Local CLI and JSON

Evaluate compatibility before you buy.

The Community engine and doctor are the evaluation path. Guard adds local supervision around the same versioned engine and public file contracts.

Run the doctor Browse source

Release status: the current repository exposes the Community Plonky3 doctor. The unified tinyzkp Guard commands below are the stable v1 contract but are not presented as downloadable production artifacts until the release gate passes.

Free Community doctor

Clone the MIT repository on a supported Rust development host, prepare a resource policy or workload manifest, and run:

cargo run -p hc-cli -- plonky3 doctor \
  --policy examples/plonky3/resource-policy.local.json

For a workload-specific check, use --manifest instead of --policy. Treat the report as potentially sensitive operational metadata; inspect it before sharing and never attach witness data, secrets, or license keys.

Guard v1 commands

Command	Purpose
`tinyzkp activate --license-key-stdin`	Validate a current subscription once and write an owner-only, exact-release entitlement.
`tinyzkp compatibility check --job job.json`	Validate the complete supported profile without proving.
`tinyzkp doctor --job job.json`	Check compatibility, paths, RAM, scratch, and planned mode.
`tinyzkp run --job job.json`	Run locally using auto, conventional, or bounded mode.
`tinyzkp resume --job-dir ./job`	Resume an exact-release-bound interrupted job.
`tinyzkp verify --bundle proof.json`	Verify through the released ordinary verification path.
`tinyzkp policy check --report run.json --baseline baseline.json`	Fail CI on a declared resource regression using PolicyBaselineV1.
`tinyzkp license status --json`	Inspect local entitlement state without contacting the merchant.
`tinyzkp version --json`	Print Guard, engine, schema, and compatibility identities.

Job contract

JobManifestV1 describes workload inputs, mode, RAM budget, scratch budget, job directory, and output directory. Paths are resolved under declared roots. Traversal, symlinks, devices, unknown fields, oversized inputs, and incompatible releases fail closed.

{
  "schema_version": 1,
  "compatibility_profile": "tinyzkp-p3-goldilocks-v1",
  "mode": "auto",
  "ram_budget_bytes": 2147483648,
  "scratch_budget_bytes": 107374182400,
  "max_threads": 8,
  "roots": {
    "input_root": "inputs",
    "job_root": "jobs",
    "output_root": "outputs",
    "scratch_root": "scratch"
  },
  "job_dir": "job-001",
  "output_dir": "job-001",
  "scratch_dir": "job-001",
  "workload": {
    "air_package": "air-package-v1.json",
    "trace_manifest": "trace-manifest-v1.json",
    "chunks_dir": "chunks",
    "public_inputs": "public-inputs-v1.json",
    "logical_rows": 1048576,
    "trace_width": 8,
    "max_constraint_degree": 3,
    "field": "goldilocks",
    "extension_degree": 2,
    "permutation": "poseidon2_width_8",
    "verifier": "p3_uni_stark_0.6.1",
    "features": {
      "uses_lookups": false,
      "uses_buses": false,
      "uses_permutations": false,
      "uses_multi_table": false,
      "uses_preprocessed_columns": false,
      "uses_periodic_columns": false,
      "uses_recursion": false,
      "uses_gpu": false
    }
  }
}

This example is illustrative until the released schema is signed. Always validate against the published JSON Schema bundled with the exact release.

Output and exit behavior

Standard output contains one JobResultV1 JSON document. Standard error contains JSON Lines progress. Stable exit classes distinguish incompatible profile, invalid input, insufficient resources, resumable interruption, corrupt checkpoint, verification failure, license failure, and internal error.

Thin GitHub Action

The public composite action runs the same local commands and never receives or activates a license key. Point it at an already installed, activated Guard binary to run the free doctor, optionally produce a proof report, and enforce a policy baseline. There is no separate CI API or hosted execution path.

Container posture

The released OCI image runs as non-root, supports a read-only root filesystem, and requires explicit /work and /scratch mounts. After release activation, proving, resume, and verification must work with networking disabled.

Updates and checkpoints

Never delete an old release while it owns an unfinished job. A newer release must not consume an older checkpoint silently. Keep the exact artifact, signature, compatibility manifest, and entitlement alongside resumable work until verification completes.

Support-safe diagnostics

The versioned JSON output from tinyzkp doctor is the only support-safe diagnostic artifact. It contains compatibility and resource metadata, not manifest paths or input contents. Inspect it before sharing and confirm it contains no witness values, input files, proof secrets, environment variables, absolute private paths, access tokens, or license key. See support boundaries.