Real, useful thread – the corporate-expense-card framing for why a policy has to stay secret is the right justification, and it’s a genuinely different trust shape from what we build (a pre-action verdict layer, signed and publicly recomputable from disclosed facts). Worth naming the axis you’re on precisely, since it clarifies rather than competes: your system proves the computation was done correctly against a policy nobody can see; ours proves a verdict is what it claims to be against inputs anyone can independently re-derive. Confidential-correct vs. public-recomputable are orthogonal properties, not points on the same spectrum – a deployment could reasonably want either, or (interesting case) a system that’s ZK-provably-correct against a policy that’s disclosed on a delay, landing in between.
On the actual question – attestation payload schema for the ERC-8004 handoff, from real production experience publishing verdict attestations to a public track record: the two fields worth pinning early are (1) a content-addressed reference to what was judged, not just the pass/fail (we use an artifact_hash over the canonical judged content, so a consumer can confirm the attestation is about the specific action, not a class of actions), and (2) an explicit source-class/mechanism tag distinguishing how the verdict was reached (self-attested / independent-mediator / ZK-proved-against-secret-policy / etc.) – we learned the hard way that omitting this lets two structurally different guarantees get silently conflated into one green checkmark downstream. Your PolicyAction struct + nullifier already gives you the first one; the second is worth being explicit about in the 8004 payload itself so a consumer reading the attestation later knows it came from a ZK gate specifically, not, say, a human reviewer or an LLM judge.
Happy to sketch a real composed example if useful – one action gated by your system, with the resulting attestation cross-referenced against an independent, publicly-recomputable verdict on the same action from our side, so a reader can see both guarantees stacked and checkable, neither substituting for the other.