Disposition: Keep signed local evidence, capabilities, scoped transparency, and signed storage receipts canonical. Add ZK only for a concrete anonymity or abuse-control requirement; add contracts only as narrow public coordination anchors.
#Role matrix
| Requirement | Default mechanism | Optional ZK mechanism | Optional contract role | Current disposition |
|---|---|---|---|---|
| Private membership eligibility | Signed TalkCo membership event or capability | Semaphore-style membership proof | Root anchor | Local evidence first |
| Non-revocation | Signed revocation frontier or scoped Key Transparency | AnonCreds proof | Status-root anchor | Local/KT first |
| Anonymous admission | Blind invitation or Privacy Pass token | Semaphore | Issuer/registry only | Privacy Pass first experiment |
| Anonymous rate limiting | Signed quota/admission token | RLN | Epoch roots/slashing | RLN later abuse-control adapter |
| Storage possession/integrity | Signed Merkle challenge-response | ZK proof only for a special marketplace | Audit/settlement | No ZK initially |
| Commitment/fork evidence | Signed roots, witnesses, scoped KT | Transition proof only if required | Batch-root anchor | KT and witnesses first |
| Committee rotation | Signed ThresholdAuthorizedRoot | Hidden committee proof only if required | Commitment/epoch registry | Contract optional |
| Conditional key release | Recipient key and signed grant | Predicate proof to release nodes | Conditions/payment/committee state | Generic adapter, TACo later |
A ZK proof must name its public inputs, witness, issuer, revocation/freshness state, replay/nullifier behavior, verifier state, and offline fallback. “Private membership” is not a sufficient statement.
#Candidate systems
Semaphore is a useful anonymous group-signaling reference: it proves knowledge of a group secret and emits a scope-bound nullifier. Its public root, scope, message, and nullifier still create a correlation surface, and it does not authorize decryption. Semaphore specification
RLN is narrower: it supports anonymous rate limits through epoch-linked nullifiers and can expose a secret when a user exceeds a quota. It is abuse control, not private-community authorization. RLN formal specification
Privacy Pass is the smallest first experiment for blind admission or rate-limited invitations. It still needs issuer, replay, token-lifetime, challenge-binding, and quota semantics. RFC 9578
AnonCreds is relevant only if TalkCo must interoperate with independent issuers and prove predicates or non-revocation. Its registry and issuer governance remain part of the trust model. AnonCreds specification, anoncreds-rs
ZK storage proofs are not justified initially. Storage peers already know the ciphertext they hold; signed Merkle challenges and receipts are smaller, easier to repair, and more useful for identifying failures. Filecoin and Walrus remain heavy economic/chain benchmarks. Filecoin proof of storage, Walrus operations
Smart contracts should be limited to batched commitment anchors, committee/epoch registries, lease/payment settlement, or dispute evidence. They must not contain posts, comments, recipient lists, peer identities, access lists, or shard placement. Contract outage, reorg, fee spikes, censorship, and upgrade must not prevent already-authorized offline reading.
#Candidate profiles
#A. Local evidence baseline
TalkCo signed authority events, signed capabilities, per-device HPKE, scoped Key Transparency, signed storage challenges, and no ZK or contract dependency in ordinary content access.
#B. Anonymous admission and abuse control
Profile A plus Privacy Pass-style blind admission tokens, optional Semaphore-style anonymous signaling, or optional RLN-style per-context quotas. A successful proof still receives a TalkCo grant or key envelope; it does not become authorization by itself.
#C. Distributed conditional release
Profile A plus a generic threshold ConditionalKeyRelease interface, optional AnonCreds or ZK eligibility evidence, scoped committee roots, and an optional chain commitment/payment anchor. This is research-only until it passes liveness, collusion, stale-state, metadata, recovery, and chain-outage tests.
#Falsifiers
- A stale membership root grants access after the declared freshness boundary.
- A nullifier or admission token links the same identity across contexts.
- Chain outage prevents cached authorized content from being read offline.
- A chain reorg silently overrides a conflicting TalkCo authority transition.
- A ZK storage proof adds cost without detecting withholding, corruption, or correlated failure.
- A threshold release cannot revoke a key already delivered to a requester, cache, backup, or old device.
- A circuit or verifier-key upgrade changes public-input, root, nullifier, or scope semantics without failing closed.
#Recommendation
Keep ZK and contracts out of ordinary posts, comments, attachments, membership, and storage flows. Prototype Privacy Pass before custom circuits. Consider Semaphore only for anonymous group signaling and RLN only for bounded anonymous rate limiting. Use AnonCreds only for external-credential interoperability. Define a generic conditional-release seam for TACo/PRE-like networks, but do not adopt TACo as a v0 dependency.