NADO v1.0.0-alpha.3 — Shielded pool + on-device private proving, presence dividend, HTLC swaps, explorer

Pre-mainnet alphanet. No value is at stake; the live node is a resettable demo and breaking/consensus changes are expected between alphas.

NADO is a phone-mineable, fair-launch, post-quantum (ML-DSA-44 / FIPS 204) lightweight L1. Alpha.3's headline is privacy: a working zk-STARK shielded pool with in-browser, on-device proving — send NADO privately from your phone, and the prover never leaves your device. It also lands the presence dividend (AFK/forever-mining rewards), HTLC atomic swaps, a click-through block explorer, and hardens the wallet.

🔒 Shielded pool — private payments (zk-STARK)

A post-quantum, no-trusted-setup shielded pool on the execution layer.

• Shield / unshield / private transfer. Deposit into the pool, withdraw to a different address, and make note→note shielded transfers with no on-chain amount. On-chain, a withdrawal/transfer is a zero-knowledge proof that hides the amount and which note was spent.
• The whole statement in one STARK. A single join-split proof binds: note ownership (ML-DSA-authorised), the input commitment, Merkle membership in the pool, the nullifier (double-spend prevention), two output commitments (recipient + change), and value conservation — so a transfer can send any amount and keep the change.
• Post-quantum by construction: Goldilocks-field STARK + FRI, the only assumption anywhere is a collision-resistant hash (BLAKE2b). No elliptic curve, no pairing, no trusted setup.
• A shielded address + claim codes. A stable znado… receive address (with QR + share) and znote… claim codes delivered out-of-band; the recipient reconstructs the note with their own key.
• Off-L1 proofs. The ~1 MB proof never touches L1 — the exec node verifies and applies it, and only the settled pool state-root reaches L1 via the bonded 2/3 quorum.
• Alpha honesty: deposit/withdraw amounts are public on L1; real unlinkability comes from shielded transfers inside the pool plus a busy pool. Deposits/withdrawals are always sound.

⚡ On-device proving — private, and fast

• "Prove on this device" tick. The browser fetches the pool leaves, builds the Merkle path, and generates the entire STARK itself — the node never sees your witness (amounts, keys, which note). Byte-verified: a browser-generated proof is accepted by the unchanged verifier.
• ~2 seconds in the browser. A ~11× speedup (from ~22 s) via a WASM BLAKE2b, a WASM Goldilocks field/NTT, a whole-tree WASM Merkle, Montgomery batch inversion, and cached NTT twiddles / periodic LDE.
• One Rust codebase, both provers. The same Rust powers the browser (WASM) and the node: the delegated prover (/exec/prove_transfer2) binds it natively via ctypes, dropping from ~20 s to ~3.8 s (pure-Python fallback ~6.3 s, no extra deps).

💸 Presence dividend — AFK / forever mining

• Open-lane blocks now split three ways, streaming a fidelity-weighted presence dividend to steady miners instead of an all-or-nothing jackpot. Accrues on the exec node against the settled root; Collect + auto-claim in the client, with an accrued-balance display. Bonded blocks fund it too (20%).

🔁 HTLC atomic swaps

• Hash-time-locked contracts for trustless cross-chain swaps, with a Swap tab in the client.

🔍 Explorer, rich list & stats

• Click-through block explorer (accounts / txs / blocks), tx-row timestamps, fixed genesis-anchored block times, a dynamic "(you)" lane marker, and a rich list leaderboard.
• Stats tab: inline-SVG distribution charts (reward pipelines + supply) and a fixed "Top balances" chart.

🔐 Wallet hardening

• BIP39 brain-seed 24-word recovery phrase (generate / reveal / restore).
• At-rest encryption (AES-256-GCM / PBKDF2) with auto-lock after inactivity.
• Import a key from a file (mirror of download-to-file).

🌍 Client & i18n

• Every new string — shielded pool, transfers, on-device proving, wallet security, swaps, explorer — translated across 16 languages; popups and dynamic status lines included.
• Social-media share buttons + one-tap QR of the site URL and your shielded address.

🛠️ Fixes & ops

• Fixed ~70–135 s block-production stalls (drop an invalid tx during own-block assembly instead of aborting the block).
• Fixed a fresh exec node cold-start on a pruned/rolling chain, a rolling-mode /status crash, and dividend visibility (exec CORS).
• scripts/install.sh --exec installs the complete package (L1 + shielded-pool node on :9273, systemd units), and builds the native prover lib when Rust is present. --exec-settle anchors the pool root to L1.

✅ Verification

zk-STARK suite green (field/NTT, FRI, STARK composition, Merkle membership, spend, join-split, 2-output circuit, field pool). Browser↔Python byte-identical cross-checks at every layer (field, NTT, Merkle, FRI, STARK, circuit) — a JS proof is accepted by the unchanged verify_transfer. Verified live on the alphanet: shield → prove → withdraw round-trip, an Alice→Bob shielded transfer (public amount = 0), and an on-device proof applied by the node.

---

🤖 Generated with Claude Code