ZK confirmation for life-first decisions: prove authorization without PII (310/320), keep two-step + revoke. Non-PII auditability: evidence ZIP + SHA256. https://zenodo.org/communities/decision-os/records?q=&l=list&p=1&s=10&sort=newest