Document Classification: Internal — CHLOM Confidential Phase: 0 → 1 Version: 0.1 Owner: CrownThrive, LLC Last Updated: 2025-08-08

Section 1 — Contract API Overview

The TLaaS contract exposes methods for license lifecycle management, dispute resolution, and compliance gating via AegisScore + ZK proofs.

1.1 Public Methods (Solidity/Rust‑ink! style)

• issueLicense(metadata, proofs)
• renewLicense(tokenId, proofs)
• revokeLicense(tokenId, reasonCode)
• transferLicense(tokenId, toAddress)
• getLicenseMetadata(tokenId)
• challengeLicense(tokenId, evidenceRef)

1.2 Access Control

• Issuer Role: Issue, renew, revoke, approve transfer.
• Holder Role: Transfer, sublicense, provide proofs.
• Regulator Role: Revoke, pause, inspect.
• Guardian Role: Emergency pause.

1.3 Events

• Issued(tokenId, issuer, holder, expiry)
• Renewed(tokenId, newExpiry)
• Revoked(tokenId, reasonCode)
• Transferred(tokenId, from, to)
• DisputeOpened(tokenId, challenger)

Section 2 — Governance Hooks

• Parameter Update: DAO proposal → timelock → execution; affects thresholds, expiries, policy bundle IDs.
• Circuit Update: DAO approves new circuit version; pinned in contract storage.
• Emergency Pause: Guardian triggers pause; DAO vote to resume.

Section 3 — Compliance Hook Integration

• Pre‑Tx Check: Calls CE via oracle to validate AegisScore ≥ threshold.
• Post‑Tx Audit: Emits audit log to WORM store + blockchain event.
• Fail‑Close Logic: If CE/unavailable or proof invalid, reject transaction.

Section 4 — API Security Considerations

• Replay Protection: Nonces in license operations.
• Signature Verification: All off‑chain metadata/proofs must be signed by issuer.
• Rate Limiting: Governance‑configurable per address.
• Auditability: Hash of all mutable fields pinned in on‑chain storage.

ZKP Circuit Performance & Audit Appendix — Obsidian

Document Classification: Internal — CHLOM Confidential Owner: CrownThrive, LLC Last Updated: 2025-08-08

Section 1 — Performance Benchmarks

• Batch Scaling: Linear up to 1k proofs; beyond that, optimize parallelization.
• Recursion Overhead: +15% proof size, +25% verification time (if used).

Section 2 — Audit Checklist

2.1 Circuit Audit

• Verify constraint set completeness.
• Check no unconstrained variables.
• Validate CRS/MPC ceremony transcripts.
• Toxic waste securely destroyed.
• Public inputs validated against schema.

2.2 Implementation Audit

• Code review of prover/verifier implementation.
• Ensure constant‑time arithmetic for sensitive paths.
• Validate batch verification loop for bounds.

2.3 Integration Audit

• Confirm CE → ZKV API enforces correct circuit IDs.
• Validate proof meta stored in audit log.

Section 3 — Versioning & Deprecation

• Version IDs:
• Deprecation Policy: 90‑day notice before removing old version; emergency removal if vulnerability found.
• Migration: Publish new params; dual‑verify old + new for grace period.

Section 4 — Test Vectors & Fixtures

• Valid Case:
• Invalid Case:
• Edge Case: Expired params, max field values.

Fixtures stored in /zk/fixtures/{circuitName}/{version}/.

Section 5 — Operational Notes

• Param Distribution: Over HTTPS + IPFS; signed manifest.
• Cache TTL: 24h default; purge on bulletin.
• Telemetry:

Section 6 — Compliance Alignment

• DPIA required for circuits with sensitive data.
• Residency tags on all audit log entries.
• Circuit changes reviewed by Compliance + Security prior to deployment.