[tracker] private transaction milestone 1: single-institution demo

**Goal:**
Design and implement a privacy-preserving transaction protocol
- institutions issue fully-controlled assets (audit/freeze/monitor)
- user identity and amounts are hidden from the public but visible to the issuer
- cross-institution settlement deferred to Milestone 2.

**Scope of milestone 1:**
Single-institution demo for benchmarking and comparison:
- a generic Groth16 verifier program on Solana,
- Gnark circuits for private transactions with issuer tracing/auditability (Zcash-style pool with viewing capability).

**Out of scope (Milestone 2):**
- Cross-institution transfer (on-chain bidirectional bridge vs. off-chain settlement layer)
- wrap/unwrap settlement of a common underlying asset (e.g., wUSDC-A ↔ wUSDC-B).

---

## Epic 1 — Protocol & Circuit Design Spec

- [ ] **1 Protocol Spec (v0)**
- Note/commitment format (asset id, amount, owner pk, randomness, memo)
- Nullifier derivation scheme
- Merkle tree spec: depth, hash function (Poseidon parameters), root history window
- Address / key hierarchy: spending key, viewing key (issuer audit key), proof authorizing key
- Tracing design: issuer-decryptable ciphertext attached to every note (Zcash IVK)
- encrypt-to-issuer with in-circuit correctness proof
- Freeze mechanism: program-level nullifier blocking

## Epic 2 — Generic Groth16 Verifier Program (Solana)

> Reusable by other ZKP protocols: verification key is an input (account data), not baked into the binary.

- [ ] **Program skeleton & instruction layout**
- Instructions: `init_vk` (store VK in a PDA), `update_vk` (authority-gated), `verify` (proof + public inputs)
- VK serialization format (arkworks/gnark compatibility)
- [ ] **Groth16 verification via alt_bn128 syscalls**
- Pairing check with `alt_bn128_pairing`, MSM of public inputs with `alt_bn128_group_op`
- Compute-unit profiling;

## Epic 3 — Gnark Circuits (Single Institution)

- [ ] **Poseidon + Merkle gadget in Gnark**
- [ ] **Transfer circuit (spend/output, Zcash-style)**
- Inputs: note commitments, Merkle membership, nullifier correctness, ownership (sig or key-derivation), value balance, amount range checks
- Asset-id consistency across inputs/outputs
- [ ] **Tracing/audit constraints**
- In-circuit proof that the note plaintext (owner, amount) is correctly encrypted to the issuer's audit key
- [ ] **Mint & burn circuits**
- Issuer-authorized mint (public amount → shielded note), burn (shielded → public)

## Epic 4 — Shielded Pool Program & Glue

> Minimal on-chain state machine so the demo is end-to-end, using the Epic 2 verifier via CPI.

- [ ] **Pool program: state & instructions**
- Merkle root management (incremental tree or root-update-with-proof), nullifier set (PDA map), root history
- `transact` instruction: CPI verify → check/insert nullifiers → append commitments → emit encrypted memos as events
- Issuer admin instructions: freeze/unfreeze, pause, VK rotation
- [ ] **Client SDK / CLI**
- Note scanning & decryption, witness building, proof generation (Gnark prover), tx assembly
- Issuer audit CLI: decrypt-all with audit key, trace a note's history

## Demo E2E

- [ ] A proof generated by the Gnark transfer circuit verifies on-chain via the generic verifier (devnet)
- [ ] Issuer can decrypt any note and freeze an account; frozen account's spends fail
- [ ] Public observers cannot learn sender, receiver, or amount from on-chain data
- [ ] Benchmark and comparison against other known solutions

Start with Epic 1's Protocol Spec, then map the init_vk, update_vk, and verify instructions and the Gnark circuit entries in Epics 2–3. Confirm the milestone boundaries and single-institution assumptions before estimating implementation. Done means the listed demo criteria pass: on-chain verification on devnet, issuer decryption and freezing, public privacy, and benchmark comparison.

Written by the indexing model from the issue text.