Complete module fix: binary-only, restore proof, clean structure

src/lib.rs

@@ -1,8 +0,0 @@
-pub mod handlers;
-pub mod inference;
-pub mod shield;
-pub mod web3;
-pub mod orchestrator;
-pub mod proof;
-pub mod api;
-pub mod federation;

src/main.rs

@@ -5,7 +5,6 @@ use tracing_subscriber::EnvFilter;
 
 mod handlers;
 mod inference;
-mod lib;
 mod shield;
 mod web3;
 mod orchestrator;
@@ -13,7 +12,8 @@ mod proof;
 mod api;
 mod federation;
 
-use rustvital_amd::handlers;
+// use the handler directly from the crate root, not from a separate library
+use handlers::triage;
 
 #[derive(Serialize)]
 struct StatusResponse {
@@ -29,9 +29,8 @@ async fn main() -> anyhow::Result<()> {
         .with_env_filter(EnvFilter::from_default_env().add_directive("rustvital_amd=debug".parse()?))
         .init();
 
-    // Init zk-lite signing key (demo key; replace with env var in production)
-    let demo_key = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
-    proof::init_signing_key(demo_key);
+    // Init zk-lite signing key
+    proof::init_signing_key("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef");
 
     let port = std::env::var("PORT").unwrap_or_else(|_| "3000".to_string());
     let addr = format!("0.0.0.0:{}", port);
@@ -41,7 +40,7 @@ async fn main() -> anyhow::Result<()> {
         .route("/", get(serve_ui))
         .route("/health", get(|| async { "healthy" }))
         .route("/status", get(status))
-        .route("/triage", post(handlers::triage::handle))
+        .route("/triage", post(triage::handle))
         .route("/triage/stream", get(api::stream::triage_stream))
         .route("/trigger-federated-tune", post(federation::trigger_tune))
         .route("/federation/round", get(federation::latest_round))

src/proof.rs

@@ -1,13 +1,25 @@
+use k256::ecdsa::{SigningKey, Signature, signature::Signer};
 use sha2::{Digest, Sha256};
 use crate::shield::redact::PiiMatch;
+use std::sync::OnceLock;
+
+static SIGNING_KEY: OnceLock<SigningKey> = OnceLock::new();
+
+pub fn init_signing_key(hex_key: &str) {
+    let key = SigningKey::from_slice(&hex::decode(hex_key).unwrap()).unwrap();
+    let _ = SIGNING_KEY.set(key);
+}
 
 pub fn generate_proof(original: &str, pii_map: &[PiiMatch]) -> String {
+    let sk = SIGNING_KEY.get().expect("Signing key not initialised");
     let mut hasher = Sha256::new();
-    hasher.update(original.as_bytes());
+    hasher.update(original);
     for m in pii_map {
         hasher.update(m.entity_type.as_bytes());
         hasher.update(m.original.as_bytes());
         hasher.update(m.placeholder.as_bytes());
     }
-    hex::encode(hasher.finalize())
+    let digest = hasher.finalize();
+    let sig: Signature = sk.sign(&digest);
+    hex::encode(sig.to_bytes())
 }