chore(release): 0.14.3-rc.7 (#990)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: avi-starkware

README.md

@@ -44,10 +44,10 @@ All components in a row are tested together. Use matching revisions when deployi
 | Component          | Docs                                                                                                                     | Tag                                                                                                                                                                                                          |
 | ------------------ | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | Transaction Prover | [README](https://github.com/starkware-libs/sequencer/tree/avi/privacy/configmap-docs/crates/starknet_transaction_prover) | [`ghcr.io/starkware-libs/starknet-privacy/transaction-prover:PRIVACY-0.14.3-RC.2`](https://github.com/starkware-libs/sequencer/pkgs/container/starknet-privacy%2Ftransaction-prover?tag=PRIVACY-0.14.3-RC.2) |
-| Proof Interceptor† | [README](proof-interceptor/README.md)                                                                                    | [`ghcr.io/starkware-libs/starknet-privacy/proof-interceptor:PRIVACY-0.14.3-RC.6`](https://github.com/starkware-libs/starknet-privacy/pkgs/container/starknet-privacy%2Fproof-interceptor)                    |
+| Proof Interceptor† | [README](proof-interceptor/README.md)                                                                                    | [`ghcr.io/starkware-libs/starknet-privacy/proof-interceptor:PRIVACY-0.14.3-RC.7`](https://github.com/starkware-libs/starknet-privacy/pkgs/container/starknet-privacy%2Fproof-interceptor)                    |
 | Discovery Service  | [README](deploy/discovery-service/README.md)                                                                             | [`ghcr.io/starkware-libs/starknet-privacy/discovery-service:PRIVACY-0.14.3-RC.2`](https://github.com/starkware-libs/starknet-privacy/pkgs/container/starknet-privacy%2Fdiscovery-service)                    |
 | Pathfinder\*       | [docs](https://eqlabs.github.io/pathfinder/getting-started/running-pathfinder)                                           | [`eqlabs/pathfinder:v0.22.7`](https://hub.docker.com/layers/eqlabs/pathfinder/v0.22.7/images/sha256-443ba8749c501f0dc5d8c8fbf03805ab7f3e9fc8ca8948f2e680005599a7f6a0)                                        |
-| SDK                | [README](sdk/README.md)                                                                                                  | [`PRIVACY-0.14.3-RC.6`](https://github.com/starkware-libs/starknet-privacy/tree/PRIVACY-0.14.3-RC.6)                                                                                                         |
+| SDK                | [README](sdk/README.md)                                                                                                  | [`PRIVACY-0.14.3-RC.7`](https://github.com/starkware-libs/starknet-privacy/tree/PRIVACY-0.14.3-RC.7)                                                                                                         |
 
 \* For the transaction prover to work correctly with Pathfinder, set `PATHFINDER_STORAGE_STATE_TRIES=10000`.
 

proof-interceptor/README.md

@@ -56,6 +56,7 @@ Defaults are deployment-friendly, not security-strict. Apply these for productio
 - **`TLS_CERT_PATH`/`TLS_KEY_PATH` are server-side TLS only.** They encrypt the prover↔sidecar connection but do _not_ authenticate the client (no `requestCert`/`ca` is configured in `src/server.ts`). For real mTLS, put a service mesh or proxy in front of the sidecar.
 - **Verify `SCREENING_URL` is set.** Without it, the service runs as a no-op pass-through that always returns `allowed: true` — `/health` still reports OK. Confirm `proof_interceptor_screening_results_total` is non-zero on `/metrics`.
 - **Point `SCREENING_RPC_URL` at an endpoint serving JSON-RPC spec ≥ 0.9.** The pre-policy-pool fallback keys on the dedicated entrypoint-miss error (21); an older endpoint reports a generic contract error instead, so every policy read fails closed and open-note deposits block.
+- **Set `SCREENING_ANONYMIZER_ADDRESS` to the shadow account anonymizer the pool lists as `Delegated`.** Its compute-invokes are screened on the shadow account they run through; a compute-invoke to any other `Delegated` target is refused with `unknown_delegated_depositor`. The service exits at startup without it.
 - **Pin `@starkware-libs/starknet-privacy-sdk`** to a version whose `PrivacyPoolABI` matches the deployed pool contract. ABI drift causes silent fail-open on Deposit detection.
 
 ## Configuration

sdk/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+## 0.14.3-RC.7
+
+### Changed
+
+- `delegateOpenNoteDepositor` now documents the revised `Delegated` rule. The pool screens the
+  addresses the depositor's invoke returns after its deposits, or the depositor itself when the
+  invoke returns none, so a `Delegated` target driven through a plain invoke is no longer exempt.
+- The proof interceptor can block with two more reasons, `unknown_delegated_depositor` and
+  `undeposited_open_notes`. `screeningErrorFromProvingError` leaves them unmapped, like
+  `multiple_screening_subjects` and `shadow_account_undetermined`. They are terminal for the
+  transaction as built but say nothing about the address, so they reach the caller as the prover's
+  own error.
+
 ## 0.14.3-RC.6
 
 ### Added

sdk/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@starkware-libs/starknet-privacy-sdk",
-  "version": "0.14.3-rc.6",
+  "version": "0.14.3-rc.7",
   "description": "TypeScript SDK for private transfers on Starknet — deposit, transfer, withdraw, and discover notes via a fluent builder API",
   "repository": {
     "type": "git",