[kchaw2005]

Why

• WalletKit’s locked Spongefish release produces different SHA-256 transcript challenges on wasm32 and 64-bit native targets.

What

• Draft placeholder for adopting published provekit-spongefish 0.2.1 in Cargo.lock.
• Waiting for a provekit-spongefish-pow release that allows Spongefish 0.2.1; its published 0.2.0 still pins =0.2.0.
• No file changes yet. Main has no Spongefish Git override to remove; that workaround exists only in a local development checkout.

Test

• Agent ran cargo update -p provekit-spongefish --precise 0.2.1 --dry-run; resolution fails on the companion crate’s exact pin.
• Pending: update the lockfile after publication and verify a WASM-generated ownership proof natively, including rejection of an incorrect public input.
• No builds or end-to-end tests run for this draft.

Risk

• Placeholder only; no runtime changes yet. Keep draft until dependency resolution and cross-target verification pass.

AI disclosure

• Prepared with OpenAI Codex (GPT-6).
• Request: create a draft PR from main to adopt published Spongefish releases and document the pending companion release.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

_{Comment @coderabbitai help to get the list of available commands.}

[kchaw2005]

Superseded by #629. world-id-protocol 0.17.1 requires provekit-spongefish ^0.2.1, and provekit-spongefish-pow 0.2.1 is now published, so bumping the world-id crates moves both Spongefish crates to 0.2.1 in the lockfile. #629 also includes the cross-target check this PR was waiting on: a browser-generated ownership proof verifies natively and is rejected when the context, nonce or sub is changed.