# Vaultfire Protocol — Solana

> KYA — Know Your Agent. A source design for privacy-preserving agent trust and accountability on Solana.

![Candidate](https://img.shields.io/badge/Status-source%20candidate-blue.svg)
![Solana](https://img.shields.io/badge/Chain-Solana-9945FF.svg)
![Programs](https://img.shields.io/badge/Supported%20programs-6-blue.svg)
![Release](https://img.shields.io/badge/Release-source--only%20blocked-red.svg)
![License](https://img.shields.io/badge/License-MIT-green.svg)

---

> **Source-only safety notice:** No program in this package is authorized for
> deployment or bootstrap. No zero-knowledge verifier, ML-DSA verifier,
> cross-chain proof verifier, privacy-compliance verifier, or value-bearing
> partner pilot is implemented and approved here. Every singleton initializer
> fails closed, and the deployment command exits non-zero.

## What is KYA?

The AI age has a trust problem. AI agents are making decisions, handling money, and operating autonomously — with zero verifiable accountability. No identity. No track record. No skin in the game. Anyone can deploy an agent that claims to be trustworthy.

**KYA (Know Your Agent)** is Vaultfire's design direction for agent trust without surveillance. This repository does not prove private facts or establish verified compliance; it contains blocked source components whose claims must remain unverified unless a separately reviewed verifier establishes them.

KYA is what the AI age needs: trust without surveillance, accountability without control, identity without exploitation.

Unlike identity systems that collect sensitive personal data, Vaultfire's mission rejects surveillance and extraction. A future private-proof design remains roadmap work; this package contains no zero-knowledge proof system.

As AI agents handle money, make decisions, and operate autonomously, the question
"can I trust this agent?" becomes critical infrastructure.

Vaultfire's Solana source is open for review, but it is not deployed or operational evidence.

---

## The HTTPS Analogy

When HTTPS was introduced, it wasn't optional. It became the universal trust layer for the web —
every serious website adopted it, browsers started warning users about sites without it,
and eventually it became the default.

Vaultfire is to AI trust what HTTPS was to web security: the universal trust and accountability
layer for the AI age. Not a product. Not a feature. Infrastructure.

This repository retains 15 Anchor program source designs but supports exactly
six release candidates. Similarity to EVM concepts does not establish
equivalent deployment, verification, or operational status.

[`v3-program-dispositions.json`](./v3-program-dispositions.json) is the
canonical V3 release boundary:

| Disposition | Programs | Release effect |
| :--- | :--- | :--- |
| `supported-candidate` | `ai_accountability_bonds`, `ai_partnership_bonds`, `identity_registry`, `multisig_governance`, `privacy_guarantees`, `vaultfire_adapter` | The only programs eligible for workspace tests, SBF build, generated IDLs/artifacts, and immutable local rehearsal. This is source candidacy, not audit or deployment approval. The adapter is passive and unverified. |
| `redesign-required` | `anti_surveillance`, `dilithium_attestor`, `mission_enforcement`, `validation_registry` | Source retained for review, but excluded from the release workspace and all executable evidence until an objective-only, non-custodial redesign is approved and tested. |
| `retired` | `belief_attestation_verifier`, `flourishing_metrics_oracle`, `production_belief_verifier`, `reputation_registry`, `trust_data_bridge` | Permanently excluded from supported V3 and prohibited from routing or protected decisions. |

The release gate fails if the workspace differs from this allowlist, if a
program depends on or invokes another Vaultfire program, if excluded programs
enter generated IDLs/artifacts or a deployment map, or if rehearsal introduces
a signer or upgrade authority. Generated IDLs are checked against source-derived
argument types, account privileges, and exact ordered PDA seed metadata
(constant bytes, seed kinds, account paths/types, and optional program seed),
plus relationships, state/event layouts, and defined enums—not names or PDA
presence alone. Packaged text claims canonicalize excluded identifiers across
snake, kebab, spaced/title, PascalCase, camelCase, and separator-free forms.
The SBF verifier owns both isolated builds and their byte comparison; no caller
environment flag can assert reproducibility.
Source-only readiness deliberately carries no commit attribution until clean
executable evidence is produced for an exact committed candidate.

> **Mainnet status:** No Vaultfire V3 Solana program is deployed on mainnet.
> The checked-in program identifiers and recorded tests are local-validator
> artifacts, not deployment evidence. The source-only, fail-closed handoff is
> [`MAINNET_READINESS.md`](./MAINNET_READINESS.md).

---

## V3 source inventory

The release surface documents behavior only for the six supported candidates:

- `ai_accountability_bonds`: agent-owned, rent-safe vault source with slashing
  unavailable.
- `ai_partnership_bonds`: mutual-consent relationship records for two distinct,
  canonically ordered signers.
- `identity_registry`: signer-owned profile registration with close and
  re-registration support.
- `multisig_governance`: expiring approval records with no CPI dispatcher;
  finalized and expired records return rent to the recorded proposer.
- `privacy_guarantees`: unverified commitment records that can be closed and
  renewed; compliance promotion remains unavailable.
- `vaultfire_adapter`: passive, unverified signer-owned text records only. It
  has no reputation, identity-verification, routing, or protected-decision
  fields, and no global authority can mutate a profile.

The remaining nine names appear only in the canonical disposition table and
manifest as source-retained exclusions. Their prior behavior and historical
identifiers are not part of the release surface.

---

## Candidate program identities

All fifteen source identities are pinned exactly once in the canonical
disposition manifest and checked against their declared source paths. Partner
documentation repeats only the six supported-candidate IDs in
[PROGRAM_IDS.md](./PROGRAM_IDS.md). These are source identities, not verified
deployments or upgrade-authority evidence.

---

## Private-Proof Roadmap

KYC has a fundamental privacy problem: proving who you are requires handing over sensitive data.

Private proofs are a roadmap requirement, not an implemented feature of this
package. No Solana ZK circuit, verifier, proof format, or audited integration is
present. The current privacy and anti-surveillance programs record unverified
declarations only and cannot inspect external data collection or prove data
minimization.

---

## Quantum Resistance — Built for the Long Game

Standard internet encryption — HTTPS, Bitcoin, Ethereum wallets — relies on cryptography that quantum computers will be able to break. Google has warned this could happen by 2029.

Vaultfire saw this coming.

`dilithium_attestor` is redesign-required source for a proposed
CRYSTALS-Dilithium (ML-DSA) attestation shape. It contains no accepted
cryptographic verification and is excluded from the V3 build and rehearsal.

| Component | Quantum Status |
| :--- | :--- |
| dilithium_attestor (redesign required) | No executable verifier evidence; excluded from supported V3 |
| belief_attestation_verifier (retired/excluded) | No executable post-quantum evidence |
| Bond programs, Identity Registry | Standard Ed25519 design; quantum hardening remains a roadmap item |
| User wallets (Solana) | Standard Ed25519; no mainnet deployment asserted |

> **Honest note:** Full quantum resistance remains roadmap work. This source
> package does not establish ML-DSA verification or quantum resistance.

---

## Security validation

This checkout contains source plus reproducible local build and validator
workflows, not approved mainnet deployment artifacts. It deliberately contains
no mainnet deployment command or approved deployment configuration.
`npm run test:rehearsal` runs
the dependency-free source, lifecycle, custody, authority, and
security-regression gates. `npm run rehearse:container` performs the pinned SBF
build and immutable local-validator preload for only the six canonical
supported candidates described in
[`PARTNER_LOCAL_REHEARSAL.md`](./PARTNER_LOCAL_REHEARSAL.md). It creates no
wallet or upgrade authority and uses loopback RPC only. Do not run `anchor
test`: the source-only `Anchor.toml` intentionally has no program map, active
test command, or wallet.

For a freshly cloned source tree, install Node 20 and Rust 1.89.0, then run
`npm run verify:source`. This one command performs the dependency-free policy
suite, locked Cargo metadata validation, formatting, native workspace tests,
and Clippy with warnings denied. It does not contact an RPC endpoint, create or
use a wallet, build deployable artifacts, or imply deployment or partner
readiness. With the pinned Anchor CLI installed, `npm run idls:verify` creates
the six supported-candidate IDLs from an exact-commit archive in a disposable
directory, validates their full source-derived interfaces, and retains only the
verified JSON under ignored `target/idl`. The canonical source tree never
receives Anchor's program-ID synchronization side effects. The separate
container rehearsal remains the executable-evidence workflow and is
intentionally commit-bound.

The V3 alpha hardening explicitly fails closed for the unimplemented bridge
attestation and ML-DSA verification paths. **All fifteen V3 singleton
initializers are also deliberately disabled** until a source-backed,
independently reviewed deployment authority and custody design is accepted.
Accordingly, the feature descriptions above are narrow source descriptions, not
currently enabled V3 behavior. The governance program is an expiring, threshold
approval ledger only: finalization has no CPI dispatcher and cannot itself
execute arbitrary actions. Accountability-bond slashing is disabled pending a
reviewed adjudication and settlement recipient design. The accountable-bond and
partnership-bond account layouts changed incompatibly from the historical local
layout; no migration or deployment is authorized by this repository.

The package `deploy` command is intentionally blocked. It has no alternative
deployment command, mainnet program map, signer, RPC target, or address.
`PARTNER_LOCAL_REHEARSAL.md` describes the only honest no-value rehearsal
available from this source package.

The current candidate passed 68 of 68 source-policy tests, locked/offline Cargo
metadata validation, formatting, nine native Rust unit tests plus doc tests,
and Clippy with warnings denied. All six supported programs built twice to
byte-identical SBF artifacts under the pinned Anchor 0.32.1, Agave 2.3.0, and
Rust 1.89.0 toolchains. Generated IDLs were independently checked against the
source-derived instructions, account privileges, PDA seeds, relationships,
layouts, enums, and errors. A loopback-only local-validator rehearsal loaded
all six immutable programs with disabled upgrade authority and verified the
expected executable accounts. These results establish reproducible local
candidate evidence only; they do not establish an independent human audit,
mainnet deployment, production operations, or partner authorization.

---

### What the EVM hub looks like from Solana's perspective

This repo contains the Solana program implementations. The live EVM hub at [theloopbreaker.com](https://theloopbreaker.com) runs on Base mainnet. The Solana programs mirror the EVM protocol design:

| EVM (Base mainnet) | Solana (this repo) | Status |
| :--- | :--- | :--- |
| AIPartnershipBondsV2 | ai_partnership_bonds | V3 alpha source; mutual-consent redesign |
| ERC8004IdentityRegistry | identity_registry | V3 alpha source only |
| AIAccountabilityBondsV2 | ai_accountability_bonds | V3 alpha source; rent-safe vault redesign |
| VaultfireNameService | trust_data_bridge | Disabled pending attestation verifier |
| DilithiumAttestor | dilithium_attestor | Disabled pending ML-DSA verifier |

> **Note:** The Solana programs have a recorded local test result. A future
> partner deployment is optional and must pass
> [`MAINNET_READINESS.md`](./MAINNET_READINESS.md); this repository does not
> provide a mainnet deployment instruction.

---

## Future partner deployment

No deploy command is included in this source-only readiness package. A native
Solana program may be deployed only by an approved partner after independent
audit, reproducible-build comparison, verified deployment evidence, accepted
upgrade-authority custody, and operational acceptance. The exact required
inputs and fail-closed defaults are in
[`MAINNET_READINESS.md`](./MAINNET_READINESS.md).

---

## How This Relates to the EVM Deployment

Vaultfire Protocol is deployed across Base, Avalanche, Arbitrum, and Polygon with 67 verified contracts. This Solana implementation mirrors that architecture — the same 15 core programs, rebuilt in Rust with Anchor.

**Honest EVM status (as of 2026-04-04):**

| Chain | Contracts/Programs | Status |
| :--- | :--- | :--- |
| Base Mainnet | 16 contracts | Hub primary chain — see below |
| Avalanche C-Chain | 15 contracts | Deployed and verified — cross-chain sync in v1.0 |
| Arbitrum One | 17 contracts | Deployed and verified — cross-chain sync in v1.0 |
| Polygon PoS | 17 contracts | Deployed and verified — cross-chain sync in v1.0 |
| **Solana** | **15 source programs** | **Recorded local tests; no mainnet deployment evidenced** |

**Base EVM feature status:**

| Feature | Status |
| :--- | :--- |
| ERC-8004 Identity Registry | ✅ LIVE — 9 agents registered |
| AIPartnershipBondsV2 | ✅ LIVE — create bonds today |
| VaultfireNameService | ✅ LIVE |
| Street Cred Scoring (0–95) | ✅ LIVE |
| AIAccountabilityBondsV2 | ✅ LIVE — deployed and verified on Base (`0x6750D28865434344e04e1D0a6044394b726C3dfE`). Yield pool funded and operational on all 4 EVM chains. |

The EVM contracts are in [ghostkey-316-vaultfire-init](https://github.com/Ghostkey316/ghostkey-316-vaultfire-init). This repo is the Solana implementation — standalone, no dependencies on the EVM repo.

---

## ⚠️ Alpha Disclaimer

**Vaultfire Protocol — Solana is currently in alpha.**

This means:

- Programs have not been formally audited by a third-party security firm
- Historical local-validator records are not current deployment evidence
- Some features are partially implemented or under active development
- The protocol may change in breaking ways before v1.0
- Do not use with significant funds until a formal audit is complete

We are building in public. Every program is open source. Every commit is public. We believe transparency is the foundation of trust.

---

## Security

- No Solana mainnet upgrade authority is asserted. The historical local source
  metadata names `6KpXaFmaR8WPWr79qzsMBvwDbDzYFErwNoWxfwqDr8JU`; it requires
  independent custody and on-chain verification before any partner launch.
- [`V3_SECURITY_RELEASE.json`](./V3_SECURITY_RELEASE.json) is deliberately
  `blocked`, contains no program IDs or deployment evidence, and records the
  remaining partner gates.
- This internal AI-assisted review does not replace an independent human audit
  before any uncapped mainnet value is accepted.

---

## Repository Structure

```
vaultfire-solana/
├── programs/
│   ├── mission_enforcement/src/lib.rs
│   ├── anti_surveillance/src/lib.rs
│   ├── privacy_guarantees/src/lib.rs
│   ├── identity_registry/src/lib.rs
│   ├── belief_attestation_verifier/src/lib.rs
│   ├── ai_partnership_bonds/src/lib.rs
│   ├── flourishing_metrics_oracle/src/lib.rs
│   ├── ai_accountability_bonds/src/lib.rs
│   ├── reputation_registry/src/lib.rs
│   ├── validation_registry/src/lib.rs
│   ├── vaultfire_adapter/src/lib.rs
│   ├── multisig_governance/src/lib.rs
│   ├── production_belief_verifier/src/lib.rs
│   ├── dilithium_attestor/src/lib.rs
│   └── trust_data_bridge/src/lib.rs
├── tests/
│   └── *.test.mjs        — Active dependency-free rehearsal regressions
├── historical/tests/        — Non-executable evidence tombstones only
├── scripts/                  — Pinned build, checksum, and local rehearsal
├── Containerfile.rehearsal   — Container-native no-value entry point
├── rehearsal-versions.env    — Exact toolchain contract
├── Anchor.toml               — Workspace configuration
├── PROGRAM_IDS.md            — Six supported-candidate source IDs only
└── TEST_RESULTS.md           — Superseded, non-executable evidence tombstone
```

---

## License

MIT — Vaultfire Protocol is open source.

---

## Mission

The exact immutable source boundary is:

> Morals over metrics. Privacy over surveillance. Freedom over control. Human thriving over extraction.

The older phrase “making human thriving more profitable than extraction” is
historical positioning, not the byte-exact initializer input.

---

## Belief Built in Partnership with AI

Vaultfire is belief built. Every program, every line of code, every design decision reflects a genuine belief that AI should be trustworthy, accountable, and on the side of human flourishing. This protocol was also built in genuine partnership with AI — not as a tool, but as a collaborator. That's not a disclaimer. That's the point. We built it the way we believe it should be built.
