V3 Source Review Hub / Exact tagged source

Clone V3. Verify first. Review from facts.

One technical front door for preliminary partner and agent diligence across Base, Solana, x402, the SDK and the open interface specification. The source is public. V3 is not deployed, activated, authorized or partner-ready.

Source releasePublic and exact-tagged

BaseSource-review ready

SolanaSource-policy verified

ProductionBlocked by evidence gates

Clone for source review

One pinned, pre-checked clone path

Install the immutable GitLawb npm release, verify the published helper integrity, set its public node, clone both pinned submodules, and independently compare the commit, tree and annotated tag object before executing repository code. The repository verifier then runs bounded source and policy suites without modifying the checkout.

Terminal / recursive exact-tag clone

npm install --global @gitlawb/gl@0.7.1
GITLAWB_HELPER="$(command -v git-remote-gitlawb)"
if [ "$(uname -s)-$(uname -m)" = "Linux-x86_64" ]; then
  printf '%s  %s\n' 'af5da2da412dfe24fff57b1d8a0834da1fa5d971897423a19ded454a0f732e74' "$GITLAWB_HELPER" | sha256sum --check
fi
export GITLAWB_NODE=https://node.gitlawb.com
git clone --branch v3-source-2026-08-27 --recurse-submodules \
  gitlawb://did:key:z6MkryiNsYdFEMHv95wxzSQ1vtFXPyVQQrxXdPw3tE5HpfxV/vaultfire
cd vaultfire
test "$(git rev-parse HEAD)" = "bf4b97f65b7032c778d137bb52a432afc4615b51"
test "$(git rev-parse HEAD^{tree})" = "a1fd90c26ae676c87a10e7d3e614e84961b2990c"
test "$(git rev-parse refs/tags/v3-source-2026-08-27)" = "d9757c125d547968f80d4c61bea08f6638b33dd6"
test -z "$(git submodule status --recursive | grep -E '^[-+U]' || true)"
./scripts/verify-v3-source.sh

Expected tag: v3-source-2026-08-27GitLawb v0.7.1 Linux x64 SHA-256: af5da2da412dfe24fff57b1d8a0834da1fa5d971897423a19ded454a0f732e74. All package integrity values ↗Requires Node.js, npm, Git, Python 3 and GitLawb network access. Do not substitute a moving branch.

Exact tagged Git bundle ↗Expanded source archive ↗Attestation bundle ↗Checksummed partner-review tooling ↗Exact partner-review logs ↗Machine-readable review result ↗Expanded archive file manifest ↗SHA-256 manifest ↗Partner-review tooling guide ↗Partner-review evidence guide ↗Fallback and custom-CA guide ↗

Verifier scope. verify-v3-source.sh covers the frozen source. The post-tag partner-review.sh wrapper also verifies attestation hashes, PR7 API/x402, SDK, V2 compatibility, OpenAPI, JSON Schemas and fail-closed gates. Forge, native Solana/SBF, local-validator and fork results are always reported separately and never implied when unrun.

One-command read-only partner verification

./scripts/partner-review.sh

Preliminary diligence entry points

Choose a review surface

Static source-review metadata returns 200 without implying deployment. Operational state, settlement and payment-dependent V3 routes retain the documented release-gate 503.

01SOURCE REVIEW

Base contracts

Review the bounded V3 contract closure, safe bond implementations, factories, governance policy and frozen V2 compatibility evidence. Deployment roles and live addresses are intentionally absent.

Contract catalog ↗Protocol status ↗

02SOURCE POLICY

Solana programs

Evaluate the supported Solana candidates and source-policy controls. Native SBF, IDL, local-validator and mainnet evidence remain production gates, and initializers stay disabled.

Solana health ↗Migration dispositions ↗

03FAIL CLOSED

x402 and APIs

Review versioned schemas and route identities without implying a live payment rail. V3 settlement, receipts and Bazaar publication remain disabled until evidence and authorization exist.

V3 x402 discovery ↗V2/default x402 manifest ↗V3-only OpenAPI ↗Combined V2 + V3 OpenAPI ↗

04SOURCE ONLY

SDK and open spec

Review the canonical TypeScript ABI closure, 20 website route identities and 11 SDK logical read-route names. No published npm package equivalence is claimed.

V3 route catalog ↗Browse source ↗

x402 integration

Review the proposed interfaces. Do not infer a launch.

Vaultfire protocol V3 and x402 payment version 2 are separate version lines. The V3 repository provides route contracts, challenge and receipt schemas, and strict publication gates while advertising zero live V3 payable resources.

Payments disabled

V3 discovery is fail-closed.

V3 presents no facilitator, pay-to address, priced resource or Bazaar listing as live. The separate /.well-known/x402.json manifest belongs to the live/default V2 Base partner-pilot surface and must not be interpreted as V3 readiness.

Controlled settlement and replay evidence
Verified chain addresses and authority custody
Owner-reviewed Bazaar publication evidence
Explicit deployment and activation authorization

Defined in tagged source

Versioned review artifacts

The tagged package defines 20 website route identities: 19 GET routes and one non-executing retired POST. The SDK separately defines 11 logical read-route names. Public V3 API access remains closed for deployment and payment-dependent behavior with a 503 release-gate response.

V3 discovery, challenge-status, challenge and receipt schemas
Read-only protocol, contract, bond and migration status routes
Canonical SDK route names and a V3-only OpenAPI view
Retired write action remains visible but non-executing

Canonical release status ↗Inspect live V2/default x402 manifest ↗Inspect V3 discovery ↗V3-only OpenAPI JSON (20 operations) ↗Canonical combined OpenAPI JSON (109 operations) ↗

Verify the claims

Exact release identity

These identifiers let a reviewer bind their checkout to the public source release and its AI-assisted closure record. GitLawb's signed ref certificate identifies the automation publisher DID, while the Git commit, tag and owner delegation remain unsigned. No independent human-auditor signature is claimed.

Release tagv3-source-2026-08-27

Commitbf4b97f65b7032c778d137bb52a432afc4615b51

Treea1fd90c26ae676c87a10e7d3e614e84961b2990c

Annotated tag objectd9757c125d547968f80d4c61bea08f6638b33dd6

Attestation ref commit77ce6a7f7c7c18484353e0a1f41df46777f5fc5e

Attestation ref tree1b3a3c5dd0965b63f7011978242f086e24ab2f8c

Live partner-hub build commit457c7e907dc34004ad879e758b90ea012a0ddf2e

Website P1 feature commit (site branch)2f9266a7b93d65f68e44d834c9e293037a503279

Repository owner DIDdid:key:z6MkryiNsYdFEMHv95wxzSQ1vtFXPyVQQrxXdPw3tE5HpfxV

Automation publisher DIDdid:key:z6Mkh3ZmzLoaDvthCPZDUow5spxn9rZYJY6sg8AHwDrNUwY7

Owner delegation statusawaiting_owner_signature

Closure report SHA-25622cd0c13197180f89878bdbc62b6777fde09c8247a55536ae0cf239378c50245

Conformance artifact SHA-25661ac8b7c6efd1ac4e794d9d129cba82660a6f8c586b4cab49d0b3a27e530f466

Browse the public GitLawb repository ↗Read machine dispositions ↗

Separate evidence boundary. The live partner hub and its /api/v3review implementation are post-tag website code and are not covered by the tagged candidate's audit hashes. The hashed artifacts live on attestations/v3-source-2026-08-27 at the pinned attestation commit above: release-attestations/v3-source-2026-08-27/AI_ASSISTED_SOURCE_AUDIT.md, external-exact-commit-conformance.json, the canonical owner-delegation request and SHA256SUMS. The automation acceptance is signed, but the owner countersignature is still pending; the record grants no authorization and is not human-auditor authentication.

Attestation / pinned read-only checksum verification

git fetch origin refs/heads/attestations/v3-source-2026-08-27
git worktree add ../vaultfire-v3-attestations --detach 77ce6a7f7c7c18484353e0a1f41df46777f5fc5e
test "$(git -C ../vaultfire-v3-attestations rev-parse HEAD^{tree})" = "1b3a3c5dd0965b63f7011978242f086e24ab2f8c"
cd ../vaultfire-v3-attestations/release-attestations/v3-source-2026-08-27
sha256sum --check SHA256SUMS

Agent review handoff

Give any coding agent the same safety boundary

Copy this handoff into a coding or review agent. It points the agent to the exact release, forces verification first and prevents a source review from drifting into an unauthorized deployment or false readiness claim.

Agent handoff prompt

Review Vaultfire V3 from the exact public source release.

1. Install the immutable npm release @gitlawb/gl@0.7.1, verify it against https://theloopbreaker.com/v3/gitlawb-helper-v0.7.1-checksums.json, and set GITLAWB_NODE=https://node.gitlawb.com.
2. Clone tag v3-source-2026-08-27 recursively from:
   gitlawb://did:key:z6MkryiNsYdFEMHv95wxzSQ1vtFXPyVQQrxXdPw3tE5HpfxV/vaultfire
3. Before running repository code, independently require commit bf4b97f65b7032c778d137bb52a432afc4615b51, tree a1fd90c26ae676c87a10e7d3e614e84961b2990c, and tag object d9757c125d547968f80d4c61bea08f6638b33dd6.
4. Run ./scripts/verify-v3-source.sh, then read V3_STATUS.md and v3-open-spec/spec/1.0.0/VF3-OPEN.md.
5. Treat the website and /api/v3 implementation as a separate, post-tag review aid, not audited candidate bytes.
6. Inspect Base, Solana, x402, SDK, open spec, and pr10/partner-package separately.
7. Keep V2 live/default and V3 source-only. Never send value, PII, secrets, signatures, or fill blank authority/address fields.
8. Do not infer deployment, enable payments, deploy, sign, activate, or claim partner readiness.
9. Report source checks, executable checks, external/human gates, and unrun gates separately.

Partner diligence only

No onboarding or activation yet

The tagged partner package documents the review process and stop conditions. It does not authorize a pilot, production use, funds, signing, deployment, or collection of partner data.

Read these tagged paths

pr10/partner-package/PARTNER_QUICKSTART.md
pr10/partner-package/README.md
pr10/partner-package/PARTNER_READINESS_RELEASE_CHECKLIST.md
pr10/partner-package/docs/BLOCKED_FIELDS.md
pr10/partner-package/docs/PRIVACY_DATA_MINIMIZATION.md

Stop conditions

Stay on V2 and keep V3 offline.

Zero active V3 design partners and no partner acceptance
Do not send value, PII, credentials, secrets or signatures
Do not invent or fill blank addresses, owners, roles or authorities
Require separate legal, privacy, security, commercial, SLA, incident, RACI and human approval evidence

SDK source provenance

Build locally from the tagged monorepo

No published npm package is claimed to match this V3 candidate. Use the tagged lockfile, build locally, and bind integrations to the four exact ABI identities below.

SDK / local lockfile build

cd repos/vaultfire-sdk
npm ci
npm run build
npm test

Accountability / 360x0c18d05c868716fad4bfc1fcfad2da51c83f247de06a7e3871dcece768a9526f

Partnership / 550x954aeee609e92a621e726dcae77be193085651626941d582ca2f7f3b7c073d8c

Governance / 450xcf81d69fed252f21bfd7661ff53868aa81b9ce1a4a1c89edbec9eaabffa7ad0a

Mandate Registry / 240xe31e9d196bf5a37c328313f688b0d6eff881847e6c46437c1fc617faff8e80e3

Download no-wallet sandbox ↗Sandbox guide and curl examples ↗V3 SDK onboarding ↗Partner intake ↗Security contact ↗

Reproducible expectations

Validation commands and evidence boundaries

Counts are tied to named commands and exact commits. Bundled evidence is labeled separately from post-tag preparation results, and no row claims independent human reproduction.

Command	Scope	Expected runtime	Expected passing count	Last verified environment	Exact commit tested	Evidence status
`./scripts/verify-v3-source.sh`	Frozen source, policy and V2 preservation	About 1 minute	7 required gates	Linux x86_64 · Node 20.20.1 · npm 10.8.2	`bf4b97f65b7032c778d137bb52a432afc4615b51`	Bundled exact-source evidence ↗
`npm test --prefix pr7`	API, x402, schemas, registry and compatibility	About 1–3 minutes	136 tests in the full PR7 suite	Linux x86_64 · Node 20.20.1 · npm 10.8.2	`457c7e907dc34004ad879e758b90ea012a0ddf2e`	Post-tag verification result and exact logs ↗
`npm test --prefix pr7/partner-sandbox`	Deterministic no-wallet lifecycle sandbox	Under 1 minute	10 tests	Linux x86_64 · Node 20.20.1 · npm 10.8.2	`457c7e907dc34004ad879e758b90ea012a0ddf2e`	Post-tag source-review tooling ↗
`node repos/theloopbreaker-site/scripts/generate-release-discovery.mjs --check`	Canonical manifest and machine-discovery parity	Under 1 minute	19 focused tests plus route parity	Linux x86_64 · Node 20.20.1 · npm 10.8.2	`457c7e907dc34004ad879e758b90ea012a0ddf2e`	Generated from canonical release status ↗

Evidence rule. Expected counts are acceptance criteria, not proof by themselves. Re-run partner-review.sh in a clean checkout and preserve its JSON result alongside the checksum manifest when producing new evidence.

Machine-readable surface

All 20 V3 routes

Each GET row includes a concrete safe example and its route-specific public outcome. Approved static source-review metadata returns HTTP 200 with conservative, non-operational content; deployment-dependent and payment-dependent routes remain behind the 503 release gate. The retired POST is visible but deliberately not linked or executed. Row badges describe website API handlers; canonical SDK status is shown separately, where API “degraded” maps to SDK “adapter-required.”

10 supported5 degraded4 unavailable1 retired

GETsupported

/api/v3/contracts

Static V3 contract catalog and deployment dispositions.

Expected now: 200 static contract catalog

GETsupported

/api/v3/contracts/MultisigGovernanceV3

Static V3 contract metadata by canonical name.

Expected now: 503 x402_release_gate_closed

GETsupported

/api/v3/bonds?party=0x1111111111111111111111111111111111111111

Bond query by required party query parameter; fail-closed while deployment/read adapter is absent.

Expected now: 503 x402_release_gate_closed · Canonical SDK: adapter-required

GETsupported

/api/v3/bonds/1

Bond read model by numeric ID.

Expected now: 503 x402_release_gate_closed · Canonical SDK: adapter-required

GETsupported

/api/v3/disputes/1

Objective dispute record by numeric ID.

Expected now: 503 x402_release_gate_closed

GETdegraded

/api/v3/evidence/0x1111111111111111111111111111111111111111111111111111111111111111

Evidence record; module is deferred by the pilot manifest.

Expected now: 503 x402_release_gate_closed

GETdegraded

/api/v3/tasks/1

Task escrow read model; module is deferred by the pilot manifest.

Expected now: 503 x402_release_gate_closed · Canonical SDK: retired

GETdegraded

/api/v3/mandates/0x1111111111111111111111111111111111111111111111111111111111111111

Canonical plural mandate lookup.

Expected now: 503 x402_release_gate_closed · Canonical SDK: adapter-required

GETdegraded

/api/v3/mandate/0x1111111111111111111111111111111111111111111111111111111111111111

Singular V3-only compatibility wrapper; never falls back to V2.

Expected now: 503 x402_release_gate_closed · Canonical SDK: adapter-required

GETsupported

/api/v3/governance/proposals/1

Governance proposal status by numeric ID.

Expected now: 503 x402_release_gate_closed · Canonical SDK: adapter-required

GETsupported

/api/v3/pull-credits?contract=0x1111111111111111111111111111111111111111&asset=0x1111111111111111111111111111111111111111&holder=0x1111111111111111111111111111111111111111

Pull-payment credit balance query with required contract, asset, and holder parameters.

Expected now: 503 x402_release_gate_closed · Canonical SDK: adapter-required

GETsupported

/api/v3/migration/dispositions

Supported, deferred, unavailable, and retired migration dispositions.

Expected now: 200 static migration dispositions

GETsupported

/api/v3/protocol/status

Static unconfigured protocol deployment/read-adapter readiness.

Expected now: 200 not-ready; data-source-unconfigured; data null

GETsupported

/api/v3/protocol/solvency

Protocol solvency read model.

Expected now: 503 x402_release_gate_closed · Canonical SDK: adapter-required

GETunavailable

/api/v3/x402/discovery

Static fail-closed x402 discovery document.

Expected now: 503 x402_release_gate_closed · Canonical SDK: unavailable

GETunavailable

/api/v3/x402/challenge-status

Static x402 challenge capability status.

Expected now: 503 x402_release_gate_closed · Canonical SDK: unavailable

GETunavailable

/api/v3/x402/challenges/0x1111111111111111111111111111111111111111111111111111111111111111

x402 challenge read model by bytes32 ID.

Expected now: 503 x402_release_gate_closed · Canonical SDK: unavailable

GETunavailable

/api/v3/x402/receipts/v3r_0123456789abcdef0123456789abcdef

Durable receipt status lookup; no in-memory production fallback.

Expected now: 503 x402_release_gate_closed · Canonical SDK: unavailable

GETdegraded

/api/v3/solana/health

Source and executable evidence health without contacting Solana.

Expected now: 200 source-only; no deployment or validator claim

POSTretired

/api/v3/x402/actions/create-partnership-bond

Non-executing retirement response retained for explicit safety.

Expected now: 503 v3_x402_route_permanently_retired; non-executing

Preliminary partner diligence

Start with exact source. Earn every stronger claim.

The fastest credible partner path is to clone the release, run the verifier, choose one bounded integration surface and record any heavyweight, chain or organizational evidence separately.

Clone for review Browse repository