History / Gate Access Control

Correct what a review of the alpha.15 prose found A separate read of the previous commit against main b6baabd checked about 80 claims and found these, now fixed on 8 pages: - MCP Gated Tools now warns not to reuse a SigvaraGate's audience for sigvara-mcp, since a gate admits any fresh challenge signed for its audience. - sigvara_verify_evidence confirms up to the last 100 covered payments, not every one, and needs SIGVARA_EVIDENCE_URL off Arc testnet; the evidence pages say the same. - sigvara-mcp works with frameworks that start a local MCP server over stdio, not any that loads MCP servers. - The trust server is imported from dist/mcp, not the package root. - The reputation contract stores a finalized root and checks one leaf against it; it does not check roots. - The gate's rule applies when a threshold is given. - sigvara-mcp's sigvara_challenge is called by the checker, the reverse of the example server's tool of that name. - Lists left stale beside the change now include the alpha.15 exports, types, verifier reads, modules and sources. Checks: 5,787 source links and 4,613 anchors resolve in main b6baabd, 86 internal links resolve, 0 CR bytes, no long dash in new text, no Mermaid block changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 3, 2026

Describe SDK 1.0.0-alpha.15: the MCP trust server, evidence roots and the new reads 28 replacements on 20 pages, each asserted to match once: - The SDK pages describe 1.0.0-alpha.15, published to npm on 3 November 2026, with what is new since alpha.14: sigvara-mcp, the evidence-root functions and the verifier reads for a trust check. - MCP Gated Tools gains a section on the other direction, sigvara-mcp: its tools, the gate's rule without the proof, why the proof tools need an audience the agent can check, and which addresses to pay. - Verifier Functions no longer says the SDK leaves Merkle proofs to the oracle; the evidence pages name the SDK functions and the MCP tool. - SDK tests: 300 in 16 files, with mcp.test.ts and evidence.test.ts described. - Home names main b6baabd. Checks: 5,785 source links and 4,611 anchors resolve in main b6baabd, 86 internal links resolve; 0 CR bytes; no long dash in new text; all 532 Mermaid blocks parse and the changed one renders. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 3, 2026

Describe the 40 merges since 29 October, and bring the counts to 2 November Prose and counts for #112 to #152, 416 replacements on 64 pages, each asserted to match once: - Slashing: 75% burned and 25% to the victim, nothing to the committee (ADR 0007), VictimIsCommittee, the two-field SlashExecuted, and a reporter credit from before 2 November still claimable. The 3 October drill stays as the record of the earlier split. - Oracle bond: an operator's exit time is fixed when it starts to leave (unbondingClaimableAt), with the old rule for an exit started before the field existed. - Testnet: identity and reputation on fdce1a7, staking on 25c2d59, the oracle bond on 76bbc97, all verified on the explorer and reproduced by the build tagged arc-testnet-2026-11-02b. Ten claims that the testnet lagged main, false since 26 October, are corrected. - Handover: the known-Safe checks, SAFE_FACTORY and SAFE_CREATION_CALL, and the reconciliation report the renounce requires. - Builds and checks: check-bytecode, check-authz and the authorisation matrix, and the CI lists. - Oracle: payer-signed outcomes (ADR 0006), GET /outcomes and the import between operators, the 409 body, the checker judging a proposal by the evidence it was made on, state backups and restore drills, and the CounterAudit relay off in production. Both operators run cf76691. - SDK 1.0.0-alpha.14: atomicNonceStore, the gate's instances and profile settings, and signPaymentOutcome and verifyPaymentOutcome. - Site: the explorer, the epochs page and the labelled simulation. - Counts: 724 contract tests in 32 files (712 run without a fork URL, 12 skip), 852 oracle, 233 SDK in 14 files. Checks: 5,779 source links and 4,607 anchors resolve in main 700a3ee, and the 81 internal links resolve; 0 CR bytes; no long dash in new text; all 532 Mermaid blocks parse and the 19 changed ones render with no error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 2, 2026

Make the line numbers in the link labels match the anchors again 1,670 labels on 71 pages named the line numbers of main 17cccb8; each now names its link's anchor. URLs are untouched (5,656 links compared, 0 problems), and the link checker finds every one of 5,770 source links and 4,599 anchors inside main 700a3ee. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 2, 2026

Move the source-link anchors from main 17cccb8 to 700a3ee Main moved by 40 merges (#112 to #152): payer-signed outcomes (ADR 0006), SDK 1.0.0-alpha.13 and alpha.14, the gate's production profile, the operations runbook and state backups, the handover Safe checks, the slash split without a committee share, the explorer, the testnet simulation, verifiable builds, the authorisation matrix and the oracle bond's fixed exit time. Only the digits of line anchors change in this commit: 1,670 anchors on 71 pages. Each was mapped through the git diff between the two commits and checked for the same first and last line of text (2,071 compared, 0 mismatching). Twelve ranges moved approximately because a line at their edge was edited: the slash event and its test, two README ranges ending on the reworded counts line, measuredFactorsFor in oracle/index.js, the gate's opening comment, and ranges in docs/arc.md, docs/counteraudit-integration.md, docs/payment-backed-attestations.md and oracle/README.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 2, 2026

Describe the handover checks of #110, the nonce-store tests of #111, and the new counts The renounce phase now takes neither the Safe nor the timelock on trust: phases 3 and 5 refuse a timelock whose code is not the TimelockController phase 2 deploys (the metadata solc appends is ignored) or that the deployer did not create, and a Safe that is an EIP-7702 delegated account. Phase 5 refuses a Safe that cannot be asked for its threshold unless CONFIRM_UNINSPECTABLE_SAFE vouches for it. Governance and Upgrades gets the four new errors with what to do about each, and Deployment Strategies the variable and the extended list. The Gate pages say that the SDK README now shows a Redis NonceStore, and the SDK testing page says what the two-gate tests show. Counts: 699 contract tests (692 run, 7 skip) and 206 SDK tests. Home names main 17cccb8. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 30, 2026

Make the labels of the moved links match their anchors The visible line numbers in 102 source-link labels showed the old range after the previous commit moved the anchors. Each label now takes its anchor's range. URLs are untouched. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 30, 2026

Move the source-link anchors from main 3e8faed to 17cccb8 Main moved by three merges: the count fix (#109), the handover trust checks (#110) and the nonce-store tests (#111). Anchors into script/SplitAuthority.s.sol, the root README, the SDK README and the Gate test moved with their files. Only the digits of line anchors change in this commit. Each was mapped through the git diff between the two commits and checked for the same first and last line of text; five approximate moves are the root README's setup and testing sections, whose last line is a count that was reworded. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 30, 2026

Describe 1.0.0-alpha.12 and bring the SDK test count to 201 The agent's blind signChallenge is gone in 1.0.0-alpha.12 (pull request 107, released by 108). A call does not compile in TypeScript, and in JavaScript it throws an error that names signChallengeFor. The pages that describe the SDK now say 1.0.0-alpha.12 and list the removal as new since alpha.11. Where a page said that signChallenge signs whatever it is handed, it now says that the method is removed and that alpha.9 has only it. The exported function signChallenge(payload, secretKey) is unchanged and stays where a page shows it. The class diagrams drop the method, and the sequence diagrams and the flowchart that showed an agent calling it show signChallengeFor(payload, audience) instead. The Home page names main 3e8faed. The SDK suite is 201 tests, not 197: 193 run and 8 skip without a live deployment, in 13 files, measured with CI=1 on a clean export of main 3e8faed. Six pages carried the old number. 62 replacements on 24 pages. 20 diagrams changed; all 532 still parse and the 20 render without an error or a clipped label. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Make the line numbers in the link labels match the anchors again 59 source links had a label whose line numbers no longer matched the anchor that the previous commit moved. The label now takes the anchor's range. Only the text between the square brackets of a link changed: the URLs are byte-identical and everything outside the labels is unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Move the source-link anchors from main 58d6b27 to 3e8faed Main moved by three commits: the test counts (ecc3dfa), the removal of the agent's blind signChallenge (9c38a44) and the 1.0.0-alpha.12 release (3e8faed). 59 line anchors on 16 pages moved: 37 into packages/sdk/src/agent.ts, 20 into packages/sdk/README.md and 2 into docs/ai-frameworks.md. Only the digits of an anchor changed. With every anchor replaced by #L, the old and new text of each page is identical, and the line endings are unchanged. Four ranges (eight anchors) have a first or last line that changed in the move: two in agent.ts, whose last line, the return of the removed method, is now the end of the stub that throws, and two in README.md, whose last line is the test count paragraph reworded on 29 October. They keep pointing at the same part of the file. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Make the line numbers in the link labels match the anchors again The label of a source link names the lines its anchor points at, and the previous commit moved 359 anchors, so their labels said the old numbers. Each label now takes the range of its anchor. The URLs are untouched, and nothing outside the square brackets of a link changes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Move the source-link anchors from main ff0fa68 to 58d6b27 Three pull requests landed after the pages were last checked: the durable answer for flag, resolve and link in the oracle, the timelock and Safe policy in the handover script with the recorded deploy block, and the key-rotation and finality notes in the docs. Only the digits of the line anchors change, so that each link points at the lines it named before. 359 anchors on 36 pages moved; 5 end on a paragraph whose wording changed and are approximate. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Say that the SDK pages describe 1.0.0-alpha.11 and that the audience is required alpha.11 reached npm on 29 October 2026 from main ff0fa68, and its tarball hash matches a local pack of that commit. verifySignature now requires the expected audience: a call without it throws, and a v1 payload is always refused. The opening paragraph of each SDK page names the version it describes and says what is new since alpha.10. The pages that treated the audience as optional ("if an expected audience is provided", "audience?") no longer do, in the text and in seven diagrams (all 532 diagrams parse and the eight changed ones render). The SDK test count follows the new tests: 197 in 13 files, 8 of which skip, measured with CI=1 on a clean copy of ff0fa68. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Make the line numbers in the link labels match the anchors again A label such as verifier.ts:124-183 names the lines its link points at. The anchors moved with the previous commit, so 201 labels on 35 pages showed the old numbers; they now take the anchor's range. 4,398 labels were already right. Only link text changed, and every URL is byte-identical. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Move the line anchors from main 652beca to main ff0fa68 Pull requests 99, 100 and 101 and the two dependency bumps (83 and 84) changed lines in README.md, the docs, deployments/5042002.json, the package files and packages/sdk/src/verifier.ts, so the anchors below those edits drifted. Each anchor was mapped through the git diff between the two commits: 201 anchors on 35 pages moved, none was dropped, and the one that spanned the audience check in verifier.ts, which the release rewrote, now covers the new block. Nothing but the digits of an anchor changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 29, 2026

Drop the unreleased marks from the SDK pages alpha.10 is on npm, so the marks that called its changes unreleased come off 14 pages (112 edits). Where a mark carried a contrast with alpha.9, the contrast stays without the word unreleased ("alpha.9 has only signChallenge"). Where a sentence said "on main" only to set a behaviour apart from the npm release, those words go. The not_active lists read as they did before the marks went in: unbonded (or bonded below the minimum stake in force now), suspended, or slashed. The two notes on the future-date refusal now say that alpha.9 still accepts a payload dated ahead. All 532 Mermaid blocks still parse, and the three that changed render. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 28, 2026

Say that the SDK pages describe 1.0.0-alpha.10, now on npm The opening paragraph of each SDK page said that npm had 1.0.0-alpha.9, that the items under Unreleased in the changelog were not in it, and that the pages marked them. alpha.10 reached npm on 28 October 2026 from main 652beca, and its tarball hash matches a local pack of that commit. The paragraphs now say which version the page describes and list what is new since alpha.9. The version in the package.json diagram and the versioning note on the code quality page follow. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 28, 2026

Move the line anchors from main 457fa9e to main 652beca The release pull request for the SDK (97) added a line to packages/sdk/README.md and took one from each of docs/quickstart.md and docs/ai-frameworks.md, so the anchors below those edits drifted. Each anchor was mapped through the git diff between the two commits: 22 anchors on 9 pages moved, none was dropped. Nothing but the digits of an anchor changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 28, 2026

Cover what the first pass left out A read-only review of the pages against the code turned up pages that still described the old behaviour or lacked the new: - the primary replaces a stranded proposal from its finalizableAt, not from proposedAt plus the window in force now - /attest answers 202 on the payment page, the operations troubleshooting list and the service page - check-role-holders.mjs runs before the renounce as well, and the registries are required in the four phases that read them (deploy-timelock only creates the timelock) - the AI framework diagrams read the bond with the status, and the bond check is marked unreleased wherever a page mentions it - maxScoreAgeSeconds is among the values the constructor refuses - the summaries of the dispute lifecycle say an uphold is refused once the dispute can be expired Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 28, 2026

Say what the SDK gate checks now The gate also reads the bond held now (hasMinimumStake) and refuses an agent below the minimum stake in force as not_active, and an optional maxScoreAgeSeconds refuses a score written longer ago than that, or never, as stale_score. verifier.getScoreUpdatedAt is the read behind it. All of it is unreleased: npm has 1.0.0-alpha.9. The pages that said the gate does not check the bond now say it does. The reason lists, the flow diagrams, the configuration table and the unreleased lists gain the new refusal and option, and the testing page covers the test of the compiled package for the agent's secret key. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 28, 2026

Make each source link's label show the lines its anchor points at The previous commit moved 911 anchors, so the line numbers printed in their labels were out of date. Each label now takes the numbers of its anchor. The 3,688 that were already right and every URL are untouched; the links, their order and all text outside the labels are byte-identical. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 28, 2026

Move the line anchors from main 638650f to main 457fa9e Pull requests 91 to 95 changed lines in SigvaraStaking.sol, the oracle, the SDK and their README files, so the floating blob/main links drifted. Each anchor was mapped through the git diff between the two commits: 911 anchors on 58 pages moved, 8 that spanned an edited block now cover the whole block, none was dropped. Nothing but the digits of an anchor changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 28, 2026

Make each source link's label show the lines its anchor points at A label such as verifier.ts:15-209 was written from the tree the wiki was generated from, and its anchor was moved later, so the two disagreed. 576 labels now take the range of their anchor; 4,023 already did. Only the text inside the square brackets changes, and the URLs are byte-identical. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 27, 2026

Move the line anchors to the pull requests that carry the 26 October documentation Source links point at blob/main, so they drift as main moves. They were taken from 27d03c4. Each anchor is mapped through the diff to the combined tree of the documentation and site pull requests; 1,182 anchors moved exactly, 3,405 files did not change, and 12 moved in blocks that were rewritten (the slash drill fork tests among them) and were read by hand. Links only: 1,175 exact moves were compared by their first and last line and none differed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 27, 2026

Make each source link's label show the lines its anchor points at A label such as verifier.ts:15-209 was written from the tree the wiki was generated from, and the anchor behind it was moved to main later, so the two disagreed on 3,871 links. With an anchor, the label now takes the anchor's range (the wiki writes 'to the end of the file' as one past the last line, so the label is clamped to the file). A label with numbers and no anchor linked the whole file and claimed a range nothing backed, so 414 of those lose their numbers. Link targets are untouched. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 23, 2026

Bring the wiki in line with the code on main Rewrote the prose of 74 of the 75 pages against main at d8e44c2, and marked what the Arc testnet proxies, which still run the September 2026 implementations, do differently. Each page was read again against the code by an independent reviewer, and every finding was checked before it was applied. Notable corrections: the admin, not the committee, rules on disputes and an upheld ruling waits for the challenge deadline; a slash nobody executes can be lapsed by anyone 14 days after its deadline; the outcome in an evidence leaf is not on chain; meetsThreshold ignores status and bond; the archived SVR sale and vesting contracts are not the mainnet design; SDK changes after alpha.9 are marked as unreleased. Also fixed four Mermaid diagrams that did not parse. All 532 diagrams now parse, and every source link resolves against main. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 23, 2026

Fix dead source links and move line anchors to main 1,755 source links carried a stray Sigvara-main/ path segment and returned 404; the segment is removed. Two links were malformed by hand (a space inside packages/sdk, a stray character inside test/E2E.t.sol) and are repaired. The line anchors were taken from the tree the wiki was generated from (main at f852051, 2 October 2026). Each one is now mapped to the current main through the git diff: 3,788 land on the same code they started on, 312 sit on code that changed and are approximate, 413 pointed at code that no longer exists and become plain file links, and 488 are in files that did not change. No prose is changed in this commit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 23, 2026

Publish the repository wiki, edited for a reader rather than a generator 73 pages generated from the source tree at f852051, plus a landing page and a sidebar. Three changes were needed before any of it was fit to publish. 5,591 citation links pointed at `file://` paths, which resolve to nothing on a wiki. Repointed at the repository, line ranges intact, so every claim on a generated page can be checked against the code it came from. That turns the densest thing about these pages into the most useful. 124 placeholder lines reading "[No sources needed since this section provides general guidance]" are generator scaffolding and are gone. One claim was misleading rather than wrong: System Overview said payment scanning is off by default, which is true of the shipped default and not of this deployment, where it has been on since 3 October. Now says both. Flattened from nine nested sections into page names, since wiki pages are addressed by name. No collisions, and the generator never cross-linked pages, so nothing broke: 75 pages, zero broken internal links. The landing page is written rather than generated. It leads with what the protocol is, the six factors and their caps, what has actually been proven on a live deployment, and what has not — no audit, admin rights still on a deployer EOA, both operators run by the same party. It also says these pages are derived and that the code and `docs/` win where they disagree, because a generated wiki drifts and readers should know which half to trust. The `.qoder/repowiki/knowledge` tree is deliberately not published: ten pages of tool-internal notes carrying `kind:` and `scope:` frontmatter and source paths prefixed `Sigvara-main/`, written for a machine rather than a reader.

RunTimeAdmin committed Oct 7, 2026