History / Merkle Proof System

Fixes from an independent review of this pass Set W, with the Home line in set X. Status lines dated, overclaims about shadow scans and the tunnel corrected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 4, 2026

Evidence in one fixed order, payments before registration, what the oracles run Sets U and V. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 4, 2026

Update source link labels to the new line numbers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 4, 2026

Re-pin source anchors to main 5262a3e Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 4, 2026

Payment chains, the event index's paging, the tunnel, the finished cycle, counts Sets R and S. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 4, 2026

Update source link labels to the new line numbers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 4, 2026

Re-pin source anchors to main 4c62904 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 4, 2026

Make link labels match their re-pinned anchors Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 3, 2026

Re-pin source links to main bef1068 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 3, 2026

Make link labels match their re-pinned anchors

RunTimeAdmin committed Nov 3, 2026

Re-pin source line anchors to main e8816a3 (#164 to #169)

RunTimeAdmin committed Nov 3, 2026

Correct what a review of the alpha.15 prose found A separate read of the previous commit against main b6baabd checked about 80 claims and found these, now fixed on 8 pages: - MCP Gated Tools now warns not to reuse a SigvaraGate's audience for sigvara-mcp, since a gate admits any fresh challenge signed for its audience. - sigvara_verify_evidence confirms up to the last 100 covered payments, not every one, and needs SIGVARA_EVIDENCE_URL off Arc testnet; the evidence pages say the same. - sigvara-mcp works with frameworks that start a local MCP server over stdio, not any that loads MCP servers. - The trust server is imported from dist/mcp, not the package root. - The reputation contract stores a finalized root and checks one leaf against it; it does not check roots. - The gate's rule applies when a threshold is given. - sigvara-mcp's sigvara_challenge is called by the checker, the reverse of the example server's tool of that name. - Lists left stale beside the change now include the alpha.15 exports, types, verifier reads, modules and sources. Checks: 5,787 source links and 4,613 anchors resolve in main b6baabd, 86 internal links resolve, 0 CR bytes, no long dash in new text, no Mermaid block changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 3, 2026

Describe SDK 1.0.0-alpha.15: the MCP trust server, evidence roots and the new reads 28 replacements on 20 pages, each asserted to match once: - The SDK pages describe 1.0.0-alpha.15, published to npm on 3 November 2026, with what is new since alpha.14: sigvara-mcp, the evidence-root functions and the verifier reads for a trust check. - MCP Gated Tools gains a section on the other direction, sigvara-mcp: its tools, the gate's rule without the proof, why the proof tools need an audience the agent can check, and which addresses to pay. - Verifier Functions no longer says the SDK leaves Merkle proofs to the oracle; the evidence pages name the SDK functions and the MCP tool. - SDK tests: 300 in 16 files, with mcp.test.ts and evidence.test.ts described. - Home names main b6baabd. Checks: 5,785 source links and 4,611 anchors resolve in main b6baabd, 86 internal links resolve; 0 CR bytes; no long dash in new text; all 532 Mermaid blocks parse and the changed one renders. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 3, 2026

Correct seven points a review of the prose found A separate read of the previous commit against main 700a3ee checked about 350 claims and found these, now fixed on 23 pages: - SplitAuthorityFork skips twelve tests, not seven, on the four pages that still said seven. - The tag arc-testnet-2026-11-02b is on the commit that records the upgrade, not on 76bbc97, whose contract sources it shares; the steps say to tag the commit that records the implementation. - A payer's signed outcome replaces a token holder's only when the payer's is the transaction's only paying leg. - A 409 carries heldOutcomeHash only when the outcome held is one the payer signed; a token holder's held outcome gives only sameOutcome: false. - The explorer asks verifyEvidence about the payments the finalized root covers, not every payment listed. - Eight "(on main)" labels removed where the testnet has run the same code since 26 or 28 October. - The Development-and-Testing diagram shows payers and CounterAudit the way the other two architecture diagrams do. Checks: 5,779 source links and 4,607 anchors resolve in main 700a3ee, 81 internal links resolve, 0 CR bytes, no long dash in new text, all 532 Mermaid blocks parse and the changed one renders. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 2, 2026

Describe the 40 merges since 29 October, and bring the counts to 2 November Prose and counts for #112 to #152, 416 replacements on 64 pages, each asserted to match once: - Slashing: 75% burned and 25% to the victim, nothing to the committee (ADR 0007), VictimIsCommittee, the two-field SlashExecuted, and a reporter credit from before 2 November still claimable. The 3 October drill stays as the record of the earlier split. - Oracle bond: an operator's exit time is fixed when it starts to leave (unbondingClaimableAt), with the old rule for an exit started before the field existed. - Testnet: identity and reputation on fdce1a7, staking on 25c2d59, the oracle bond on 76bbc97, all verified on the explorer and reproduced by the build tagged arc-testnet-2026-11-02b. Ten claims that the testnet lagged main, false since 26 October, are corrected. - Handover: the known-Safe checks, SAFE_FACTORY and SAFE_CREATION_CALL, and the reconciliation report the renounce requires. - Builds and checks: check-bytecode, check-authz and the authorisation matrix, and the CI lists. - Oracle: payer-signed outcomes (ADR 0006), GET /outcomes and the import between operators, the 409 body, the checker judging a proposal by the evidence it was made on, state backups and restore drills, and the CounterAudit relay off in production. Both operators run cf76691. - SDK 1.0.0-alpha.14: atomicNonceStore, the gate's instances and profile settings, and signPaymentOutcome and verifyPaymentOutcome. - Site: the explorer, the epochs page and the labelled simulation. - Counts: 724 contract tests in 32 files (712 run without a fork URL, 12 skip), 852 oracle, 233 SDK in 14 files. Checks: 5,779 source links and 4,607 anchors resolve in main 700a3ee, and the 81 internal links resolve; 0 CR bytes; no long dash in new text; all 532 Mermaid blocks parse and the 19 changed ones render with no error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 2, 2026

Make the line numbers in the link labels match the anchors again 1,670 labels on 71 pages named the line numbers of main 17cccb8; each now names its link's anchor. URLs are untouched (5,656 links compared, 0 problems), and the link checker finds every one of 5,770 source links and 4,599 anchors inside main 700a3ee. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 2, 2026

Move the source-link anchors from main 17cccb8 to 700a3ee Main moved by 40 merges (#112 to #152): payer-signed outcomes (ADR 0006), SDK 1.0.0-alpha.13 and alpha.14, the gate's production profile, the operations runbook and state backups, the handover Safe checks, the slash split without a committee share, the explorer, the testnet simulation, verifiable builds, the authorisation matrix and the oracle bond's fixed exit time. Only the digits of line anchors change in this commit: 1,670 anchors on 71 pages. Each was mapped through the git diff between the two commits and checked for the same first and last line of text (2,071 compared, 0 mismatching). Twelve ranges moved approximately because a line at their edge was edited: the slash event and its test, two README ranges ending on the reworded counts line, measuredFactorsFor in oracle/index.js, the gate's opening comment, and ranges in docs/arc.md, docs/counteraudit-integration.md, docs/payment-backed-attestations.md and oracle/README.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Nov 2, 2026

Say that the testnet proxies run the contracts on main since 26 October 2026 The four Arc testnet proxies were upgraded in place on 26 October 2026, so about 30 pages that said the testnet still runs the 21 September implementations, "(main only)", or "the testnet predates this" were wrong. - The page header notes say the testnet has run the contracts on main since the upgrade and keep the one thing an upgrade cannot change: role administrators are written when a proxy is initialised, so the testnet's admin still grants the slasher, committee and staking-core roles and the timelocked grants do not apply there. - The "(main only)" markers on the guardian pause, the admin ruling, the veto and the lapse are gone. - The signer registry is live on the testnet, but neither operator has named a signer. - The two proposals pending at the upgrade have finalized, and a proposal made before the upgrade reads zero in the two new PendingScore fields. - The VPS deployments fetch one pinned commit, not main; both testnet oracles run fdce1a7. - Test counts match the README (693 contract tests, 686 run, 19 invariants in five campaigns, 760 oracle tests, 168 SDK tests); seven pages still carried the 22 October numbers. - The slash drill is described with testnet faucet tokens. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 27, 2026

Make each source link's label show the lines its anchor points at A label such as verifier.ts:15-209 was written from the tree the wiki was generated from, and the anchor behind it was moved to main later, so the two disagreed on 3,871 links. With an anchor, the label now takes the anchor's range (the wiki writes 'to the end of the file' as one past the last line, so the label is clamped to the file). A label with numbers and no anchor linked the whole file and claimed a range nothing backed, so 414 of those lose their numbers. Link targets are untouched. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 23, 2026

Bring the wiki in line with the code on main Rewrote the prose of 74 of the 75 pages against main at d8e44c2, and marked what the Arc testnet proxies, which still run the September 2026 implementations, do differently. Each page was read again against the code by an independent reviewer, and every finding was checked before it was applied. Notable corrections: the admin, not the committee, rules on disputes and an upheld ruling waits for the challenge deadline; a slash nobody executes can be lapsed by anyone 14 days after its deadline; the outcome in an evidence leaf is not on chain; meetsThreshold ignores status and bond; the archived SVR sale and vesting contracts are not the mainnet design; SDK changes after alpha.9 are marked as unreleased. Also fixed four Mermaid diagrams that did not parse. All 532 diagrams now parse, and every source link resolves against main. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 23, 2026

Fix dead source links and move line anchors to main 1,755 source links carried a stray Sigvara-main/ path segment and returned 404; the segment is removed. Two links were malformed by hand (a space inside packages/sdk, a stray character inside test/E2E.t.sol) and are repaired. The line anchors were taken from the tree the wiki was generated from (main at f852051, 2 October 2026). Each one is now mapped to the current main through the git diff: 3,788 land on the same code they started on, 312 sit on code that changed and are approximate, 413 pointed at code that no longer exists and become plain file links, and 488 are in files that did not change. No prose is changed in this commit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RunTimeAdmin committed Oct 23, 2026

Publish the repository wiki, edited for a reader rather than a generator 73 pages generated from the source tree at f852051, plus a landing page and a sidebar. Three changes were needed before any of it was fit to publish. 5,591 citation links pointed at `file://` paths, which resolve to nothing on a wiki. Repointed at the repository, line ranges intact, so every claim on a generated page can be checked against the code it came from. That turns the densest thing about these pages into the most useful. 124 placeholder lines reading "[No sources needed since this section provides general guidance]" are generator scaffolding and are gone. One claim was misleading rather than wrong: System Overview said payment scanning is off by default, which is true of the shipped default and not of this deployment, where it has been on since 3 October. Now says both. Flattened from nine nested sections into page names, since wiki pages are addressed by name. No collisions, and the generator never cross-linked pages, so nothing broke: 75 pages, zero broken internal links. The landing page is written rather than generated. It leads with what the protocol is, the six factors and their caps, what has actually been proven on a live deployment, and what has not — no audit, admin rights still on a deployer EOA, both operators run by the same party. It also says these pages are derived and that the code and `docs/` win where they disagree, because a generated wiki drifts and readers should know which half to trust. The `.qoder/repowiki/knowledge` tree is deliberately not published: ten pages of tool-internal notes carrying `kind:` and `scope:` frontmatter and source paths prefixed `Sigvara-main/`, written for a machine rather than a reader.

RunTimeAdmin committed Oct 7, 2026