QuantZK / Halborn Review Packet

Prepared for: Halborn (Rich + engineering)
Product: Verifiable API billing (billing_version: v2)
Production API: https://api.quantzk.com
Trust index: https://quantzk.com/trust
Repo baseline: main @ 8ec535c
Packet version: 2026-07-09
Contact: Omar@quantzk.com

This folder is the scoped review package for Halborn. Read in order for a 30–60 minute technical session, or use individual sections as pre-read. For a formal security session (coverage, threat model, assumptions, circuit/parser/canon, trust boundaries), start with §7.

Positioning: QuantZK includes a formal security package designed to support an independent review — not a claim that the product “has been security audited.” Coverage here means primary adversarial scenarios in the threat model are covered by executable tests, not a line-coverage percentage.

---

Packet contents

#	Document	Purpose
1	One-page overview	Executive summary: what we built, what we need reviewed, known limitations
2	Production smoke evidence	Recorded production attest → verify → tamper run; artifact pins
3	Operational readiness	Release gates, perf budget, MPC status, deploy readiness
4	Trust surface scope	In-scope / out-of-scope, key files, reviewer questions
5	Pilot packet	Design-partner pilot: problem, workflow, integration, ROI
6	Architecture	Billing trust stack diagrams (Mermaid)
7	Formal security package	Coverage, threat model, assumptions, unsupported cases, circuit/parser/canon, trust boundaries

---

Quick start (reviewer)

# Source — monorepo: https://github.com/ayitsomar/zkCaptcha-backend (protocol/)
# After access: checkout baseline 8ec535c (or current main)

# Formal audit gates (artifacts + conformance + 15/15 pilot + 12/12 adversarial)
bash scripts/run-formal-security-audit.sh

# Or release gate alone (15/15)
cd verifier-api
DATABASE_URL="postgresql://zkcaptcha:development@localhost:5432/zkcaptcha" \
REDIS_ENABLED="false" REDIS_DISABLED="true" NODE_ENV=test DB_SSL=false \
npm run test:billing-pilot

# Optional: attachable Jest coverage snapshot
bash scripts/halborn-coverage-report.sh

# Live health (no secret)
curl -sS https://api.quantzk.com/health | jq .

# Live smoke (secret on request)
API=https://api.quantzk.com VDI_ATTEST_SECRET=<secret> bash scripts/smoke-billing-phase2.sh

---

Related documents

Document	Access
Formal security audit (protocol)	/docs/formal-security-audit
Attack matrix	/docs/billing-v2-attack-matrix
Cryptographic binding model	/docs/vdi-cryptographic-binding-model
External validation packet	Available on request — Omar@quantzk.com
Full pilot packet (PDF)	Available on request — Omar@quantzk.com
Trusted setup + MPC	/docs/trusted-setup-mpc
NCC review entry	/docs/ncc-review
Offline verifier	https://quantzk.com/protocol/verify.html

---

Suggested call agenda (30–45 min)

1. Overview (5 min) — §1 one-pager; two-call surface
2. Live demo (8 min) — smoke script or /vdi-billing UI
3. Formal security asks (15 min) — §7 coverage / threat model / circuit / boundaries
4. Scope ack (5 min) — §4 in/out of scope; unsupported cases
5. Q&A + next steps (5–7 min) — findings format; independent-host MPC path