# Vaultfire V3 x402 adversarial-audit closure

**Date:** 2026-08-25  
**Audited finding source:** `/home/user/workspace/Vaultfire_V3_x402_Foundation_Adversarial_Audit_20260825.md`  
**Scope:** additive `pr7/**`, `repos/theloopbreaker-site/app/api/v3/**`, and middleware only  
**Activation posture:** fail-closed; no live payment, settlement, fulfillment, or Bazaar claim

## Result

All 3 High, 5 Medium, and 3 Low source findings have source-level remediations and regression coverage. V3 Bazaar candidates remain zero. The release still cannot activate: authenticated production capabilities and the seven external live-evidence classes listed below are absent.

## Finding-by-finding closure

| Finding | Status | Source remediation | Regression/evidence |
|---|---|---|---|
| H-01 binding accepted unrelated or malformed values | Closed | `receipt-store.ts` now accepts only an immutable registered requirement, allowlists normalized uppercase `GET`/`POST`, requires exact route/method/network/chain/asset/amount/scheme/payee/finality/depth equality, matches the concrete normalized resource against the registered template, rejects query/fragment/dot/repeated-slash/trailing-slash/encoded-separator variants, and enforces lowercase EVM/CAIP formats. Request, payment, authorization, nonce, and transaction replay keys are reserved atomically. | `x402-v3-adversarial-regression.spec.ts` exercises unrelated routes/resources, `BREW`, lowercase methods, query and path normalization attacks, malformed addresses/network/chain, and binding mismatches. |
| H-02 expired or invalid observations could settle | Closed | Complete observations require the bound network and chain, lowercase hashes, canonical-block membership, safe integer heights/times, bounded age, nonfuture time, a valid finality enum, and coherent confirmation depth. State is derived from the requirement and observation. Direct transitions to confirmed/finalized/reorged are forbidden. Reconcile atomically expires stale pending receipts and reserves transaction hashes; reorg is derived from a canonical observation. | Adversarial tests reject future/stale/invalid-finality/noncanonical/wrong-chain/incoherent-depth observations, prohibit manual settlement, and prove the expiry race closes atomically. |
| H-03 audit hashing omitted material data/history | Closed | Every event persists a complete transition snapshot and hashes receipt ID, sequence, event type/time, previous digest, recomputed binding digest, state, created/updated/version, the full chain observation, and failure code. Reads verify every persisted event from zero-digest genesis through the current head, including order, links, chronology, transition semantics, version/history length, and current-record equality. | Mutation tests cover binding, every chain-evidence field, timestamps, failure, omission, reordering, payload edits, chronology, and event-type tampering. |
| M-01 permissive schemas and weak schema tests | Closed for the checked-in contract vocabulary | The six versioned V3 x402 schemas close security objects, require negative truth labels, constrain routes/IDs/methods/times/payment/evidence, enforce unique endpoint items, and impose receipt state/evidence conditionals. `json-schema-2020-subset.ts` centrally implements the checked-in Draft 2020-12 vocabulary and fails on unsupported keywords instead of silently ignoring them. | Foundation tests validate all emitted documents, nested-object mutations, and contradictory settlement state. A full independent Draft 2020-12 implementation remains a recommended clean-CI assurance upgrade; no dependency was installed in this constrained run. |
| M-02 unauthenticated/duplicate publication evidence | Closed | Capability artifacts use canonical payloads and digests, typed evidence kinds, production environment, network/deployment address, issuer, signature, bounded observation time, unique IDs, and a required verifier callback. Recursive duplicate-key-safe JSON parsing rejects nested and top-level duplicate keys. All six capability kinds are required. Publication remains ineligible and zero-candidate even with valid test evidence. | Foundation tests cover authenticated test artifacts, missing verifier, duplicate IDs, malformed artifacts, duplicate JSON keys, and the zero-candidate publication gate. |
| M-03 registries disagreed | Closed | The site registry is derived from the V3 inventory, generator normalization was removed for V3 security fields, and generation fails on incomplete semantics. Handler lookup uses stable route IDs. Generated and site semantics now agree exactly for method/path/free/finality/data source/privacy/schema/idempotency. The stale seven/eight-route assertion text was replaced by the authoritative current 20-route inventory assertion. | `x402-v3-adversarial-regression.spec.ts` performs identity and semantic equality checks; `registry/check_generated.py` reproduces nine generated files in a temporary directory byte-for-byte. |
| M-04 validation record was not reproducible | Closed as an explicitly unauthenticated local record | The validation record now truthfully labels itself ineligible publication evidence and records base commit, dirty-tree status, source-set hash, lockfile/tool versions, exact commands, exit codes, and zero-candidate/no-live claims. Generator verification uses a temporary output tree and does not compare expected work against HEAD. | `pr7/evidence/v3-x402-foundation-validation-20260825.json`; full package test now passes. Authenticated clean-CI identity/signature remains an external publication blocker. |
| M-05 isolation test targeted the wrong store | Closed | The isolation test targets `app/api/v3/x402/_lib/receipt-store.ts`, scans protected V2 imports, and explicitly verifies the legacy duplicate is unreachable. | `x402-v3-website-isolation.spec.ts`; protected V2 diff against HEAD is empty. |
| L-01 identical reconciliation advanced version | Closed | Lua reconciliation compares the canonical observation and derived state and returns `existing` without write, version increment, audit event, or TTL refresh when unchanged. | Adversarial atomicity/idempotence test. |
| L-02 positional registry indexes | Closed | V3 handlers retrieve records by stable unique IDs and assert method/path at module initialization. | Registry duplicate-ID and exact-identity tests. |
| L-03 receipt privacy/entropy unspecified | Closed | Receipt locators require at least 128 bits of caller-supplied entropy, public fields and correlation risk are documented, retention is seven days, logs are privacy-minimal, and reads verify the complete audit chain before returning data. | `V3_X402_RECEIPT_PRIVACY_CONTRACT.md`, receipt schema/tests, static no-sensitive-log checks. |

## Capability and activation boundary

Production writes dynamically require authenticated evidence for:

1. V3 deployment,
2. verified payee,
3. durable receipt store,
4. finality verifier,
5. audit anchor, and
6. objective listing receipt.

No verifier or evidence is configured by the production default. Missing durable-store credentials select the explicit unavailable store; there is no process-memory fallback. Disabled handlers do not inspect payment headers or request bodies and never emit HTTP 402. V2 payment/verifier code is not imported as fallback.

## Validation performed

- `npm --prefix pr7 test` — PASS: 20 test files, 123 tests.
- `npm --prefix pr7 run typecheck` — PASS.
- Narrow additive site V3 `tsc --noEmit` using the locked PR7 compiler — PASS.
- `python3 pr7/registry/check_generated.py` — PASS: nine files byte-identical from temporary output.
- Bazaar V2 metadata validation — PASS: 76 V2 candidates, 29 with Solana options.
- V3 Bazaar candidate inspection — PASS: zero.
- `python3 pr7/registry/validate_bazaar_readiness.py` — expected fail-closed: owner evidence absent.
- Scoped `git diff --check` — PASS.
- Protected V2 handler/baseline diff against HEAD — empty.
- Static V3 scan for logging, 402 status emission, and V2 payment imports — PASS.

The local evidence source-set SHA-256 is `c0f183a8dcb3807fdb22bd96e9b3dc06080c7077b2ddef5f9d6bc4dce47261d5`.

## Remaining external blockers

These are deliberately not represented as source-complete or live:

1. independently verified V3 production deployment/address evidence;
2. verified chain-specific asset and payee configuration;
3. a production canonical-chain/finality verifier and reorg observations;
4. production durable-store availability, backup, retention, and failure-drill evidence;
5. a successful route-bound V3 payment, authorization, and settlement record;
6. objective Bazaar listing receipt IDs, indexing observation, and canonical publication response; and
7. authenticated, signed, clean-CI publication-gate evidence.

An authenticated external audit anchor is also required before claiming resistance to a malicious storage administrator capable of rewriting an entire history and all in-store digests.

## Prohibited actions observed

No dependency installation, deployment, commit, push, payment, signing operation, or RPC call was performed.
