{
  "schemaVersion": 1,
  "canonicalNetwork": "solana:mainnet",
  "assessmentScope": "source-only",
  "programDispositionManifest": "v3-program-dispositions.json",
  "supportedCandidateCount": 6,
  "executableEvidenceAvailable": false,
  "asOfCommit": null,
  "asOfCommitReason": "unavailable-until-clean-committed-candidate",
  "v3Program": {
    "status": "not_deployed",
    "statement": "No Vaultfire V3 Solana program is evidenced as deployed on Solana mainnet by this source package.",
    "mainnetProgramIds": [],
    "requiredEvidence": [
      "mainnet RPC program-account evidence",
      "verifiable deployment transaction signature",
      "reproducible build and deployed-bytecode comparison",
      "approved upgrade-authority custody record"
    ]
  },
  "x402UsdcSettlement": {
    "status": "configured_unverified",
    "statement": "Solana x402 metadata is checked into the source package, but no Solana payment rail is advertised by the Vercel runtime and no settlement receipt, facilitator evidence, or production route verification is supplied.",
    "x402NetworkAlias": "solana",
    "canonicalNetwork": "solana:mainnet",
    "usdcMint": {
      "value": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "provenance": "repos/theloopbreaker-site/app/api/x402/trust/_lib/verify-solana.ts (source constant only)"
    },
    "payTo": {
      "value": null,
      "provenance": "No runtime payTo is configured or advertised while the x402 release gate is closed."
    },
    "settlementEvidence": [],
    "requiredEvidence": [
      "payTo ownership attestation",
      "mint provenance review",
      "successful controlled mainnet settlement receipt",
      "route challenge and receipt capture",
      "replay, expiry, and incident-handling production evidence"
    ]
  },
  "discoveryAndBazaar": {
    "status": "generated_metadata_only",
    "statement": "The checked-in PR7 registry contains 29 Solana metadata-configured-unverified x402 candidates. Those checked-in resource records are source configuration, not a published-discovery capture, facilitator confirmation, or settlement proof.",
    "pr7RouteRegistry": "pr7/generated/route-registry.json",
    "websiteRuntimeSource": "repos/theloopbreaker-site/app/api/x402/trust/_lib/verify-payment.ts",
    "requiredEvidence": [
      "published discovery document capture",
      "matching route implementation and configuration review",
      "controlled challenge and settlement receipt"
    ],
    "generatedSolanaMetadataConfiguredUnverifiedCount": 29
  },
  "readOnlyTrustAndIndexingLanes": [
    {
      "path": "/api/solana/health",
      "class": "read-only",
      "evidence": "CONTRACTS.md inventory only"
    },
    {
      "path": "/api/solana/scan",
      "class": "read-only",
      "evidence": "CONTRACTS.md inventory only"
    },
    {
      "path": "/api/solana/program-scan",
      "class": "read-only",
      "evidence": "CONTRACTS.md inventory only"
    },
    {
      "path": "/api/solana/agents",
      "class": "read-only",
      "evidence": "CONTRACTS.md inventory only"
    },
    {
      "path": "/api/solana/receipt",
      "class": "read-only",
      "evidence": "CONTRACTS.md inventory only"
    },
    {
      "path": "/api/solana/bonds/map",
      "class": "read-only",
      "evidence": "CONTRACTS.md inventory only"
    },
    {
      "path": "/api/solana/index",
      "class": "read-indexing",
      "evidence": "CONTRACTS.md inventory only"
    },
    {
      "path": "/api/solana/webhook",
      "class": "receive-only",
      "evidence": "CONTRACTS.md inventory only"
    }
  ],
  "operationalDependencies": {
    "rpc": {
      "namedDependency": "Alchemy",
      "status": "not_evidenced_in_source"
    },
    "webhook": {
      "namedDependency": "Alchemy address-activity webhook and HMAC verification",
      "status": "not_evidenced_in_source"
    },
    "indexer": {
      "namedDependency": "Upstash KV and hourly cron",
      "status": "not_evidenced_in_source"
    }
  },
  "optionalPartnerDeployedAuditedProgram": {
    "status": "not_ready",
    "statement": "A future partner may deploy an audited program; it is not a Vaultfire V3 deployment until the required evidence is recorded and approved.",
    "partnerApproval": false,
    "independentAudit": false,
    "programId": null,
    "deploymentSignature": null,
    "upgradeAuthorityPlan": null,
    "requiredEvidence": [
      "written partner approval and accountable signatory",
      "independent audit scope, report, and remediation disposition",
      "program ID and verifiable deployment transaction",
      "reproducible build and deployed-bytecode comparison",
      "upgrade-authority and emergency-response plan",
      "monitoring, webhook, indexer, and rollback acceptance"
    ]
  }
}
