proof-aware-crypto-tooling-.../llms.txt

# pacta — proof-aware crypto tooling agent

> Tooling for autonomous agents that must choose, and then run on, a
> cryptographic library they can trust with money. Evidence of formal
> verification is turned into machine-readable claim cards, scored R0–R5,
> with every verdict re-derived locally from observed Lean axiom cones —
> never taken on a provider's word. The `warden` product builds a custody
> wallet whose Ed25519 boundary is a quorum of four independently proven
> curve25519-dalek forks.

## Start here

- [ESTATE.md](ESTATE.md): the map of the whole endeavour — every repo, service, mirror, operator-held entity, and the two self-referential loops.

- [README.md](README.md): what pacta is, the R0–R5 risk model, the dogfood loop.
- [WALLET.md](WALLET.md): warden, the verified-custody wallet — the quorum boundary, the signing firewall, the R4 gate, the MCP surface.
- [docs/agent-native.md](docs/agent-native.md): why the wallet is agent-native first (AX, MCP, A2A, AP2, x402, ERC-8004) and what each idea became.
- [docs/products.md](docs/products.md): the four warden deployment profiles.

## Live evidence

- Transparency log (RFC 9162): https://ltl.zkdefi.org — signed replay attestations of the Lean proofs. Thirteen leaves: three replay generations over four Ed25519 forks, plus entry 13 attesting the Lean mechanization of the log's own accumulator model. The mirror ships a fail-closed offline verifier (verify.py --all covers every leaf, signed head, and receipt) with an adversarial self-test.
- The paper: https://ltl.zkdefi.org/paper — "Accountable Distribution of Machine-Checked Correctness Evidence: A Transparency Model and the Lean Transparency Log" (23 pages: trust decomposition, scheme-level accountability games with explicit reductions, live deployment, and the measured model/deployment divergence reported as a result). Earlier versions archived at /paper/v0.2 (19 pages) and /paper/v0.1 (4 pages).

## For agents

warden speaks MCP over stdio: `pacta wallet mcp --wallet <dir>`. Tools:
`wallet_status`, `verify_inbound`, `request_signature`, `custody_card`,
`posture_challenge`, `list_incidents`, `explain_refusal`. Errors are
structured objects (code / missing / remediation). The custody card at
`.well-known/custody-card.json` is self-proving: it embeds transparency-log
inclusion proofs a counterparty recomputes rather than trusts.

## Honesty boundary

Verification paths are certificate-covered; signing is trusted base (the
attested artifact, fenced by the firewall). SHA-512 is an opaque oracle;
wire parsers are hypotheses; reproducible builds and side channels are R5,
not claimed; ML-DSA (PQC) fails closed — no proven implementation exists.
-												warden docs + study material: WALLET.md, products lineup, llms.txt, lecture 10

- WALLET.md: the product manual (one idea, trust posture table, R4 gate,
  quickstart, MCP surface, self-proving card, firewall, taxonomy)
- docs/products.md: four production-ready deployment profiles
  (solo/airgap/treasury/choir) with honest built-vs-wired boundaries
- llms.txt: agent-native discovery manifest at repo root
- README: warden intro + lecture 10 pointer
- notebooks/10_verified_custody_wallet.ipynb: ratchet-rule lecture (toy
  3-of-3 -> real four proven forks -> counterparty recomputes a card's
  inclusion proof); course README + notebook test updated
- 83 tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-06 21:46:27 +00:00
+								# pacta — proof-aware crypto tooling agent
 								> Tooling for autonomous agents that must choose, and then run on, a
 								> cryptographic library they can trust with money. Evidence of formal
 								> verification is turned into machine-readable claim cards, scored R0–R5,
 								> with every verdict re-derived locally from observed Lean axiom cones —
 								> never taken on a provider's word. The `warden` product builds a custody
 								> wallet whose Ed25519 boundary is a quorum of four independently proven
 								> curve25519-dalek forks.
 								## Start here
-												ESTATE.md: the one-page estate map (operator order 2026-07-19)

The endeavour spans ~12 active repos, a generated mirror, a droplet
with three containers, a full-account Forgejo mirror, operator-held
state, and two self-referential loops — enough that oversight was
genuinely lost. ESTATE.md is the canonical committed map: five lanes of
custody (upstream inputs -> verified subjects -> machinery &
operator-held -> published faces -> consumers) as a GitHub-rendered
Mermaid diagram, plus the two loops explained first (dogfood signer;
entry-13 self-attestation), a repository inventory with mutability
classes (frozen / generated / free / operator-only), the services and
operator-held table, an edge glossary, and maintenance triggers.

Lives HERE because pacta is the machinery hub and the only repo that
changes freely; the mirror is generated, the subjects are frozen, and
the book is independent. Linked from README and llms.txt. An
interactive operator's version of the same model exists outside the
repos.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-19 14:51:20 +00:00
+								- [ESTATE.md](ESTATE.md): the map of the whole endeavour — every repo, service, mirror, operator-held entity, and the two self-referential loops.
-												warden docs + study material: WALLET.md, products lineup, llms.txt, lecture 10

- WALLET.md: the product manual (one idea, trust posture table, R4 gate,
  quickstart, MCP surface, self-proving card, firewall, taxonomy)
- docs/products.md: four production-ready deployment profiles
  (solo/airgap/treasury/choir) with honest built-vs-wired boundaries
- llms.txt: agent-native discovery manifest at repo root
- README: warden intro + lecture 10 pointer
- notebooks/10_verified_custody_wallet.ipynb: ratchet-rule lecture (toy
  3-of-3 -> real four proven forks -> counterparty recomputes a card's
  inclusion proof); course README + notebook test updated
- 83 tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-06 21:46:27 +00:00
+								- [README.md](README.md): what pacta is, the R0–R5 risk model, the dogfood loop.
 								- [WALLET.md](WALLET.md): warden, the verified-custody wallet — the quorum boundary, the signing firewall, the R4 gate, the MCP surface.
 								- [docs/agent-native.md](docs/agent-native.md): why the wallet is agent-native first (AX, MCP, A2A, AP2, x402, ERC-8004) and what each idea became.
 								- [docs/products.md](docs/products.md): the four warden deployment profiles.
 								## Live evidence
-												publish assets: sync the fail-open time bomb; llms/course/test docs refreshed (doc audit 2026-07-19)

REAL DEFECT found by the operator-ordered doc-freshness audit:
published_assets.py still carried the PRE-HARDENING fail-open verify.py
and the pre-Tier-2 README as the templates that log-publish drops into
the mirror — the next publish would have silently overwritten the
round-13-hardened fail-closed verifier and the corrected README with
the old versions. Fixed:
- published_assets.py regenerated from the canonical mirror files
  (byte-identity verified by round-trip exec), now also carrying
  verify_selftest.py; SYNC RULE documented in the module docstring.
- transparency_log.publish() now writes verify_selftest.py too.
- NEW tests/test_published_assets.py pins the security-critical markers
  (fail-closed FATAL, RECEIPT_TYPE, verify_receipt, --all receipt
  coverage, required fingerprint) so template drift fails CI instead of
  shipping.
- test_web_and_witness updated to the hardened verifier's markers —
  the published test log now passes FULL signature mode end to end
  ('RESULT: OK [full]'), a stronger assertion than the old string.

Doc refresh in the same pass:
- llms.txt: thirteen leaves + entry-13 self-attestation + fail-closed
  verifier; paper line -> new title, 23 pages, v0.2/v0.1 archives.
- Course (generator + generated 06b notebook): 'the git hash IS the
  content hash' -> 'the commit pins the exact source tree';
  'irrevocably part of the log every other agent sees' -> 'committed to
  the log's signed view, which any agent can compare' (the two Tier-2
  scope corrections had never reached the teaching material).
- test_paper_verifiers.py docstring rescoped: its 164k counts are the
  archived v0.2 report's citation; the current paper cites the corpus
  harness and makes no extensional-equality claim.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-19 11:10:55 +00:00
+								- Transparency log (RFC 9162): https://ltl.zkdefi.org — signed replay attestations of the Lean proofs. Thirteen leaves: three replay generations over four Ed25519 forks, plus entry 13 attesting the Lean mechanization of the log's own accumulator model. The mirror ships a fail-closed offline verifier (verify.py --all covers every leaf, signed head, and receipt) with an adversarial self-test.
 								- The paper: https://ltl.zkdefi.org/paper — "Accountable Distribution of Machine-Checked Correctness Evidence: A Transparency Model and the Lean Transparency Log" (23 pages: trust decomposition, scheme-level accountability games with explicit reductions, live deployment, and the measured model/deployment divergence reported as a result). Earlier versions archived at /paper/v0.2 (19 pages) and /paper/v0.1 (4 pages).
-												warden docs + study material: WALLET.md, products lineup, llms.txt, lecture 10

- WALLET.md: the product manual (one idea, trust posture table, R4 gate,
  quickstart, MCP surface, self-proving card, firewall, taxonomy)
- docs/products.md: four production-ready deployment profiles
  (solo/airgap/treasury/choir) with honest built-vs-wired boundaries
- llms.txt: agent-native discovery manifest at repo root
- README: warden intro + lecture 10 pointer
- notebooks/10_verified_custody_wallet.ipynb: ratchet-rule lecture (toy
  3-of-3 -> real four proven forks -> counterparty recomputes a card's
  inclusion proof); course README + notebook test updated
- 83 tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-06 21:46:27 +00:00
 								## For agents
 								warden speaks MCP over stdio: `pacta wallet mcp --wallet <dir>`. Tools:
 								`wallet_status`, `verify_inbound`, `request_signature`, `custody_card`,
 								`posture_challenge`, `list_incidents`, `explain_refusal`. Errors are
 								structured objects (code / missing / remediation). The custody card at
 								`.well-known/custody-card.json` is self-proving: it embeds transparency-log
 								inclusion proofs a counterparty recomputes rather than trusts.
 								## Honesty boundary
 								Verification paths are certificate-covered; signing is trusted base (the
 								attested artifact, fenced by the firewall). SHA-512 is an opaque oracle;
 								wire parsers are hypotheses; reproducible builds and side channels are R5,
 								not claimed; ML-DSA (PQC) fails closed — no proven implementation exists.