precept v0.1.1

The Guardian-audited v0.1.0 source rebuilt on the current toolchain, plus small post-audit changes. Tag v0.1.1 → 19cb928 (signed).

Changes since v0.1.0

Production source changed by +70/−30 lines (test modules, proofs and specs excluded):

• Events (#20): defaulted_debt and debt_setoff topics now carry the user: ["defaulted_debt", user, asset], ["debt_setoff", user, asset]. For backstop bad debt, user is the backstop address. Monitoring that reads asset at topic position 1 must be updated (hypernative#44).
• mint_supply (#21): b_supply increases go through ReserveData::mint_supply; same behaviour.
• Health factor (#22): computed through the FixedMath helper. fixed_div_floor(c, l, s) and floor(c, s, l) both evaluate scaled_mul_div_floor(c, s, l), so results are identical.
• Certora hooks (#12): oracle reads switch to Certora summaries only under --features certora; not compiled into these artifacts.
• Toolchain (#28): soroban-sdk 25.3.0, Rust 1.98.0, target wasm32v1-none, Stellar CLI 28.1.0. Contract interfaces (functions, errors, events) unchanged apart from the two event topics above. pool-oracle-adapter is now a workspace member (MIT).

Guardian findings: unchanged from v0.1.0. L-01..L-04 and I-01..I-10 resolved; L-05 acknowledged (the adapter refuses future-dated parent prices; the root-cause fix belongs to the parent proxy oracle). Report.

Testnet

Deployed and exercised on Stellar testnet on 2026-10-23 with precept-abtest scripted pair runs (fork-vs-fork, and stock-vs-fork with the fork side on this commit):

• On-chain WASM hashes of every deployed pool, backstop and factory equal the artifacts below.
• Supply, borrow, partial and full repay, withdraw, backstop deposit/queue/dequeue, the full liquidation auction chain and stale-auction deletion all succeeded.
• defaulted_debt was emitted with the new topic layout.
• Accounting invariants held on every snapshot; no unexpected differential divergences.

Artifacts

File	Bytes	SHA-256
pool.wasm	49520	acf7a128074d4d9c34b4ac4e8ab46cc1148eb353eb3908ad0faf922851728086
backstop.wasm	18080	41608bcb5176fdfdc74d4594be7ea538e93bc32bda24bc537cc1cd9e44e650d1
pool_factory.wasm	3433	47956acea8b2ca37ea83e4153fd592609f430ddc4899eca7d7878c6bf1cfbe65
pool_oracle_adapter.wasm	13449	c5e1f21099f532b84d02571e24d196fbdb76e77286e973239dc47ed926f368c2

Reproduce

make build at the tag (Rust 1.98.0 from rust-toolchain.toml, Stellar CLI 28.1.0) → target/wasm32v1-none/optimized/{pool,backstop,pool_factory}.wasm; cd pool-oracle-adapter && just optimize → target/wasm32v1-none/release-soroban-checked/pool_oracle_adapter.optimized.wasm. The release workflow rebuilt these in CI and attached build-provenance attestations.

These bytes differ from v0.1.0 (new compiler and SDK); v0.1.0 remains the exact build Guardian reviewed.

precept v0.1.0 (Guardian-audited)

First Templar release of the Blend v2 fork, at the commit covered by the Guardian audit.

What's in it

• Source: tag v0.1.0 → b72a1d1. That is the Guardian remediation-review commit b385dfb (#11) plus one commit adding pool-oracle-adapter/. The pool, backstop and pool-factory sources are identical to b385dfb.
• Guardian review (report, final 2026-10-22; main review at 7a09b0e3d228, remediation review at b385dfb5cf18): 5 Low and 10 Informational findings, confidence ranking 5/5. L-01..L-04 and I-01..I-10 are resolved, in #13/#15 plus the L-02 follow-up in #16. L-05 (adapter timestamp flooring defeats the pool's future-dated price check) is acknowledged, not resolved.
• Oracle adapter: the SEP-40 pool oracle adapter as reviewed in the remediation round, imported unchanged from precept-internal@324fc5b. That commit makes lastprice refuse a parent price ahead of ledger time. Guardian's recommended root-cause fix is in the parent proxy oracle and is not part of this release. The adapter source is MIT-licensed; the Blend-derived contracts remain AGPL-3.0.

Artifacts

File	Bytes	SHA-256
pool.wasm	55057	042d41030d396f3607b8750f3cb0c2225a503a6775636d046ca9b4abaa4daab2
backstop.wasm	22701	6bd13007c020b617c43c718c2ad3d2d13605d4d42fa8f739da2293f8a4e293a0
pool_factory.wasm	3135	d1cc41cd4903ceb17a0729565f541bdb784bfd637f9aac3177e2ede805c2c25b
pool_oracle_adapter.wasm	13620	575e8d7c7c248b630169a5078c39e83b324baf97c15d009e2e5aa4b49616504b

Reproduce

• pool, backstop, pool_factory: make build at the tag with Rust 1.81.0 (rust-toolchain.toml) and Stellar CLI 22.6.0 → target/wasm32-unknown-unknown/optimized/.
• pool_oracle_adapter: cd pool-oracle-adapter && just optimize with Rust 1.89.0 + wasm32v1-none and Stellar CLI 26.0.0 → target/wasm32v1-none/release-soroban-checked/pool_oracle_adapter.optimized.wasm. The adapter CI gate pins this hash.

Two independent local builds (a worktree build and a clean git archive v0.1.0 export) produced byte-identical artifacts.

Kani run 753b1ae — 2026-09-15

Kani lending-kernel campaign — 2026-09-15

This release freezes the complete bounded Kani campaign executed against commit 753b1ae57cd60bf8bfd1ca595d0e1d71d4d1b1fb (tree 3a5d23a1d7bc7ac55eeb475a46c3d1ce9ea431c8).

Result

• Inventory: 3,197 unique targets (927473cc6ad2777ff21c87b018aa3311363264e49727aa74d4945fefc0fa0541)
• Accepted verdicts: 3,197 PASS, 0 FAIL
• Expected covers: satisfied for every accepted target
• Toolchain: Kani 0.67.0 with Kissat
• Source binding: all 116 recorded Rust/manifest SHA-256 values match commit 753b1ae exactly, across all 3,199 retained executions; every before/after digest set is unchanged

The archive deliberately retains two superseded TIMEOUT attempts for pool::reserve::verification::independent_probe_b_d_inverse_equivalence. Its 3,600-second probe-long PASS is the accepted result.

Assets

• kani-run-753b1ae-2026-09-15.tar.zst
• kani-run-753b1ae-2026-09-15.tar.zst.sha256

Archive SHA-256: 6d516a7248aa220d6b86543c6f3e5aa9459f01f57ca0b623023d747eed00449c

The archive contains the exact runner, inventory, obligation map, closure/provenance records, campaign receipt, and all raw shard/retry/long-probe results and logs. MANIFEST.json records the claim boundary, and SHA256SUMS covers every one of its 3,227 payload members.

Verification

sha256sum --check kani-run-753b1ae-2026-09-15.tar.zst.sha256
mkdir kani-run-readback
tar --zstd -xf kani-run-753b1ae-2026-09-15.tar.zst -C kani-run-readback
cd kani-run-readback/kani-run-753b1ae-2026-09-15
sha256sum --check SHA256SUMS

Claim boundary

This is the full campaign for commit 753b1ae. It is historical evidence for PR #4; it is not a full-inventory result for the later rebased or file-separated PR tree.