TAP-9 / TAP-10 · Phase 3 · Vision

Confidentiality with structured accountability.

Some counterparties need to prove a fact without revealing the data behind it — that a payment is within a mandate, that an agent holds authority, that a record has not been revoked — while an examiner retains a lawful path to the full truth. Phase 3 adds that capability as an extension, not a rewrite: the codebase was shaped from the start so zero-knowledge lands cleanly on top of the existing invariants.

Two commitments, one document.

SHA-256 stays canonical for identity and legal legibility — the hash a court and an auditor read. A ZK-friendly commitment is added alongside, with attested binding between the two, so nothing about today's verification changes.

Legal legibility

SHA-256 canonical

The commitment the NFT anchors and every resolver recomputes today. Stays exactly as specified — praxis-canonical-json/1, unchanged.

attested binding

ZK legibility

Poseidon2 / Blake2

A commitment a circuit can prove over efficiently, added alongside the canonical hash — never replacing it. Enables proofs about the document without disclosing it.

Reveal exactly what a relationship requires — no more.

Confidentiality is not all-or-nothing. Each tier discloses strictly more than the one below it, so a counterparty, a regulator, and the public each see the layer appropriate to their relationship — and an examiner always retains a lawful path to the whole.

Public existence

An identity exists and is anchored — the commitment is on-chain, nothing more is revealed.

anyone

Predicate proof

A specific fact holds — "this action is within an authorized scope," "assurance meets the floor" — proven without the underlying values.

counterparty

Scoped attributes

Selected fields disclosed under a viewing key — the controller, the mandate window, the capability in question — nothing outside the grant.

authorized party

Full record

The complete AID and its version history, disclosed to a party that holds the appropriate authority — the current default for non-confidential identities.

principal · relying party

Examiner tier

Point-in-time disclosure queries against the transparency log — commitment roots, nullifier sets, revocation-log roots — the lawful path to the whole truth.

regulator · examiner

Where each circuit attaches to an existing module.

Every extension point already exists as a seam in the shipped codebase. The plaintext path stays; a circuit path is added beside it, with equivalence testing between the two.

Existing module	TAP-9 / TAP-10 extension point
codec/canonical.ts	Dual-commitment: SHA-256 stays canonical; a Poseidon2/Blake2 ZK-commitment is added alongside, with attested binding between the two.
tap3/scope.ts	The closed, deterministic scope grammar compiles to a fixed arithmetic circuit — no unbounded loops, no hidden clocks. One spec feeds both the TypeScript evaluator and the circuit, with equivalence testing.
tap3/cpoa.ts	Commitment plus viewing-key derivation; non-revocation witness generation for revocation-freshness proofs against a committed log root.
tap4/intent.ts	Nullifier binding for spend-once semantics; witness production for the confidential-settlement circuit; the four checks gain a circuit path beside the plaintext path.
tap8/log.ts	Anchors commitment roots, nullifier sets, and revocation-log roots; point-in-time disclosure queries serve the examiner tier.
contracts/	Root anchoring plus a verifier-callback interface in the SmartPy drafts; the STARK verifier itself lives off-L1 — Etherlink first, an app-specific rollup under Tezos X later.

Existing module

TAP-9 / TAP-10 extension point

codec/canonical.ts

Dual-commitment: SHA-256 stays canonical; a Poseidon2/Blake2 ZK-commitment is added alongside, with attested binding between the two.

tap3/scope.ts

The closed, deterministic scope grammar compiles to a fixed arithmetic circuit — no unbounded loops, no hidden clocks. One spec feeds both the TypeScript evaluator and the circuit, with equivalence testing.

tap3/cpoa.ts

Commitment plus viewing-key derivation; non-revocation witness generation for revocation-freshness proofs against a committed log root.

tap4/intent.ts

Nullifier binding for spend-once semantics; witness production for the confidential-settlement circuit; the four checks gain a circuit path beside the plaintext path.

tap8/log.ts

Anchors commitment roots, nullifier sets, and revocation-log roots; point-in-time disclosure queries serve the examiner tier.

contracts/

Root anchoring plus a verifier-callback interface in the SmartPy drafts; the STARK verifier itself lives off-L1 — Etherlink first, an app-specific rollup under Tezos X later.

The sequencing rule

Ship scope-compliance and revocation-freshness circuits before confidential settlement. Confidentiality without a proof that authority is current and unrevoked is dangerous — the order is a safety property, not a preference.

Every circuit is a model, governed like one.

Cryptographic soundness is treated with the same discipline a bank applies to a risk model. From day one, every circuit carries the artifacts an examiner expects.

Conceptual soundness

Documented

What the circuit proves, its assumptions, and its limits — written before it ships, not after.

Effective challenge

Reviewed

Independent review of the construction and its trusted-setup posture — transparent STARKs need no trusted setup.

Outcomes analysis

Monitored

Ongoing analysis of proof behavior in production — a milestone artifact, not an afterthought.

Vision · Phase 3

TAP-9/TAP-10 is a named phase with an established research direction, not a shipped component. The current build is shaped to receive it; the circuits themselves are future work, labeled honestly under invariant I11.