Implement ADR-0026 beta readiness remediation

README.md

@@ -12,6 +12,34 @@ Java-first zero-knowledge proof toolkit for Cardano.
 
 ZeroJ lets Java developers **define ZK circuits**, **generate proofs**, **verify** them off-chain, and **execute on-chain verification** on Cardano. The Java DSL and pure-Java proving path require no native libraries or external CLIs.
 
+## Support Matrix
+
+**Beta** means feature-complete and correctness-tested (3,500+ tests; the full
+Groth16 flow is verified end-to-end on-chain against Yaci DevKit), but **not
+externally audited and not for value-bearing/mainnet use**. **Experimental**
+components are opt-in and may change or have known limitations. Statuses and
+remaining production gates are tracked in
+[ADR-0026](docs/adr/0026-production-readiness-review-and-remediation-plan.md).
+
+| Area | Components | Status |
+|------|-----------|--------|
+| Core proof model, codecs, verifier SPI/orchestrator | `zeroj-api`, `zeroj-codec`, `zeroj-backend-spi`, `zeroj-verifier-core` | **Beta** |
+| Circuit definition (DSL, symbolic annotations, gadgets) | `zeroj-circuit-dsl`, `zeroj-circuit-annotation-*`, `zeroj-circuit-lib` ([per-gadget table](zeroj-circuit-lib/README.md)) | **Beta** |
+| Groth16 BLS12-381 — pure Java prove + verify | `zeroj-crypto`, `zeroj-verifier-groth16` | **Beta** (production trusted setup requires an external snarkjs MPC ceremony; in-repo setup is dev-only and flag-gated) |
+| Groth16 BLS12-381 — on-chain (Julc / Plutus V3) | `zeroj-onchain-julc` | **Beta — testnet only**, not value-bearing; bind `ScriptContext` in real validators (see `Groth16BLS12381TxOutRefBindingVerifier`) |
+| PlonK BLS12-381 — pure Java prove + verify, `.ptau`/`.zkey` import | `zeroj-crypto`, `zeroj-verifier-plonk` | **Beta** |
+| PlonK BLS12-381 — on-chain (Julc / Plutus V3) | `zeroj-onchain-julc` | **Experimental** — full KZG check implemented; labeled testnet trials only |
+| BBS (CFRG draft-10) — verification | `zeroj-bbs` | **Beta** (spec is an IRTF draft, not yet an RFC) |
+| BBS — issuance / proof generation | `zeroj-bbs` | **Beta with caveat** — default pure-Java provider is not constant-time; prefer the blst provider for issuer keys |
+| BLS12-381 pure Java primitives | `zeroj-bls12381` | **Beta** — verification-grade; performance work tracked in ADR-0026 |
+| blst native acceleration | `zeroj-blst` | **Beta, opt-in** — upstream binary provenance not yet pinned |
+| Cardano anchoring + CCL helpers | `zeroj-cardano`, `zeroj-ccl`, `zeroj-patterns` | **Beta** |
+| WASM backends | `zeroj-bls12381-wasm`, `zeroj-bbs-wasm` | **Experimental, opt-in** |
+| gnark native prover | `zeroj-prover-gnark` | **Experimental, opt-in** (Go native library) |
+| MPF Poseidon | `zeroj-mpf-poseidon` | **Experimental** (circuit too large for the practical on-chain path) |
+| BN254 (Groth16 + PlonK, off-chain) | legacy classes | **Disabled by default** — `-Dzeroj.allowLegacyBn254=true`; not a Cardano curve |
+| Halo2 verifier, WASM prover | `incubator/*` | **Incubator** |
+
 ## What You Can Do Today
 
 ### Define ZK Circuits

docs/adr/0003-pure-java-mvp.md

@@ -15,14 +15,14 @@ ZK verification requires elliptic curve arithmetic including pairing operations.
 3. **Hybrid**: Use native bindings for one curve (BLS12-381 via blst) and pure Java for the other (BN254).
 
 After analysis, a hybrid approach provides the best trade-off:
-- **BLS12-381** is Cardano's native curve (CIP-0381). The `foundation.icon:blst-java` library is already a proven dependency in the bloxbean ecosystem (used by julc-bls). It provides audited, constant-time implementations with both JNI (SWIG) and FFM bindings.
+- **BLS12-381** is Cardano's native curve (CIP-0381). The `foundation.icon:blst-java` library is already a proven dependency in the bloxbean ecosystem (used by julc-bls). It provides native blst-backed operations through JNI/SWIG bindings.
 - **BN254** is the Ethereum/snarkjs ecosystem curve. Pure Java is viable here because: (a) extensive Ethereum test vectors exist (EIP-196, EIP-197), (b) Hyperledger Besu has reference Java implementations, and (c) 100-300ms verification latency is acceptable for semi-trusted node networks.
 
 ## Decision
 
 Use a **hybrid backend from day one** (Milestone 2):
 
-- **BLS12-381**: via `foundation.icon:blst-java:0.3.2` (JNI + FFM, same as julc-bls). The `zeroj-blst` module wraps the blst library and exposes curve operations needed for Groth16 verification.
+- **BLS12-381**: via `foundation.icon:blst-java:0.3.2` (JNI/SWIG, same as julc-bls). The `zeroj-blst` module wraps the blst library and exposes curve operations needed for Groth16 verification.
 - **BN254**: via pure Java implementation in `zeroj-verifier-groth16`. Field arithmetic (Fp through Fp12 tower), curve operations (G1, G2), and optimal Ate pairing implemented in Java.
 
 Both backends are behind the `ZkVerifier` SPI, so consumers don't need to know which backend handles their proof.

docs/adr/0009-halo2-support-strategy.md

@@ -34,7 +34,7 @@ Even without Plutus builtins for IPA/Pasta curves, Halo2 is valuable off-chain:
 **Implementation approach:**
 1. Build a Rust shared library (`cdylib`) wrapping Halo2 KZG verification on BLS12-381
 2. Expose C-ABI functions: `halo2_verify(vk, proof, public_inputs) → bool`
-3. Call from Java via FFM (same pattern as zeroj-blst and zeroj-prover-gnark)
+3. Call from Java via FFM (same native-provider pattern as zeroj-prover-gnark; zeroj-blst remains JNI/SWIG)
 4. Register as `ZkVerifier` SPI implementation (`Halo2BLS12381Verifier`)
 5. The rest of ZeroJ (patterns, pipeline, anchoring) works unchanged
 

docs/adr/0012-pure-java-provers-groth16-plonk.md

@@ -1,7 +1,8 @@
 # ADR-0012: Pure Java Provers for Groth16 and PlonK
 
 ## Status
-Proposed
+Accepted — implemented for BLS12-381 Groth16 and PlonK beta paths; production
+ceremony/audit gates tracked by ADR-0026
 
 ## Date
 2026-03-29

docs/adr/0022-pure-java-plonk-hardening.md

@@ -1,7 +1,8 @@
 # ADR-0022: Pure Java PlonK Backend Review Outcomes and Hardening Posture
 
 ## Status
-Proposed
+Accepted — hardening implemented for the current beta path; remaining
+production gates tracked by ADR-0026
 
 ## Date
 2026-06-27