feat: add Tacit plugin

[z0r0z]

Tacit is a trustless ETH/ERC-20 mixer that uses Bitcoin as its settlement layer. Deposits go into fixed-denomination Poseidon Merkle pools on Ethereum; withdrawals are verified through a Bitcoin light relay + SP1 state proofs + Groth16 burn proofs. No operators, no multisigs.

This adds @kohaku-eth/tacit implementing the plugin interface:

• prepareShield — builds the Poseidon commitment, returns deposit TxData (same flow as Tornado/Privacy Pools)
• prepareUnshield — returns a TacitPrivateOperation carrying the burn envelope, Groth16 witness, and contract parameters. The operation is tagged crosschain: true / phase: "bitcoin-burn-required" so the wallet knows the withdrawal is a multi-step flow across Bitcoin and Ethereum
• Key derivation — BIP-32 via host.keystore.deriveAt() at coin type 28785', secrets reduced mod BN254

The unshield is the interesting part. In Tornado or Privacy Pools, prepareUnshield returns an Ethereum transaction. In Tacit, the user first embeds a burn envelope in a Bitcoin OP_RETURN, waits for 6+ confirmations and SP1 acceptance, then calls withdrawFromBurn() on Ethereum with the raw Bitcoin tx and relay headers. The plugin returns all the structured data for both steps.

Shield:   user → deposit(commitment, denom) → TacitBridgeMixer.sol

Unshield: plugin returns burn envelope + proof
          → wallet embeds in Bitcoin OP_RETURN
          → 6 confirmations + SP1 prover accepts burn
          → wallet calls withdrawFromBurn(rawBtcTx, headers, height, merkleProof, txIndex)
          → contract: relay check → SP1 acceptance → Groth16 verify → nullifier check → payout

Proof generation (snarkjs + circuit artifacts) and Bitcoin tx construction are left to the consuming wallet — the plugin provides the commitment math, Merkle tree utils, and the complete witness/envelope structure.

Workspace-level changes (pnpm-workspace.yaml, changeset) included. Docs pages not included — happy to add once the approach looks right.

Links: tacit.finance · TacitBridgeMixer.sol · withdraw.circom

[kassandraoftroy]

Interesting! I will look into this. Maybe a little bit out of our scope (since narrowest scope is pure eth L1 shielded pool implementations) but will def look into it