{"id":36237040,"url":"https://github.com/mikebrown0409/project-fuse","last_synced_at":"2026-01-11T06:02:42.597Z","repository":{"id":329317705,"uuid":"1118669280","full_name":"Mikebrown0409/project-fuse","owner":"Mikebrown0409","description":"Zero-knowledge proof system for verifiable compliance envelopes. Proves compliance checkers executed correctly without revealing sensitive data. Built with RISC Zero zkVM. Phase 1 complete.","archived":false,"fork":false,"pushed_at":"2025-12-31T01:25:58.000Z","size":620,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-02T07:36:27.386Z","etag":null,"topics":["audit","compliance","cryptography","gdpr","privacy-preserving","regulatory-compliance","risc-zero","rust","soc2","zero-knowledge-proofs","zkp","zkvm"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Mikebrown0409.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-18T05:28:36.000Z","updated_at":"2025-12-31T01:26:02.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Mikebrown0409/project-fuse","commit_stats":null,"previous_names":["mikebrown0409/project-fuse"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/Mikebrown0409/project-fuse","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mikebrown0409%2Fproject-fuse","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mikebrown0409%2Fproject-fuse/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mikebrown0409%2Fproject-fuse/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mikebrown0409%2Fproject-fuse/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Mikebrown0409","download_url":"https://codeload.github.com/Mikebrown0409/project-fuse/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mikebrown0409%2Fproject-fuse/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28293188,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-11T04:44:51.577Z","status":"ssl_error","status_checked_at":"2026-01-11T04:44:44.232Z","response_time":60,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audit","compliance","cryptography","gdpr","privacy-preserving","regulatory-compliance","risc-zero","rust","soc2","zero-knowledge-proofs","zkp","zkvm"],"created_at":"2026-01-11T06:02:41.823Z","updated_at":"2026-01-11T06:02:42.592Z","avatar_url":"https://github.com/Mikebrown0409.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Project FUSE (Verifiable Proof-of-Verification)\n\n**Tagline:** \"The checksum for verification — portable, machine-verifiable assurance.\"\n\n![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)\n![Version](https://img.shields.io/badge/version-1.2.0-blue.svg)\n![Specification](https://img.shields.io/badge/spec-VCE%20v0.1-green.svg)\n![Rust](https://img.shields.io/badge/rust-1.70%2B-orange.svg)\n\n## Overview\n\nProject FUSE defines a standard cryptographic artifact — the **Verifiable Compliance Envelope (VCE)** — that proves a specific procedural verification ran to completion, without revealing proprietary systems, sensitive data, or internal logic.\n\n**Key Principle:** FUSE proves *that* a process occurred; it does not assert the *truth* of the content being verified. We prove \"This system ran a procedural checker against this specification and passed.\"\n\n## Status\n\nStable open-source infrastructure for verifiable procedural proofs.\n\n**Version 1.2.0**: ✅ **Current** - Hardened security, finalized scope boundaries, and explicit stability guarantees.\n\n**VCE Specification v0.1**: ✅ **Published** - The formal VCE specification is now available. See [specs/VCE_SPECIFICATION_V0.1.md](specs/VCE_SPECIFICATION_V0.1.md) for the complete specification.\n\n## Stability Contract\n\nFUSE follows [Semantic Versioning](https://semver.org/). As of v1.0.0, the core proof format and verification semantics are considered stable.\n\n- **Stable**: VCE file format, `ComplianceSpec` structure, and proof verification logic.\n- **Experimental**: GPU/Hardware acceleration (see `SECURITY.md` for known limitations).\n\n*Breaking changes to the proof surface or core protocol will only be introduced in v2.0.0.*\n\n## Quick Start\n\n### Installation\n\n```bash\ncargo build --release\n```\n\n### Usage\n\n**Generate a compliance proof:**\n```bash\ncargo run --release --bin fuse-prove -- \\\n  --spec examples/specs/soc2-control-x.json \\\n  --system examples/systems/sample-saas-logs.json \\\n  --output compliance.vce\n```\n\n**Verify a compliance envelope:**\n```bash\ncargo run --release --bin fuse-verify -- compliance.vce\n```\n\nFor more examples, see [docs/QUICKSTART.md](docs/QUICKSTART.md).\n\n## Project Structure\n\n```\nProjectFuse/\n├── fuse-core/          # Core protocol implementation\n├── fuse-cli/           # CLI tools (fuse-prove, fuse-verify)\n├── fuse-checkers/      # Example procedural checkers\n├── examples/           # Example specs and test data\n│   ├── specs/         # Example specification files\n│   └── systems/       # Sample system data for testing\n├── specs/              # VCE specification and schemas\n│   ├── VCE_SPECIFICATION_V0.1.md  # Formal specification\n│   └── schemas/       # JSON Schema validation files\n└── docs/              # Documentation\n```\n\n## Core Components\n\n1. **CLI Tool**\n   - `fuse-prove \u003cspec\u003e \u003csystem\u003e` → outputs `.vce`\n   - `fuse-verify \u003c.vce\u003e` → returns pass/fail\n\n2. **Example Spec Files**\n   - SOC2 procedural check\n   - GDPR data residency verification\n   - Supply-chain provenance validation\n   - ML model usage constraint\n\n3. **Reference Implementation**\n   - Open-source, documented\n   - Production-ready with real cryptographic proofs\n\n## Technical Stack\n\n- **zkVM**: RISC Zero (Rust, CPU/GPU)\n- **Spec format**: JSON/YAML\n- **Envelope format**: `.vce` (JSON container with proof + metadata)\n- **Proof type**: ZK-SNARK / STARK\n\n## Roadmap\n\n| Phase | Timeline | Focus | Key Deliverables |\n|-------|----------|-------|------------------|\n| Phase 1 | ✅ Complete | zkVM integration \u0026 proof generation | Real RISC Zero proofs, CLI tools, core checkers |\n| Phase 2 | ✅ Complete | Testing \u0026 Reliability | Official C2PA fixtures, tamper detection, integration tests |\n| Phase 3 | ✅ Complete | Security Basics | Fuzzing, internal review, security audit readiness |\n| Phase 4 | Q4 2026 | Ecosystem expansion | Auditor tools, governance framework, enterprise features |\n\n## Specification\n\n**VCE Specification v0.1** is now published as an open standard:\n\n- **[VCE Specification v0.1](specs/VCE_SPECIFICATION_V0.1.md)** - Complete specification document\n- **[JSON Schemas](specs/schemas/)** - Validation schemas for `.vce` files and input specs\n- **[Specs Directory](specs/)** - Specification documentation and schemas\n\nThe VCE format is designed to be:\n- **Portable**: Works offline, no network dependency\n- **Verifiable**: Cryptographic verification without platform lock-in\n- **Standardized**: Open format, implementable by anyone\n- **Interoperable**: Works across platforms and languages\n\n## Documentation\n\n- [Quick Start Guide](docs/QUICKSTART.md) - Get started in minutes\n- [Architecture Documentation](docs/ARCHITECTURE.md) - Technical deep dive\n- [Testing Guide](docs/TESTING.md) - How to run tests and measure coverage\n- [Implementation Status](docs/IMPLEMENTATION_STATUS.md) - Current state and roadmap\n- [VCE Specification v0.1](specs/VCE_SPECIFICATION_V0.1.md) - Formal specification\n\n## Testing\n\nRun tests with:\n```bash\n# All tests (uses dev mode for speed)\nRISC0_DEV_MODE=1 cargo test --workspace\n\n# Or use Makefile\nmake test\n```\n\nMeasure coverage:\n```bash\nmake coverage\n```\n\nRun security checks:\n```bash\nmake audit          # Dependency vulnerability scan\nmake lint-security  # Security-focused clippy checks\n```\n\nSee [docs/TESTING.md](docs/TESTING.md) for detailed testing information.\n\n## Security\n\n**Status**: Pre-audit dev version (internal security review completed)\n\n- ✅ Dependency scanning (`cargo audit`)\n- ✅ Fuzzing infrastructure (5 targets)\n- ✅ Internal security review completed\n- ⏳ External audit pending\n\nSee [SECURITY.md](SECURITY.md) for security policy and [docs/SECURITY_REVIEW.md](docs/SECURITY_REVIEW.md) for detailed security analysis.\n\n**For Pilots**: Use \"Pre-audit dev version\" disclaimer until external audit completed.\n\n## License\n\nThis project is licensed under the Apache License 2.0. See [LICENSE](LICENSE) for details.\n\n\u003e **Note:** FUSE is a proof-of-verification infrastructure. Higher-level trust decisions belong to downstream systems.\n\n## Contributing\n\nWe welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on how to contribute to Project FUSE.\n\n## Note on Zero-Knowledge Proofs\n\n**Status**: ✅ **Complete** - RISC Zero zkVM integration is fully operational. The system generates real cryptographic proofs using RISC Zero 1.2.6. \n\n**Performance**: Real proof generation takes 10-20+ minutes depending on data size. For development and testing, use `RISC0_DEV_MODE=1` for instant proofs (not cryptographically secure).\n\n**Usage**: Once the guest program is built, `fuse-prove` automatically generates real zkVM proofs. The system maintains backward compatibility with placeholder proofs when the guest program is not available.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmikebrown0409%2Fproject-fuse","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmikebrown0409%2Fproject-fuse","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmikebrown0409%2Fproject-fuse/lists"}