OpenChainGraph Suite · ART-811 · Private-Input Profile · Pilot
Private-Input Debt-to-Income Within Policy Check
The verdict is public. The inputs are not in the receipt. A receipt made from inputs you gave a server was seen by that server.
Shows that the committed monthly debt obligations are at most the chosen share of the committed monthly income. The share comes from a fixed list. It does not show that every debt was listed or that the income is real.
Each receipt answers one yes/no question. Asking many questions about the same figures at different shares reveals more.
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data. Use synthetic or anonymised inputs only. Income and debt amounts stay a private witness; only two salted commitments and the yes/no verdict appear in the artifact. Salts are generated here with crypto.getRandomValues and held in memory only.
What the rule says and does not say
12 CFR 1026.51(a)(1)(ii) requires a card issuer to have reasonable written policies and procedures that consider, among other things, the ratio of debt obligations to income, and treats it as unreasonable to issue a card to a consumer who has no income or assets. The regulation names no ratio. The share on this page is the issuer's own policy figure, chosen from a fixed list so the choice does not become a probe. The list is our design choice; the regulation prescribes none of it.
Assets are out of scope here: a zero income always gives “not within policy”, even if the consumer holds assets. The minimum-payment estimate in paragraph (a)(2) is not checked.
Private witness (never leaves this page in the clear)
Exactly 16 monthly debt slots. Leave unused slots at 0, so the committed witness has the same length whatever the number of debts. Amounts are whole minor units (for example cents), digits only, at most 20 digits.
SlotMonthly obligation (minor units)
Private. Committed separately from the debts, so it can be opened to an employment-verification party on its own.
Fresh CSPRNG salt for this run. Never included in the artifact. Do not reuse across artifacts.
A second, independent salt. Never included in the artifact.
Public inputs
Public. Debts must be at most this share of income. Fixed list only.
Public label for the minor unit of every amount.
Public. The date the figures describe.
Preview, not a receipt. Nothing here is proven; the proof for this node is deferred.
Verdict detail
Private-input declaration (section 25)
Execution hash (SHA-256)
Export decision: the exported file is the artifact, which holds the verdict, the public inputs and two commitments. It never holds an amount or a salt. The witness download is a separate file for you to keep; whoever holds it can open both commitments, so treat it as a secret.
Limits of the check
The check takes both committed numbers as given. It cannot tell whether the income is income to which the consumer has a reasonable expectation of access, whether every current obligation was listed, or whether the committed figures are the true ones. It does not compute the minimum-payment estimate in paragraph (a)(2), and it does not look at assets.
The ratio itself is never computed in the output and no band is published. The share is the issuer's own policy; the regulation sets no figure.
What leaks
One bit per receipt: within policy or not. The public inputs (share, unit, date) are a disclosure you choose.
Many receipts over the same figures at different shares reveal more. About fourteen receipts at chosen shares would pin the ratio to roughly one basis point by binary search. The fixed list of four shares limits this but does not remove it.
The Groth16 receipt this node would carry has no cycle count in its claim. We make no claim that execution length is hidden, and a composite receipt would show its segment count, so private nodes are not published as composite receipts.
Whoever runs the prover sees the inputs. Hiding holds only against verifiers, and only if the proof is generated where the inputs already live.
Run it yourself
Use this page on synthetic figures. It shows both commitments and the verdict, labelled preview, not a receipt.
Download the witness to keep your salts; they are not stored anywhere else.
On your own machine, with the repository checked out, write a witness file in the same shape (16 debt slots, 20-digit amounts, one income, two fresh salts) and run the section 25 private-input guest in exec mode to check the verdict and cycle count.
Prove and wrap to a Groth16 receipt on your own hardware (a risc0 toolchain is needed), then verify it locally against the node's image id. Proving stays off-band; this page never proves.
Share the artifact and the receipt, never the witness.
The MCP route sends your inputs to the Worker and is not private. Use it only on synthetic data.