<!--
NON-NORMATIVE DOCUMENT

This file is historical/legacy/audit material and may contain aspirational language.
The canonical, current claims & limits are in: docs/CLAIMS_AND_LIMITS.md
-->

# Vaultfire Attestation Request Templates

Enterprise partners can reference these templates when requesting independent verification of Vaultfire's smart contracts and compliance posture. Each request is designed for direct use in email threads, audit portals, or third-party intake forms.

## 1. Smart Contract Assurance Request (Trail of Bits / OpenZeppelin / CertiK)

**Objective**: Validate Vaultfire's VaultfireYieldPool.sol and GovernanceAnchor.sol implementations, including upgrade mechanisms and Guardian Loop modifiers.

**Request Body**
```
Subject: Vaultfire Smart Contract Assurance | Vaultfire Protocol v3.2

Hello <Audit Team>,

Vaultfire is ready to commence a formal smart contract assurance engagement covering the following scope:
- VaultfireYieldPool.sol (reward emission + staking protections)
- GovernanceAnchor.sol (3-of-5 Guardian multisig controls)
- LoyaltySignalRegistry.sol (belief-signal ingestion + privacy guardrails)
- Upgrade proxy configuration & timelock governance

Artifacts attached / linked:
- Repository snapshot: https://github.com/vaultfire/protocol (commit {{COMMIT_HASH}})
- Architecture overview: docs/enterprise_protocol.md
- Threat model: docs/technical-due-diligence.md#threat-model
- Telemetry baselines: telemetry/templates/

Engagement goals:
1. Confirm alignment with Vaultfire ethics-first constraints (no hidden admin keys, all emergency functions governed by Guardian Loop).
2. Produce machine-verifiable attestations (JSON + signed PDF) for partner distribution.
3. Map identified findings to remediation playbooks in governance/runbooks.md.

Requested deliverables:
- Severity-weighted findings report
- Remediation verification letter
- Attestation hash for on-chain publication

Availability:
- Kickoff window: {{DATE_RANGE}}
- Technical contact: engineering@vaultfire.network
- Governance contact: trust@vaultfire.network

Thank you for supporting belief-aligned deployments.

Respectfully,
Vaultfire Protocol Trust Office
```

## 2. Compliance Readiness Request (SOC 2 Type II & ISO/IEC 27001)

**Objective**: Document Vaultfire's readiness for SOC 2 Type II and ISO/IEC 27001 certification with emphasis on telemetry transparency and guardian-led governance.

**Request Body**
```
Subject: Vaultfire Compliance Assessment Intake | SOC 2 Type II + ISO/IEC 27001

Hello <Assessment Partner>,

Vaultfire is preparing for enterprise deployment and requests a readiness assessment across the following domains:
- Security, Availability, Confidentiality, Processing Integrity (SOC 2)
- Annex A controls with emphasis on access management, logging, and incident response (ISO/IEC 27001)

Included materials:
- Governance overview: governance.md
- DAO continuity plan: governance/dao_pathway.md
- Telemetry logging baselines: telemetry/templates/
- Adoption dashboards: dashboards/adoption_mission_dashboard.json
- Data residency map: data_residency.yaml

Focus areas:
1. Validate opt-in telemetry design and cross-border safeguards.
2. Review Guardian Council escalation procedures for incident response.
3. Confirm retention policies for belief-aligned loyalty data.

Requested outputs:
- Gap analysis with severity and remediation timeline
- Attestation letter suitable for partner procurement portals
- Control mapping matrix (CSV + signed PDF)

Primary contacts:
- Compliance steward: compliance@vaultfire.network
- Security steward: security@vaultfire.network

We appreciate your guidance to ensure Vaultfire's mission outcomes stay ethics-first and audit-ready.

With gratitude,
Vaultfire Trust & Assurance Team
```

## 3. Submission Checklist
- [ ] Attach telemetry baseline templates for wallet activity, XP yield, and retention.
- [ ] Link to governance multisig template for audit traceability.
- [ ] Include ROI summary from docs/loyalty_engine_roi_model.md.
- [ ] Confirm partner-specific NDA or secure upload instructions.
- [ ] Capture attestation hash into governance/auditLog.json after receipt.

## 4. Publication Notes
- Store signed attestations under `docs/attestations/signed/` with SHA-256 manifest.
- Reference `docs/vaultfire_pilot_bundle/publishing_assets.md` for GitHub/Notion embedding snippets.
- Update landing pages `/attestations` and `/metrics` after each new audit milestone.
