proof-aware-crypto-tooling-agent/llms.txt

# pacta — proof-aware crypto tooling agent

> Tooling for autonomous agents that must choose, and then run on, a
> cryptographic library they can trust with money. Evidence of formal
> verification is turned into machine-readable claim cards, scored R0–R5,
> with every verdict re-derived locally from observed Lean axiom cones —
> never taken on a provider's word. The `warden` product builds a custody
> wallet whose Ed25519 boundary is a quorum of four independently proven
> curve25519-dalek forks.

## Start here

- [ESTATE.md](ESTATE.md): the map of the whole endeavour — every repo, service, mirror, operator-held entity, and the two self-referential loops.

- [README.md](README.md): what pacta is, the R0–R5 risk model, the dogfood loop.
- [WALLET.md](WALLET.md): warden, the verified-custody wallet — the quorum boundary, the signing firewall, the R4 gate, the MCP surface, and the local read-only custody cockpit for the human operator (docs/cockpit.md).
- [docs/agent-native.md](docs/agent-native.md): why the wallet is agent-native first (AX, MCP, A2A, AP2, x402, ERC-8004) and what each idea became.
- [docs/products.md](docs/products.md): the four warden deployment profiles.

## Live evidence

- Transparency log (RFC 9162): https://ltl.zkdefi.org — signed replay attestations of the Lean proofs. Nineteen leaves: three replay generations over four Ed25519 forks (newest at 44/44 certificates, leaves 13-16), the Lean mechanization of the log's own accumulator model (leaves 12 and 17), and the first post-quantum leaf - the SLH-DSA (FIPS 205) verify path (leaf 18); heads dual-signed (Ed25519 + SLH-DSA) since size 14. The mirror ships a fail-closed offline verifier (verify.py --all covers every leaf, signed head, and receipt) with an adversarial self-test.
- The paper: https://ltl.zkdefi.org/paper — "Accountable Distribution of Machine-Checked Correctness Evidence: A Transparency Model and the Lean Transparency Log" (25 pages, v0.15, revised August 2026, DOI 10.5281/zenodo.22057482: trust decomposition, scheme-level accountability games with explicit reductions, live deployment, and the measured model/deployment divergence reported as a result). Superseded drafts remain retrievable from the repository git history.

## For agents

warden speaks MCP over stdio: `pacta wallet mcp --wallet <dir>`. Tools:
`wallet_status`, `verify_inbound`, `request_signature`, `custody_card`,
`posture_challenge`, `list_incidents`, `explain_refusal`, `airgap_pending`. Errors are
structured objects (code / missing / remediation). The custody card at
`.well-known/custody-card.json` is self-proving: it embeds transparency-log
inclusion proofs a counterparty recomputes rather than trusts.

## Honesty boundary

Verification paths are certificate-covered; signing is trusted base (the
attested artifact, fenced by the firewall). SHA-512 is an opaque oracle;
wire parsers are hypotheses; reproducible builds and side channels are R5,
not claimed; ML-DSA fails closed — no proven implementation exists; the SLH-DSA verify path IS proven (verify only; signing remains trusted base).