GitDigital Solana · Open-source compliance layer for Real-World Assets, regulated DeFi, and identity-gated applications on Solana.
<script src="https://liberapay.com/GitDigital_liberapay/widgets/button.js"></script>
🔐 Cryptographic Verification Banners
Polar Checkout QR Verified · Autonomous Agent Economies (GitDigital-aligned)
| Layer | Pages |
|---|---|
| 🏛️ Core | Home · Ecosystem Overview · Governance Model · Tax-First Architecture · Contributor Authority |
| ⚙️ Enforcement | Compliance Registry · SAS / KYC · Transfer Hooks · TypeScript SDK |
| 💳 Marketplace & RWA | Tiered Role-Access Marketplace · Legal Agreements |
| 🧬 Privacy | Aurora ZK · Tokenless Models · ZK Identity & Registry · ZK Age & FHE |
| 📚 Docs & Standards | Documentation · Badge Catalog · Templates |
| 🧑💻 Authority | Authority Levels · Zero-Token Lead Teams |
GitDigital Solana is a Solana-native KYC/AML compliance stack that enforces identity, authority, and policy at the token level.
It combines:
- Token-2022 Transfer Hooks + Permanent Delegate
- Solana Attestation Service (SAS) for portable credentials
- A versioned Compliance Registry
- A Tiered Role-Access Marketplace
- Modern privacy primitives: tokenless models, ZK Identity, ZK Registry, ZK Age, and FHE
- Aurora ZK Cryptography Framework as the underlying cryptographic engine (Groth16, alt_bn128, Pedersen, ElGamal, Plonky2)
Designed for RWA issuers, regulated DeFi, identity-gated dApps, and autonomous agent economies.
Every transfer, role grant, and access decision is auditable, authority-scoped, and optionally zero-knowledge.
🏷️ Ecosystem · Architecture · Governance · Solana · RWA · Privacy
A multi-layer architecture built for clarity, continuous compliance, automation, and contributor safety.
Core principles
- Federated governance with dual-approval / multi-sig rules
- Tax-first and compliance-first separation of funds & identity
- Automated enforcement (Transfer Hook + Registry + SAS)
- Contributor-safe authority levels (including zero-token lead-team roles)
- Immutable audit trails
- Transparent and privacy-preserving paths
| Layer | Responsibility |
|---|---|
| 1. Governance | Authority levels, roles, dual-approval rules, policy |
| 2. Enforcement | Compliance Registry · Transfer Hooks · SAS · Permanent Delegate |
| 3. Marketplace & RWA | Tiered Role-Access Marketplace · Credit patterns · Legal Agreements |
| 4. Privacy | Tokenless models · ZK Identity / Registry / Age · FHE hybrid · Aurora ZK cryptographic engine |
| 5. Documentation | Templates · Wizard · Badge Catalog · Audit packets |
🏷️ Governance · Authority · Compliance · Audit
Ensures clear boundaries, dual-founder (or Squads multi-sig + time-lock) approvals, immutable audit trails, contributor safety, and tax-/compliance-first separation.
- Authority Levels — Owner · Manager · Contributor · Automation · Lead-Team (zero-token)
- Approval Rules — Privileged actions require dual approval or Squads multi-sig + time-lock; agreements require identity-verified signatures
- Enforcement — KYC/SAS Validator · Transfer Hook + Registry · Immutable logs
🏷️ Authority · Roles · Governance · Zero-Token
| Level | Description | Privileged Actions |
|---|---|---|
| 1. Owner | Full authority | Dual-approval required |
| 2. Manager | Operational authority, onboarding, workflow execution | Limited / approved |
| 3. Contributor | Task-level authority | None |
| 4. Automation | Transfer Hook, Registry, SAS Validator, API Gateway | System-enforced |
| 5. Lead-Team | Zero-token roles (Developer / Programmer / Designer) | Role-proof gated |
Lead-team roles can be exercised without holding any token:
- Access granted purely by valid SAS attestation or ZK role proof
- Roles stored in the Compliance Registry (or ZK Registry) with capability bitmasks
- Compatible with Squads time-locks
- Ideal for pure identity-gated dApps and account-abstraction flows
| Role | Typical Capabilities | Proof Required |
|---|---|---|
| Lead Developer | Deploy programs, update Transfer Hooks, manage Registry | Role + KYC + optional multi-sig |
| Lead Programmer | Circuits, risk engines, PRs | Role + KYC |
| Lead Designer | Marketplace UI, branding, gated content | Role + basic attestation |
🏷️ Tax · Compliance · Governance · Audit
Every workflow, repo, agreement, and ledger is designed to:
- Separate personal vs business finances & identity
- Maintain audit-ready documentation
- Enforce identity and authority
- Prevent accidental commingling
- Separation of Funds & Identity — No money or privileged action moves without documentation, approval, and Registry/ledger entry
- Immutable Records — All actions logged in Loaner Ledger patterns, Agreements, Workflow/Transfer Hook logs, and Compliance Registry events
- Automation Enforcement — System prevents unauthorized transfers, missing documentation, unverified identities, and policy violations
🏷️ Registry · On-Chain · Compliance · Authority
Canonical on-chain (or hybrid) directory of trusted KYC providers, wallet statuses & tiers, roles & capability bitmasks, jurisdiction policies, and versioned policy templates.
- PDA-based lookups for low-latency enforcement
- Versioned entries for auditability
- Supports both clear-text and ZK (commitment / Merkle-root) variants
- Single source of truth for Transfer Hooks, marketplaces, and zero-token gates
🏷️ KYC · Identity · Security · SAS
- Identity verification via real KYC providers
- Portable, reusable SAS credentials
- Signature / attestation validation
- Authority enforcement and sanctions screening
- Optional upgrade path to ZK credentials for selective disclosure
No workflow or transfer proceeds without a valid attestation.
🏷️ Automation · Token-2022 · Enforcement · Security
Continuous on-chain enforcement:
- Every transfer is intercepted and validated against the Compliance Registry or a ZK proof
- Permanent Delegate enables recovery / administrative controls (via Squads + time-lock)
- Freeze Authority for temporary locks
- DefaultAccountState for controlled account initialization
🏷️ Marketplace · Roles · Lending · Compliance
Listings, purchases, and role grants are gated by:
- Compliance Registry status
- Tier / role checks
- Optional zero-token proofs
- Polar MoR / verified checkout flows (QR-driven, tax-compliant, identity-gated)
Supports both token-gated and pure credential-gated (tokenless) experiences.
Polar Checkout QR Verified — Official cryptographic trust signal for autonomous commerce and verified payments.
Powered by the Aurora ZK Cryptography Framework — the cryptographic engine for zero-knowledge proofs, commitments, and on-chain verification on Solana.
Aurora provides the production-grade primitives this SDK relies on:
| Aurora Capability | Used by Compliance SDK for |
|---|---|
| Optimized Groth16 verifier (low CU) | On-chain verification of ZK Identity, ZK Registry membership, and ZK Age proofs |
| alt_bn128 + BLS12-381 field arithmetic | Core elliptic-curve operations for all proofs |
| Pedersen commitments & ElGamal | Confidential attributes, range proofs, selective disclosure |
| Plonky2 (experimental) | Future recursive / cheaper proofs |
| Token-2022 + ZK Compression compatibility | Native fit with Transfer Hooks and compressed state |
| Off-chain prover + on-chain notary pattern | Heavy math runs off-chain; lightweight attestation is recorded on-chain |
Aurora is treated as a first-class sister project. This SDK does not re-implement the same cryptographic primitives.
Access control without requiring any SPL / Token-2022 token. Users prove attributes (KYC status, age, jurisdiction, accreditation, role) via ZK credentials or SAS attestations.
- Portable zero-knowledge identity credentials with selective disclosure
- Merkle-root / commitment-based registry
- Users prove membership or policy satisfaction + nullifier without revealing clear-text status
- Proofs generated and verified via Aurora
- Circuits that prove age ≥ threshold (or range) without revealing date of birth
- Fully Homomorphic Encryption for computation on encrypted compliance data (risk scores, attributes) — hybrid off-chain FHE + on-chain ZK proof of correct computation (Aurora + FHE layer)
Compliance remains foundational whether the path is clear-text or zero-knowledge.
# Clone
git clone https://github.com/Gitdigital-products/solana-kyc-compliance-sdk.git
cd solana-kyc-compliance-sdk
# Build Rust program
cd programs/compliance_registry
cargo build-bpf
# Build TypeScript SDK
cd ../../sdk/typescript
npm install && npm run buildimport { ComplianceClient } from "@gitdigital/solana-kyc-sdk";
const client = new ComplianceClient({
connection,
registryProgramId,
});
// Check wallet status
const status = await client.getWalletStatus(wallet.publicKey);
if (!status.isCompliant) {
throw new Error("Wallet not registered or attestation expired");
}🏷️ Performance · Security · Polyglot · MLOps
On-chain programs stay in Rust + Anchor (Token-2022, Transfer Hooks, Registry).
Off-chain risk engines, FHE kernels, secure gateways, oracle adapters, and agent runtimes use the languages below for speed, safety, and lower operational cost.
| Language | Primary Strengths | How it helps this SDK |
|---|---|---|
| TypeScript | Ubiquitous Solana client ecosystem, strong typing, excellent DX | Primary client SDK, dApp front-ends, Registry/SAS orchestration, type-safe policy engines |
| Julia | Extreme numerical / scientific performance (LLVM), excellent for ML & Monte-Carlo | Off-chain AML risk engines, continuous scoring, portfolio/jurisdiction risk aggregation, scientific ZK parameter tuning |
| Mojo | Python-like ergonomics + C++/Rust-level speed, MLIR-based, SIMD/GPU targeting | High-throughput FHE kernels, confidential risk scoring, AI-augmented sanctions screening, deterministic financial compute |
| Ballerina | Cloud-native, integration-first, first-class security (mTLS, JWT, OAuth2) | Secure API gateways between KYC providers ↔ SAS ↔ Compliance Registry, Travel-Rule messaging, oracle ingestion |
| V | Extremely fast compilation & runtime, memory-safe by default, tiny binaries | Fast off-chain verifiers, lightweight client-side tooling, high-frequency status polling against the Registry |
| Zig | Manual memory control + strong safety, excellent C interop, no hidden control flow | Low-level FHE primitives, BPF-adjacent tooling, high-assurance crypto helpers, performance-critical side services |
| Nim | Python-like productivity + C-level performance, powerful metaprogramming | Rapid development of secure services, policy engines, oracle adapters, internal tooling |
| Crystal | Ruby-like syntax with static typing and high performance, built-in concurrency | Rapid development of secure microservices, internal admin tools, and lightweight compliance helpers |
| Kotlin | Strong static typing, null safety, coroutines, excellent JVM interop | Secure microservices, enterprise KYC/AML integration, concurrent Registry/oracle handling, multiplatform wallet logic |
| OCaml / Reason | Extremely strong static type system, excellent for formal reasoning and high-assurance code | High-assurance compliance logic, policy decision points, formal verification of critical off-chain components, audit-friendly modules |
| F# | Discriminated unions, immutable records, active patterns, strong .NET interop | Compliance domain modeling (“illegal states unrepresentable”), KYC/AML decision logic, audit-friendly event sourcing, enterprise .NET integration |
| Carbon (experimental) | C++ successor with better safety & modern generics | Future systems-level components that interoperate with existing C/C++ crypto or FHE libraries |
Guidance
- Keep on-chain code in Rust + Anchor.
- Use TypeScript as the primary client and orchestration language.
- Use Aurora ZK for all zero-knowledge proof generation and on-chain verification primitives.
- Prefer the languages above for off-chain risk engines, FHE nodes, secure gateways, and high-assurance modules.
- Languages that reduce attack surface (Ballerina’s built-in security, V/Zig immutability & bounds checks, Mojo ownership, OCaml/F# strong type systems) and lower cost (faster runtimes → fewer machines) are preferred.
- A top-level Makefile unifies polyglot builds (Rust + TS + Julia/Mojo/Zig/Crystal/Kotlin/OCaml/F#/etc.).
These languages make the compliance engines, risk scoring, FHE computations, and autonomous agent loops faster, cheaper, and more secure.
Language-specific interop lives inside the main repository for now (clean extraction into dedicated repos later if needed):
lang/
├── julia/ # AML risk engines, Monte-Carlo scoring, ZK parameter tuning
├── mojo/ # FHE kernels, confidential risk scoring, sanctions screening
├── v/ # Fast off-chain verifiers, lightweight tooling
├── zig/ # Low-level FHE primitives, high-assurance crypto helpers
├── ballerina/ # Secure API gateways, Travel-Rule, oracle ingestion
├── nim/ # Policy engines, oracle adapters, internal services
├── crystal/ # Secure microservices, admin tools, lightweight compliance helpers
├── kotlin/ # Secure microservices, enterprise KYC/AML integration
├── ocaml/ # High-assurance compliance logic, formal verification, audit-friendly modules
├── fsharp/ # Compliance domain modeling, KYC/AML decision logic, event sourcing
└── README.md # Interop contracts, FFI/gRPC boundaries, build notes
Each language folder will contain:
- Thin interop wrappers (calling the core Registry / SAS / Transfer Hook surface)
- Minimal examples
- Build instructions
- Clear interface documentation
This keeps the core focused while making the polyglot surface easy to discover and later extract.
🏷️ Agreements · Identity · Compliance
All agreements are:
- Legally binding
- Identity-verified (SAS or ZK)
- Signature-required
- Immutable
Types
- Founder / Loan Agreements — dual-signature, KYC-verified
- Contributor Agreements — role-based, authority-scoped
- Operational / Marketplace Agreements — workflow-generated
All programs and clients return structured, human-readable errors. Never emit bare numeric codes.
| Code | Meaning |
|---|---|
NOT_REGISTERED |
Wallet not in Compliance Registry |
MISSING_OR_EXPIRED_KYC |
Attestation missing or expired |
SANCTIONED |
Wallet on restricted list |
MISSING_LEAD_ROLE |
Required lead-team role not present |
ZERO_TOKEN_ROLE_PROOF_FAILED |
Zero-token role proof failed |
INVALID_ZK_PROOF |
ZK verification or nullifier failure |
UNDER_AGE |
Age circuit failed |
POLICY_VIOLATION |
Transfer Hook rejected |
MULTISIG_REQUIRED |
Privileged action needs Squads + time-lock |
FHE_ERROR |
FHE ciphertext or key issue |
🏷️ Docs · Templates · Standards
- Documentation Wizard — automates README generation, agreement templates, ledger/Registry patterns, onboarding docs, and badge walls
- Templates Library — reusable modules for agreements, READMEs, workflows, and contributor onboarding
- Badge Catalog — official GitDigital Solana badges across Governance, Automation, Lending/RWA, Documentation, Privacy, Solana Signals, and Readiness
- Aurora ZK Cryptography Framework — Core cryptographic engine (Groth16, alt_bn128, Pedersen, ElGamal, Plonky2)
- Compliance Registry Design
- Tiered Marketplace
- Privacy / ZK / FHE
- Zero-Token Lead Teams
- Solana Ecosystem Submission
- Demo Design
- ZK Identity Architecture
| Category | Examples |
|---|---|
| Governance | Governance · Authority · Compliance |
| Enforcement | Registry · Transfer Hook · SAS · KYC |
| Marketplace / RWA | Credit Authority · Loaner Ledger · Marketplace |
| Privacy | ZK · FHE · Tokenless · Selective Disclosure · Aurora ZK |
| Documentation | Docs · Templates · Wizard · Badge Catalog |
| Solana Signals | Solana Aligned · Grant Candidate · Security Ready |
| Readiness | Sponsor Ready · DD Ready · Enterprise Ready |
<script src="https://liberapay.com/GitDigital_liberapay/widgets/button.js"></script>
Author & Code Owner: Rickcreator87 (@Rickcreator87)
Licensed under the MIT License.
See LICENSE, CODEOWNERS, and AUTHORS.md.
- The scoring rubric (don't improvise this)
"Completion" is meaningless unless it's defined. Use six measurable signals per repo. Each is binary or countable — no vibes.
Signal Weight How to check Has description 5% gh repo view --json description Has topics/tags 5% gh repo view --json repositoryTopics Has LICENSE 10% file exists Has README > 500 bytes 10% file size Has tests (any test dir/files) 15% tests/, .test., _test.go, etc. Has CI (.github/workflows/) 15% file exists Commits in last 90 days 20% gh api commit history Has release/tag OR deployed artifact 20% gh release list or program ID
Total = 100%. That gives you a number you can defend, not a guess.
Maturity tier (map score → label):
· 0–24 → Concept · 25–49 → Prototype · 50–74 → Active · 75–89 → Production-Ready · 90–100 → Mainnet / Shipped
- Progress bar formats that render on GitHub
GitHub strips HTML in most contexts. Three options that actually work:
Option A — Unicode blocks (works everywhere, no external service):
████████████████░░░░ 80%
████████░░░░░░░░░░░░ 40%
Option B — Shields.io dynamic badge (cleanest, auto-updates):
Color thresholds: brightgreen ≥90, green ≥75, yellow ≥50, orange ≥25, red <25.
Option C — Shields.io dynamic JSON endpoint (pulls live from a JSON file you host):
This is the right long-term answer — the script writes JSON, the badge reads it, everything stays in sync.
- The scanner script
Save as scripts/scan-org.sh. Requires gh CLI authenticated with org read access.
#!/usr/bin/env bash
set -euo pipefail
ORG="GitDigital-Solana"
OUT="status"
mkdir -p "$OUT"
repos=$(gh repo list "$ORG" --limit 200 --json name,description,repositoryTopics,isArchived,pushedAt,licenseInfo,primaryLanguage)
echo "$repos" | jq -c '.[]' | while read -r repo; do
name=$(echo "$repo" | jq -r .name)
archived=$(echo "$repo" | jq -r .isArchived)
pushed=$(echo "$repo" | jq -r .pushedAt)
desc=$(echo "$repo" | jq -r '.description // ""')
topics=$(echo "$repo" | jq -r '.repositoryTopics | length')
license=$(echo "$repo" | jq -r '.licenseInfo.spdxId // ""')
lang=$(echo "$repo" | jq -r '.primaryLanguage.name // ""')
score=0
# 5% — description
[ -n "$desc" ] && [ "$desc" != "null" ] && score=$((score+5))
# 5% — topics
[ "$topics" -gt 0 ] && score=$((score+5))
# 10% — license
[ -n "$license" ] && [ "$license" != "null" ] && score=$((score+10))
# 10% — README > 500 bytes
readme_size=$(gh api "repos/$ORG/$name/contents/README.md" --jq '.size' 2>/dev/null || echo 0)
[ "$readme_size" -gt 500 ] && score=$((score+10))
# 15% — tests dir/file present
has_tests=$(gh api "repos/$ORG/$name/contents" --jq '.[].name' 2>/dev/null | grep -iE '^(tests?|spec)$|test|spec' | head -1 || true)
[ -n "$has_tests" ] && score=$((score+15))
# 15% — CI workflows
ci=$(gh api "repos/$ORG/$name/contents/.github/workflows" --jq 'length' 2>/dev/null || echo 0)
[ "$ci" -gt 0 ] && score=$((score+15))
# 20% — commit in last 90 days
if [ "$pushed" != "null" ]; then
days=$(( ( $(date +%s) - $(date -d "$pushed" +%s) ) / 86400 ))
[ "$days" -le 90 ] && score=$((score+20))
fi
# 20% — has a release or tag
rels=$(gh release list -R "$ORG/$name" --limit 1 --json tagName 2>/dev/null | jq 'length' || echo 0)
[ "$rels" -gt 0 ] && score=$((score+20))
# Status tier
if [ "$score" -ge 90 ]; then tier="Mainnet"; color="brightgreen"
elif [ "$score" -ge 75 ]; then tier="Production-Ready"; color="green"
elif [ "$score" -ge 50 ]; then tier="Active"; color="yellow"
elif [ "$score" -ge 25 ]; then tier="Prototype"; color="orange"
else tier="Concept"; color="red"
fi
# Build unicode bar (20 blocks)
filled=$(( score / 5 ))
empty=$(( 20 - filled ))
bar="$(printf '█%.0s' $(seq 1 $filled 2>/dev/null))$(printf '░%.0s' $(seq 1 $empty 2>/dev/null))"
# Write JSON for live shield
jq -n \
--arg schemaVersion 1 --arg label "completion" \
--arg message "${score}% · ${tier}" --arg color "$color" \
'{schemaVersion:1,label:"completion",message:$message,color:$color}' \
> "$OUT/$name.json"
# Emit a markdown row
echo "| [\`$name\`](https://github.com/$ORG/$name) | $lang | \`$bar\` | **$score%** | $tier |"
done > "$OUT/report.md"
echo "Done. See $OUT/report.md and $OUT/*.json"Run it, commit status/ to your .github repo, and you have both a static report and live badges.
- The org profile README with progress bars
Drop this into GitDigital-Solana/.github/profile/README.md. Replace the repo rows with the actual output of the script.
# GitDigital Solana
Open-source compliance, ZK, and RWA infrastructure for Solana.
**87 repos · X active · Y production-ready** · [Full status report →](status/report.md)
---
## ⭐ Flagship
| Repo | Lang | Progress | Score | Status |
|------|------|----------|-------|--------|
| [`solana-kyc-compliance-sdk`](https://github.com/GitDigital-Solana/solana-kyc-compliance-sdk) | Rust + TS | `████████████████░░░░` | **80%** | Production-Ready |
| [`Aurora-zk-cryptography-framework`](https://github.com/GitDigital-Solana/Aurora-zk-cryptography-framework) | Rust | `██████████████░░░░░░` | **70%** | Active |
| [`zk-Identity-masks`](https://github.com/GitDigital-Solana/zk-Identity-masks) | Zig + Mojo + TS | `██████████░░░░░░░░░░` | **50%** | Active |
---
## 📊 By Tier
### 🟢 Production-Ready (75–89)
<!-- generated rows here -->
### 🟡 Active (50–74)
<!-- generated rows here -->
### 🟠 Prototype (25–49)
<!-- generated rows here -->
### 🔴 Concept (0–24)
<!-- generated rows here -->
### ⚫ Archived
<!-- generated rows here -->
---
## 🚦 Live Status
Each repo publishes a live completion badge:

Full methodology: docs/completion-rubric.md
---
## 5. Per-repo README block
Add this near the top of each repo's README, generated per-repo:




**Completion:** `████████████████░░░░` 80% · **Tier:** Production-Ready
<details>
<summary>How this score is calculated</summary>
| Signal | Weight | Status |
|--------|--------|--------|
| Description | 5% | ✅ |
| Topics | 5% | ✅ |
| LICENSE | 10% | ✅ |
| README > 500B | 10% | ✅ |
| Tests | 15% | ✅ |
| CI workflows | 15% | ✅ |
| Commit < 90d | 20% | ✅ |
| Release/tag | 20% | ❌ |
</details>- Why this is the right approach
· It's honest. Anyone can read the rubric and reproduce the number. No self-awarded "Enterprise Ready" badges. · It auto-updates. The script re-runs, JSON changes, shields.io re-renders. No manual maintenance. · It forces prioritization. When you see ████░░░░░░░░░░░░░░░░ on a repo you thought was done, you know what to fix. · It scales to 87 repos. A human can't track 87 repos honestly. A script can. · It kills the "Sponsor Ready / DD Ready" problem. You replace unearned marketing labels with computed status. Reviewers trust that.
GitDigital Solana — Compliance that lives on-chain.
Transparent when you need it. Zero-knowledge when you require it.
GitDigital Solana · Open-source compliance layer for Real-World Assets, regulated DeFi, and identity-gated applications on Solana.
<script src="https://liberapay.com/GitDigital_liberapay/widgets/button.js"></script>
🔐 Cryptographic Verification Banners
Polar Checkout QR Verified · Autonomous Agent Economies (GitDigital-aligned)
| Layer | Pages |
|---|---|
| 🏛️ Core | Home · Ecosystem Overview · Governance Model · Tax-First Architecture · Contributor Authority |
| ⚙️ Enforcement | Compliance Registry · SAS / KYC · Transfer Hooks · TypeScript SDK |
| 💳 Marketplace & RWA | Tiered Role-Access Marketplace · Legal Agreements |
| 🧬 Privacy | Aurora ZK · Tokenless Models · ZK Identity & Registry · ZK Age & FHE |
| 📚 Docs & Standards | Documentation · Badge Catalog · Templates |
| 🧑💻 Authority | Authority Levels · Zero-Token Lead Teams |
GitDigital Solana is a Solana-native KYC/AML compliance stack that enforces identity, authority, and policy at the token level.
It combines:
- Token-2022 Transfer Hooks + Permanent Delegate
- Solana Attestation Service (SAS) for portable credentials
- A versioned Compliance Registry
- A Tiered Role-Access Marketplace
- Modern privacy primitives: tokenless models, ZK Identity, ZK Registry, ZK Age, and FHE
- Aurora ZK Cryptography Framework as the underlying cryptographic engine (Groth16, alt_bn128, Pedersen, ElGamal, Plonky2)
Designed for RWA issuers, regulated DeFi, identity-gated dApps, and autonomous agent economies.
Every transfer, role grant, and access decision is auditable, authority-scoped, and optionally zero-knowledge.
🏷️ Ecosystem · Architecture · Governance · Solana · RWA · Privacy
A multi-layer architecture built for clarity, continuous compliance, automation, and contributor safety.
Core principles
- Federated governance with dual-approval / multi-sig rules
- Tax-first and compliance-first separation of funds & identity
- Automated enforcement (Transfer Hook + Registry + SAS)
- Contributor-safe authority levels (including zero-token lead-team roles)
- Immutable audit trails
- Transparent and privacy-preserving paths
| Layer | Responsibility |
|---|---|
| 1. Governance | Authority levels, roles, dual-approval rules, policy |
| 2. Enforcement | Compliance Registry · Transfer Hooks · SAS · Permanent Delegate |
| 3. Marketplace & RWA | Tiered Role-Access Marketplace · Credit patterns · Legal Agreements |
| 4. Privacy | Tokenless models · ZK Identity / Registry / Age · FHE hybrid · Aurora ZK cryptographic engine |
| 5. Documentation | Templates · Wizard · Badge Catalog · Audit packets |
🏷️ Governance · Authority · Compliance · Audit
Ensures clear boundaries, dual-founder (or Squads multi-sig + time-lock) approvals, immutable audit trails, contributor safety, and tax-/compliance-first separation.
- Authority Levels — Owner · Manager · Contributor · Automation · Lead-Team (zero-token)
- Approval Rules — Privileged actions require dual approval or Squads multi-sig + time-lock; agreements require identity-verified signatures
- Enforcement — KYC/SAS Validator · Transfer Hook + Registry · Immutable logs
🏷️ Authority · Roles · Governance · Zero-Token
| Level | Description | Privileged Actions |
|---|---|---|
| 1. Owner | Full authority | Dual-approval required |
| 2. Manager | Operational authority, onboarding, workflow execution | Limited / approved |
| 3. Contributor | Task-level authority | None |
| 4. Automation | Transfer Hook, Registry, SAS Validator, API Gateway | System-enforced |
| 5. Lead-Team | Zero-token roles (Developer / Programmer / Designer) | Role-proof gated |
Lead-team roles can be exercised without holding any token:
- Access granted purely by valid SAS attestation or ZK role proof
- Roles stored in the Compliance Registry (or ZK Registry) with capability bitmasks
- Compatible with Squads time-locks
- Ideal for pure identity-gated dApps and account-abstraction flows
| Role | Typical Capabilities | Proof Required |
|---|---|---|
| Lead Developer | Deploy programs, update Transfer Hooks, manage Registry | Role + KYC + optional multi-sig |
| Lead Programmer | Circuits, risk engines, PRs | Role + KYC |
| Lead Designer | Marketplace UI, branding, gated content | Role + basic attestation |
🏷️ Tax · Compliance · Governance · Audit
Every workflow, repo, agreement, and ledger is designed to:
- Separate personal vs business finances & identity
- Maintain audit-ready documentation
- Enforce identity and authority
- Prevent accidental commingling
- Separation of Funds & Identity — No money or privileged action moves without documentation, approval, and Registry/ledger entry
- Immutable Records — All actions logged in Loaner Ledger patterns, Agreements, Workflow/Transfer Hook logs, and Compliance Registry events
- Automation Enforcement — System prevents unauthorized transfers, missing documentation, unverified identities, and policy violations
🏷️ Registry · On-Chain · Compliance · Authority
Canonical on-chain (or hybrid) directory of trusted KYC providers, wallet statuses & tiers, roles & capability bitmasks, jurisdiction policies, and versioned policy templates.
- PDA-based lookups for low-latency enforcement
- Versioned entries for auditability
- Supports both clear-text and ZK (commitment / Merkle-root) variants
- Single source of truth for Transfer Hooks, marketplaces, and zero-token gates
🏷️ KYC · Identity · Security · SAS
- Identity verification via real KYC providers
- Portable, reusable SAS credentials
- Signature / attestation validation
- Authority enforcement and sanctions screening
- Optional upgrade path to ZK credentials for selective disclosure
No workflow or transfer proceeds without a valid attestation.
🏷️ Automation · Token-2022 · Enforcement · Security
Continuous on-chain enforcement:
- Every transfer is intercepted and validated against the Compliance Registry or a ZK proof
- Permanent Delegate enables recovery / administrative controls (via Squads + time-lock)
- Freeze Authority for temporary locks
- DefaultAccountState for controlled account initialization
🏷️ Marketplace · Roles · Lending · Compliance
Listings, purchases, and role grants are gated by:
- Compliance Registry status
- Tier / role checks
- Optional zero-token proofs
- Polar MoR / verified checkout flows (QR-driven, tax-compliant, identity-gated)
Supports both token-gated and pure credential-gated (tokenless) experiences.
Polar Checkout QR Verified — Official cryptographic trust signal for autonomous commerce and verified payments.
Powered by the Aurora ZK Cryptography Framework — the cryptographic engine for zero-knowledge proofs, commitments, and on-chain verification on Solana.
Aurora provides the production-grade primitives this SDK relies on:
| Aurora Capability | Used by Compliance SDK for |
|---|---|
| Optimized Groth16 verifier (low CU) | On-chain verification of ZK Identity, ZK Registry membership, and ZK Age proofs |
| alt_bn128 + BLS12-381 field arithmetic | Core elliptic-curve operations for all proofs |
| Pedersen commitments & ElGamal | Confidential attributes, range proofs, selective disclosure |
| Plonky2 (experimental) | Future recursive / cheaper proofs |
| Token-2022 + ZK Compression compatibility | Native fit with Transfer Hooks and compressed state |
| Off-chain prover + on-chain notary pattern | Heavy math runs off-chain; lightweight attestation is recorded on-chain |
Aurora is treated as a first-class sister project. This SDK does not re-implement the same cryptographic primitives.
Access control without requiring any SPL / Token-2022 token. Users prove attributes (KYC status, age, jurisdiction, accreditation, role) via ZK credentials or SAS attestations.
- Portable zero-knowledge identity credentials with selective disclosure
- Merkle-root / commitment-based registry
- Users prove membership or policy satisfaction + nullifier without revealing clear-text status
- Proofs generated and verified via Aurora
- Circuits that prove age ≥ threshold (or range) without revealing date of birth
- Fully Homomorphic Encryption for computation on encrypted compliance data (risk scores, attributes) — hybrid off-chain FHE + on-chain ZK proof of correct computation (Aurora + FHE layer)
Compliance remains foundational whether the path is clear-text or zero-knowledge.
# Clone
git clone https://github.com/Gitdigital-products/solana-kyc-compliance-sdk.git
cd solana-kyc-compliance-sdk
# Build Rust program
cd programs/compliance_registry
cargo build-bpf
# Build TypeScript SDK
cd ../../sdk/typescript
npm install && npm run buildimport { ComplianceClient } from "@gitdigital/solana-kyc-sdk";
const client = new ComplianceClient({
connection,
registryProgramId,
});
// Check wallet status
const status = await client.getWalletStatus(wallet.publicKey);
if (!status.isCompliant) {
throw new Error("Wallet not registered or attestation expired");
}🏷️ Performance · Security · Polyglot · MLOps
On-chain programs stay in Rust + Anchor (Token-2022, Transfer Hooks, Registry).
Off-chain risk engines, FHE kernels, secure gateways, oracle adapters, and agent runtimes use the languages below for speed, safety, and lower operational cost.
| Language | Primary Strengths | How it helps this SDK |
|---|---|---|
| TypeScript | Ubiquitous Solana client ecosystem, strong typing, excellent DX | Primary client SDK, dApp front-ends, Registry/SAS orchestration, type-safe policy engines |
| Julia | Extreme numerical / scientific performance (LLVM), excellent for ML & Monte-Carlo | Off-chain AML risk engines, continuous scoring, portfolio/jurisdiction risk aggregation, scientific ZK parameter tuning |
| Mojo | Python-like ergonomics + C++/Rust-level speed, MLIR-based, SIMD/GPU targeting | High-throughput FHE kernels, confidential risk scoring, AI-augmented sanctions screening, deterministic financial compute |
| Ballerina | Cloud-native, integration-first, first-class security (mTLS, JWT, OAuth2) | Secure API gateways between KYC providers ↔ SAS ↔ Compliance Registry, Travel-Rule messaging, oracle ingestion |
| V | Extremely fast compilation & runtime, memory-safe by default, tiny binaries | Fast off-chain verifiers, lightweight client-side tooling, high-frequency status polling against the Registry |
| Zig | Manual memory control + strong safety, excellent C interop, no hidden control flow | Low-level FHE primitives, BPF-adjacent tooling, high-assurance crypto helpers, performance-critical side services |
| Nim | Python-like productivity + C-level performance, powerful metaprogramming | Rapid development of secure services, policy engines, oracle adapters, internal tooling |
| Kotlin | Strong static typing, null safety, coroutines, excellent JVM interop | Secure microservices, enterprise KYC/AML integration, concurrent Registry/oracle handling, multiplatform wallet logic |
| Carbon (experimental) | C++ successor with better safety & modern generics | Future systems-level components that interoperate with existing C/C++ crypto or FHE libraries |
Guidance
- Keep on-chain code in Rust + Anchor.
- Use TypeScript as the primary client and orchestration language.
- Use Aurora ZK for all zero-knowledge proof generation and on-chain verification primitives.
- Prefer the languages above for off-chain risk engines, FHE nodes, secure gateways, and high-assurance modules.
- Languages that reduce attack surface (Ballerina’s built-in security, V/Zig immutability & bounds checks, Mojo ownership) and lower cost (faster runtimes → fewer machines) are preferred.
- A top-level Makefile unifies polyglot builds (Rust + TS + Julia/Mojo/Zig/Kotlin/etc.).
These languages make the compliance engines, risk scoring, FHE computations, and autonomous agent loops faster, cheaper, and more secure.
Language-specific interop lives inside the main repository for now (clean extraction into dedicated repos later if needed):
lang/
├── julia/ # AML risk engines, Monte-Carlo scoring, ZK parameter tuning
├── mojo/ # FHE kernels, confidential risk scoring, sanctions screening
├── v/ # Fast off-chain verifiers, lightweight tooling
├── zig/ # Low-level FHE primitives, high-assurance crypto helpers
├── ballerina/ # Secure API gateways, Travel-Rule, oracle ingestion
├── nim/ # Policy engines, oracle adapters, internal services
├── kotlin/ # Secure microservices, enterprise KYC/AML integration
└── README.md # Interop contracts, FFI/gRPC boundaries, build notes
Each language folder will contain:
- Thin interop wrappers (calling the core Registry / SAS / Transfer Hook surface)
- Minimal examples
- Build instructions
- Clear interface documentation
This keeps the core focused while making the polyglot surface easy to discover and later extract.
🏷️ Agreements · Identity · Compliance
All agreements are:
- Legally binding
- Identity-verified (SAS or ZK)
- Signature-required
- Immutable
Types
- Founder / Loan Agreements — dual-signature, KYC-verified
- Contributor Agreements — role-based, authority-scoped
- Operational / Marketplace Agreements — workflow-generated
All programs and clients return structured, human-readable errors. Never emit bare numeric codes.
| Code | Meaning |
|---|---|
NOT_REGISTERED |
Wallet not in Compliance Registry |
MISSING_OR_EXPIRED_KYC |
Attestation missing or expired |
SANCTIONED |
Wallet on restricted list |
MISSING_LEAD_ROLE |
Required lead-team role not present |
ZERO_TOKEN_ROLE_PROOF_FAILED |
Zero-token role proof failed |
INVALID_ZK_PROOF |
ZK verification or nullifier failure |
UNDER_AGE |
Age circuit failed |
POLICY_VIOLATION |
Transfer Hook rejected |
MULTISIG_REQUIRED |
Privileged action needs Squads + time-lock |
FHE_ERROR |
FHE ciphertext or key issue |
🏷️ Docs · Templates · Standards
- Documentation Wizard — automates README generation, agreement templates, ledger/Registry patterns, onboarding docs, and badge walls
- Templates Library — reusable modules for agreements, READMEs, workflows, and contributor onboarding
- Badge Catalog — official GitDigital Solana badges across Governance, Automation, Lending/RWA, Documentation, Privacy, Solana Signals, and Readiness
- Aurora ZK Cryptography Framework — Core cryptographic engine (Groth16, alt_bn128, Pedersen, ElGamal, Plonky2)
- Compliance Registry Design
- Tiered Marketplace
- Privacy / ZK / FHE
- Zero-Token Lead Teams
- Solana Ecosystem Submission
- Demo Design
- ZK Identity Architecture
| Category | Examples |
|---|---|
| Governance | Governance · Authority · Compliance |
| Enforcement | Registry · Transfer Hook · SAS · KYC |
| Marketplace / RWA | Credit Authority · Loaner Ledger · Marketplace |
| Privacy | ZK · FHE · Tokenless · Selective Disclosure · Aurora ZK |
| Documentation | Docs · Templates · Wizard · Badge Catalog |
| Solana Signals | Solana Aligned · Grant Candidate · Security Ready |
| Readiness | Sponsor Ready · DD Ready · Enterprise Ready |
<script src="https://liberapay.com/GitDigital_liberapay/widgets/button.js"></script>
Author & Code Owner: Rickcreator87 (@Rickcreator87)
Licensed under the MIT License.
See LICENSE, CODEOWNERS, and AUTHORS.md.
GitDigital Solana — Compliance that lives on-chain.
Transparent when you need it. Zero-knowledge when you require it.

