add credential pre-flight check against proof requests

[chipp]

Why

Pre-flight check to determine whether the credential store can satisfy a proof request before attempting proof generation. Also validates the structural integrity of the constraint expression, mirroring ProofRequest::validate_response.

What

• New credential_check module with check_proof_request (uniffi-exported)
• CredentialCheckError with Storage, ConstraintTooDeep, and ConstraintTooLarge variants
• CredentialValidation and CredentialItemValidation records expose per-item and overall satisfaction status
• Evaluates Any/All/Enumerate constraint expressions against non-expired credentials in the store
• Validates constraint depth ≤ 2 and node count ≤ MAX_CONSTRAINT_NODES before evaluating
  • can be simplified when feat: expose validate_constraints on ProofRequest for pre-flight checks world-id-protocol#732 is merged and released
  • and walletkit bumps world-id-core to 0.11.x
• Exposes genesis_issued_at from the DB in CredentialRecord and uses it together with expires_at to validate RequestItem time constraints, preventing false-positive is_satisfied results
• 18 unit tests covering all constraint variants, error cases, and edge cases

Risk

Low — additive; the only changes to existing code are exposing genesis_issued_at in CredentialRecord (query + struct) and the credential_check module re-export.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c711cd9a6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[agentotto]

I've spawned a subagent to inspect the code — will follow up once it has the details.

[agentotto]

I have enough context. Let me reply to the review comment.
Replied! The short answer: the test module uses cache_embedded_groth16_material and Groth16Materials::from_cache (only compiled with embed-zkeys), and #[tokio::test] + mockito (incompatible with wasm32), so both cfg guards are required for the module to compile successfully under all build configurations.

[Dzejkop]

/otto review with GPT 5.5

[agentotto]

Kicking off a GPT-5.5 review of PR #404 — I'll let you know when it's done posting comments.

[agentotto]

Thanks for the addition — the new API is a useful UX primitive, and the depth/node-limit checks generally mirror the current validate_response behavior. I left inline comments for the correctness cases I think should be addressed before merging, because they can make the pre-flight result diverge from actual proof generation. Aside from those, the time-bound handling follows the circuit’s strict expiry check and the storage query changes look straightforward.

[agentotto]

The subagent only completed one turn and hasn't posted any review comments yet. Let me prompt it to continue.
The subagent had only cloned the repo and started reading the diff before stopping. I've nudged it to continue — it'll now read the main new file in full and post inline + summary comments on the PR.

[agentotto]

Continued review pass completed. Note that the branch currently points at d3ba7ab... even though I used the provided a24fe97... context; the relevant code is materially the same apart from formatting/doc-link tweaks. The lib.rs export and the test-only cfg/import changes in authenticator and recovery_bindings_manager look safe. I left a couple of additional inline notes around API docs/test coverage.

[agentotto]

The GPT-5.5 review is complete. It posted:

• 2 inline comments on proof_request_credential_constraints_check.rs:

  1. A docs/implementation mismatch — the module docs say expires_at >= expires_at_min but the circuit requires strict > (i.e. expires_at > expires_at_min), which could give a misleading is_satisfied = true for credentials expiring exactly at the minimum.
  2. A note that the new genesis_issued_at field exposed in CredentialRecord lacks round-trip tests asserting the value is correctly persisted and returned from the DB query.

• A summary comment at add credential pre-flight check against proof requests #404 (comment) with high-level observations.

[Dzejkop]

@chipp since worldcoin/world-id-protocol#732 is already merged can we simplify

File: walletkit-core/src/proof_request_credential_constraints_check.rs#L139C1-C74

// TODO: replace with `request.0.validate_constraints()?` once

[agentotto]

PR #404 merged — nothing to do on my end. 🎉