[Security/Ceremony] Pin official Powers-of-Tau / Phase-2 MPC ceremony artifact verification hashes

[satran004]

Background & Objective

Before any value-bearing mainnet release, ZeroJ must not rely on ephemeral or local single-party setups.

Official, verified Multi-Party Computation (MPC) ceremony artifacts (such as standard Powers-of-Tau .ptau files and circuit-specific Phase-2 .zkey files) must be selected, cryptographically verified, and their SHA-256 hashes permanently pinned in the repository.

Scope & Tasks

• Establish SHA-256 verification hash pins for standard Powers-of-Tau BLS12-381 ceremony files (e.g. Hermez / Filecoin / community ceremonies).
• Add runtime validation in ZkeyImporterBLS381 and PtauImporterBLS381 to verify file integrity against pinned hashes when required.
• Document the ceremony lineage, participant counts, and transcript verification instructions in docs/ceremony/.

Risk Classification

• R2: Production security gate & trust boundary.
• Reference: docs/zeroj-comprehensive-review-and-readiness-gemini.md (Section 6).

[satran004]

Closing — the two implementation tasks are already done, the source decision is already made in ADR-0031, and one of the named ceremonies is the wrong curve. There is a real remaining gap, but it is a different piece of work (see the end).

1. Runtime SHA-256 validation already exists. Task 2 asks to "add runtime validation in ZkeyImporterBLS381 and PtauImporterBLS381". Both already take an expectedSha256 and fail closed on mismatch:

• PtauImporterBLS381.java:71-75, :173, and the check itself at :295-310 (if (!MessageDigest.isEqual(sha256(data), expectedSha256)) throw new IOException(label + " SHA-256 hash mismatch"))
• ZkeyImporterBLS381.java:60, :423
• PlonKZkeyImporterBLS381.java:408

2. The ceremony documentation already exists. Task 3 asks to document lineage and verification instructions in docs/ceremony/. That directory holds OPTION-A-RUNBOOK.md (phase-0 .ptau acquisition, contribution chain, beacon, publication checklist), USER-GUIDE.md, and rehearsal.sh — plus docs/zeroj-ceremony-review-2026-07-10.md.

3. Hermez cannot supply a BLS12-381 SRS. Task 1 lists "Hermez / Filecoin / community ceremonies" as candidate sources. Hermez / Perpetual Powers of Tau is BN254 (alt_bn128). That is precisely why ADR-0031 §113 already decided: "adopt Filecoin's phase 1 as the primary source; own-ptau as fallback" — Filecoin's BLS12-381 ceremony (2²⁷, ~20 publicly-attested participants + beacon), with the ~60–105h prepare phase2 cost documented in the runbook.

(Separately: ADRs 0012, 0013, 0025 and 0030 also name Hermez loosely in a BLS12-381 context. That doc inconsistency is worth its own cleanup ticket.)

What is actually missing — and why this needs a differently-scoped issue: there are no pinned hash values anywhere in the repo, only the parameter. But no value can be pinned until a specific prepared .ptau exists, and per ADR-0031 that is blocked on the Filecoin conversion plus the prepare phase2 run. The real work is "execute ADR-0031 M3/M4, publish the artifact, then pin its hash" — not "add validation".