sptos-proof

Proof engine with 3-tier routing for the SPTOS Cognition Kernel

Overview

sptos-proof implements the proof engine from ADR-087. Every state mutation in SPTOS requires a cryptographic proof. The engine routes proof requests through three tiers based on operation type: Reflex (sub-100ns for vector updates), Standard (sub-100us with Merkle witnesses), and Deep (sub-10ms with full coherence verification).

Key Features

• 3-tier proof routing — Automatic tier selection based on mutation type and routing context
• Time-bounded validity — Proofs expire after a configurable window (default 100ms)
• Single-use nonces — Each nonce can only be consumed once, preventing replay attacks
• Merkle witnesses — Standard-tier proofs include Merkle tree path witnesses
• Proof cache — Up to 64 entries with configurable TTL for Reflex-tier fast paths
• spt-verified interop — Optional bridge to formal verification attestations

Dependencies

Key internal dependencies:

• sptos-types — Proof types (ProofToken, ProofTier, ProofAttestation)
• sptos-cap — Capability checking for PROVE rights enforcement

Usage

use sptos_proof::{ProofEngine, ProofEngineConfig, ProofVerifier};
use sptos_types::ProofTier;

let mut engine = ProofEngine::new(ProofEngineConfig::default());
let token = engine.generate_reflex_proof(&hash, timestamp).unwrap();

let mut verifier = ProofVerifier::new();
verifier.verify(&token, &hash, timestamp).unwrap();

API Reference

Core Types

Type	Description
ProofEngine	Central engine for generating proofs at all tiers
ProofEngineConfig	Engine configuration (validity window, cache size)
ProofVerifier	Verifies proof tokens against mutation hashes
ProofCache	Fixed-size LRU cache for Reflex-tier proof entries
TierRouter	Routes proof requests to the appropriate tier
MerkleWitness	Merkle tree path witness for Standard-tier proofs
AttestationBuilder	Constructs attestation records for the witness log
ProofError	Error type for proof operations