ConflictZero

• 

  Home Page

Inspiration

Professional firms need to show that conflict controls were followed, but ordinary audit evidence can expose the confidential clients, counterparties, and matters the control is meant to protect. ConflictZero explores a different model: produce portable proof that a check cleared without revealing the private relationship registry behind it.

What it does

A firm privately commits a fixed-size registry of organization identifiers, then checks the confirmed parties for a proposed engagement against that registry. When the sets are disjoint, ConflictZero creates a replay-protected clearance receipt that can be independently verified. When an exact identifier matches, the check stops locally: no public failure record and no matching relationship are revealed.

The claim is intentionally narrow. ConflictZero proves exact-identifier set disjointness for the supplied, committed inputs at one registry version. It does not claim to prove registry completeness, resolve aliases or corporate families, or replace legal review.

How we built it

We built a responsive React workspace and independent receipt verifier around a browser-compatible deterministic privacy core. The core canonicalizes confirmed organizations, pads inputs to fixed capacities, creates deterministic external audit digests, and uses golden vectors for reproducibility.

The Midnight Compact contract performs private eight-by-four set-disjointness checks. It uses generated Compact entity fingerprints and typed commitments, rotates registries with monotonic versions, and records a public receipt only after a successful check. The receipt is bound to the firm, deployment, registry version, engagement digest, proposal commitment, and one-time nonce to prevent replay.

For judge reliability, the UI includes a clearly labelled deterministic demo provider that follows the same success/failure semantics. The repository also includes the compiled Compact contract, generated bindings, adapter boundary, protocol model tests, and a threat model. It does not present the demo provider as a live network transaction.

Challenges and lessons

The hard part was being precise about privacy claims. We designed failure as private by default, avoided publishing per-entry fingerprints, used fixed-capacity inputs rather than variable-size disclosures, and documented the limits of exact matching. The result is a focused prototype for selective, privacy-preserving evidence: prove the control worked without exposing the relationships behind it.

Built With

• typescript