Struct ZkChainCommitment 

pub struct ZkChainCommitment {
    pub commitment: [u8; 32],
    pub intent: IntentHash,
    pub sealed_at_unix: u64,
    pub chain_fingerprint_hex: String,
    pub authority_signature: String,
    pub authority_did: String,
    pub mode: ZkProofMode,
    pub zk_proof_hex: String,
    pub passport_namespace: Option<String>,
}

Available on crate feature zk only.

A compact, verifiable commitment to the validity of a full delegation chain.

Instead of shipping the entire delegation chain to every verifier, a gateway or trusted service can compute a ZkChainCommitment and hand it to downstream consumers. Verification is O(1): one Blake3 hash + one Ed25519 signature check, regardless of chain depth.

The commitment field is a domain-separated Blake3 hash over:

• The chain fingerprint (covers all certs and the principal scope)
• The authorized intent hash
• The narrowing commitment (capability mask at authorization time)
• The timestamp

Because the chain fingerprint already commits to every cert’s signature and scope, this commitment transitively proves that the full chain is valid.

Wire format

ZkChainCommitment is JSON-serializable (requires wire feature). Store it in your audit log, ship it to downstream services, or anchor it on-chain.

Upgrade path to real ZK

Set mode = ZkProofMode::ExternalZkvm and populate zk_proof_bytes with the output of your zkVM (RISC Zero, Jolt, etc.) over the same commitment. The verify_commitment check stays unchanged — consumers that understand the ZK mode can additionally verify the zkVM proof.

Fields

commitment: [u8; 32]

Blake3 hash binding chain fingerprint + intent + narrowing + timestamp.

intent: IntentHash

Authorized intent hash.

sealed_at_unix: u64

Unix timestamp when this commitment was sealed.

chain_fingerprint_hex: String

Hex of the chain fingerprint, for human-readable logs.

authority_signature: String

Ed25519 signature over commitment from the sealing authority.

authority_did: String

DID of the sealing authority (hex public key in did:a1: format).

mode: ZkProofMode

Proof mode. Blake3Commit unless a zkVM proof is attached.

zk_proof_hex: String

Raw zkVM proof bytes (hex). Empty for Blake3Commit mode.

passport_namespace: Option<String>

Optional passport namespace for human-readable audit records.

Implementations

impl ZkChainCommitment

pub fn seal( chain: &DyoloChain, intent: &IntentHash, narrowing_commitment: &[u8; 32], sealed_at_unix: u64, authority: &dyn Signer, passport_namespace: Option<&str>, ) -> Self

Seal a commitment over an authorized chain.

Call this after DyoloChain::authorize succeeds. The authority is typically the gateway’s signing identity. The resulting commitment can be distributed to downstream consumers in place of the full chain.

pub fn verify_commitment( &self, narrowing_commitment: &[u8; 32], now_unix: u64, max_age_secs: Option<u64>, ) -> Result<(), A1Error>

Verify the authority signature and optionally check commitment freshness.

This is an O(1) operation regardless of the original chain depth. Pass max_age_secs = None to skip freshness checking.

pub fn with_zk_proof(self, proof_bytes: &[u8]) -> Self

Attach an external zkVM proof to this commitment.

Use this after running the chain through RISC Zero, Jolt, or any compatible zkVM. The commitment bytes stay identical — consumers that only check verify_commitment will continue to work unchanged, while consumers that understand ZK can additionally verify zk_proof_hex.

pub fn has_zk_proof(&self) -> bool

Returns true if this commitment carries a zkVM proof.

Trait Implementations

impl Clone for ZkChainCommitment

fn clone(&self) -> ZkChainCommitment

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ZkChainCommitment

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ZkChainCommitment

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ZkChainCommitment

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.