ZK in this repo (high level)

SVG sources: web/public/diagrams/zk-loop.svg and zk-claims-map.svg — edit in any text editor or Inkscape.

1. Witness → relation → proof → verifier

ZK loop: witness w, relation R(x,w), proof pi, verifier V(x,pi), public input x

Witness w: secrets only the prover knows.
Public x: roots, pubkeys, declared values, etc.
Proof π: one message the verifier checks without learning w.

2. Claims → modules → rollup

Claims mapped to sigma, commitment, bits, merkle, then mini rollup

Exercises line up loosely: Ex1 → Sigma, Ex2 → Pedersen sum, Ex3 → bits + OR, Ex4 → Merkle, then the rollup composes signatures + state tree.

3. Fiat–Shamir

Interactive Sigma is commit → challenge → response. Fiat–Shamir sets e = Hash(transcript) so the proof is non-interactive. Domain-separated hashing: transcript.rs / patterns in sigma.rs.

4. Strict vs illustrative ZK

Piece	Role
Sigma + FS, bit-OR	Σ-protocol style NIZK in the ROM (toy group).
Basic Merkle open	Membership; hiding the leaf needs extra machinery.
Rollup demo	System composition; not replacing the primitives above with a SNARK.

Repo copy (Markdown + GitHub image paths): docs/zk_high_level.md