WHAT ACTUALLY CHANGED

Changed

zkvm_stark::public_inputs_for(program, trace) replaced with public_inputs_for_program(program). The old signature took a program and a trace but silently ignored the program (let _ = program;) — every call site in this repo always re-executed the program immediately beforehand, so this was never a live bug here, but nothing in the type system stopped a caller from passing a trace that didn't actually correspond to the program argument. The new function takes only the program and re-executes it internally, making that mismatch impossible to construct. Found via an external code review; verified against the actual source (all four call sites in zkvm-cli, zkvm-host-server) before fixing.

Added

• crates/zkvm-isa — the VM: an accumulator machine (ADD/SUB/MUL), conditional branching (JZ/JNZ, forward-only), and a 4-register file (LOAD/STORE), with a real interpreter and a .zkasm assembly format (labels, comments).
• crates/zkvm-stark — a from-scratch AIR over Winterfell binding a STARK proof to one specific program and its actual execution (control flow, register accesses), without a lookup/permutation argument — sound because this system has no private witness.
• crates/zkvm-cli — run / prove / verify / deploy / demo.
• crates/zkvm-host-server — an HTTP proving API (/v1/proofs, /v1/verify), a ProverBackend trait with a real stark backend and an honestly-labeled mock-echo routing stub, and MCP tools (prove, verify) verified against a real MCP client handshake.
• contracts/ — a Foundry project: ProofOrchestrator (task/reward lifecycle with zero verification logic of its own) plus two verifiers — UnimplementedStarkVerifier (reverts, honestly, until a real one exists) and AttestedVerifier (an explicit, documented trust bridge).
• scripts/onchain_demo.sh and scripts/mcp_demo.sh — real end-to-end demos, not simulated output.
• .github/workflows/zk-ci.yml — CI that builds, tests, then deploys and verifies every example program against a live server on every PR and push to main.
• Documentation: ROADMAP.md, HOST_SERVICE.md, ONCHAIN_VERIFIER.md, THREAT_MODEL.md, RECURSION.md, MCP.md — each states plainly what's real, what isn't, and what closing a given gap would actually require.

Known limitations

• No loops (jumps are forward-only), no addressable memory, not RISC-V compatible.
• On-chain verification is an attested trust bridge, not a cryptographic STARK verifier.
• No auth on the HTTP or MCP surfaces — local/trusted-network use only.