DID 核心 — 实现

For Claude: REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

Goal: 在 BabyDriver L2 上实现核心 DID 系统 — DIDRegistry (0x8017) + CredentialRegistry (0x8018) + IdentityVerifier (0x8019) 三个系统合约，完成身份注册→凭证发行→凭证验证的完整闭环。

Architecture: 三个独立系统合约继承 SystemContractBase，使用 onlySystemCall / onlyCallFromBootloader 修饰符保护写操作。IdentityVerifier 先用 ECDSA 签名验证模式（P1 再替换为 ZK PLONK）。跨合约交互：IdentityVerifier 调用 DIDRegistry 验证身份状态，调用 CredentialRegistry 验证凭证有效性。

Tech Stack: Solidity 0.8.28 (zksolc 1.5.11), SystemContractBase, Hardhat + TypeScript tests, Foundry tests

设计文档: docs/plans/2026-03-04-did-system-design.md

关键参考文件

在实现前务必阅读以下文件理解模式：

文件

用途

era-contracts-l1/system-contracts/contracts/OracleHub.sol

系统合约实现模式

era-contracts-l1/system-contracts/contracts/interfaces/IOracleHub.sol

接口定义模式

era-contracts-l1/system-contracts/contracts/abstract/SystemContractBase.sol

基类 + 修饰符

era-contracts-l1/system-contracts/contracts/Constants.sol

地址常量注册

era-contracts-l1/system-contracts/scripts/constants.ts

TypeScript 常量注册

era-core/core/lib/constants/src/contracts.rs

Rust 地址常量

era-core/core/lib/types/src/system_contracts.rs

SYSTEM_CONTRACT_LIST

refs/ethr-did-registry/contracts/EthereumDIDRegistry.sol

DID 注册参考

Task 1: 地址常量注册（基础设施）

Files:

Modify: era-contracts-l1/system-contracts/contracts/Constants.sol
Modify: era-contracts-l1/system-contracts/scripts/constants.ts
Modify: era-core/core/lib/constants/src/contracts.rs
Modify: era-core/core/lib/types/src/system_contracts.rs

Step 1: 在 Constants.sol 添加 DID 系统合约地址

在 ORACLE_HUB_SYSTEM_CONTRACT 定义之后（约 line 112），添加：

/// @dev The address of the DIDRegistry system contract.
address constant DID_REGISTRY_SYSTEM_CONTRACT = address(SYSTEM_CONTRACTS_OFFSET + 0x17);

/// @dev The address of the CredentialRegistry system contract.
address constant CREDENTIAL_REGISTRY_SYSTEM_CONTRACT = address(SYSTEM_CONTRACTS_OFFSET + 0x18);

/// @dev The address of the IdentityVerifier system contract.
address constant IDENTITY_VERIFIER_SYSTEM_CONTRACT = address(SYSTEM_CONTRACTS_OFFSET + 0x19);

Step 2: 在 TypeScript constants.ts 注册

在 oracleHub 条目之后添加：

didRegistry: {
    address: "0x0000000000000000000000000000000000008017",
    codeName: "DIDRegistry",
    lang: Language.Solidity,
    location: SourceLocation.SystemContracts,
},
credentialRegistry: {
    address: "0x0000000000000000000000000000000000008018",
    codeName: "CredentialRegistry",
    lang: Language.Solidity,
    location: SourceLocation.SystemContracts,
},
identityVerifier: {
    address: "0x0000000000000000000000000000000000008019",
    codeName: "IdentityVerifier",
    lang: Language.Solidity,
    location: SourceLocation.SystemContracts,
},

Step 3: 在 Rust contracts.rs 添加地址常量

在 ORACLE_HUB_ADDRESS 定义之后添加：

/// DIDRegistry system contract address (0x8017)
pub const DID_REGISTRY_ADDRESS: Address = H160([
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x80, 0x17,
]);

/// CredentialRegistry system contract address (0x8018)
pub const CREDENTIAL_REGISTRY_ADDRESS: Address = H160([
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x80, 0x18,
]);

/// IdentityVerifier system contract address (0x8019)
pub const IDENTITY_VERIFIER_ADDRESS: Address = H160([
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x80, 0x19,
]);

Step 4: 在 SYSTEM_CONTRACT_LIST 注册

在 system_contracts.rs 的 OracleHub 条目之后添加 3 个条目：

// BabyDriver: DID Registry system contract
(
    "",
    "DIDRegistry",
    DID_REGISTRY_ADDRESS,
    ContractLanguage::Sol,
),
// BabyDriver: Credential Registry system contract
(
    "",
    "CredentialRegistry",
    CREDENTIAL_REGISTRY_ADDRESS,
    ContractLanguage::Sol,
),
// BabyDriver: Identity Verifier system contract
(
    "",
    "IdentityVerifier",
    IDENTITY_VERIFIER_ADDRESS,
    ContractLanguage::Sol,
),

更新数组长度注释（41 → 44）。在文件顶部 import 新增的 3 个常量。

Step 5: 验证编译

Run: cd era-core/core && cargo check 2>&1 | tail -20 Expected: 编译通过（Rust 常量和 import 无错误）

Step 6: Commit

git add era-contracts-l1/system-contracts/contracts/Constants.sol \
        era-contracts-l1/system-contracts/scripts/constants.ts \
        era-core/core/lib/constants/src/contracts.rs \
        era-core/core/lib/types/src/system_contracts.rs
git commit -m "feat(did): register DID system contract addresses (0x8017-0x8019)"

Task 2: IDIDRegistry 接口 + DIDRegistry 合约

Files:

Create: era-contracts-l1/system-contracts/contracts/interfaces/IDIDRegistry.sol
Create: era-contracts-l1/system-contracts/contracts/DIDRegistry.sol

Step 1: 创建 IDIDRegistry 接口

Create era-contracts-l1/system-contracts/contracts/interfaces/IDIDRegistry.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.28;

interface IDIDRegistry {
    // ── Structs ────────────────────────────────────────────────
    struct DIDDocument {
        bytes32[] verificationMethods; // keccak256 of each public key
        address controller;            // address that controls this DID
        uint64 created;
        uint64 updated;
        bool active;
        bytes32 serviceEndpointHash;   // hash of off-chain service endpoints JSON
    }

    // ── Events ─────────────────────────────────────────────────
    event DIDCreated(address indexed identity, address controller);
    event DIDUpdated(address indexed identity, bytes32 documentHash);
    event DIDDeactivated(address indexed identity);
    event DelegateAdded(address indexed identity, address indexed delegate, uint256 validity);
    event DelegateRevoked(address indexed identity, address indexed delegate);

    // ── Identity Management ────────────────────────────────────
    function createDID(bytes32[] calldata verificationMethods, bytes32 serviceEndpointHash) external;
    function updateDocument(bytes32[] calldata verificationMethods, bytes32 serviceEndpointHash) external;
    function deactivateDID() external;

    // ── Delegation ─────────────────────────────────────────────
    function addDelegate(address delegate, uint256 validity) external;
    function revokeDelegate(address delegate) external;

    // ── Queries (view) ─────────────────────────────────────────
    function resolveDID(address identity) external view returns (DIDDocument memory);
    function isActive(address identity) external view returns (bool);
    function isDelegate(address identity, address delegate) external view returns (bool);
    function getNonce(address identity) external view returns (uint256);
}

Step 2: 创建 DIDRegistry 系统合约

Create era-contracts-l1/system-contracts/contracts/DIDRegistry.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.28;

import {IDIDRegistry} from "./interfaces/IDIDRegistry.sol";
import {SystemContractBase} from "./abstract/SystemContractBase.sol";
import {CREDENTIAL_REGISTRY_SYSTEM_CONTRACT, IDENTITY_VERIFIER_SYSTEM_CONTRACT} from "./Constants.sol";

/// @title DIDRegistry — BabyDriver Decentralized Identity Registry
/// @notice System contract at 0x8017. Manages did:ethr:baby identities.
/// @dev Follows ethr-did-registry pattern adapted for zksync system contracts.
contract DIDRegistry is IDIDRegistry, SystemContractBase {
    // ── Storage ────────────────────────────────────────────────
    mapping(address => DIDDocument) private _documents;
    mapping(address => mapping(address => uint256)) private _delegateExpiry;
    // delegate → identity → expiry timestamp
    mapping(address => address[]) private _delegateList;
    mapping(address => uint256) private _nonces;

    // ── Errors ─────────────────────────────────────────────────
    error DIDAlreadyExists(address identity);
    error DIDNotFound(address identity);
    error DIDNotActive(address identity);
    error NotController(address caller, address controller);
    error DelegateAlreadyExists(address delegate);
    error DelegateNotFound(address delegate);
    error InvalidValidityPeriod();
    error EmptyVerificationMethods();

    // ── Modifiers ──────────────────────────────────────────────
    modifier onlyController(address identity) {
        DIDDocument storage doc = _documents[identity];
        if (doc.controller == address(0)) revert DIDNotFound(identity);
        if (doc.controller != msg.sender) revert NotController(msg.sender, doc.controller);
        _;
    }

    modifier didExists(address identity) {
        if (_documents[identity].controller == address(0)) revert DIDNotFound(identity);
        _;
    }

    modifier didActive(address identity) {
        DIDDocument storage doc = _documents[identity];
        if (doc.controller == address(0)) revert DIDNotFound(identity);
        if (!doc.active) revert DIDNotActive(identity);
        _;
    }

    // ── Identity Management ────────────────────────────────────

    /// @notice Create a new DID for msg.sender.
    /// @param verificationMethods Array of keccak256(pubkey) for this identity.
    /// @param serviceEndpointHash Hash of off-chain service endpoints JSON.
    function createDID(
        bytes32[] calldata verificationMethods,
        bytes32 serviceEndpointHash
    ) external override onlySystemCall {
        if (_documents[msg.sender].controller != address(0)) {
            revert DIDAlreadyExists(msg.sender);
        }
        if (verificationMethods.length == 0) revert EmptyVerificationMethods();

        DIDDocument storage doc = _documents[msg.sender];
        doc.controller = msg.sender;
        doc.created = uint64(block.timestamp);
        doc.updated = uint64(block.timestamp);
        doc.active = true;
        doc.serviceEndpointHash = serviceEndpointHash;
        for (uint256 i = 0; i < verificationMethods.length; i++) {
            doc.verificationMethods.push(verificationMethods[i]);
        }

        _nonces[msg.sender] = 1;
        emit DIDCreated(msg.sender, msg.sender);
    }

    /// @notice Update the DID document for msg.sender.
    function updateDocument(
        bytes32[] calldata verificationMethods,
        bytes32 serviceEndpointHash
    ) external override onlyController(msg.sender) {
        if (!_documents[msg.sender].active) revert DIDNotActive(msg.sender);
        if (verificationMethods.length == 0) revert EmptyVerificationMethods();

        DIDDocument storage doc = _documents[msg.sender];

        // Replace verification methods
        delete doc.verificationMethods;
        for (uint256 i = 0; i < verificationMethods.length; i++) {
            doc.verificationMethods.push(verificationMethods[i]);
        }
        doc.serviceEndpointHash = serviceEndpointHash;
        doc.updated = uint64(block.timestamp);
        _nonces[msg.sender]++;

        emit DIDUpdated(
            msg.sender,
            keccak256(abi.encode(verificationMethods, serviceEndpointHash))
        );
    }

    /// @notice Deactivate the DID for msg.sender. Irreversible.
    function deactivateDID() external override onlyController(msg.sender) {
        _documents[msg.sender].active = false;
        _documents[msg.sender].updated = uint64(block.timestamp);
        _nonces[msg.sender]++;
        emit DIDDeactivated(msg.sender);
    }

    // ── Delegation ─────────────────────────────────────────────

    /// @notice Add a delegate for the caller's DID.
    /// @param delegate Address to delegate to.
    /// @param validity Duration in seconds for which the delegation is valid.
    function addDelegate(
        address delegate,
        uint256 validity
    ) external override onlyController(msg.sender) {
        if (!_documents[msg.sender].active) revert DIDNotActive(msg.sender);
        if (validity == 0) revert InvalidValidityPeriod();

        uint256 expiry = block.timestamp + validity;
        if (_delegateExpiry[msg.sender][delegate] > block.timestamp) {
            // Update existing delegation
            _delegateExpiry[msg.sender][delegate] = expiry;
        } else {
            _delegateExpiry[msg.sender][delegate] = expiry;
            _delegateList[msg.sender].push(delegate);
        }
        _nonces[msg.sender]++;
        emit DelegateAdded(msg.sender, delegate, expiry);
    }

    /// @notice Revoke a delegate.
    function revokeDelegate(
        address delegate
    ) external override onlyController(msg.sender) {
        if (_delegateExpiry[msg.sender][delegate] == 0) revert DelegateNotFound(delegate);
        _delegateExpiry[msg.sender][delegate] = 0;
        _nonces[msg.sender]++;
        emit DelegateRevoked(msg.sender, delegate);
    }

    // ── Queries ────────────────────────────────────────────────

    /// @notice Resolve a DID document.
    function resolveDID(address identity) external view override returns (DIDDocument memory) {
        if (_documents[identity].controller == address(0)) revert DIDNotFound(identity);
        return _documents[identity];
    }

    /// @notice Check if a DID is active.
    function isActive(address identity) external view override returns (bool) {
        DIDDocument storage doc = _documents[identity];
        return doc.controller != address(0) && doc.active;
    }

    /// @notice Check if an address is a valid delegate for an identity.
    function isDelegate(address identity, address delegate) external view override returns (bool) {
        return _delegateExpiry[identity][delegate] > block.timestamp;
    }

    /// @notice Get the current nonce for an identity.
    function getNonce(address identity) external view override returns (uint256) {
        return _nonces[identity];
    }
}

Step 3: 验证编译

cd era-contracts-l1/system-contracts
nvm use 20
yarn preprocess:system-contracts && npx hardhat compile 2>&1 | tail -20

Expected: 编译通过，DIDRegistry included

Step 4: Commit

git add era-contracts-l1/system-contracts/contracts/interfaces/IDIDRegistry.sol \
        era-contracts-l1/system-contracts/contracts/DIDRegistry.sol
git commit -m "feat(did): DIDRegistry system contract (0x8017) — identity CRUD + delegation"

Task 3: ICredentialRegistry 接口 + CredentialRegistry 合约

Files:

Create: era-contracts-l1/system-contracts/contracts/interfaces/ICredentialRegistry.sol
Create: era-contracts-l1/system-contracts/contracts/CredentialRegistry.sol

Step 1: 创建 ICredentialRegistry 接口

Create era-contracts-l1/system-contracts/contracts/interfaces/ICredentialRegistry.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.28;

interface ICredentialRegistry {
    // ── Structs ────────────────────────────────────────────────
    struct Credential {
        address issuer;
        address subject;
        bytes32 credentialType; // keccak256("KYC"), keccak256("CREDIT_SCORE"), etc.
        bytes32 claimHash;     // hash of off-chain claim data
        uint64 issuedAt;
        uint64 expiresAt;
    }

    // ── Events ─────────────────────────────────────────────────
    event CredentialIssued(
        bytes32 indexed credentialId,
        address indexed issuer,
        address indexed subject,
        bytes32 credentialType
    );
    event CredentialRevoked(bytes32 indexed credentialId, address indexed issuer);

    // ── Issuance ───────────────────────────────────────────────
    function issueCredential(
        address subject,
        bytes32 credentialType,
        bytes32 claimHash,
        uint64 expiresAt
    ) external returns (bytes32 credentialId);

    // ── Revocation ─────────────────────────────────────────────
    function revokeCredential(bytes32 credentialId) external;

    // ── Queries ────────────────────────────────────────────────
    function getCredential(bytes32 credentialId) external view returns (Credential memory);
    function isCredentialValid(bytes32 credentialId) external view returns (bool);
    function getCredentialsBySubject(address subject) external view returns (bytes32[] memory);
    function getCredentialsByIssuer(address issuer) external view returns (bytes32[] memory);
    function isRevoked(bytes32 credentialId) external view returns (bool);
}

Step 2: 创建 CredentialRegistry 系统合约

Create era-contracts-l1/system-contracts/contracts/CredentialRegistry.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.28;

import {ICredentialRegistry} from "./interfaces/ICredentialRegistry.sol";
import {SystemContractBase} from "./abstract/SystemContractBase.sol";
import {DID_REGISTRY_SYSTEM_CONTRACT} from "./Constants.sol";
import {IDIDRegistry} from "./interfaces/IDIDRegistry.sol";

/// @title CredentialRegistry — BabyDriver Verifiable Credential Registry
/// @notice System contract at 0x8018. Manages Verifiable Credentials issuance and revocation.
/// @dev Issuer must have an active DID in DIDRegistry. Subject must have an active DID.
contract CredentialRegistry is ICredentialRegistry, SystemContractBase {
    // ── Storage ────────────────────────────────────────────────
    mapping(bytes32 => Credential) private _credentials;
    mapping(bytes32 => bool) private _revoked;
    mapping(address => bytes32[]) private _issuedByIssuer;
    mapping(address => bytes32[]) private _heldBySubject;

    // ── Errors ─────────────────────────────────────────────────
    error CredentialNotFound(bytes32 credentialId);
    error CredentialAlreadyRevoked(bytes32 credentialId);
    error NotCredentialIssuer(address caller, address issuer);
    error IssuerDIDNotActive(address issuer);
    error SubjectDIDNotActive(address subject);
    error InvalidExpiry();
    error EmptyClaimHash();

    // ── Internal Helpers ───────────────────────────────────────

    function _didRegistry() internal view returns (IDIDRegistry) {
        return IDIDRegistry(DID_REGISTRY_SYSTEM_CONTRACT);
    }

    function _computeCredentialId(
        address issuer,
        address subject,
        bytes32 credentialType,
        bytes32 claimHash,
        uint64 issuedAt
    ) internal pure returns (bytes32) {
        return keccak256(abi.encode(issuer, subject, credentialType, claimHash, issuedAt));
    }

    // ── Issuance ───────────────────────────────────────────────

    /// @notice Issue a new Verifiable Credential.
    /// @dev Both issuer (msg.sender) and subject must have active DIDs.
    /// @param subject The credential holder.
    /// @param credentialType Type hash (e.g., keccak256("KYC")).
    /// @param claimHash Hash of off-chain claim data.
    /// @param expiresAt Expiration timestamp. 0 = never expires.
    /// @return credentialId The unique credential identifier.
    function issueCredential(
        address subject,
        bytes32 credentialType,
        bytes32 claimHash,
        uint64 expiresAt
    ) external override onlySystemCall returns (bytes32 credentialId) {
        if (claimHash == bytes32(0)) revert EmptyClaimHash();
        if (expiresAt != 0 && expiresAt <= block.timestamp) revert InvalidExpiry();

        // Verify both issuer and subject have active DIDs
        if (!_didRegistry().isActive(msg.sender)) revert IssuerDIDNotActive(msg.sender);
        if (!_didRegistry().isActive(subject)) revert SubjectDIDNotActive(subject);

        uint64 issuedAt = uint64(block.timestamp);
        credentialId = _computeCredentialId(msg.sender, subject, credentialType, claimHash, issuedAt);

        _credentials[credentialId] = Credential({
            issuer: msg.sender,
            subject: subject,
            credentialType: credentialType,
            claimHash: claimHash,
            issuedAt: issuedAt,
            expiresAt: expiresAt
        });

        _issuedByIssuer[msg.sender].push(credentialId);
        _heldBySubject[subject].push(credentialId);

        emit CredentialIssued(credentialId, msg.sender, subject, credentialType);
    }

    // ── Revocation ─────────────────────────────────────────────

    /// @notice Revoke a credential. Only the original issuer can revoke.
    function revokeCredential(bytes32 credentialId) external override onlySystemCall {
        Credential storage cred = _credentials[credentialId];
        if (cred.issuer == address(0)) revert CredentialNotFound(credentialId);
        if (cred.issuer != msg.sender) revert NotCredentialIssuer(msg.sender, cred.issuer);
        if (_revoked[credentialId]) revert CredentialAlreadyRevoked(credentialId);

        _revoked[credentialId] = true;
        emit CredentialRevoked(credentialId, msg.sender);
    }

    // ── Queries ────────────────────────────────────────────────

    /// @notice Get a credential by ID.
    function getCredential(bytes32 credentialId) external view override returns (Credential memory) {
        Credential storage cred = _credentials[credentialId];
        if (cred.issuer == address(0)) revert CredentialNotFound(credentialId);
        return cred;
    }

    /// @notice Check if a credential is currently valid (not revoked, not expired, issuer DID active).
    function isCredentialValid(bytes32 credentialId) external view override returns (bool) {
        Credential storage cred = _credentials[credentialId];
        if (cred.issuer == address(0)) return false;
        if (_revoked[credentialId]) return false;
        if (cred.expiresAt != 0 && cred.expiresAt <= block.timestamp) return false;
        // Issuer DID must still be active for credential to be valid
        if (!_didRegistry().isActive(cred.issuer)) return false;
        return true;
    }

    /// @notice Get all credential IDs held by a subject.
    function getCredentialsBySubject(address subject) external view override returns (bytes32[] memory) {
        return _heldBySubject[subject];
    }

    /// @notice Get all credential IDs issued by an issuer.
    function getCredentialsByIssuer(address issuer) external view override returns (bytes32[] memory) {
        return _issuedByIssuer[issuer];
    }

    /// @notice Check if a credential has been revoked.
    function isRevoked(bytes32 credentialId) external view override returns (bool) {
        return _revoked[credentialId];
    }
}

Step 3: 验证编译

cd era-contracts-l1/system-contracts
yarn preprocess:system-contracts && npx hardhat compile 2>&1 | tail -20

Expected: 编译通过

Step 4: Commit

git add era-contracts-l1/system-contracts/contracts/interfaces/ICredentialRegistry.sol \
        era-contracts-l1/system-contracts/contracts/CredentialRegistry.sol
git commit -m "feat(did): CredentialRegistry system contract (0x8018) — VC issuance + revocation"

Task 4: IIdentityVerifier 接口 + IdentityVerifier 合约

Files:

Create: era-contracts-l1/system-contracts/contracts/interfaces/IIdentityVerifier.sol
Create: era-contracts-l1/system-contracts/contracts/IdentityVerifier.sol

Step 1: 创建 IIdentityVerifier 接口

Create era-contracts-l1/system-contracts/contracts/interfaces/IIdentityVerifier.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.28;

interface IIdentityVerifier {
    // ── Enums ──────────────────────────────────────────────────
    enum VerificationMode { ECDSA, ZK_PLONK }

    // ── Events ─────────────────────────────────────────────────
    event ComplianceUpdated(address indexed identity, bytes32 indexed requirement, bool status);
    event VerificationModeChanged(VerificationMode oldMode, VerificationMode newMode);
    event TrustedIssuerAdded(address indexed issuer);
    event TrustedIssuerRemoved(address indexed issuer);

    // ── Verification ───────────────────────────────────────────
    function verifyIdentity(address identity, bytes32 credentialType) external view returns (bool);
    function checkCompliance(address identity, bytes32 requirement) external view returns (bool);

    // ── Compliance Management ──────────────────────────────────
    function setCompliance(address identity, bytes32 requirement, bool status) external;

    // ── Admin ──────────────────────────────────────────────────
    function addTrustedIssuer(address issuer) external;
    function removeTrustedIssuer(address issuer) external;
    function isTrustedIssuer(address issuer) external view returns (bool);
    function setVerificationMode(VerificationMode mode) external;
    function currentMode() external view returns (VerificationMode);
}

Step 2: 创建 IdentityVerifier 系统合约

Create era-contracts-l1/system-contracts/contracts/IdentityVerifier.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.28;

import {IIdentityVerifier} from "./interfaces/IIdentityVerifier.sol";
import {SystemContractBase} from "./abstract/SystemContractBase.sol";
import {DID_REGISTRY_SYSTEM_CONTRACT, CREDENTIAL_REGISTRY_SYSTEM_CONTRACT} from "./Constants.sol";
import {IDIDRegistry} from "./interfaces/IDIDRegistry.sol";
import {ICredentialRegistry} from "./interfaces/ICredentialRegistry.sol";

/// @title IdentityVerifier — BabyDriver Identity Verification Engine
/// @notice System contract at 0x8019. Verifies identity + credentials for compliance.
/// @dev P0: ECDSA mode (credential signature verification).
///      P1: ZK_PLONK mode (zero-knowledge proof verification via boojum).
contract IdentityVerifier is IIdentityVerifier, SystemContractBase {
    // ── Storage ────────────────────────────────────────────────
    VerificationMode private _currentMode;
    mapping(address => bool) private _trustedIssuers;
    mapping(address => mapping(bytes32 => bool)) private _compliance;
    // identity → requirement → isCompliant

    // ── Errors ─────────────────────────────────────────────────
    error IssuerNotTrusted(address issuer);
    error IdentityNotActive(address identity);
    error AlreadyTrustedIssuer(address issuer);
    error NotTrustedIssuer(address issuer);

    // ── Constructor ────────────────────────────────────────────

    // System contracts don't use constructors — state is set at genesis or via admin calls.

    // ── Internal Helpers ───────────────────────────────────────

    function _didRegistry() internal view returns (IDIDRegistry) {
        return IDIDRegistry(DID_REGISTRY_SYSTEM_CONTRACT);
    }

    function _credentialRegistry() internal view returns (ICredentialRegistry) {
        return ICredentialRegistry(CREDENTIAL_REGISTRY_SYSTEM_CONTRACT);
    }

    // ── Verification ───────────────────────────────────────────

    /// @notice Verify that an identity has a valid credential of the given type
    ///         issued by a trusted issuer.
    /// @param identity The address to verify.
    /// @param credentialType The required credential type (e.g., keccak256("KYC")).
    /// @return True if the identity has a valid, non-revoked, non-expired credential
    ///         of the specified type from a trusted issuer.
    function verifyIdentity(
        address identity,
        bytes32 credentialType
    ) external view override returns (bool) {
        // Identity must have an active DID
        if (!_didRegistry().isActive(identity)) return false;

        // Check if any credential of this type is valid and from a trusted issuer
        bytes32[] memory credIds = _credentialRegistry().getCredentialsBySubject(identity);
        for (uint256 i = 0; i < credIds.length; i++) {
            if (!_credentialRegistry().isCredentialValid(credIds[i])) continue;

            ICredentialRegistry.Credential memory cred = _credentialRegistry().getCredential(credIds[i]);
            if (cred.credentialType == credentialType && _trustedIssuers[cred.issuer]) {
                return true;
            }
        }
        return false;
    }

    /// @notice Check if an identity meets a specific compliance requirement.
    /// @dev Compliance is set by trusted issuers via setCompliance().
    function checkCompliance(
        address identity,
        bytes32 requirement
    ) external view override returns (bool) {
        if (!_didRegistry().isActive(identity)) return false;
        return _compliance[identity][requirement];
    }

    // ── Compliance Management ──────────────────────────────────

    /// @notice Set compliance status for an identity. Only callable by trusted issuers.
    /// @param identity The identity to update.
    /// @param requirement The compliance requirement (e.g., keccak256("AML_CLEAR")).
    /// @param status Whether the identity meets the requirement.
    function setCompliance(
        address identity,
        bytes32 requirement,
        bool status
    ) external override onlySystemCall {
        if (!_trustedIssuers[msg.sender]) revert IssuerNotTrusted(msg.sender);
        if (!_didRegistry().isActive(identity)) revert IdentityNotActive(identity);

        _compliance[identity][requirement] = status;
        emit ComplianceUpdated(identity, requirement, status);
    }

    // ── Admin ──────────────────────────────────────────────────

    /// @notice Add a trusted credential issuer.
    function addTrustedIssuer(address issuer) external override onlyCallFromBootloader {
        if (_trustedIssuers[issuer]) revert AlreadyTrustedIssuer(issuer);
        _trustedIssuers[issuer] = true;
        emit TrustedIssuerAdded(issuer);
    }

    /// @notice Remove a trusted credential issuer.
    function removeTrustedIssuer(address issuer) external override onlyCallFromBootloader {
        if (!_trustedIssuers[issuer]) revert NotTrustedIssuer(issuer);
        _trustedIssuers[issuer] = false;
        emit TrustedIssuerRemoved(issuer);
    }

    /// @notice Check if an address is a trusted issuer.
    function isTrustedIssuer(address issuer) external view override returns (bool) {
        return _trustedIssuers[issuer];
    }

    /// @notice Change verification mode. Only bootloader (genesis/upgrade).
    function setVerificationMode(VerificationMode mode) external override onlyCallFromBootloader {
        VerificationMode oldMode = _currentMode;
        _currentMode = mode;
        emit VerificationModeChanged(oldMode, mode);
    }

    /// @notice Get current verification mode.
    function currentMode() external view override returns (VerificationMode) {
        return _currentMode;
    }
}

Step 3: 验证编译

cd era-contracts-l1/system-contracts
yarn preprocess:system-contracts && npx hardhat compile 2>&1 | tail -20

Expected: 编译通过

Step 4: Commit

git add era-contracts-l1/system-contracts/contracts/interfaces/IIdentityVerifier.sol \
        era-contracts-l1/system-contracts/contracts/IdentityVerifier.sol
git commit -m "feat(did): IdentityVerifier system contract (0x8019) — compliance + trusted issuers"

Task 5: Foundry 测试 — DIDRegistry

Files:

Create: contracts/test/DIDRegistry.t.sol
Create: contracts/src/did/IDIDRegistryLocal.sol

说明: 系统合约测试有两种方式。此处用 Foundry 做独立逻辑测试（不依赖 zkSync 环境），验证合约逻辑正确性。集成测试（bootloader 交互）在 Task 8 用 Hardhat 做。

Step 1: 创建本地测试用接口

因为 Foundry 测试不使用 zkSync 系统调用机制，我们需要一个可在标准 EVM 上测试的方式。创建一个本地版本的 DIDRegistry 用于 Foundry 测试（移除系统合约修饰符，保留核心逻辑）。

Create contracts/src/did/IDIDRegistryLocal.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

/// @dev Local test interface mirroring IDIDRegistry for Foundry testing.
interface IDIDRegistryLocal {
    struct DIDDocument {
        bytes32[] verificationMethods;
        address controller;
        uint64 created;
        uint64 updated;
        bool active;
        bytes32 serviceEndpointHash;
    }

    event DIDCreated(address indexed identity, address controller);
    event DIDUpdated(address indexed identity, bytes32 documentHash);
    event DIDDeactivated(address indexed identity);
    event DelegateAdded(address indexed identity, address indexed delegate, uint256 validity);
    event DelegateRevoked(address indexed identity, address indexed delegate);

    function createDID(bytes32[] calldata verificationMethods, bytes32 serviceEndpointHash) external;
    function updateDocument(bytes32[] calldata verificationMethods, bytes32 serviceEndpointHash) external;
    function deactivateDID() external;
    function addDelegate(address delegate, uint256 validity) external;
    function revokeDelegate(address delegate) external;
    function resolveDID(address identity) external view returns (DIDDocument memory);
    function isActive(address identity) external view returns (bool);
    function isDelegate(address identity, address delegate) external view returns (bool);
    function getNonce(address identity) external view returns (uint256);
}

Step 2: 创建本地测试版 DIDRegistry

Create contracts/src/did/DIDRegistryLocal.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {IDIDRegistryLocal} from "./IDIDRegistryLocal.sol";

/// @dev Local Foundry-testable version of DIDRegistry.
///      Same core logic as system contract, without zkSync-specific modifiers.
contract DIDRegistryLocal is IDIDRegistryLocal {
    mapping(address => DIDDocument) private _documents;
    mapping(address => mapping(address => uint256)) private _delegateExpiry;
    mapping(address => address[]) private _delegateList;
    mapping(address => uint256) private _nonces;

    error DIDAlreadyExists(address identity);
    error DIDNotFound(address identity);
    error DIDNotActive(address identity);
    error NotController(address caller, address controller);
    error DelegateNotFound(address delegate);
    error InvalidValidityPeriod();
    error EmptyVerificationMethods();

    modifier onlyController(address identity) {
        DIDDocument storage doc = _documents[identity];
        if (doc.controller == address(0)) revert DIDNotFound(identity);
        if (doc.controller != msg.sender) revert NotController(msg.sender, doc.controller);
        _;
    }

    function createDID(
        bytes32[] calldata verificationMethods,
        bytes32 serviceEndpointHash
    ) external override {
        if (_documents[msg.sender].controller != address(0)) revert DIDAlreadyExists(msg.sender);
        if (verificationMethods.length == 0) revert EmptyVerificationMethods();

        DIDDocument storage doc = _documents[msg.sender];
        doc.controller = msg.sender;
        doc.created = uint64(block.timestamp);
        doc.updated = uint64(block.timestamp);
        doc.active = true;
        doc.serviceEndpointHash = serviceEndpointHash;
        for (uint256 i = 0; i < verificationMethods.length; i++) {
            doc.verificationMethods.push(verificationMethods[i]);
        }
        _nonces[msg.sender] = 1;
        emit DIDCreated(msg.sender, msg.sender);
    }

    function updateDocument(
        bytes32[] calldata verificationMethods,
        bytes32 serviceEndpointHash
    ) external override onlyController(msg.sender) {
        if (!_documents[msg.sender].active) revert DIDNotActive(msg.sender);
        if (verificationMethods.length == 0) revert EmptyVerificationMethods();

        DIDDocument storage doc = _documents[msg.sender];
        delete doc.verificationMethods;
        for (uint256 i = 0; i < verificationMethods.length; i++) {
            doc.verificationMethods.push(verificationMethods[i]);
        }
        doc.serviceEndpointHash = serviceEndpointHash;
        doc.updated = uint64(block.timestamp);
        _nonces[msg.sender]++;
        emit DIDUpdated(msg.sender, keccak256(abi.encode(verificationMethods, serviceEndpointHash)));
    }

    function deactivateDID() external override onlyController(msg.sender) {
        _documents[msg.sender].active = false;
        _documents[msg.sender].updated = uint64(block.timestamp);
        _nonces[msg.sender]++;
        emit DIDDeactivated(msg.sender);
    }

    function addDelegate(address delegate, uint256 validity) external override onlyController(msg.sender) {
        if (!_documents[msg.sender].active) revert DIDNotActive(msg.sender);
        if (validity == 0) revert InvalidValidityPeriod();

        uint256 expiry = block.timestamp + validity;
        if (_delegateExpiry[msg.sender][delegate] <= block.timestamp) {
            _delegateList[msg.sender].push(delegate);
        }
        _delegateExpiry[msg.sender][delegate] = expiry;
        _nonces[msg.sender]++;
        emit DelegateAdded(msg.sender, delegate, expiry);
    }

    function revokeDelegate(address delegate) external override onlyController(msg.sender) {
        if (_delegateExpiry[msg.sender][delegate] == 0) revert DelegateNotFound(delegate);
        _delegateExpiry[msg.sender][delegate] = 0;
        _nonces[msg.sender]++;
        emit DelegateRevoked(msg.sender, delegate);
    }

    function resolveDID(address identity) external view override returns (DIDDocument memory) {
        if (_documents[identity].controller == address(0)) revert DIDNotFound(identity);
        return _documents[identity];
    }

    function isActive(address identity) external view override returns (bool) {
        DIDDocument storage doc = _documents[identity];
        return doc.controller != address(0) && doc.active;
    }

    function isDelegate(address identity, address delegate) external view override returns (bool) {
        return _delegateExpiry[identity][delegate] > block.timestamp;
    }

    function getNonce(address identity) external view override returns (uint256) {
        return _nonces[identity];
    }
}

Step 3: 编写 Foundry 测试

Create contracts/test/DIDRegistry.t.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import "forge-std/Test.sol";
import "../src/did/DIDRegistryLocal.sol";

contract DIDRegistryTest is Test {
    DIDRegistryLocal public registry;

    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address charlie = makeAddr("charlie");

    bytes32 key1 = keccak256("pubkey_alice_1");
    bytes32 key2 = keccak256("pubkey_alice_2");
    bytes32 serviceHash = keccak256("https://alice.example.com/.well-known/did.json");

    function setUp() public {
        registry = new DIDRegistryLocal();
    }

    // ── createDID ──────────────────────────────────────────────

    function test_createDID_success() public {
        bytes32[] memory methods = new bytes32[](1);
        methods[0] = key1;

        vm.prank(alice);
        registry.createDID(methods, serviceHash);

        IDIDRegistryLocal.DIDDocument memory doc = registry.resolveDID(alice);
        assertEq(doc.controller, alice);
        assertEq(doc.verificationMethods.length, 1);
        assertEq(doc.verificationMethods[0], key1);
        assertTrue(doc.active);
        assertEq(doc.serviceEndpointHash, serviceHash);
        assertEq(registry.getNonce(alice), 1);
    }

    function test_createDID_emitsEvent() public {
        bytes32[] memory methods = new bytes32[](1);
        methods[0] = key1;

        vm.expectEmit(true, false, false, true);
        emit IDIDRegistryLocal.DIDCreated(alice, alice);

        vm.prank(alice);
        registry.createDID(methods, serviceHash);
    }

    function test_createDID_multipleKeys() public {
        bytes32[] memory methods = new bytes32[](2);
        methods[0] = key1;
        methods[1] = key2;

        vm.prank(alice);
        registry.createDID(methods, serviceHash);

        IDIDRegistryLocal.DIDDocument memory doc = registry.resolveDID(alice);
        assertEq(doc.verificationMethods.length, 2);
    }

    function test_createDID_revert_alreadyExists() public {
        bytes32[] memory methods = new bytes32[](1);
        methods[0] = key1;

        vm.prank(alice);
        registry.createDID(methods, serviceHash);

        vm.expectRevert(abi.encodeWithSelector(DIDRegistryLocal.DIDAlreadyExists.selector, alice));
        vm.prank(alice);
        registry.createDID(methods, serviceHash);
    }

    function test_createDID_revert_emptyMethods() public {
        bytes32[] memory methods = new bytes32[](0);

        vm.expectRevert(DIDRegistryLocal.EmptyVerificationMethods.selector);
        vm.prank(alice);
        registry.createDID(methods, serviceHash);
    }

    // ── updateDocument ─────────────────────────────────────────

    function test_updateDocument_success() public {
        _createDID(alice);

        bytes32[] memory newMethods = new bytes32[](1);
        newMethods[0] = key2;
        bytes32 newServiceHash = keccak256("new-endpoint");

        vm.prank(alice);
        registry.updateDocument(newMethods, newServiceHash);

        IDIDRegistryLocal.DIDDocument memory doc = registry.resolveDID(alice);
        assertEq(doc.verificationMethods[0], key2);
        assertEq(doc.serviceEndpointHash, newServiceHash);
        assertEq(registry.getNonce(alice), 2);
    }

    function test_updateDocument_emitsEvent() public {
        _createDID(alice);

        bytes32[] memory newMethods = new bytes32[](1);
        newMethods[0] = key2;
        bytes32 newServiceHash = keccak256("new-endpoint");

        vm.expectEmit(true, false, false, true);
        emit IDIDRegistryLocal.DIDUpdated(
            alice,
            keccak256(abi.encode(newMethods, newServiceHash))
        );

        vm.prank(alice);
        registry.updateDocument(newMethods, newServiceHash);
    }

    function test_updateDocument_revert_notController() public {
        _createDID(alice);

        bytes32[] memory methods = new bytes32[](1);
        methods[0] = key2;

        vm.expectRevert(abi.encodeWithSelector(DIDRegistryLocal.NotController.selector, bob, alice));
        vm.prank(bob);
        registry.updateDocument(methods, serviceHash);
    }

    function test_updateDocument_revert_deactivated() public {
        _createDID(alice);
        vm.prank(alice);
        registry.deactivateDID();

        bytes32[] memory methods = new bytes32[](1);
        methods[0] = key2;

        vm.expectRevert(abi.encodeWithSelector(DIDRegistryLocal.DIDNotActive.selector, alice));
        vm.prank(alice);
        registry.updateDocument(methods, serviceHash);
    }

    // ── deactivateDID ──────────────────────────────────────────

    function test_deactivateDID_success() public {
        _createDID(alice);

        vm.prank(alice);
        registry.deactivateDID();

        assertFalse(registry.isActive(alice));
    }

    function test_deactivateDID_emitsEvent() public {
        _createDID(alice);

        vm.expectEmit(true, false, false, false);
        emit IDIDRegistryLocal.DIDDeactivated(alice);

        vm.prank(alice);
        registry.deactivateDID();
    }

    function test_deactivateDID_revert_notController() public {
        _createDID(alice);

        vm.expectRevert(abi.encodeWithSelector(DIDRegistryLocal.NotController.selector, bob, alice));
        vm.prank(bob);
        registry.deactivateDID();
    }

    // ── addDelegate ────────────────────────────────────────────

    function test_addDelegate_success() public {
        _createDID(alice);

        vm.prank(alice);
        registry.addDelegate(bob, 3600); // 1 hour

        assertTrue(registry.isDelegate(alice, bob));
    }

    function test_addDelegate_emitsEvent() public {
        _createDID(alice);

        vm.expectEmit(true, true, false, true);
        emit IDIDRegistryLocal.DelegateAdded(alice, bob, block.timestamp + 3600);

        vm.prank(alice);
        registry.addDelegate(bob, 3600);
    }

    function test_addDelegate_expires() public {
        _createDID(alice);

        vm.prank(alice);
        registry.addDelegate(bob, 3600);

        assertTrue(registry.isDelegate(alice, bob));

        vm.warp(block.timestamp + 3601);
        assertFalse(registry.isDelegate(alice, bob));
    }

    function test_addDelegate_revert_zeroValidity() public {
        _createDID(alice);

        vm.expectRevert(DIDRegistryLocal.InvalidValidityPeriod.selector);
        vm.prank(alice);
        registry.addDelegate(bob, 0);
    }

    function test_addDelegate_revert_deactivated() public {
        _createDID(alice);
        vm.prank(alice);
        registry.deactivateDID();

        vm.expectRevert(abi.encodeWithSelector(DIDRegistryLocal.DIDNotActive.selector, alice));
        vm.prank(alice);
        registry.addDelegate(bob, 3600);
    }

    // ── revokeDelegate ─────────────────────────────────────────

    function test_revokeDelegate_success() public {
        _createDID(alice);

        vm.prank(alice);
        registry.addDelegate(bob, 3600);
        assertTrue(registry.isDelegate(alice, bob));

        vm.prank(alice);
        registry.revokeDelegate(bob);
        assertFalse(registry.isDelegate(alice, bob));
    }

    function test_revokeDelegate_emitsEvent() public {
        _createDID(alice);
        vm.prank(alice);
        registry.addDelegate(bob, 3600);

        vm.expectEmit(true, true, false, false);
        emit IDIDRegistryLocal.DelegateRevoked(alice, bob);

        vm.prank(alice);
        registry.revokeDelegate(bob);
    }

    function test_revokeDelegate_revert_notFound() public {
        _createDID(alice);

        vm.expectRevert(abi.encodeWithSelector(DIDRegistryLocal.DelegateNotFound.selector, charlie));
        vm.prank(alice);
        registry.revokeDelegate(charlie);
    }

    // ── resolveDID ─────────────────────────────────────────────

    function test_resolveDID_revert_notFound() public {
        vm.expectRevert(abi.encodeWithSelector(DIDRegistryLocal.DIDNotFound.selector, alice));
        registry.resolveDID(alice);
    }

    // ── isActive ───────────────────────────────────────────────

    function test_isActive_false_noIdentity() public view {
        assertFalse(registry.isActive(alice));
    }

    function test_isActive_true_afterCreate() public {
        _createDID(alice);
        assertTrue(registry.isActive(alice));
    }

    function test_isActive_false_afterDeactivate() public {
        _createDID(alice);
        vm.prank(alice);
        registry.deactivateDID();
        assertFalse(registry.isActive(alice));
    }

    // ── Helper ─────────────────────────────────────────────────

    function _createDID(address user) internal {
        bytes32[] memory methods = new bytes32[](1);
        methods[0] = keccak256(abi.encodePacked("pubkey_", user));

        vm.prank(user);
        registry.createDID(methods, serviceHash);
    }
}

Step 4: 运行测试

cd contracts && forge test --match-contract DIDRegistryTest -v

Expected: 所有 ~20 个测试通过

Step 5: Commit

git add contracts/src/did/IDIDRegistryLocal.sol \
        contracts/src/did/DIDRegistryLocal.sol \
        contracts/test/DIDRegistry.t.sol
git commit -m "test(did): DIDRegistry Foundry tests — 20 tests covering CRUD + delegation"

Task 6: Foundry 测试 — CredentialRegistry + IdentityVerifier

Files:

Create: contracts/src/did/CredentialRegistryLocal.sol
Create: contracts/src/did/IdentityVerifierLocal.sol
Create: contracts/test/CredentialRegistry.t.sol
Create: contracts/test/IdentityVerifier.t.sol

Step 1: 创建 CredentialRegistryLocal

Create contracts/src/did/CredentialRegistryLocal.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {IDIDRegistryLocal} from "./IDIDRegistryLocal.sol";

/// @dev Local Foundry-testable version of CredentialRegistry.
contract CredentialRegistryLocal {
    struct Credential {
        address issuer;
        address subject;
        bytes32 credentialType;
        bytes32 claimHash;
        uint64 issuedAt;
        uint64 expiresAt;
    }

    event CredentialIssued(bytes32 indexed credentialId, address indexed issuer, address indexed subject, bytes32 credentialType);
    event CredentialRevoked(bytes32 indexed credentialId, address indexed issuer);

    IDIDRegistryLocal public didRegistry;

    mapping(bytes32 => Credential) private _credentials;
    mapping(bytes32 => bool) private _revoked;
    mapping(address => bytes32[]) private _issuedByIssuer;
    mapping(address => bytes32[]) private _heldBySubject;

    error CredentialNotFound(bytes32 credentialId);
    error CredentialAlreadyRevoked(bytes32 credentialId);
    error NotCredentialIssuer(address caller, address issuer);
    error IssuerDIDNotActive(address issuer);
    error SubjectDIDNotActive(address subject);
    error InvalidExpiry();
    error EmptyClaimHash();

    constructor(address _didRegistry) {
        didRegistry = IDIDRegistryLocal(_didRegistry);
    }

    function issueCredential(
        address subject,
        bytes32 credentialType,
        bytes32 claimHash,
        uint64 expiresAt
    ) external returns (bytes32 credentialId) {
        if (claimHash == bytes32(0)) revert EmptyClaimHash();
        if (expiresAt != 0 && expiresAt <= block.timestamp) revert InvalidExpiry();
        if (!didRegistry.isActive(msg.sender)) revert IssuerDIDNotActive(msg.sender);
        if (!didRegistry.isActive(subject)) revert SubjectDIDNotActive(subject);

        uint64 issuedAt = uint64(block.timestamp);
        credentialId = keccak256(abi.encode(msg.sender, subject, credentialType, claimHash, issuedAt));

        _credentials[credentialId] = Credential({
            issuer: msg.sender,
            subject: subject,
            credentialType: credentialType,
            claimHash: claimHash,
            issuedAt: issuedAt,
            expiresAt: expiresAt
        });

        _issuedByIssuer[msg.sender].push(credentialId);
        _heldBySubject[subject].push(credentialId);

        emit CredentialIssued(credentialId, msg.sender, subject, credentialType);
    }

    function revokeCredential(bytes32 credentialId) external {
        Credential storage cred = _credentials[credentialId];
        if (cred.issuer == address(0)) revert CredentialNotFound(credentialId);
        if (cred.issuer != msg.sender) revert NotCredentialIssuer(msg.sender, cred.issuer);
        if (_revoked[credentialId]) revert CredentialAlreadyRevoked(credentialId);
        _revoked[credentialId] = true;
        emit CredentialRevoked(credentialId, msg.sender);
    }

    function getCredential(bytes32 credentialId) external view returns (Credential memory) {
        Credential storage cred = _credentials[credentialId];
        if (cred.issuer == address(0)) revert CredentialNotFound(credentialId);
        return cred;
    }

    function isCredentialValid(bytes32 credentialId) external view returns (bool) {
        Credential storage cred = _credentials[credentialId];
        if (cred.issuer == address(0)) return false;
        if (_revoked[credentialId]) return false;
        if (cred.expiresAt != 0 && cred.expiresAt <= block.timestamp) return false;
        if (!didRegistry.isActive(cred.issuer)) return false;
        return true;
    }

    function getCredentialsBySubject(address subject) external view returns (bytes32[] memory) {
        return _heldBySubject[subject];
    }

    function getCredentialsByIssuer(address issuer) external view returns (bytes32[] memory) {
        return _issuedByIssuer[issuer];
    }

    function isRevoked(bytes32 credentialId) external view returns (bool) {
        return _revoked[credentialId];
    }
}

Step 2: 创建 IdentityVerifierLocal

Create contracts/src/did/IdentityVerifierLocal.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {IDIDRegistryLocal} from "./IDIDRegistryLocal.sol";
import {CredentialRegistryLocal} from "./CredentialRegistryLocal.sol";

/// @dev Local Foundry-testable version of IdentityVerifier.
contract IdentityVerifierLocal {
    enum VerificationMode { ECDSA, ZK_PLONK }

    event ComplianceUpdated(address indexed identity, bytes32 indexed requirement, bool status);
    event TrustedIssuerAdded(address indexed issuer);
    event TrustedIssuerRemoved(address indexed issuer);

    IDIDRegistryLocal public didRegistry;
    CredentialRegistryLocal public credentialRegistry;
    address public admin;

    VerificationMode private _currentMode;
    mapping(address => bool) private _trustedIssuers;
    mapping(address => mapping(bytes32 => bool)) private _compliance;

    error IssuerNotTrusted(address issuer);
    error IdentityNotActive(address identity);
    error AlreadyTrustedIssuer(address issuer);
    error NotTrustedIssuer(address issuer);
    error OnlyAdmin();

    modifier onlyAdmin() {
        if (msg.sender != admin) revert OnlyAdmin();
        _;
    }

    constructor(address _didRegistry, address _credentialRegistry, address _admin) {
        didRegistry = IDIDRegistryLocal(_didRegistry);
        credentialRegistry = CredentialRegistryLocal(_credentialRegistry);
        admin = _admin;
    }

    function verifyIdentity(address identity, bytes32 credentialType) external view returns (bool) {
        if (!didRegistry.isActive(identity)) return false;

        bytes32[] memory credIds = credentialRegistry.getCredentialsBySubject(identity);
        for (uint256 i = 0; i < credIds.length; i++) {
            if (!credentialRegistry.isCredentialValid(credIds[i])) continue;

            CredentialRegistryLocal.Credential memory cred = credentialRegistry.getCredential(credIds[i]);
            if (cred.credentialType == credentialType && _trustedIssuers[cred.issuer]) {
                return true;
            }
        }
        return false;
    }

    function checkCompliance(address identity, bytes32 requirement) external view returns (bool) {
        if (!didRegistry.isActive(identity)) return false;
        return _compliance[identity][requirement];
    }

    function setCompliance(address identity, bytes32 requirement, bool status) external {
        if (!_trustedIssuers[msg.sender]) revert IssuerNotTrusted(msg.sender);
        if (!didRegistry.isActive(identity)) revert IdentityNotActive(identity);
        _compliance[identity][requirement] = status;
        emit ComplianceUpdated(identity, requirement, status);
    }

    function addTrustedIssuer(address issuer) external onlyAdmin {
        if (_trustedIssuers[issuer]) revert AlreadyTrustedIssuer(issuer);
        _trustedIssuers[issuer] = true;
        emit TrustedIssuerAdded(issuer);
    }

    function removeTrustedIssuer(address issuer) external onlyAdmin {
        if (!_trustedIssuers[issuer]) revert NotTrustedIssuer(issuer);
        _trustedIssuers[issuer] = false;
        emit TrustedIssuerRemoved(issuer);
    }

    function isTrustedIssuer(address issuer) external view returns (bool) {
        return _trustedIssuers[issuer];
    }

    function currentMode() external view returns (VerificationMode) {
        return _currentMode;
    }
}

Step 3: 创建 CredentialRegistry 测试

Create contracts/test/CredentialRegistry.t.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import "forge-std/Test.sol";
import "../src/did/DIDRegistryLocal.sol";
import "../src/did/CredentialRegistryLocal.sol";

contract CredentialRegistryTest is Test {
    DIDRegistryLocal public didRegistry;
    CredentialRegistryLocal public credRegistry;

    address issuer = makeAddr("issuer");
    address subject = makeAddr("subject");
    address stranger = makeAddr("stranger");

    bytes32 KYC_TYPE = keccak256("KYC");
    bytes32 claimHash = keccak256("claim_data_json");

    function setUp() public {
        didRegistry = new DIDRegistryLocal();
        credRegistry = new CredentialRegistryLocal(address(didRegistry));

        // Create DIDs for issuer and subject
        _createDID(issuer);
        _createDID(subject);
    }

    // ── issueCredential ────────────────────────────────────────

    function test_issueCredential_success() public {
        bytes32 credId = _issueKYC(issuer, subject, 0);

        CredentialRegistryLocal.Credential memory cred = credRegistry.getCredential(credId);
        assertEq(cred.issuer, issuer);
        assertEq(cred.subject, subject);
        assertEq(cred.credentialType, KYC_TYPE);
        assertEq(cred.claimHash, claimHash);
        assertTrue(credRegistry.isCredentialValid(credId));
    }

    function test_issueCredential_emitsEvent() public {
        vm.expectEmit(false, true, true, true);
        emit CredentialRegistryLocal.CredentialIssued(bytes32(0), issuer, subject, KYC_TYPE);

        vm.prank(issuer);
        credRegistry.issueCredential(subject, KYC_TYPE, claimHash, 0);
    }

    function test_issueCredential_withExpiry() public {
        uint64 expiry = uint64(block.timestamp + 365 days);
        bytes32 credId = _issueKYC(issuer, subject, expiry);
        assertTrue(credRegistry.isCredentialValid(credId));

        // After expiry
        vm.warp(expiry + 1);
        assertFalse(credRegistry.isCredentialValid(credId));
    }

    function test_issueCredential_revert_emptyClaimHash() public {
        vm.expectRevert(CredentialRegistryLocal.EmptyClaimHash.selector);
        vm.prank(issuer);
        credRegistry.issueCredential(subject, KYC_TYPE, bytes32(0), 0);
    }

    function test_issueCredential_revert_pastExpiry() public {
        vm.expectRevert(CredentialRegistryLocal.InvalidExpiry.selector);
        vm.prank(issuer);
        credRegistry.issueCredential(subject, KYC_TYPE, claimHash, uint64(block.timestamp - 1));
    }

    function test_issueCredential_revert_issuerNoDID() public {
        vm.expectRevert(abi.encodeWithSelector(CredentialRegistryLocal.IssuerDIDNotActive.selector, stranger));
        vm.prank(stranger);
        credRegistry.issueCredential(subject, KYC_TYPE, claimHash, 0);
    }

    function test_issueCredential_revert_subjectNoDID() public {
        vm.expectRevert(abi.encodeWithSelector(CredentialRegistryLocal.SubjectDIDNotActive.selector, stranger));
        vm.prank(issuer);
        credRegistry.issueCredential(stranger, KYC_TYPE, claimHash, 0);
    }

    // ── revokeCredential ───────────────────────────────────────

    function test_revokeCredential_success() public {
        bytes32 credId = _issueKYC(issuer, subject, 0);
        assertTrue(credRegistry.isCredentialValid(credId));

        vm.prank(issuer);
        credRegistry.revokeCredential(credId);

        assertFalse(credRegistry.isCredentialValid(credId));
        assertTrue(credRegistry.isRevoked(credId));
    }

    function test_revokeCredential_emitsEvent() public {
        bytes32 credId = _issueKYC(issuer, subject, 0);

        vm.expectEmit(true, true, false, false);
        emit CredentialRegistryLocal.CredentialRevoked(credId, issuer);

        vm.prank(issuer);
        credRegistry.revokeCredential(credId);
    }

    function test_revokeCredential_revert_notIssuer() public {
        bytes32 credId = _issueKYC(issuer, subject, 0);

        vm.expectRevert(abi.encodeWithSelector(CredentialRegistryLocal.NotCredentialIssuer.selector, subject, issuer));
        vm.prank(subject);
        credRegistry.revokeCredential(credId);
    }

    function test_revokeCredential_revert_alreadyRevoked() public {
        bytes32 credId = _issueKYC(issuer, subject, 0);
        vm.prank(issuer);
        credRegistry.revokeCredential(credId);

        vm.expectRevert(abi.encodeWithSelector(CredentialRegistryLocal.CredentialAlreadyRevoked.selector, credId));
        vm.prank(issuer);
        credRegistry.revokeCredential(credId);
    }

    // ── isCredentialValid edge cases ───────────────────────────

    function test_isCredentialValid_false_issuerDeactivated() public {
        bytes32 credId = _issueKYC(issuer, subject, 0);
        assertTrue(credRegistry.isCredentialValid(credId));

        // Deactivate issuer's DID
        vm.prank(issuer);
        didRegistry.deactivateDID();

        assertFalse(credRegistry.isCredentialValid(credId));
    }

    function test_isCredentialValid_false_nonExistent() public view {
        assertFalse(credRegistry.isCredentialValid(bytes32(0)));
    }

    // ── query functions ────────────────────────────────────────

    function test_getCredentialsBySubject() public {
        _issueKYC(issuer, subject, 0);

        bytes32[] memory creds = credRegistry.getCredentialsBySubject(subject);
        assertEq(creds.length, 1);
    }

    function test_getCredentialsByIssuer() public {
        _issueKYC(issuer, subject, 0);

        bytes32[] memory creds = credRegistry.getCredentialsByIssuer(issuer);
        assertEq(creds.length, 1);
    }

    // ── Helpers ────────────────────────────────────────────────

    function _createDID(address user) internal {
        bytes32[] memory methods = new bytes32[](1);
        methods[0] = keccak256(abi.encodePacked("pubkey_", user));
        vm.prank(user);
        didRegistry.createDID(methods, keccak256("service"));
    }

    function _issueKYC(address _issuer, address _subject, uint64 expiry) internal returns (bytes32) {
        vm.prank(_issuer);
        return credRegistry.issueCredential(_subject, KYC_TYPE, claimHash, expiry);
    }
}

Step 4: 创建 IdentityVerifier 测试

Create contracts/test/IdentityVerifier.t.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import "forge-std/Test.sol";
import "../src/did/DIDRegistryLocal.sol";
import "../src/did/CredentialRegistryLocal.sol";
import "../src/did/IdentityVerifierLocal.sol";

contract IdentityVerifierTest is Test {
    DIDRegistryLocal public didRegistry;
    CredentialRegistryLocal public credRegistry;
    IdentityVerifierLocal public verifier;

    address admin = makeAddr("admin");
    address issuer = makeAddr("issuer");
    address subject = makeAddr("subject");
    address stranger = makeAddr("stranger");

    bytes32 KYC_TYPE = keccak256("KYC");
    bytes32 AML_CLEAR = keccak256("AML_CLEAR");
    bytes32 claimHash = keccak256("claim_data");

    function setUp() public {
        didRegistry = new DIDRegistryLocal();
        credRegistry = new CredentialRegistryLocal(address(didRegistry));
        verifier = new IdentityVerifierLocal(
            address(didRegistry),
            address(credRegistry),
            admin
        );

        _createDID(issuer);
        _createDID(subject);

        // Register issuer as trusted
        vm.prank(admin);
        verifier.addTrustedIssuer(issuer);
    }

    // ── verifyIdentity ─────────────────────────────────────────

    function test_verifyIdentity_true_validCredential() public {
        _issueKYC(issuer, subject);
        assertTrue(verifier.verifyIdentity(subject, KYC_TYPE));
    }

    function test_verifyIdentity_false_noCredential() public view {
        assertFalse(verifier.verifyIdentity(subject, KYC_TYPE));
    }

    function test_verifyIdentity_false_noDID() public view {
        assertFalse(verifier.verifyIdentity(stranger, KYC_TYPE));
    }

    function test_verifyIdentity_false_untrustedIssuer() public {
        // Create a DID for stranger so they can issue
        _createDID(stranger);

        // Issue from stranger (not trusted)
        vm.prank(stranger);
        credRegistry.issueCredential(subject, KYC_TYPE, claimHash, 0);

        assertFalse(verifier.verifyIdentity(subject, KYC_TYPE));
    }

    function test_verifyIdentity_false_revokedCredential() public {
        bytes32 credId = _issueKYC(issuer, subject);

        vm.prank(issuer);
        credRegistry.revokeCredential(credId);

        assertFalse(verifier.verifyIdentity(subject, KYC_TYPE));
    }

    function test_verifyIdentity_false_expiredCredential() public {
        uint64 expiry = uint64(block.timestamp + 1 days);
        vm.prank(issuer);
        credRegistry.issueCredential(subject, KYC_TYPE, claimHash, expiry);

        vm.warp(expiry + 1);
        assertFalse(verifier.verifyIdentity(subject, KYC_TYPE));
    }

    function test_verifyIdentity_false_deactivatedDID() public {
        _issueKYC(issuer, subject);

        vm.prank(subject);
        didRegistry.deactivateDID();

        assertFalse(verifier.verifyIdentity(subject, KYC_TYPE));
    }

    // ── checkCompliance ────────────────────────────────────────

    function test_checkCompliance_true() public {
        vm.prank(issuer);
        verifier.setCompliance(subject, AML_CLEAR, true);

        assertTrue(verifier.checkCompliance(subject, AML_CLEAR));
    }

    function test_checkCompliance_false_notSet() public view {
        assertFalse(verifier.checkCompliance(subject, AML_CLEAR));
    }

    function test_checkCompliance_false_deactivatedDID() public {
        vm.prank(issuer);
        verifier.setCompliance(subject, AML_CLEAR, true);

        vm.prank(subject);
        didRegistry.deactivateDID();

        assertFalse(verifier.checkCompliance(subject, AML_CLEAR));
    }

    // ── setCompliance ──────────────────────────────────────────

    function test_setCompliance_emitsEvent() public {
        vm.expectEmit(true, true, false, true);
        emit IdentityVerifierLocal.ComplianceUpdated(subject, AML_CLEAR, true);

        vm.prank(issuer);
        verifier.setCompliance(subject, AML_CLEAR, true);
    }

    function test_setCompliance_revert_untrustedIssuer() public {
        vm.expectRevert(abi.encodeWithSelector(IdentityVerifierLocal.IssuerNotTrusted.selector, stranger));
        vm.prank(stranger);
        verifier.setCompliance(subject, AML_CLEAR, true);
    }

    function test_setCompliance_revert_identityNotActive() public {
        vm.expectRevert(abi.encodeWithSelector(IdentityVerifierLocal.IdentityNotActive.selector, stranger));
        vm.prank(issuer);
        verifier.setCompliance(stranger, AML_CLEAR, true);
    }

    // ── Trusted Issuer Management ──────────────────────────────

    function test_addTrustedIssuer_emitsEvent() public {
        vm.expectEmit(true, false, false, false);
        emit IdentityVerifierLocal.TrustedIssuerAdded(stranger);

        vm.prank(admin);
        verifier.addTrustedIssuer(stranger);
    }

    function test_addTrustedIssuer_revert_alreadyTrusted() public {
        vm.expectRevert(abi.encodeWithSelector(IdentityVerifierLocal.AlreadyTrustedIssuer.selector, issuer));
        vm.prank(admin);
        verifier.addTrustedIssuer(issuer);
    }

    function test_addTrustedIssuer_revert_notAdmin() public {
        vm.expectRevert(IdentityVerifierLocal.OnlyAdmin.selector);
        vm.prank(stranger);
        verifier.addTrustedIssuer(stranger);
    }

    function test_removeTrustedIssuer_success() public {
        vm.prank(admin);
        verifier.removeTrustedIssuer(issuer);
        assertFalse(verifier.isTrustedIssuer(issuer));
    }

    function test_removeTrustedIssuer_revert_notTrusted() public {
        vm.expectRevert(abi.encodeWithSelector(IdentityVerifierLocal.NotTrustedIssuer.selector, stranger));
        vm.prank(admin);
        verifier.removeTrustedIssuer(stranger);
    }

    // ── E2E: Full DID → VC → Verify Flow ──────────────────────

    function test_e2e_fullFlow() public {
        // 1. Subject already has DID (from setUp)
        assertTrue(didRegistry.isActive(subject));

        // 2. Issuer issues KYC credential
        bytes32 credId = _issueKYC(issuer, subject);
        assertTrue(credRegistry.isCredentialValid(credId));

        // 3. Verifier confirms identity
        assertTrue(verifier.verifyIdentity(subject, KYC_TYPE));

        // 4. Issuer sets compliance
        vm.prank(issuer);
        verifier.setCompliance(subject, AML_CLEAR, true);
        assertTrue(verifier.checkCompliance(subject, AML_CLEAR));

        // 5. Revoke credential → identity no longer verified
        vm.prank(issuer);
        credRegistry.revokeCredential(credId);
        assertFalse(verifier.verifyIdentity(subject, KYC_TYPE));

        // 6. But compliance flag remains (independent)
        assertTrue(verifier.checkCompliance(subject, AML_CLEAR));
    }

    // ── Helpers ────────────────────────────────────────────────

    function _createDID(address user) internal {
        bytes32[] memory methods = new bytes32[](1);
        methods[0] = keccak256(abi.encodePacked("pubkey_", user));
        vm.prank(user);
        didRegistry.createDID(methods, keccak256("service"));
    }

    function _issueKYC(address _issuer, address _subject) internal returns (bytes32) {
        vm.prank(_issuer);
        return credRegistry.issueCredential(_subject, KYC_TYPE, claimHash, 0);
    }
}

Step 5: 运行所有测试

cd contracts && forge test --match-contract "CredentialRegistryTest|IdentityVerifierTest" -v

Expected: 所有 ~30 个测试通过

Step 6: Commit

git add contracts/src/did/CredentialRegistryLocal.sol \
        contracts/src/did/IdentityVerifierLocal.sol \
        contracts/test/CredentialRegistry.t.sol \
        contracts/test/IdentityVerifier.t.sol
git commit -m "test(did): CredentialRegistry + IdentityVerifier Foundry tests — 30 tests + E2E flow"

Task 7: 系统合约编译验证 + 全套回归

Step 1: 预处理并编译系统合约

cd era-contracts-l1/system-contracts
nvm use 20
yarn preprocess:system-contracts
npx hardhat compile 2>&1 | tail -20

Expected: 所有合约编译成功（包括 DIDRegistry, CredentialRegistry, IdentityVerifier）

Step 2: 编译 bootloader（确认无破坏）

cd era-contracts-l1/system-contracts
yarn preprocess:bootloader && yarn compile-yul compile-bootloader 2>&1 | tail -10

Expected: 7 个 bootloader 变体编译通过

Step 3: Rust 编译检查

cd era-core/core && ZKSYNC_USE_CUDA_STUBS=true cargo check 2>&1 | tail -20

Expected: ~200 crates 编译通过

Step 4: 运行全部 Foundry 测试

cd contracts && forge test -v

Expected: 所有测试通过（DIDRegistry ~20 + CredentialRegistry ~15 + IdentityVerifier ~15 + 现有 ~83）

Step 5: Commit（如有修复）

git add -A && git commit -m "chore(did): compilation verification — all system contracts + Rust + tests pass"

Task 8: 更新开发日志

Files:

Modify: docs/dev-log.md

Step 1: 在 dev-log.md 底部追加 Phase 5a 记录

在文件末尾添加：

---

## 2026-03-04 — Phase 5a: DID 系统核心层 (P0)

### 背景

DID 是 BabyDriver 的去中心化身份基础设施。基于 did:ethr 标准，部署为系统合约，
为后续 ZK 身份证明 (P1) 和企业 IAM (P2) 奠定基础。

### 三个系统合约

**DIDRegistry (0x8017):**
- did:ethr:baby 标识符格式
- DIDDocument 存储：verificationMethods + controller + serviceEndpointHash
- 委托机制：addDelegate/revokeDelegate（时间有效性）
- 访问控制：onlySystemCall (createDID), onlyController (update/deactivate)
- 事件完整覆盖

**CredentialRegistry (0x8018):**
- Verifiable Credential 发行 + 撤销
- 双方 DID 活跃性验证（issuer + subject 必须有活跃 DID）
- CredentialId = keccak256(issuer, subject, type, claimHash, issuedAt)
- 有效性检查：未撤销 + 未过期 + issuer DID 仍活跃
- 按 issuer/subject 索引查询

**IdentityVerifier (0x8019):**
- 双模式设计：ECDSA (P0) → ZK_PLONK (P1)
- verifyIdentity(): 查找 trusted issuer 发行的有效凭证
- checkCompliance(): 合规标记查询
- Trusted Issuer 管理（bootloader 控制）

### 改动文件

| 文件 | 改动 |
|------|------|
| Constants.sol | +3 地址常量 (0x8017-0x8019) |
| constants.ts | +3 系统合约注册 |
| contracts.rs | +3 Rust 地址常量 |
| system_contracts.rs | SYSTEM_CONTRACT_LIST 41→44 |
| DIDRegistry.sol + IDIDRegistry.sol | 新建 |
| CredentialRegistry.sol + ICredentialRegistry.sol | 新建 |
| IdentityVerifier.sol + IIdentityVerifier.sol | 新建 |
| contracts/src/did/*.sol | 本地测试版 (Foundry) |
| contracts/test/DIDRegistry.t.sol | ~20 测试 |
| contracts/test/CredentialRegistry.t.sol | ~15 测试 |
| contracts/test/IdentityVerifier.t.sol | ~15 测试 + E2E |

Step 2: Commit

git add docs/dev-log.md
git commit -m "docs: Phase 5a dev log — DID system contracts (0x8017-0x8019)"

验证清单

完成所有 8 个 Task 后，确认以下全部通过：

PreviousDID 核心 — 设计 NextZK 身份 + Oracle — 设计

Last updated 10 minutes ago

Good morning

hashtag关键参考文件

hashtagTask 1: 地址常量注册（基础设施）

hashtagStep 1: 在 Constants.sol 添加 DID 系统合约地址

hashtagStep 2: 在 TypeScript constants.ts 注册

hashtagStep 3: 在 Rust contracts.rs 添加地址常量

hashtagStep 4: 在 SYSTEM_CONTRACT_LIST 注册

hashtagStep 5: 验证编译

hashtagStep 6: Commit

hashtagTask 2: IDIDRegistry 接口 + DIDRegistry 合约

hashtagStep 1: 创建 IDIDRegistry 接口

hashtagStep 2: 创建 DIDRegistry 系统合约

hashtagStep 3: 验证编译

hashtagStep 4: Commit

hashtagTask 3: ICredentialRegistry 接口 + CredentialRegistry 合约

hashtagStep 1: 创建 ICredentialRegistry 接口

hashtagStep 2: 创建 CredentialRegistry 系统合约

hashtagStep 3: 验证编译

hashtagStep 4: Commit

hashtagTask 4: IIdentityVerifier 接口 + IdentityVerifier 合约

hashtagStep 1: 创建 IIdentityVerifier 接口

hashtagStep 2: 创建 IdentityVerifier 系统合约

hashtagStep 3: 验证编译

hashtagStep 4: Commit

hashtagTask 5: Foundry 测试 — DIDRegistry

hashtagStep 1: 创建本地测试用接口

hashtagStep 2: 创建本地测试版 DIDRegistry

hashtagStep 3: 编写 Foundry 测试

hashtagStep 4: 运行测试

hashtagStep 5: Commit

hashtagTask 6: Foundry 测试 — CredentialRegistry + IdentityVerifier

hashtagStep 1: 创建 CredentialRegistryLocal

hashtagStep 2: 创建 IdentityVerifierLocal

hashtagStep 3: 创建 CredentialRegistry 测试

hashtagStep 4: 创建 IdentityVerifier 测试

hashtagStep 5: 运行所有测试

hashtagStep 6: Commit

hashtagTask 7: 系统合约编译验证 + 全套回归

hashtagStep 1: 预处理并编译系统合约

hashtagStep 2: 编译 bootloader（确认无破坏）

hashtagStep 3: Rust 编译检查

hashtagStep 4: 运行全部 Foundry 测试

hashtagStep 5: Commit（如有修复）

hashtagTask 8: 更新开发日志

hashtagStep 1: 在 dev-log.md 底部追加 Phase 5a 记录

hashtagStep 2: Commit

hashtag验证清单

关键参考文件

Task 1: 地址常量注册（基础设施）

Step 1: 在 Constants.sol 添加 DID 系统合约地址

Step 2: 在 TypeScript constants.ts 注册

Step 3: 在 Rust contracts.rs 添加地址常量

Step 4: 在 SYSTEM_CONTRACT_LIST 注册

Step 5: 验证编译

Step 6: Commit

Task 2: IDIDRegistry 接口 + DIDRegistry 合约

Step 1: 创建 IDIDRegistry 接口

Step 2: 创建 DIDRegistry 系统合约

Step 3: 验证编译

Step 4: Commit

Task 3: ICredentialRegistry 接口 + CredentialRegistry 合约

Step 1: 创建 ICredentialRegistry 接口

Step 2: 创建 CredentialRegistry 系统合约

Step 3: 验证编译

Step 4: Commit

Task 4: IIdentityVerifier 接口 + IdentityVerifier 合约

Step 1: 创建 IIdentityVerifier 接口

Step 2: 创建 IdentityVerifier 系统合约

Step 3: 验证编译

Step 4: Commit

Task 5: Foundry 测试 — DIDRegistry

Step 1: 创建本地测试用接口

Step 2: 创建本地测试版 DIDRegistry

Step 3: 编写 Foundry 测试

Step 4: 运行测试

Step 5: Commit

Task 6: Foundry 测试 — CredentialRegistry + IdentityVerifier

Step 1: 创建 CredentialRegistryLocal

Step 2: 创建 IdentityVerifierLocal

Step 3: 创建 CredentialRegistry 测试

Step 4: 创建 IdentityVerifier 测试

Step 5: 运行所有测试

Step 6: Commit

Task 7: 系统合约编译验证 + 全套回归

Step 1: 预处理并编译系统合约

Step 2: 编译 bootloader（确认无破坏）

Step 3: Rust 编译检查

Step 4: 运行全部 Foundry 测试

Step 5: Commit（如有修复）

Task 8: 更新开发日志

Step 1: 在 dev-log.md 底部追加 Phase 5a 记录

Step 2: Commit

验证清单