Add on-chain BBS selective-disclosure verifier + BbsToCardano codec

[satran004]

Summary

Adds native on-chain BBS selective-disclosure verification to ZeroJ, promoting the gadgets proven out in the zeroj-usecases reusable-KYC usecase into the library — following the same reusable-@OnchainLibrary + off-chain-codec pattern as Groth16 and PlonK.

zeroj-onchain-julc — new bbs.lib on-chain gadgets

• BbsHashToScalar (@OnchainLibrary) — BBS hash_to_scalar (RFC 9380 expand_message_xmd(SHA-256), len=48, OS2IP mod r). Ciphersuite-generic: any BBS validator composes it for message→scalar mapping and the Fiat–Shamir challenge.
• BbsProofVerify (@OnchainLibrary) — full BBS ProofVerify (T1/T2 recomputation, challenge recomputed on-chain and compared, pairing check e(Abar,W) == e(Bbar,BP2)) for the BLS12381G1-SHA-256 suite. Unrolled for the 5-message / disclose-{2,3} profile (Plutus has no cheap dynamic loop); measured ~2.44×10⁹ CPU / 0.18M mem — well inside per-tx limits. Arbitrary-disclosure generalization is the tracked follow-up (mirroring PlonK's one-input → bounded-MPI evolution).
• OnChainFeasibility: BBS/BLS12-381 now EXPERIMENTAL with the measured budget (annotated as measured, not estimated).

zeroj-bbs — new bbs.cardano.BbsToCardano off-chain codec

• verifierParams(pk, header, messageCount) → issuer verification material for validator @Params (generators, domain, DSTs — deterministic, cacheable).
• onChainProof(presentation) → redeemer values (proof points, Schnorr responses, revealed messages sorted by index, presentation header).
• Plain off-chain Java, no Julc/Plutus dependency — the BBS analog of SnarkjsToCardano. Kept in zeroj-bbs so the on-chain module takes no main-scope BBS dependency (test-scope only), preserving the bom-core opt-in boundary.

Crypto-only by design

Like the Groth16/PlonK libs, BbsProofVerify verifies the proof but binds no ScriptContext. Validators protecting value must add policy: disclosed-value checks, payout, and replay-safe binding of the presentation header to the spend. A worked claim validator (voucher-derived header = intrinsic nullifier) lives in zeroj-usecases reusable-kyc.

Testing

• BbsHashToScalarVmTest — Julc-VM differential test against CfrgBbsCore.hashToScalar (byte-exact across empty/short/multi-block messages).
• BbsProofVerifyVmTest — full ProofVerify in the Julc VM against a real zeroj-bbs presentation: accept + tampered-header reject; prints the measured budget.
• BbsToCardanoTest — params well-formedness + disclosed/hidden split.
• Full zeroj-bbs (89 tests incl. CFRG draft-10 fixtures) and zeroj-onchain-julc suites green — no regressions.
• Relocation verified byte-exact downstream: the reusable-kyc claim validator compiled against these gadgets has an identical script hash and identical ExUnits, and completed a fresh live lock+claim on Yaci DevKit (ledger-verified BBS presentation).

🤖 Generated with Claude Code