# Vaultfire V3 open interface — adversarial remediation handoff

SPDX-License-Identifier: MIT

Date: 2026-08-25 EDT

Specification: `1.0.0`

Protocol mapping: `3.0.0`

Permitted change scope: repository-root `LICENSE` and additive `v3-open-spec/` only

## Truth boundary

This package is a repository-local, offline open interface and conformance package for permissionless compatible Accountability and Partnership bond implementations. Accountability and Partnership bonds are the core product; identity, evidence, payment, governance, and enforcement are bounded supporting infrastructure.

Specification compliance does not imply audited, deployed, authorized, endorsed, activated, operationally ready, or production-decentralized. Every included truth object keeps those four named external-status labels false. The canonical mapping records all four SDK deployment identities as `not-deployed-not-authorized`. No external publication, RPC observation, wallet action, signature generation, deployment, authorization, or endorsement is claimed.

The root MIT license is open licensing, not evidence of production decentralization or deployment.

## Independent audit remediation

The independent report's 16 findings were extracted from the full DOCX, and both preserved independent harnesses were executed before remediation. Baseline evidence is retained in `reports/baseline-independent-mutations-20260825.jsonl` and `reports/baseline-parser-edge-20260825.txt`. The original mutation harness accepted 21 of 21 invalid documents before remediation.

| Finding | Closure |
| --- | --- |
| C-01 | Added a self-sufficient, exact-hash-bound interface snapshot with full canonical signatures, four ABI identities, EIP-712 domain/type layouts, constants, state ordinals/transitions, 15 source modules, four SDK deployments, 11 SDK read routes, and 20 generated V3 API paths. The snapshot is a pinned compatibility view, not a replacement authority or fallback. |
| C-02 | Added a fixed registry of 29 REQUIRED check IDs; strict reports require every ID exactly once, nonzero evidence digests, arithmetically exact summaries, no failed/not-run checks for conformance, and truth synchronized to the result. Arbitrary caller-selected checks cannot claim conformance. |
| H-01 | Removed the noncanonical domain `salt`; bound exact domain, chain, verifier, terms digest, party set, nonce, validity interval, replay scope, nonce-consumption state, canonical low-`s`/27-or-28 signature structure, and canonical EIP-712 layouts. Production implementations normatively must recover exact consenting signers; the offline corpus does not claim external signing or authenticity. |
| H-02 | Enforced canonical Accountability and Partnership create constraints: nonzero/distinct parties, native asset, nonzero verifier, positive/bounded stake/slash/windows, exact rule/config/source/evidence/privacy commitments, empty signer-set commitments, proposal/active-period ordering, and overflow-safe bounds. |
| H-03 | Replaced free-form protected-decision input with a closed typed provenance model. Personal/surveillance inputs, unsafe provenance, decision-influencing extensions, and primitive/transitive/hash-label extension bypasses are rejected. |
| H-04 | Added exact principal conservation, reward separation, funded/liability/withdrawn equality, Partnership no-slash rule, embedded-definition validation/digest binding, canonical transition history, matured pause-safe exits, pull-credit accounting, and bilateral bounded settlement. |
| H-05 | Evidence now requires safe repository-relative regular-file paths, exact hashes, source-set digest, exact ABI identity, exact commit/tree, strict UTC timestamps, nonstale bounds, module gates, and conservative source-only truth. Traversal, symlink, fabricated deployment, authorization, capability, and runtime claims fail closed. |
| H-06 | Removed `assert` from checker control flow. Normal and `python -O` runs use explicit failures and return nonzero on tamper. Dedicated optimized-mode regressions cover checker and full tests. |
| H-07 | Replaced boolean-only exactness with immutable commit, tree, path/hash, source-set, ABI, definition, subject, evidence, and terms bindings. Candidate/source drift is compared to exact pinned values. |
| H-08 | Corrected exact closure to 15 canonical source modules, four SDK deployments with signature counts 36/55/45/24, four exact SDK write-method closures, 11 SDK read-route dispositions, and 20 generated V3 API path/method records. |
| M-01 | Receipts bind subject/evidence digests and enforce result/error conditionals; errors bind code, title, and retryability to the stable 18-code registry; internal-error context is redacted. |
| M-02 | The manifest covers every regular package artifact plus `../LICENSE`, excluding only itself and interpreter caches. Package/source symlinks, unsafe paths, incomplete manifests, and source drift fail closed. |
| M-03 | Duplicate keys, floats, `NaN`, infinities, oversized integers, unpaired surrogates, malformed JSON, malformed mutation objects/paths, and unexpected exceptions are rejected or sanitized to fail-closed internal results. |
| M-04 | Added machine-readable semantic-versioning, extension, canonicalization, compatibility, deprecation, and removed-feature rules. Extensions are typed, non-security-critical, and prohibited from protected-decision influence. |
| M-05 | Expanded to 38 deterministic adversarial vectors, froze expected codes independently of validator output, converted the legacy-named updater into a read-only verifier, and added a verbatim 21-mutation regression. |
| L-01 | Enforced strict `YYYY-MM-DDTHH:MM:SSZ` parsing, exact signed-term observation bounds, and deployment-evidence observation/expiry ordering. |

## Mission and whole-stack invariants

The normative specification, schemas, semantics, vectors, and required checks enforce:

1. Flourishing cannot slash principal.
2. Rewards cannot consume collateral.
3. Surveillance data is never required or permitted for protected decisions.
4. Consent is explicit.
5. Exits and refunds are bounded and pause-safe.
6. Every module has bounded liabilities, pull-payment claims where value is claimable, terminal/bounded exits, immutable evidence, fail-closed APIs, and exact-commit testing.
7. Activation is independent and module-by-module behind default-closed gates; monolithic or transitive activation is prohibited.
8. Cross-chain trust-history portability uses consent-bound immutable commitments, data minimization, and fresh chain-specific authorization; it cannot carry surveillance/personal data or authorize a destination-chain action.

## Canonical closure

* Repository commit: `ce4d738adc406b5125ef373e0809c4839e01670e`
* Repository tree: `874d567a53fab7e3a10ccae14afb106e1470b599`
* Root MIT License SHA-256: `6ffb9af0a5ff2c17d0bbcb866634076f7bcd0f82ce756bd80856398ef67dd42a`
* SDK ABI identities:
  * accountabilityBond: `0x0c18d05c868716fad4bfc1fcfad2da51c83f247de06a7e3871dcece768a9526f`
  * partnershipBond: `0x954aeee609e92a621e726dcae77be193085651626941d582ca2f7f3b7c073d8c`
  * governance: `0xcf81d69fed252f21bfd7661ff53868aa81b9ce1a4a1c89edbec9eaabffa7ad0a`
  * mandateRegistry: `0xe31e9d196bf5a37c328313f688b0d6eff881847e6c46437c1fc617faff8e80e3`

The source snapshot is exact-hash-bound. A later change by another owner requires an explicit mapping/snapshot refresh and full revalidation; it must not be silently treated as compatible.

## 2026-08-26 residual-audit remediation

All 12 residual source findings (C-02; H-01, H-03, H-04, H-05, H-07, H-08; M-02, M-03, M-04, M-05; L-01) now have direct regression coverage. The 13 newly accepted negative cases are rejected. The exact vector oracle fixes the corpus at 8 positive and 38 adversarial vectors and prohibits parser/internal failures as expected successes. Reports recompute implementation and per-check evidence digests and verify Git commit/tree existence, relationship, required committed paths, and candidate cleanliness. All 15 supported source modules and all 20 normalized API operations are checked on every run.

The checked working candidate is intentionally **BLOCKED / NONCONFORMANT**: its current `HEAD` does not contain the new root `LICENSE` and `v3-open-spec` package, and the relevant working paths are not clean at that commit. The report therefore records 28 passed checks, one failed `EXACT_COMMIT` check, `summary.conformant=false`, and `truth.specificationCompliant=false`. This is not bypassed in tests. A final owner must commit the exact package and license, regenerate the current commit/tree bindings and fresh report, then rerun every validation before any conformance claim.

Open MIT licensing is established by the exact root license digest. It does not establish audit, deployment, authorization, endorsement, production decentralization, or module activation; all such labels remain false.

## Final validation

* Strict checker, normal mode: PASS — 98 checks, 8 schemas, 8 positive vectors, 38 adversarial vectors, 33 checksummed entries.
* Strict checker, `python -O`: PASS with the same counts.
* Standard-library tests, normal mode: PASS — 39 tests.
* Standard-library tests, `python -O`: PASS — 39 tests.
* Pytest: PASS — 39 tests.
* Preserved independent invalid-mutation harness: PASS — 0 accepted, 21 rejected.
* Preserved parser-edge harness: `NaN` parse rejected; `NaN` extension rejected; malformed mutation sanitized into the expected `VF3-INTERNAL-001` vector result. Its literal `malformed_vector ACCEPTED` label means the harness call returned without an uncaught exception, not that the malformed document conformed.
* Frozen vector expected-code verifier: PASS — 38 of 38.
* Conformance report: PASS — 29 required checks passed, zero failed, zero not run.
* Normal and optimized checksum tamper tests: PASS — modified artifacts fail closed.
* Missing/modified/wrong/stale license tests: PASS.
* Source-hash, missing-manifest, and symlink tamper tests: PASS.
* Deterministic report and manifest regeneration: PASS.
* `git diff --check -- LICENSE v3-open-spec`: PASS.

No installation, network access, RPC, indexer, wallet, signing, deployment, commit, push, or external publication was performed.

## Exact intended files

The intended change set is the root `LICENSE` plus every regular source artifact listed in `ARTIFACTS.sha256` and `ARTIFACTS.sha256` itself. Interpreter cache files are ignored and not deliverables. No pre-existing Base Solidity, protected V2, SDK, site/x402, Solana, `v3-operations`, or ledger file is part of this package's change scope.

## Blockers

No technical or licensing blocker remains for this repository-local open interface package. Production deployment, independent audit, external authorization, live capability evidence, and real-signature/deployed-domain verification remain intentionally unclaimed external gates, not inferred outcomes of specification compliance.


## Third independent audit structural remediation — 2026-08-26

H-02 is closed by a closed, typed, reachable provenance DAG: self-cycles and all graph cycles, unreachable nodes, generic objective-source escapes, absent or opaque derivations, and recursively nested biometric/surveillance/profiling/behavioral/tracking/opaque/transitive content all fail closed. H-03 is closed by one external candidate envelope and one validation path binding the same commit/tree to the canonical mapping, interface snapshot, evidence, manifest, license, and committed inclusion. The report is post-commit output excluded from the source manifest; the CLI does not rewrite committed inputs and an isolated temporary commit passes end to end when its source hashes are current. M-01 is closed by exact source-artifact discovery: `.pytest_cache`, `__pycache__`, and bytecode are ignored in development but rejected in release mode.

H-01 is finalized against the stabilized source. `MultisigGovernanceV3.sol`, the canonical mapping, and the interface snapshot all bind SHA-256 `993a66ca97ce77b6b240d8ed607e26d9755f86ecdf0361dffd70951d83ac8cfe`. Source drift is zero across all 15 modules. The present working tree is not a final clean candidate commit, so no conformance claim is made.

## Authoritative current validation — third-audit structural pass

This section supersedes earlier validation counts. Standard-library unit tests pass 57/57 in normal mode and 57/57 under `python -O`; the six third-audit regressions pass in both modes, including a read-only isolated temporary-commit end-to-end conformant run. Schema closure is 8/8. The frozen corpus is 8 positive plus 38 adversarial vectors (46/46 expected outcomes). After the stabilized-source refresh, the generated report is truthfully nonconformant only on exact-commit cleanliness/inclusion; all source bindings are current. Release mode is cache-free. `git diff --check` passes. Pytest is not installed and was not installed. No real commit was created; the end-to-end regression creates only an isolated temporary repository that is automatically discarded.

## Stabilized Base finalization — 2026-08-25 23:03 EDT

Pending H-01 is closed. The exact current `v3-src/contracts/governance/MultisigGovernanceV3.sol` SHA-256 is `993a66ca97ce77b6b240d8ed607e26d9755f86ecdf0361dffd70951d83ac8cfe`, pinned identically in the canonical mapping and interface snapshot. Direct byte verification covers all 15 supported modules and all additional canonical source/license files. The final four SDK identities use signature counts 36, 55, 45, and 24; all four SDK write closures, 11 SDK reads, and 20 generated V3 APIs are exact. The only failed conformance check remains `EXACT_COMMIT`, because no clean real commit containing the root `LICENSE` and package was permitted. Source drift is zero. Release mode is cache-free. Open licensing still does not imply deployment, audit, authorization, endorsement, activation, or production decentralization.

## Post-bond-change lifecycle refresh — 2026-08-26

The refreshed exact source bindings are `AccountabilityBondV3Safe.sol` SHA-256 `fffa87569e1afbc74301eccb099815a27b2954586e13f05b8c8e766a096ccffa` and `BondStateV3.sol` SHA-256 `d22611af5957320446ed95784497d0e0280860786eba8e34b76e2e960fc2d14b`. Direct verification covers all 15 supported modules with zero drift. The normative lifecycle treats `activePeriodEnd` as exclusive for ordinary active and staged settlement activity: those operations may occur at end minus one and cannot occur at end or end plus one. Expiry may occur at end or later but not end minus one. The sole typed exception is a previously accepted Accountability liability: its timeout is callable while paused at or after the boundary and must perform a same-timestamp, codehash-pinned canonical revalidation immediately before either settling the bounded accepted liability or cancelling with a full refund. Accountability response, challenge, and decision windows remain consecutive half-open intervals and their decision deadline must be strictly less than `activePeriodEnd`; equality fails closed. Focused regressions cover staged timing, all end-minus-one/end/end-plus-one cases, same-timestamp revalidation, and both timeout outcomes. The canonical corpus remains frozen at 8 positive and 38 adversarial vectors because these are boundary regressions over already normative schemas, not new interchange document classes or error expectations.

Authoritative post-change validation: standard-library tests pass 59/59 normally and 59/59 under `python -O`; the frozen corpus passes 8/8 positive and 38/38 adversarial outcomes; all 29 required checks execute with 28 pass, one fail, and zero not-run; all 15 supported module hashes match; manifest discovery covers 45 artifacts and regenerates byte-identically; normal, optimized, and cache-free release checks are blocked only by `EXACT_COMMIT`; and `git diff --check` passes. No cache artifacts remain.

## Final independent audit C0/H1/M1/L0 closure — 2026-08-26

H-01 remains closed for ordinary transitions: the validator rejects `SettlementFrozen -> Settled` and every settlement-request, challenge, finalizable, settlement-freeze, and settlement-finalization transition whose transition timestamp is `activePeriodEnd` or later; each remains valid at `activePeriodEnd - 1`. The final source adds the narrowly typed accepted-liability timeout described above and does not reopen ordinary finalization. M-01 remains closed: both `mappings/canonical-v3.json` and `interfaces/canonical-v3-interfaces.v1.json` carry the identical exact 25-edge source transition closure, including `SettlementRequested -> Expired`, `Finalizable -> Expired`, `SettlementFrozen -> Expired`, and the final source-valid `SettlementFrozen -> Cancelled`. Internal regressions validate all end-minus-one/end/end-plus-one settlement targets, execute the staged expiry paths, and distinguish ordinary transitions from the typed timeout. The preserved independent final timing harness is run in normal and optimized Python. The frozen 8/38 corpus remains unchanged because this correction tightens lifecycle semantics and repairs a canonical snapshot omission without introducing a new schema or stable vector error contract. `EXACT_COMMIT` remains the sole expected blocker until a clean commit contains the root license and package.

The final Base ABI snapshot contains 36 Accountability signatures and excludes all retired generic dispute, challenge, freeze, direct-settlement, and payout selectors. Its ABI identity is `0x0c18d05c868716fad4bfc1fcfad2da51c83f247de06a7e3871dcece768a9526f`. The final Partnership, Governance, and Mandate Registry closures contain 55, 45, and 24 signatures with identities `0x954aeee609e92a621e726dcae77be193085651626941d582ca2f7f3b7c073d8c`, `0xcf81d69fed252f21bfd7661ff53868aa81b9ce1a4a1c89edbec9eaabffa7ad0a`, and `0xe31e9d196bf5a37c328313f688b0d6eff881847e6c46437c1fc617faff8e80e3`. Partnership adds only the two flourishing read constants. Governance adds codehash reads, append-only only-self pinning, and the codehash-bound policy overload while excluding all configuration selectors from SDK write methods. The mapping and interface snapshot are exact peers, bind all 15 supported source modules, four SDK write closures, 11 SDK read routes, and 20 generated V3 API routes, and preserve truth labels: open MIT licensing does not imply audit, deployment, authorization, decentralization, or endorsement.

Final SDK-reconciliation validation: 64/64 standard-library tests pass normally and 64/64 pass under `python -O`; pytest passes 64 tests and 82 subtests with its cache provider disabled; all eight preserved independent open-spec harnesses pass in both normal and optimized modes; all 8 positive and 38 adversarial vectors produce their exact expected outcomes; eight schemas and four registries parse and validate; all 15 supported module hashes, four SDK identity records, four SDK write closures, 11 SDK reads, 20 V3 API operations, and 25 state transitions match their canonical closures. Partnership's flourishing constants are read-only and non-controlling. Governance's unpinned policy overload is absent, its codehash-bound overload and codehash getters are present, and configuration selectors do not intersect the eight exposed Governance SDK writes. The external report executes all 29 required checks, with 28 passing and only `EXACT_COMMIT` failing. This failure is expected and truthful in the current uncommitted candidate: specification compliance remains false until a clean commit and tree include the root `LICENSE` and the complete package.
