Noir Catalyst

a Noir circuit takes the sensitive value as a private input and the bound as a `pub` input, then states the claim as an assertion — `fn main(dob_year: u32, threshold: pub u32) { assert(dob_year <= threshold) }`. A proof exists only when the assertion holds, so the verifier learns the verdict and nothing else: no age, no salary, no score, no location

the circuit hashes the private witness and returns the digest as a public output — `std::hash::pedersen_hash([secret_lo, secret_hi])` over the two 128-bit limbs of a SHA-256 digest, because a 256-bit hash does not fit in one BN254 field. Pedersen is deterministic, so the same secret always yields the same commitment: two proofs can be linked to one hidden document, and a verifier can recognise it without ever seeing it

publish a Merkle root of the allowed set, then prove a private leaf and its private sibling path hash up to that public root. The circuit recomputes the path and asserts equality with the root, so membership is proved while the identity of the member — and the size and order of the set — stay private

verify an ECDSA (secp256k1/secp256r1) or EdDSA signature inside the circuit — `std::ecdsa_secp256k1::verify_signature(pub_key_x, pub_key_y, signature, message_hash)` — with the signed payload private and the issuer's public key public. The proof says 'a named authority signed something with these properties' without publishing the signed document itself

verify one proof inside another with `std::verify_proof`, folding several independent claims into a single succinct proof. The inner proofs' public inputs become private witnesses of the outer circuit, so a chain of attestations, a batch of transactions or a season of contributions collapses to one artefact a verifier checks once