20 real capabilities, each labeled honestly. Nothing here is marked done unless it is -- and nothing marked "not planned" is quietly reframed as coming soon.
INIT/ADD/SUB/MUL, forward-only JZ/JNZ, LOAD/STORE across 4 fixed registers -- a real interpreter and a .zkasm assembly format.
A from-scratch AIR binding a proof to one exact program and its actual execution. Real proof, ~11 KB, ~5.5ms to verify.
Because the program and inputs are fully public, the verifier re-executes and asserts almost everything directly -- no lookup or permutation argument needed.
Seven opcode-selector columns and a register selector, multiplied algebraically instead of using a lookup/mux gadget.
Five subcommands, one binary. deploy pushes a program to a running zkvm-host-server and verifies the returned proof locally.
1 MB body limit, 60s timeout, 4 concurrent requests, and a 2,000-instruction ceiling derived from real measured proving times.
Real prove/verify MCP tools, verified against an actual initialize -> tools/list -> tools/call handshake, on their own port.
A task/reward lifecycle contract with zero verification logic of its own, plus an explicit, documented trust-bridge verifier.
Reverts, always -- the honest state of "no real on-chain verifier exists yet," instead of a stub that quietly returns true.
8 real tests: the unimplemented verifier makes payout impossible, the attested happy path, and every failure mode (wrong proof, wrong caller, double-fulfillment, unclaimed tasks).
Five pieces needed: Fiat-Shamir recompute (Keccak, not Blake3), Merkle authentication, FRI verification, field arithmetic in Solidity/Yul, and the out-of-domain constraint check.
The path to genuinely cheap, trustless on-chain verification -- proving the STARK verifier's own execution with a SNARK.
JZ/JNZ can only jump forward today. Real loops need a dynamically-sized, bounded execution trace.
LOAD/STORE address one of four statically-named registers, not a runtime-computed address.
A standard RISC-V subset instead of the custom .zkasm ISA.
The only soundness evidence today is this repo's own unit test suite.
Blake3_256 and a 128-bit field with default parameters were chosen for correctness first, not speed.
SP1 was specifically investigated and declined.
Both are local/trusted-network use only, on purpose, today.
No token, no proving marketplace, no cross-chain bridges -- none of it has a code artifact anywhere in this repo.