feat(pattern): add Confidential Policy Verdicts

[mzf11125]

Adds patterns/pattern-confidential-policy-verdicts.md. Across 69 pattern cards, none covers agent policy compliance or confidential allow/deny verdicts.

What it covers

Gating an autonomous agent action on a policy the agent is not allowed to read. A verifier learns that some committed ruleset was evaluated and returned allow, and learns nothing about its contents.

The motivating shape is a standing ruleset that governs actors who never individually signed it, and that would be defeated by publication. Fraud rules at a corporate card issuer are the clean example, because a published rule is an evasion guide. Existing agent standards are either retrospective (attestation after the fact) or mandate-based (a principal pre-signs a specific grant). Neither fits.

Standards

Tracks draft ERC-8354 (ethereum/ERCs#1919), which has an assigned editor number and sits in s-draft. It requires ERC-165, ERC-7812 (ZK Identity Registry, supplying the policy commitment root) and ERC-8004 (Trustless Agents, supplying the agent identity).

Disclosure: I am an author of that ERC.

On the maturity claim

Set to testnet, and I want to be precise about what backs it, because the honest version is narrower than it might look.

The reference implementation has a Noir circuit with a generated UltraHonk verifier, and a real proof verifies through consume across 23 passing Foundry tests. What it does not have is any deployment: no contract addresses on any network, and the README states the circuit, verifier and contracts are unaudited and not for production use.

So testnet is claimed against the template gloss of "PoC/pilot". The ## Example section says the proof verifies in an EVM test harness and that nothing is deployed or audited. The card never says "deployed" or "mainnet". If reviewers would rather see concept until something is on a public testnet, I will change it without argument.

CROPS

Deliberately unflattering where the pattern deserves it:

• cr: low, because denial is the pattern function. It is a censorship mechanism by construction. It stays above none because the Guard bounds one execution path and the principal keeps whatever authority it holds outside that path.
• p: partial, because the standard hides the policy, not the action. A permitted action executes publicly and is fully visible. Overclaiming here seemed like the fastest way to make the card useless.
• s: medium, since the code is unaudited and the ERC-165 interfaceId is still a placeholder pending finalisation.
• post_quantum: high, since UltraHonk is pairing-based over BN254 with KZG commitments. The reference implementation already carries an SP1 program alongside the Noir circuit, which is the practical migration route.

The visibility block maps onto the ERC verdict envelope directly.

Checks

• CI_MODE=strict npm run validate passes with zero warnings against this file, 675 body words
• check-terms clean
• Vale clean

CHANGELOG entry added under [Unreleased].