Main circuits
| Circuit | Publics | Proves |
|---|---|---|
shield | commitment, asset, amount | well-formed note for a public deposit |
initiate | note_root, nullifiers[2], change_commitment, payment_root, recipient_fi_index, deadline_bucket, time_bucket, fee, relayer | 2 inputs in tree under a recent root, owned by the prover, nullifiers correct; Σ inputs = amount + change + fee; payment_root recomputed from all four regions' plaintext; refund_commitment welded to its preimage in sender_private; range checks |
resolve | payment_root, output_commitment, time_bucket | envelope plaintext recomputes payment_root with sender_private_root opaque; witness bit selects: accept → output_commitment is the recipient note from shared fields and a Schnorr signature under the recipient's ak over payment_root verifies; reject → output_commitment == shared.refund_commitment |
reclaim | payment_root, output_commitment, time_bucket | same recomputation; output_commitment == shared.refund_commitment; Schnorr under the sender's ak; time_bucket > deadline_bucket |
unshield | note_root, nullifiers[2], change_commitment, asset, amount, recipient | standard exit |
The resolve circuit instantiates each shared gadget once (root recomputation, note commitment, signature verify) and lets the branch bit multiplex the values fed into them, so the disjunction costs little more than the larger branch.
Unshield has no FI policy slot in v1. This is deliberate and listed as a
non-goal; a fourth Ctx phase and VK slot is the reserved extension.
These are the protocol team's circuits; FI developers never touch them.