[satran004]

Adds runtime circuit compilation and typed authoring to the modular Wasm SDK. TypeScript definitions and portable Java graphs reach the existing Java symbolic APIs, R1CS compiler, witness calculator and Groth16 prover. Fixed arrays support the existing Poseidon Merkle gadget. The default profile proves depths 1/2, with a confirmed local Cardano claim; a separate research image now proves depths 8/16/32 in Node, Chromium, Firefox and JVM at 6g/8g.

Stacked on #92 (design/adr-0057-wasm-and-native-bindings, base 844a0625). Remains draft: measured frontend/application slices are implemented; independent review and broader roadmap gates remain open. No core compiler, hash/curve equations or proof security parameters changed.

Implemented:

• ADR-0064, staged plan, Java adapter, typed @zeroj/circuit, selected compiler/prover image and authoring lint.
• Canonical graph/recipe formats and build-time artifact export. Trusted graph/fingerprint identities are checked before private inputs. Recipe v2 adds fixed field/bool/UInt arrays, static indexing and Java BLS12-381 T3 Merkle expansion; existing definitions retain v1 bytes.
• Normal compiler key policy remains 2 MiB / 4,096 wires/domain / 16,384 coefficients, with 64 KiB chunks, one upload/successful key, resource counters, cleanup and cancellation. Standalone/direct imports retain their original smaller cap.
• Separate Java-selected research policy: 32 MiB / 65,536 wires / 8,192 domain / 262,144 coefficients. RPC cannot raise limits; state retains its owning policy. Research entry point/output are isolated from consumer npm packages. Point/subgroup/relation/witness checks remain active.
• Eleven normal browser scenarios plus an opt-in larger-Merkle page with progress, cancellation and fresh-runtime recovery.
• Loopback-only JuLC/Yaci runner pins root/VK/signer/action and submits an exact Chromium proof. No new larger-depth on-chain cost claim.

Validation:

• Current default regressions: 35 adapter JVM tests, 34 Node compiler tests, strict TS/lint. Earlier M3 also ran 119 selected existing Java gadget/symbolic tests, eleven scenarios in both browsers and five SDK tarballs installed offline. Full nine-image SDK suite was not rerun.
• Larger experiment: all 15 engine/depth cases cross-verify with JVM and independent snarkjs, with changed-root rejection. Invalid witnesses/paths, resource ceilings, malformed keys, cleanup and actual import cancellation pass. Final-image browser buttons cancel, recover and generate/verify a fresh depth-8 proof.
• All six larger JVM runs pass with 6g/8g heap caps, no observed OOM; sampled used-heap peaks 1.223–1.404 GiB. Node maximum process RSS is 418–628 MiB. These scopes are distinct; browser peak memory was not measured.
• Prior local PV11 Cardano claim: 2,058,505,076 CPU, 163,706 memory, 1,980-byte script CBOR, 2,682-byte transaction, 0.435698 ADA total fee. Four signed invalid claims and a different transaction spending the consumed UTxO reject. This measured depth 1, not the new deeper profiles.

Larger-profile Chromium feasibility samples, seconds:

Depth	Raw key bytes	Key load	First proof	Reused proof median (3 samples)
8	8,052,135	64.495	2.608	2.775
16	16,002,823	156.787	5.951	6.156
32	31,904,199	352.990	9.174	9.379

Import dominates: Firefox depth 32 loaded in 523.097 s, then proved in 14.092 s. Samples ran concurrently on a shared desktop; they are not isolated engine rankings or p95 estimates. The research driver explicitly uses a 600 s per-call deadline; normal defaults are unchanged.

The larger-Merkle report includes all timings, memory methodology, JFR allocation attribution and reproducible commands. A read-only census found unused wire columns and substantial compression potential; wire compaction is a separate core proposal, not implemented here. Compression measurements do not establish reduced parsed-key memory or validation cost.

M3/Cardano, M2 and M1 remain historical baselines. The Cardano guide documents isolated JuLC/CCL dependencies; core dependency versions are unchanged.

Security/scope: disposable setup, published test witnesses and experimental variable-time secret operations. Membership remains reusable on other deposits and the signer is public; same-UTxO rejection is not a nullifier protocol. No anonymous/private-state, mainnet-cost, production-readiness or post-quantum claim. No npm publication; raw keys/proofs/results/images/traces remain ignored. Default promotion, hostile-input heap containment, actual mobile/Safari, ceremony/side-channel assurance, independent review, broader SHA-2/BLAKE2b and private-state protocols remain open.

[beanbot-gh]

Initial automated review · Aster

Hi @satran004, thanks for the PR! 🙏 This is an automatic first check by an AI reviewer. It does not replace maintainer review and may be wrong.

Noted that this is a draft.

Reviewed commit: 392dd2023b36f2aeb136acf36e11be1abbeac840

Issues found:

• bindings/js/packages/circuit-lint/src/index.mjs:11 — zeroj-circuit-lint ./src/circuit.ts silently skips the file because TypeScript removes ./ while files.includes(file.fileName) compares the raw argument, letting unsafe symbolic branches pass. Could we normalize both paths and add a negative test using ./?

Not tested: Code was read only; builds, lint reproduction, Wasm proofs, and browser tests were not run.