[codex] Recover programmatic privacy rail

.github/workflows/privacy-audit.yml

@@ -31,6 +31,13 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Install Noir toolchain
+        run: |
+          curl -L https://raw.githubusercontent.com/noir-lang/noirup/main/install | bash
+          "$HOME/.nargo/bin/noirup" -v 1.0.0-beta.19
+          "$HOME/.nargo/bin/nargo" --version
+          echo "$HOME/.nargo/bin" >> "$GITHUB_PATH"
+
       - name: Check Claude privacy audit tracker
         run: npm run privacy-audit:tracker-check
 

docs/twitter-intelligence/2026-06-12-integration.md

@@ -0,0 +1,50 @@
+# Twitter Pass Integration - 2026-06-12
+
+This repo-local digest mirrors the June 12 Vanta Vault watch markers used by
+the T10-T16 Twitter intelligence guards. It is claim-control evidence only; it
+does not prove Vanta adoption, partnership, production privacy, compliance
+approval, or live usage.
+
+## T10 - Unlink/Euler Institutional Private Lending Privacy
+
+Source phrase: Building privacy in 5 lines of code.
+
+Watch item markers: Unlink + Euler Finance, @unlink_xyz, @phklive, institutional private lending.
+
+Source refs: https://x.com/i/status/2065449637352501467.
+
+## T11 - Arcium Confidential AI Benchmark and C-SPL
+
+June 12 update: Arcium/Inpher is tracked for >1.1M confidential computations and C-SPL.
+
+Source refs: https://x.com/i/status/2065404370645340213.
+
+## T12 - HeliusPrivacy Scalable Onchain ZK Privacy Layer Blueprint
+
+June 12 update: Encryption at the speed of Solana, developer interest form, APIs expected soon.
+
+Source refs: https://www.helius.dev/privacy.
+
+## T13 - zkRune Client-Side Groth16 Eligibility Gating
+
+June 12 update: Xona Agent, HTTP header proof, ~0.5s with snarkjs, and fail-closed API boundaries.
+
+Fail-closed design marker: local proof request first, on-chain verify second.
+
+## T14 - ZK Bounty Hardware Attestation for RWA Velocity
+
+Watch item markers: ZK Bounty, @zk_bounty, Solana slot hash, hardware ZK proofs, 4-layer attestation.
+
+Source refs: https://x.com/zk_bounty/status/2065464938680721770.
+
+## T15 - TrustBoostAI Agent Privacy Layer
+
+Watch item markers: TrustBoostAI, @TrustBoostAI, PII redaction, PII redaction before LLMs, Mastercard Agent Pay.
+
+Source refs: https://x.com/i/status/2065436902371541288.
+
+## T16 - Privacy Cash Private Transfer Volume Benchmark
+
+Watch item markers: Privacy Cash, @theprivacycash, $400M+ processed, volume benchmark.
+
+Source refs: https://x.com/i/status/2065454669195809251.

docs/twitter-intelligence/2026-06-13-integration.md

@@ -0,0 +1,40 @@
+# Twitter Pass Integration - 2026-06-13
+
+This repo-local digest mirrors the June 13 Vanta Vault and watchlist markers
+used by the T17-T21 Twitter intelligence guards. It is claim-control evidence
+only; it does not prove integration, legal approval, production privacy,
+mainnet readiness, audit acceptance, or deployed proof verification.
+
+## T17 - Medusa Client-Side Reputation Attestation
+
+Medusa is the strongest new local-proving signal.
+
+Watchlist markers: @ZkMedusa, Medusa, client-side reputation ZK.
+
+Benchmark phrase: Generate proof -> Verify on-chain -> Keep wallet private.
+
+## T18 - Midnight Selective Disclosure for Agents and Compliance
+
+policy-scoped, time-bound disclosure packets for private-by-default on-chain AI agent interactions.
+
+Watchlist markers: @CardanoAftrDark, Midnight, selective disclosure.
+
+## T19 - Concordium Identity + ZK Agent/Institutional Pattern
+
+Concordium is an identity-plus-ZK benchmark for an identity envelope, not public identity exposure.
+
+Watchlist markers: @barondickson, Concordium, identity + ZK.
+
+## T20 - Noir on Solana Integration Opportunity
+
+This validates Vanta's existing Noir-first Phase 2 starter and creates a watch lane for verifier programs, examples, client proving, and cross-chain Noir usage.
+
+Watchlist markers: @aztecnetwork, @NoirLang, @solanapayments.
+
+## T21 - Sedna Lightweight Hybrid Privacy Benchmark
+
+Sedna is useful for metadata privacy, sequencing, and UX cost.
+
+Claim boundary: benchmark, not a claim-lift substitute.
+
+Watchlist markers: @jayendra_jog, Sedna, lightweight hybrid privacy.

scripts/check-arcium-confidential-ai-benchmark-and-c-spl.mjs

@@ -36,14 +36,16 @@ const spec = {
 };
 const failures = [];
 
-function readRequired(path) {
-  const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
-  try {
-    return readFileSync(fullPath, "utf8");
-  } catch {
-    failures.push(`Missing required file: ${path}`);
-    return "";
+function readRequired(pathOrPaths) {
+  const paths = Array.isArray(pathOrPaths) ? pathOrPaths : [pathOrPaths];
+  for (const path of paths) {
+    const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
+    try {
+      return readFileSync(fullPath, "utf8");
+    } catch {}
   }
+  failures.push(`Missing required file: ${paths.join(" or ")}`);
+  return "";
 }
 
 function requireMarkers(label, content, markers) {
@@ -56,8 +58,11 @@ console.log(`=== ${spec.npmScript} (${spec.id}) ===`);
 
 const state = readRequired("docs/goals/2026-05-14-claude-privacy-audit-tracker/state.yaml");
 const requirements = readRequired("docs/twitter-intelligence/2026-06-12-requirements.md");
-const integration = readRequired("/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-12.md");
-const watch = readRequired(spec.watchPath);
+const integration = readRequired([
+  "docs/twitter-intelligence/2026-06-12-integration.md",
+  "/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-12.md"
+]);
+const watch = readRequired(["docs/twitter-intelligence/2026-06-12-integration.md", spec.watchPath]);
 const packageJson = JSON.parse(readRequired("package.json") || "{}");
 
 requireMarkers("state.yaml", state, spec.stateMarkers);

scripts/check-concordium-identity-zk-patterns.mjs

@@ -31,14 +31,16 @@ const spec = {
 
 const failures = [];
 
-function readRequired(path) {
-  const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
-  try {
-    return readFileSync(fullPath, "utf8");
-  } catch {
-    failures.push(`Missing required file: ${path}`);
-    return "";
+function readRequired(pathOrPaths) {
+  const paths = Array.isArray(pathOrPaths) ? pathOrPaths : [pathOrPaths];
+  for (const path of paths) {
+    const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
+    try {
+      return readFileSync(fullPath, "utf8");
+    } catch {}
   }
+  failures.push(`Missing required file: ${paths.join(" or ")}`);
+  return "";
 }
 
 function requireMarkers(label, content, markers) {
@@ -51,8 +53,14 @@ console.log(`=== ${spec.npmScript} (${spec.id}) ===`);
 
 const state = readRequired("docs/goals/2026-05-14-claude-privacy-audit-tracker/state.yaml");
 const requirements = readRequired("docs/twitter-intelligence/2026-06-13-requirements.md");
-const integration = readRequired("/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md");
-const watchlists = readRequired("/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md");
+const integration = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md"
+]);
+const watchlists = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md"
+]);
 const packageJson = JSON.parse(readRequired("package.json") || "{}");
 
 requireMarkers("state.yaml", state, spec.stateMarkers);

scripts/check-heliusprivacy-scalable-onchain-zk-privacy-layer-blueprint.mjs

@@ -36,14 +36,16 @@ const spec = {
 };
 const failures = [];
 
-function readRequired(path) {
-  const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
-  try {
-    return readFileSync(fullPath, "utf8");
-  } catch {
-    failures.push(`Missing required file: ${path}`);
-    return "";
+function readRequired(pathOrPaths) {
+  const paths = Array.isArray(pathOrPaths) ? pathOrPaths : [pathOrPaths];
+  for (const path of paths) {
+    const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
+    try {
+      return readFileSync(fullPath, "utf8");
+    } catch {}
   }
+  failures.push(`Missing required file: ${paths.join(" or ")}`);
+  return "";
 }
 
 function requireMarkers(label, content, markers) {
@@ -56,8 +58,11 @@ console.log(`=== ${spec.npmScript} (${spec.id}) ===`);
 
 const state = readRequired("docs/goals/2026-05-14-claude-privacy-audit-tracker/state.yaml");
 const requirements = readRequired("docs/twitter-intelligence/2026-06-12-requirements.md");
-const integration = readRequired("/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-12.md");
-const watch = readRequired(spec.watchPath);
+const integration = readRequired([
+  "docs/twitter-intelligence/2026-06-12-integration.md",
+  "/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-12.md"
+]);
+const watch = readRequired(["docs/twitter-intelligence/2026-06-12-integration.md", spec.watchPath]);
 const packageJson = JSON.parse(readRequired("package.json") || "{}");
 
 requireMarkers("state.yaml", state, spec.stateMarkers);

scripts/check-medusa-client-side-reputation-attestation.mjs

@@ -31,14 +31,16 @@ const spec = {
 
 const failures = [];
 
-function readRequired(path) {
-  const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
-  try {
-    return readFileSync(fullPath, "utf8");
-  } catch {
-    failures.push(`Missing required file: ${path}`);
-    return "";
+function readRequired(pathOrPaths) {
+  const paths = Array.isArray(pathOrPaths) ? pathOrPaths : [pathOrPaths];
+  for (const path of paths) {
+    const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
+    try {
+      return readFileSync(fullPath, "utf8");
+    } catch {}
   }
+  failures.push(`Missing required file: ${paths.join(" or ")}`);
+  return "";
 }
 
 function requireMarkers(label, content, markers) {
@@ -51,8 +53,14 @@ console.log(`=== ${spec.npmScript} (${spec.id}) ===`);
 
 const state = readRequired("docs/goals/2026-05-14-claude-privacy-audit-tracker/state.yaml");
 const requirements = readRequired("docs/twitter-intelligence/2026-06-13-requirements.md");
-const integration = readRequired("/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md");
-const watchlists = readRequired("/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md");
+const integration = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md"
+]);
+const watchlists = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md"
+]);
 const packageJson = JSON.parse(readRequired("package.json") || "{}");
 
 requireMarkers("state.yaml", state, spec.stateMarkers);

scripts/check-midnight-selective-disclosure-patterns.mjs

@@ -31,14 +31,16 @@ const spec = {
 
 const failures = [];
 
-function readRequired(path) {
-  const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
-  try {
-    return readFileSync(fullPath, "utf8");
-  } catch {
-    failures.push(`Missing required file: ${path}`);
-    return "";
+function readRequired(pathOrPaths) {
+  const paths = Array.isArray(pathOrPaths) ? pathOrPaths : [pathOrPaths];
+  for (const path of paths) {
+    const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
+    try {
+      return readFileSync(fullPath, "utf8");
+    } catch {}
   }
+  failures.push(`Missing required file: ${paths.join(" or ")}`);
+  return "";
 }
 
 function requireMarkers(label, content, markers) {
@@ -51,8 +53,14 @@ console.log(`=== ${spec.npmScript} (${spec.id}) ===`);
 
 const state = readRequired("docs/goals/2026-05-14-claude-privacy-audit-tracker/state.yaml");
 const requirements = readRequired("docs/twitter-intelligence/2026-06-13-requirements.md");
-const integration = readRequired("/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md");
-const watchlists = readRequired("/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md");
+const integration = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md"
+]);
+const watchlists = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md"
+]);
 const packageJson = JSON.parse(readRequired("package.json") || "{}");
 
 requireMarkers("state.yaml", state, spec.stateMarkers);

scripts/check-noir-on-solana-integration-opportunity.mjs

@@ -31,14 +31,16 @@ const spec = {
 
 const failures = [];
 
-function readRequired(path) {
-  const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
-  try {
-    return readFileSync(fullPath, "utf8");
-  } catch {
-    failures.push(`Missing required file: ${path}`);
-    return "";
+function readRequired(pathOrPaths) {
+  const paths = Array.isArray(pathOrPaths) ? pathOrPaths : [pathOrPaths];
+  for (const path of paths) {
+    const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
+    try {
+      return readFileSync(fullPath, "utf8");
+    } catch {}
   }
+  failures.push(`Missing required file: ${paths.join(" or ")}`);
+  return "";
 }
 
 function requireMarkers(label, content, markers) {
@@ -51,8 +53,14 @@ console.log(`=== ${spec.npmScript} (${spec.id}) ===`);
 
 const state = readRequired("docs/goals/2026-05-14-claude-privacy-audit-tracker/state.yaml");
 const requirements = readRequired("docs/twitter-intelligence/2026-06-13-requirements.md");
-const integration = readRequired("/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md");
-const watchlists = readRequired("/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md");
+const integration = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-13.md"
+]);
+const watchlists = readRequired([
+  "docs/twitter-intelligence/2026-06-13-integration.md",
+  "/Users/clay/.hermes/skills/supergrok-research/references/watchlists.md"
+]);
 const packageJson = JSON.parse(readRequired("package.json") || "{}");
 
 requireMarkers("state.yaml", state, spec.stateMarkers);

scripts/check-privacy-cash-private-transfer-volume-benchmark.mjs

@@ -36,14 +36,16 @@ const spec = {
 };
 const failures = [];
 
-function readRequired(path) {
-  const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
-  try {
-    return readFileSync(fullPath, "utf8");
-  } catch {
-    failures.push(`Missing required file: ${path}`);
-    return "";
+function readRequired(pathOrPaths) {
+  const paths = Array.isArray(pathOrPaths) ? pathOrPaths : [pathOrPaths];
+  for (const path of paths) {
+    const fullPath = path.startsWith("/") ? path : resolve(repoRoot, path);
+    try {
+      return readFileSync(fullPath, "utf8");
+    } catch {}
   }
+  failures.push(`Missing required file: ${paths.join(" or ")}`);
+  return "";
 }
 
 function requireMarkers(label, content, markers) {
@@ -56,8 +58,11 @@ console.log(`=== ${spec.npmScript} (${spec.id}) ===`);
 
 const state = readRequired("docs/goals/2026-05-14-claude-privacy-audit-tracker/state.yaml");
 const requirements = readRequired("docs/twitter-intelligence/2026-06-12-requirements.md");
-const integration = readRequired("/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-12.md");
-const watch = readRequired(spec.watchPath);
+const integration = readRequired([
+  "docs/twitter-intelligence/2026-06-12-integration.md",
+  "/Users/clay/Desktop/Vanta Vault/02 Projects/Twitter-Pass-Integration-2026-06-12.md"
+]);
+const watch = readRequired(["docs/twitter-intelligence/2026-06-12-integration.md", spec.watchPath]);
 const packageJson = JSON.parse(readRequired("package.json") || "{}");
 
 requireMarkers("state.yaml", state, spec.stateMarkers);