[hmzakhalid]

What and why

Stacked on #2372. Docs only. This adds packages/interfold-contracts/audits/identity-gate.md, the
pack that an auditor starts from:

• Scope: the Solidity files of feat(contracts): gate committee admission on bond-owner identity #2371 and feat(contracts): verify bond-owner identity with ZKPassport proofs #2372 with their heads, the context PRs (feat(sortition): apply the identity policy and refresh owner capacity #2377 node,
  feat(dashboard): verify a bond owner with ZKPassport #2378 page, feat(contracts): add the identity gate rollout scripts #2379 rollout), and what stays out (ZKPassport's contracts and circuits).
• How it works: registration, the ZKPassport adapter, eligibility at T−1, owner capacity
  windows, and governance.
• Threat model: actors, trust, and the attacker goals to rule out.
• Invariants: eight properties, from identifier reservation to the size budget.
• Known limits: the accepted limits that the docs already state (document, not person; trusted
  ZKPassport keys; fail-closed capacity at window starts; and others).
• Test evidence: the specs, the last full run, mutation checks, reviews, and the open real-proof
  fork test. Focus areas for the auditor.

The audits README links it.

Verification

• pnpm check:links: 0 errors. Prettier. The facts come from the code at the listed heads and from
  the PR descriptions of feat(contracts): gate committee admission on bond-owner identity #2371 and feat(contracts): verify bond-owner identity with ZKPassport proofs #2372.

Review

Codex gpt-6.1-sol at maximum effort checked every claim against the code: the heads and the
Solidity scope match, and the pack discloses the mock-only proof coverage. Fixed in 85954f131:
verifier changes affect future registrations only; recovery needs credentials that cover the window,
a refresh after a revocation, and an admission-policy change during a pause; an unrevoked identifier
can be renewed after it expired.

Compatibility

Docs only. Part of the identity stack: #2371 and #2372 first, then #2377, #2378, #2379, and this
PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
interfold-dashboard	Ready	Preview	Oct 30, 2026 8:20pm UTC
interfold-docs	Ready	Preview	Oct 30, 2026 8:20pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 2

• main
• dev

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: theinterfold/interfold
• Branch: feat/identity-audit-pack
• File: .coderabbit.yaml
• Commit: 3ba729f
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: d7281db2-9f37-418f-851c-0642df6e2dc4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}