┌─────────────────────────────────────────────────────────────┐
│  Application Layer: 会议业务逻辑（议程管理、实时音视频、UI）   │
├─────────────────────────────────────────────────────────────┤
│  Protocol Layer: ZK-Vote / ZK-Auth 协议状态机                │
├─────────────────────────────────────────────────────────────┤
│  Circuit Layer: Circom 电路（VoteCircuit, AuthCircuit）      │
├─────────────────────────────────────────────────────────────┤
│  Crypto Primitive Layer: Poseidon Hash, BabyJubJub, BLS      │
├─────────────────────────────────────────────────────────────┤
│  Transport Layer: WebRTC DataChannel / gRPC + mTLS           │
└─────────────────────────────────────────────────────────────┘

vote_commit = r * G + v * G_j          // v ∈ {0,1}, r ←$ Z_r
nullifier   = H(sk_id || agenda_id)    // 防重复投票标识

{ agenda_id, vc_root, nullifier, vote_commit, pk_id }

{ sk_id, cred, r, v, merkle_path }

MaxConcurrentMeetings ≈ (CPU_Cores × 620) / (AvgAttendees × VoteFreq)

// circuits/vote/VoteCircuit.circom
pragma circom 2.1.6;

include "circomlib/circuits/poseidon.circom";
include "circomlib/circuits/bitify.circom";
include "circomlib/circuits/merkleTree.circom";
include "./bls12381/VerifyBLS.circom";   // 复用 BLS 验证子电路
include "./pedersen/PedersenCommit.circom";

template VoteCircuit(
    MERKLE_DEPTH = 20,      // 支持 100 万级白名单
    VOTE_OPTIONS = 5        // 最大选项数
) {
    // ========== 公共输入 ==========
    signal input agendaId;           // 议程哈希
    signal input vcRoot;             // 凭证 Merkle 根
    signal input nullifier;          // 防重复投票标识
    signal input voteCommit;         // Pedersen 承诺
    signal input pkIdX, pkIdY;       // 身份公钥 (BabyJubJub)

    // ========== 私有输入 ==========
    signal private input skId;       // 身份私钥
    signal private input cred[3];    // VC: [issuerSigR, issuerSigS, credHash]
    signal private input merklePath[MERKLE_DEPTH];
    signal private input merklePathIndex[MERKLE_DEPTH];
    signal private input r;          // 承诺随机数
    signal private input v;          // 投票值 (0/1 单选, 或 bit 向量多选)
    signal private input optionIndex; // 选中的选项索引

    // ========== 约束 1: BLS 凭证签名验证 ==========
    // Registrar 公钥硬编码在电路常量或通过可信设置传入
    component blsVerify = VerifyBLS();
    blsVerify.credHash <== cred[2];
    blsVerify.sigR <== cred[0];
    blsVerify.sigS <== cred[1];
    // pk_R 通过模板参数或常量注入，此处省略赋值
    blsVerify.pkRx <== PK_R_X;
    blsVerify.pkRy <== PK_R_Y;
    // 输出 1 表示合法

    // ========== 约束 2: 身份一致性 pkId = skId * G ==========
    component idKeyGen = BabyJubJubScalarMul();
    idKeyGen.scalar <== skId;
    idKeyGen.baseX <== BASE_G_X;
    idKeyGen.baseY <== BASE_G_Y;
    idKeyGen.outX === pkIdX;
    idKeyGen.outY === pkIdY;

    // ========== 约束 3: Merkle 白名单证明 ==========
    component merkle = MerkleTreeChecker(MERKLE_DEPTH);
    merkle.root === vcRoot;
    merkle.leaf <== cred[2]; // credHash 作为叶子
    for (var i = 0; i < MERKLE_DEPTH; i++) {
        merkle.pathElements[i] <== merklePath[i];
        merkle.pathIndices[i] <== merklePathIndex[i];
    }

    // ========== 约束 4: Nullifier 绑定身份 ==========
    component nfHash = Poseidon(2);
    nfHash.inputs[0] <== skId;
    nfHash.inputs[1] <== agendaId;
    nfHash.out === nullifier;

    // ========== 约束 5: Pedersen 承诺打开 & 选项有效性 ==========
    // 选项基 G_i = Poseidon(agendaId || i) * G (链下预计算, 作为公共输入传入或电路内算)
    // 此处演示电路内动态计算单选基点 (多选需循环展开)
    signal optionBaseX[VOTE_OPTIONS];
    signal optionBaseY[VOTE_OPTIONS];
    for (var i = 0; i < VOTE_OPTIONS; i++) {
        component hashBase = Poseidon(2);
        hashBase.inputs[0] <== agendaId;
        hashBase.inputs[1] <== i;
        // 简化: 实际需将 hash 映射到曲线点, 此处假设预计算传入
        optionBaseX[i] <== OPTION_BASE_X[i]; // 公共输入数组
        optionBaseY[i] <== OPTION_BASE_Y[i];
    }

    // 选中的基点
    signal selBaseX, selBaseY;
    // 使用 Mux 选择 (optionIndex 为私有, 需比特分解约束)
    component bits = Num2Bits(MAX_OPTION_BITS);
    bits.in <== optionIndex;
    // ... 省略 Mux 逻辑, 最终得到 selBaseX, selBaseY

    component commit = PedersenCommit();
    commit.r <== r;
    commit.v <== v;
    commit.baseX <== selBaseX;
    commit.baseY <== selBaseY;
    commit.outX === voteCommit; // 假设 voteCommit 仅取 x 坐标或哈希

    // ========== 约束 6: v ∈ {0,1} (单选) 或范围证明 (多选) ==========
    component isBool = IsBoolean();
    isBool.in <== v;
    // 多选时: v 是 bit 向量, 需额外约束 sum(v) == 1 (单选) 或 <= k (多选)
}

// circuits/auth/AuthCircuit.circom
template AuthCircuit(MERKLE_DEPTH = 20) {
    signal input sessionId;
    signal input epoch;
    signal input vcRoot;
    signal input revokedRoot;      // 吊销 SMT 根
    signal input epkX, epkY;       // 临时公钥
    signal input chal;             // 服务端挑战

    signal private input skId;
    signal private input cred[3];
    signal private input merklePath[MERKLE_DEPTH];
    signal private input merklePathIndex[MERKLE_DEPTH];
    signal private input esk;      // 临时私钥

    // 1. 临时公钥一致性
    component ephKey = BabyJubJubScalarMul();
    ephKey.scalar <== esk;
    ephKey.baseX <== BASE_G_X;
    ephKey.baseY <== BASE_G_Y;
    ephKey.outX === epkX;
    ephKey.outY === epkY;

    // 2. Schnorr 签名绑定会话上下文 (防重放/中间人)
    // s = esk + H(chal || epk || sessionId) * skId
    signal private input s;
    component chalHash = Poseidon(3);
    chalHash.inputs[0] <== chal;
    chalHash.inputs[1] <== epkX;
    chalHash.inputs[2] <== sessionId;
    signal e = chalHash.out;

    // 线性组合约束 (无需范围证明, 因为模序运算在域内自动取模)
    s === esk + e * skId;

    // 3. 吊销非成员证明 (SMT)
    // 叶子值为 0 表示未吊销
    component revokeCheck = SMTNonMembershipProof(256); // 256 深度
    revokeCheck.root === revokedRoot;
    revokeCheck.key <== cred[2]; // credHash
    revokeCheck.value <== 0;
    // path 由服务端实时生成并作为私有输入传入 (或公共输入, 视威胁模型)
    for (var i = 0; i < 256; i++) {
        revokeCheck.siblings[i] <== revokePath[i];
        revokeCheck.directions[i] <== revokeDir[i];
    }

    // 4. 凭证有效性 & 白名单 (复用 VoteCircuit 逻辑, 建议抽象为 Include 模板)
    // ...
}

// packages/zk-sdk/src/prover.ts
import { createWorker } from 'circomlibjs/worker';
import { Poseidon, BabyJubJub } from 'circomlibjs';
import { ethers } from 'ethers';

export class ZKProver {
  private worker: Worker;
  private poseidon: Poseidon;
  private babyJub: BabyJubJub;

  async init(circuitName: 'vote' | 'auth') {
    this.poseidon = await Poseidon.create();
    this.babyJub = await BabyJubJub.create();
    // 使用 Web Worker 避免阻塞主线程
    this.worker = createWorker(
      `/wasm/${circuitName}_browser.wasm`,
      `/zkeys/${circuitName}.zkey`
    );
  }

  async genVoteProof(inputs: VoteInputs): Promise<ZKProof> {
    // 1. 客户端侧预计算 (减少电路约束)
    const optionBases = await this.precomputeOptionBases(inputs.agendaId);
    const nullifier = this.poseidon.F.toObject(
      this.poseidon([inputs.skId, inputs.agendaId])
    );

    // 2. 组装电路输入 (注意字段顺序必须与 .sym 文件一致)
    const circuitInput = {
      agendaId: inputs.agendaId,
      vcRoot: inputs.vcRoot,
      nullifier,
      voteCommit: inputs.voteCommit,
      pkIdX: inputs.pkIdX,
      pkIdY: inputs.pkIdY,
      // 私有输入
      skId: inputs.skId,
      cred: inputs.cred,
      merklePath: inputs.merklePath,
      merklePathIndex: inputs.merklePathIndex,
      r: inputs.r,
      v: inputs.v,
      optionIndex: inputs.optionIndex,
      OPTION_BASE_X: optionBases.map(b => b.x),
      OPTION_BASE_Y: optionBases.map(b => b.y),
    };

    // 3. 调用 Worker 生成证明 (含 witness 计算 + Groth16 Prove)
    const { proof, publicSignals } = await this.worker.prove(circuitInput);

    // 4. 格式转换为 Solidity verifier 兼容格式
    return this.formatProofForContract(proof, publicSignals);
  }

  // 内存敏感数据清零
  destroy() {
    this.worker.terminate();
    // 强制 GC 提示 (视浏览器支持)
    (window as any).gc?.();
  }
}

// pkg/verifier/batch_verifier.go
type BatchVerifier struct {
    vk           *groth16.VerifyingKey
    pairingPool  *bls12381.PairingPool // 预计算 Miller Loop 状态
    batchSize    int
    timeout      time.Duration
    queue        chan *VerifyTask
    resultCh     chan *VerifyResult
}

type VerifyTask struct {
    Proof        *groth16.Proof
    PublicInputs []fr.Element
    Callback     func(error)
    Ctx          context.Context
}

func NewBatchVerifier(vkPath string, batchSize int) (*BatchVerifier, error) {
    vkBytes, _ := os.ReadFile(vkPath)
    vk, _ := groth16.NewVerifyingKey(vkBytes)
    return &BatchVerifier{
        vk:          vk,
        pairingPool: bls12381.NewPairingPool(runtime.NumCPU()),
        batchSize:   batchSize,
        timeout:     50 * time.Millisecond, // 最大等待凑批时间
        queue:       make(chan *VerifyTask, 10000),
        resultCh:    make(chan *VerifyResult, 10000),
    }, nil
}

func (bv *BatchVerifier) Start(ctx context.Context) {
    for i := 0; i < runtime.NumCPU(); i++ {
        go bv.worker(ctx)
    }
}

func (bv *BatchVerifier) worker(ctx context.Context) {
    batch := make([]*VerifyTask, 0, bv.batchSize)
    timer := time.NewTimer(bv.timeout)
    defer timer.Stop()

    for {
        select {
        case <-ctx.Done():
            return
        case task := <-bv.queue:
            batch = append(batch, task)
            if len(batch) >= bv.batchSize {
                bv.flushBatch(batch)
                batch = batch[:0]
                if !timer.Stop() { <-timer.C }
                timer.Reset(bv.timeout)
            }
        case <-timer.C:
            if len(batch) > 0 {
                bv.flushBatch(batch)
                batch = batch[:0]
            }
            timer.Reset(bv.timeout)
        }
    }
}

func (bv *BatchVerifier) flushBatch(batch []*VerifyTask) {
    // 1. 聚合公共输入 (Groth16 不支持原生聚合验证, 但可批量 Miller Loop)
    // 使用 bls12381 批量配对: e(Σ[proof.A]_1, [vk.gamma]_2) * e(Σ[proof.B]_2, [vk.delta]_1) ...
    // 此处简化为并行单验证, 实际生产建议接入 gnark 的 BatchVerify 或自定义聚合电路
    var wg sync.WaitGroup
    errs := make([]error, len(batch))

    for i, task := range batch {
        wg.Add(1)
        go func(idx int, t *VerifyTask) {
            defer wg.Done()
            // 并行验证, 利用 pairingPool 复用预计算
            err := groth16.Verify(bv.vk, t.PublicInputs, t.Proof, bv.pairingPool)
            errs[idx] = err
        }(i, task)
    }
    wg.Wait()

    for i, task := range batch {
        task.Callback(errs[i])
    }
}

// 提交验证任务 (非阻塞)
func (bv *BatchVerifier) Submit(task *VerifyTask) error {
    select {
    case bv.queue <- task:
        return nil
    default:
        return ErrQueueFull
    }
}

// services/revocation-sync/src/main.rs
use tokio::sync::watch;
use merkle_tree::SparseMerkleTree;

struct RevocationSyncer {
    registrar_client: RegistrarGrpcClient,
    local_smt: Arc<RwLock<SparseMerkleTree<Poseidon>>>,
    root_tx: watch::Sender<[u8; 32]>, // 广播最新 revokedRoot
}

impl RevocationSyncer {
    async fn run(&self, mut interval: tokio::time::Interval) {
        loop {
            tokio::select! {
                _ = interval.tick() => {
                    if let Err(e) = self.sync_once().await {
                        tracing::error!("revocation sync failed: {}", e);
                    }
                }
                _ = self.shutdown.changed() => break,
            }
        }
    }

    async fn sync_once(&self) -> Result<()> {
        // 1. 拉取增量吊销列表 (since last_epoch)
        let updates = self.registrar_client.get_revocation_delta(self.last_epoch).await?;
        
        // 2. 本地 SMT 批量更新
        let mut smt = self.local_smt.write().await;
        for (cred_hash, is_revoked) in updates {
            smt.update(cred_hash, is_revoked as u8)?;
        }
        let new_root = smt.root();
        
        // 3. 生成所有受影响凭证的非成员/成员证明 (供客户端 AuthCircuit 使用)
        // 仅生成「在线用户」的证明, 推送至客户端缓存
        let online_users = self.presence_service.get_online_cred_hashes().await;
        let proofs = smt.batch_prove(online_users)?;
        self.proof_cache.update(proofs).await;

        // 4. 广播新根
        self.root_tx.send(new_root)?;
        self.last_epoch = updates.epoch;
        Ok(())
    }
}

(* specs/VoteCircuitSpec.v *)
Require Import Circom.Arithmetic.
Require Import Circom.Poseidon.
Require Import ZArith.

(* 抽象规格: 投票有效性谓词 *)
Definition VoteValid (skId agendaId: F) (v: Z) (optIdx: Z) : Prop :=
  (0 <= v < 2)%Z / (* 单选 0/1 *)
  (0 <= optIdx < VOTE_OPTIONS)%Z /
  (* Nullifier 正确性 *)
  nullifier = Poseidon2(skId, agendaId) /
  (* 承诺正确性 *)
  voteCommit = PedersenCommit(r, v, OptionBase(optIdx)).

(* 定理: 电路约束蕴含规格 *)
Theorem CircuitImpliesSpec :
  forall (witness: Witness),
    CircuitConstraints witness = true ->
    VoteValid witness.skId witness.agendaId witness.v witness.optIdx.
Proof.
  (* 使用 `circom-coq` 自动生成的约束多项式系统进行证明 *)
  (* 关键步骤: 将 R1CS 约束转化为 Coq 命题, 利用 `lia` `ring` `field_simplify` 自动化 *)
  admit. (* 实际项目中由形式化验证团队完成 *)
Qed.

# .github/workflows/fuzzing.yml
name: Circuit Fuzzing & Differential Testing

on: [push, pull_request]

jobs:
  fuzz:
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v4
      - name: Build Circom & Rust Fuzzer
        run: |
          cargo build --release -p zk-fuzzer
          circom circuits/vote/VoteCircuit.circom --r1cs --wasm --sym -o build/
      
      - name: Run Differential Fuzzing (WASM vs Native Rust)
        run: |
          # 生成随机合法/非法见证
          ./target/release/zk-fuzzer 
            --circuit build/VoteCircuit.r1cs 
            --wasm build/VoteCircuit.wasm 
            --native-lib target/release/libvote_native.so 
            --iterations 100000 
            --corpus corpus/ 
            --sanitize=address,undefined
      
      - name: Property-Based Testing (Proptest)
        run: |
          cargo test --release --test proptest_vote -- --nocapture
      
      - name: Upload Crash Artifacts
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-crashes
          path: crashes/

Trace: meeting_join_abc123
├── Span: signaling_handshake (12ms)
├── Span: auth_challenge_fetch (8ms)
├── Span: zk_auth_prove (1400ms)  [Tag: circuit=auth, wasm=true, simd=true]
│   ├── Event: witness_gen (300ms)
│   ├── Event: groth16_prove (1100ms)
│   └── Event: proof_serialize (5ms)
├── Span: dtls_transport_establish (45ms)
└── Span: media_flow_start (200ms)