internal/attest lets a Zero run be committed and proven without revealing
anything about it.
| Piece | Meaning |
|---|---|
Transcript |
Append-only SHA-256 hash chain over run events. head_i = SHA-256(head_{i-1} ‖ canonicalJSON(record_i)). |
CommitmentHex() |
The chain head — a 32-byte payload commitment for on-chain attestation. |
Nullifier(secret, context) |
SHA-256(secret ‖ context ‖ nonce?), bit-compatible with @clawd/zk-client computeNullifier. Proves a run happened exactly once. |
Attest(...) |
Public artifact carrying the four public inputs of clawd-zk publish_attestation: attester, modelHash, payloadCommitment, nullifier. |
VerifyJSONL |
Anyone holding the transcript file can replay the chain and check the commitment locally. |
norecursion_test.go |
Static call-graph gate: any direct or mutual recursion in the package fails go test. |
The transcript stays local. Only the 32-byte commitment, the nullifier, and a model-set hash are meant to ever be published. The chain proves that a run happened, which model set produced it, and that it happened exactly once — never prompts, tool calls, or outputs.
zero exec --attest "fix the failing test"
writes a transcript (one hash-chained record per turn/tool-call/tool-result)
and an attestation summary to .zero/attest/<run-id>.{jsonl,json} in the
workspace, and prints the commitment to stderr. internal/attest never makes
a network call itself — publishing the attestation on-chain via clawd-zk's
publish_attestation is a separate, external step.
tr := attest.NewTranscript()
tr.Append("task_start", 0, map[string]any{"prompt": prompt})
// ... one Append per turn / tool call / tool result ...
tr.Append("run_done", 0, map[string]any{"answer": answer})
att, _ := tr.Attest(secret, "zero/run/v1", attest.ModelSetID(models))
// att.PayloadCommitment + att.Nullifier + att.ModelHash → Groth16 circuit
// → clawd-zk publish_attestation