verify confidential per-asset conservation

2 files changed, 25 insertions, 0 deletions

diff --git a/docs/MONZERO_ASSETS_V1_SPEC.md b/docs/MONZERO_ASSETS_V1_SPEC.md
index 73bd27790..55d1391ef 100644
--- a/docs/MONZERO_ASSETS_V1_SPEC.md
+++ b/docs/MONZERO_ASSETS_V1_SPEC.md
@@ -252,6 +252,29 @@ properties remain prerequisites for an isolated prototype network. The
 transparent statement must never be mistaken for a production transaction
 design.
 
+### 6.2 Inactive confidential conservation prototype
+
+The source tree now contains an inactive per-asset Pedersen-commitment and
+Bulletproof+ verifier. It reuses the inherited RingCT curve and range-proof
+implementation, requires exact proof coverage of every output and explicit
+burn commitment, and checks that pseudo inputs equal outputs plus burns inside
+each public asset-ID domain. Fixed-supply issuance uses a zero-mask commitment
+to the descriptor's public lifetime supply. Limits currently cap each balance
+group at 16 pseudo inputs and 16 destinations.
+
+Adversarial tests reject inflation, substituted commitments, malformed range
+proofs, duplicate asset groups, unknown assets, cross-asset pseudo inputs, and
+issuance commitments that disagree with the declared supply. Malformed curve
+proofs are converted to deterministic validation failure rather than escaping
+as exceptions.
+
+This layer still does **not** authorize ownership or prevent double spends.
+Production integration requires ring-member references resolved against stored
+asset outputs, asset key images, a domain-separated CLSAG transcript, canonical
+wire serialization, and database indexes for unspent output lookup. Until that
+layer exists and is reviewed, these proofs cannot make an asset transaction
+valid on any Monzero network.
+
 ## 7. Metadata
 
 Consensus stores only bounded identity and commitment fields. Descriptions,
diff --git a/docs/MONZERO_PHASE0_STABILIZATION.md b/docs/MONZERO_PHASE0_STABILIZATION.md
index 13ce9ef20..4b9a37e72 100644
--- a/docs/MONZERO_PHASE0_STABILIZATION.md
+++ b/docs/MONZERO_PHASE0_STABILIZATION.md
@@ -133,6 +133,8 @@ isolated disposable development network may be used after cryptographic review.
 - [x] Atomic ordered block-issuance adapter, detach behavior, and deterministic state commitments.
 - [x] Detached versioned transaction extension bound to a native prefix commitment.
 - [x] Atomic block-extension validation against independently supplied native carrier commitments.
+- [x] Persistent LMDB issuance registry with restart reconstruction and native reorg rollback.
+- [x] Inactive per-asset Pedersen/Bulletproof+ conservation and burn verifier.
 - [x] External cryptographic-review brief and mandatory threat cases.
 - [ ] Reviewed confidential per-asset commitment and range-proof construction.
 - [ ] Versioned asset transaction serialization with strict parser limits.