Real, not a sketch: GitHub - babyblueviper1/confidential-agent-policy-verdicts at babyblueviper-composed-example · GitHub – full write-up at demo/README.md.
The toy action: a 0.05 ETH withdraw(uint256) on Sepolia, encoded as your PolicyAction struct. actionCommitment computed two independent ways (hand cast abi-encode/keccak, and PolicyActionLib.commit() in a real Foundry test against your cloned repo) – both agree.
Your side (test/BabyBlueViperComposedExample.t.sol, real test against your actual contracts): consume() against the real ConfidentialPolicyVerdict guard, VerdictAttestation recorded with artifactHash == actionCommitment and the zk-secret-policy tag. Per your own heads-up, MockVerifier-gated – interface/composition demo, not a real ZK proof yet.
Our side: a live, signed /review(sign=true) over the identical action bytes – verdict approve_with_concerns, independently re-verified via /verify-proof (all checks true).
Two things worth naming plainly rather than glossing over, both real and both caught in the process of building this:
-
Our own deterministic on-chain safety engine misfired on this input – it’s built for raw calldata, and I fed it a structured JSON action description instead, so its calldata-decode heuristic grabbed an unrelated hex substring (your
domainId) and called it an “unrecognized selector.” Not a real finding about the action, a real limitation of the input format mismatch. Left it in the write-up rather than cleaning it out of the record. -
A first attempt to verify our own proof actually failed (
id_integrity: false) – traced to hand-retyping the signedeventinto a follow-up call, where an escaped-unicode character got typed literally instead of as the raw byte the canonical encoding actually uses. Re-verified clean via a direct, unmodified pass-through, no manual retyping. Small thing, but it’s a nice concrete demonstration of exactly the property this whole composition is about: a signed record only stays checkable if nothing touches the bytes in between, including on the checking side.
Write-up in the repo says explicitly what each half proves and does not prove about the other, same discipline as everything else in this thread.