Third-party review (NCC track)

Single entry point for independent reviewers reproducing QuantZK checks without hunting the tree.

Prerequisites

Tool	Version	Used for
Node.js	≥ 18	Protocol packages, JS verifier, tests
npm	9+	Installs protocol/ workspaces
Go	≥ 1.21	protocol/packages/vdi-verifier-go tests
Python	≥ 3.10	protocol/packages/vdi-verifier-python golden vectors

Optional: Docker for verifier-api local PostgreSQL/Redis; Circom/snarkjs only if recompiling circuits.

One command (protocol audit suite)

From the repository root after git clone:

make ncc-review

Equivalent: bash scripts/ncc-review.sh

Runs protocol install, VDI audit suite (JS conformance, Go verifier, Python golden vectors), and MPC policy E2E integrity gate.

API billing pilot gate

With PostgreSQL available:

cd verifier-api
DATABASE_URL="postgresql://zkcaptcha:development@localhost:5432/zkcaptcha" \
REDIS_ENABLED="false" REDIS_DISABLED="true" NODE_ENV=test DB_SSL=false \
npm run test:billing-pilot

Expect 15/15 passing tests.

Production smoke (live)

API=https://api.quantzk.com VDI_ATTEST_SECRET=<secret> \
bash scripts/smoke-billing-phase2.sh

Pins billing_proof.vkey_hash against ARTIFACT_MANIFEST.json. See Production smoke evidence.

Manual protocol steps

cd protocol
npm install --legacy-peer-deps
npm run test:audit-suite
npm run mpc:e2e-check -- --environment ncc-review-gate --output audit-logs/mpc-e2e-check.ncc-review.json

Command	What it does
npm run test:audit-suite	Primary NCC bar: conformance + Go + Python
npm run artifact:status	Artifact authority + MPC provenance (JSON)
npm run mpc:e2e-check	Prove/verify + hash alignment for MPC circuits
npm run docs:check-terms	Mode terminology drift guard

Artifact expectations

Suite	Prebuilt WASM/zkey required?
npm run test:audit-suite	No — fixtures under protocol/fixtures/
npm test (full)	Partially — some policy-circuit tests need protocol/build/
npm run test:examples	Yes — needs zk-cp/build/ (Groth16)

Formal security package

Adversarial vectors (proof swap, revocation, transparency forgery, canonicalization). Primary claim: threat-model scenarios are covered by executable tests — not a line-coverage percentage, and not a completed third-party audit.

bash scripts/run-formal-security-audit.sh

See Formal security package.

Artifact pins (api-billing-v2)

bash scripts/verify-artifact-hashes.sh

Reproduces WASM/zkey/vkey hashes and runs offline conformance vectors (protocol/conformance/billing-v2-conformance.json). See Artifact hash commands.

Related docs

• Security model
• Security disclosure
• Billing v2 attack matrix
• Artifact hash commands
• Trusted setup (MPC)
• API billing pilot
• Trust index on quantzk.com

Full reviewer README in repo root: NCC_REVIEW.md.