feat(pcp): support five-party DI embedding shares [HARD-2109] by ShevchenkoRostyslav · Pull Request #1480 · worldcoin/orb-software

ShevchenkoRostyslav · 2026-11-10T13:30:27Z

Adds optional manifest hash fields (tags 61–65) for di_iris_embeddings_5_party_shares_0.pb through _4.pb, a five-party family of DI embedding shares. Each file holds one recipient's DiIrisEmbeddingShares, the message the three-party family already uses; the filename identifies the family, and index i holds Shamir ID i + 1.

Di accepts an optional owned array of five recipient bundles through Di::embeddings(embeddings).di_embedding_5_party_shares(bundles).shares(shares). When supplied, all five files are written with signed hashes alongside the existing three-party DI files. Omitting the input or the DI group, or redacting biometrics, omits the family. Di checks both families the same way: each share needs its record and the embedding's model and embedding versions. Share payloads and encoded buffers are zeroized on drop.

PCP version remains 2.8. Callers own share generation, dimension and value validation, and enabling five-party shares only for compatible consumers.

Replaces #1466 by @evagelia, rebuilt on current main. The earlier review discussion is in #1466.

Validation

cargo test -p orb-pcp -p orb-pcp-defs --all-features --all-targets --locked: 89 passed; the two existing fixture tests remain ignored.
Clippy with -D warnings, rustfmt, rustdoc with -D warnings, the build_pcp example, buf lint, buf format and buf breaking against main pass.
Not run locally: Linux/Android builds and end-to-end consumer acceptance.

AI-assisted-by: Codex, Claude Code

🤖 Generated with Claude Code

Add the `Orbit5DiIrisEmbeddingShares` protobuf payload and five optional `Hashes` fields, tags 61-65, for `orbit5_di_iris_embeddings_shares_0.pb` through `_4.pb`. `Di` takes an optional owned array of five ORBIT5 recipient bundles through `orbit5_di_embedding_shares`. When it is supplied, the builder writes all five files with signed hashes alongside the three-party DI files. Omitting the input or the DI group, or redacting biometrics, omits the family. Share payloads and their encoded buffers are zeroized on drop. The PCP version remains 2.8. Co-authored-by: Evangelia <6171986+evagelia@users.noreply.github.com> AI-assisted-by: Codex, Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Name the family `di_iris_embeddings_5_party_shares_{0..4}.pb`, with `DiIrisEmbedding5PartyShares` and `DiIrisEmbedding5PartyShareV1` messages and the `di_embedding_5_party_shares` builder input. The filenames are signed manifest keys, so they describe the sharing scheme rather than a project. Hashes tags 61-65 and the wire format are unchanged. AI-assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Five-party files encode `DiIrisEmbeddingShares`, field for field the three-party message; the filename identifies the family. `Di::new` applies the same record and version checks to both families, so empty or mismatched bundles are rejected before signing. Errors name the family and share index. Tests pin the tier0 layout with and without the five-party family and give each five-party share distinct contents. AI-assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The PCP version stays 2.8, so readers detect the family by its files and manifest keys. Issued packages keep the family, so producers enable it only after every reader of their packages accepts it. AI-assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ShevchenkoRostyslav

LGTM

The pcp-defs README documents the Shamir ID mapping and how readers identify each share family. AI-assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

evagelia

lgtm as well!

ShevchenkoRostyslav requested a review from a team as a code owner November 10, 2026 13:30

ShevchenkoRostyslav requested review from danielle-tfh and evagelia November 10, 2026 13:30