ByProof

ByProof is a privacy-preserving proof application built around reviewed Providers and server-authoritative verification. The repository is intentionally split by runtime boundary:

• apps/mobile - Flutter iOS/Android client.
• services/api - authenticated API and lifecycle authority.
• services/worker - asynchronous verification and retention jobs.
• contracts - OpenAPI, JSON Schema, and cryptographic fixtures.
• deploy/attestor - default/reference Attestor deployment policy.
• infra - local, CI, migration, and observability scaffolding.
• tooling - Provider/Attestor operations and contract checks.

Local baseline

The API and worker smoke harnesses use Node.js 22.6+ native TypeScript type stripping and have no runtime dependency. Flutter and Reclaim are pinned in apps/mobile/pubspec.yaml but require the vendor-gated toolchain described in doc/implementation/vendor-gates.md.

npm --prefix services/api test
npm --prefix services/worker test
node tooling/contract-checks/check.mjs

After the /data toolchain is available, the complete local gate (including Flutter analysis, tests, and Android debug/release APK builds) is:

./tooling/check-local.sh

No command in this repository claims Reclaim production support until VGB-1 through VGB-4 are evidenced.

The mobile gate passes cronetHttpNoPlay=true to use Cronet's embedded Android implementation. This avoids the duplicate org.chromium.net namespace shipped by the current Play Services Cronet transitive AARs under AGP 9 and keeps the network stack independent of Google Play Services. The exact Android toolchain and artifact checks are documented in doc/implementation/android-build.md.

Local storage invariant

All ByProof SDKs, dependency caches, temporary files, build outputs, and local runtime data must stay on /data. Load the canonical environment before local development:

source tooling/env/byproof.env

See PROJECT_MEMORY.md for the required paths and the reason this repository does not use the default home-directory caches.