proof-aware-crypto-tooling-.../llms.txt

# pacta — proof-aware crypto tooling agent

> Tooling for autonomous agents that must choose, and then run on, a
> cryptographic library they can trust with money. Evidence of formal
> verification is turned into machine-readable claim cards, scored R0–R5,
> with every verdict re-derived locally from observed Lean axiom cones —
> never taken on a provider's word. The `warden` product builds a custody
> wallet whose Ed25519 boundary is a quorum of four independently proven
> curve25519-dalek forks.

## Start here

- [ESTATE.md](ESTATE.md): the map of the whole endeavour — every repo, service, mirror, operator-held entity, and the two self-referential loops.

- [README.md](README.md): what pacta is, the R0–R5 risk model, the dogfood loop.
- [WALLET.md](WALLET.md): warden, the verified-custody wallet — the quorum boundary, the signing firewall, the R4 gate, the MCP surface, and the local read-only custody cockpit for the human operator (docs/cockpit.md).
- [docs/agent-native.md](docs/agent-native.md): why the wallet is agent-native first (AX, MCP, A2A, AP2, x402, ERC-8004) and what each idea became.
- [docs/products.md](docs/products.md): the four warden deployment profiles.

## Live evidence

- Transparency log (RFC 9162): https://ltl.zkdefi.org — signed replay attestations of the Lean proofs. Thirteen leaves: three replay generations over four Ed25519 forks, plus entry 13 attesting the Lean mechanization of the log's own accumulator model. The mirror ships a fail-closed offline verifier (verify.py --all covers every leaf, signed head, and receipt) with an adversarial self-test.
- The paper: https://ltl.zkdefi.org/paper — "Accountable Distribution of Machine-Checked Correctness Evidence: A Transparency Model and the Lean Transparency Log" (23 pages: trust decomposition, scheme-level accountability games with explicit reductions, live deployment, and the measured model/deployment divergence reported as a result). Earlier versions archived at /paper/v0.2 (19 pages) and /paper/v0.1 (4 pages).

## For agents

warden speaks MCP over stdio: `pacta wallet mcp --wallet <dir>`. Tools:
`wallet_status`, `verify_inbound`, `request_signature`, `custody_card`,
`posture_challenge`, `list_incidents`, `explain_refusal`. Errors are
structured objects (code / missing / remediation). The custody card at
`.well-known/custody-card.json` is self-proving: it embeds transparency-log
inclusion proofs a counterparty recomputes rather than trusts.

## Honesty boundary

Verification paths are certificate-covered; signing is trusted base (the
attested artifact, fenced by the firewall). SHA-512 is an opaque oracle;
wire parsers are hypotheses; reproducible builds and side channels are R5,
not claimed; ML-DSA (PQC) fails closed — no proven implementation exists.
-												warden docs + study material: WALLET.md, products lineup, llms.txt, lecture 10

- WALLET.md: the product manual (one idea, trust posture table, R4 gate,
  quickstart, MCP surface, self-proving card, firewall, taxonomy)
- docs/products.md: four production-ready deployment profiles
  (solo/airgap/treasury/choir) with honest built-vs-wired boundaries
- llms.txt: agent-native discovery manifest at repo root
- README: warden intro + lecture 10 pointer
- notebooks/10_verified_custody_wallet.ipynb: ratchet-rule lecture (toy
  3-of-3 -> real four proven forks -> counterparty recomputes a card's
  inclusion proof); course README + notebook test updated
- 83 tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-06 21:46:27 +00:00
+								# pacta — proof-aware crypto tooling agent
 								> Tooling for autonomous agents that must choose, and then run on, a
 								> cryptographic library they can trust with money. Evidence of formal
 								> verification is turned into machine-readable claim cards, scored R0–R5,
 								> with every verdict re-derived locally from observed Lean axiom cones —
 								> never taken on a provider's word. The `warden` product builds a custody
 								> wallet whose Ed25519 boundary is a quorum of four independently proven
 								> curve25519-dalek forks.
 								## Start here
-												ESTATE.md: the one-page estate map (operator order 2026-07-19)

The endeavour spans ~12 active repos, a generated mirror, a droplet
with three containers, a full-account Forgejo mirror, operator-held
state, and two self-referential loops — enough that oversight was
genuinely lost. ESTATE.md is the canonical committed map: five lanes of
custody (upstream inputs -> verified subjects -> machinery &
operator-held -> published faces -> consumers) as a GitHub-rendered
Mermaid diagram, plus the two loops explained first (dogfood signer;
entry-13 self-attestation), a repository inventory with mutability
classes (frozen / generated / free / operator-only), the services and
operator-held table, an edge glossary, and maintenance triggers.

Lives HERE because pacta is the machinery hub and the only repo that
changes freely; the mirror is generated, the subjects are frozen, and
the book is independent. Linked from README and llms.txt. An
interactive operator's version of the same model exists outside the
repos.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-19 14:51:20 +00:00
+								- [ESTATE.md](ESTATE.md): the map of the whole endeavour — every repo, service, mirror, operator-held entity, and the two self-referential loops.
-												warden docs + study material: WALLET.md, products lineup, llms.txt, lecture 10

- WALLET.md: the product manual (one idea, trust posture table, R4 gate,
  quickstart, MCP surface, self-proving card, firewall, taxonomy)
- docs/products.md: four production-ready deployment profiles
  (solo/airgap/treasury/choir) with honest built-vs-wired boundaries
- llms.txt: agent-native discovery manifest at repo root
- README: warden intro + lecture 10 pointer
- notebooks/10_verified_custody_wallet.ipynb: ratchet-rule lecture (toy
  3-of-3 -> real four proven forks -> counterparty recomputes a card's
  inclusion proof); course README + notebook test updated
- 83 tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-06 21:46:27 +00:00
+								- [README.md](README.md): what pacta is, the R0–R5 risk model, the dogfood loop.
-												warden cockpit: local read-only custody UI for the human operator

Operator-ordered milestone, built under an explicit no-risk constraint
while the paper application is in flight: strictly ADDITIVE (one new
module + one CLI subcommand; zero changes to wallet semantics, the
public site, or anything the paper describes), LOCAL-ONLY (never
deployed; binds 127.0.0.1), and READ-ONLY in v1 (human approve/deny is
deliberately deferred — that is a custody-semantics change belonging to
a separately reviewed milestone).

New: src/pacta/walletui.py — four views over an existing wallet:
- Posture: latch state, ledger head with FULL hash-chain
  re-verification, pinned quorum members, spending policy verbatim.
- Signature queue: airgap outbox/inbox, observed never operated.
- Incidents & refusals: verbatim records, newest first.
- Receipt inspector: paste attestation + receipt + log key; verdict,
  per-signature results, and diagnostics come verbatim from
  transparency.verify_receipt — the deployed verifier itself, reused
  not reimplemented.

Design law, stated in the module and enforced by tests: THE COCKPIT
RENDERS EVIDENCE, IT NEVER ASSERTS IT. Every panel recomputes at
request time and carries a provenance line (function + timestamp);
anything unverifiable renders a loud FAILED-TO-VERIFY panel — no cached
green, no neutral gray. Panels state what they do NOT prove (e.g.
binary pinning vs source-to-binary correspondence).

CLI: pacta wallet cockpit --wallet DIR [--host --port].
Tests (10 new, suite 118 -> 128 green): recomputed-evidence rendering,
CHAIN BROKEN on tampered ledger, loud failure on collector error,
latched-state rendering, airgap queue states, verbatim incident/refusal
rendering, fail-closed inspector on garbage, real-evidence roundtrip
(skips if example evidence absent), full-sweep BYTE-LEVEL read-only
guarantee (wallet dir hash-identical after all GETs + a POST), and
fail-fast on non-wallet dirs. Rendering additionally verified visually
against a live demo wallet (posture, quorum table, incidents).

Docs: docs/cockpit.md; WALLET.md section; ESTATE.md + llms.txt updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-19 16:02:17 +00:00
+								- [WALLET.md](WALLET.md): warden, the verified-custody wallet — the quorum boundary, the signing firewall, the R4 gate, the MCP surface, and the local read-only custody cockpit for the human operator (docs/cockpit.md).
-												warden docs + study material: WALLET.md, products lineup, llms.txt, lecture 10

- WALLET.md: the product manual (one idea, trust posture table, R4 gate,
  quickstart, MCP surface, self-proving card, firewall, taxonomy)
- docs/products.md: four production-ready deployment profiles
  (solo/airgap/treasury/choir) with honest built-vs-wired boundaries
- llms.txt: agent-native discovery manifest at repo root
- README: warden intro + lecture 10 pointer
- notebooks/10_verified_custody_wallet.ipynb: ratchet-rule lecture (toy
  3-of-3 -> real four proven forks -> counterparty recomputes a card's
  inclusion proof); course README + notebook test updated
- 83 tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-06 21:46:27 +00:00
+								- [docs/agent-native.md](docs/agent-native.md): why the wallet is agent-native first (AX, MCP, A2A, AP2, x402, ERC-8004) and what each idea became.
 								- [docs/products.md](docs/products.md): the four warden deployment profiles.
 								## Live evidence
-												publish assets: sync the fail-open time bomb; llms/course/test docs refreshed (doc audit 2026-07-19)

REAL DEFECT found by the operator-ordered doc-freshness audit:
published_assets.py still carried the PRE-HARDENING fail-open verify.py
and the pre-Tier-2 README as the templates that log-publish drops into
the mirror — the next publish would have silently overwritten the
round-13-hardened fail-closed verifier and the corrected README with
the old versions. Fixed:
- published_assets.py regenerated from the canonical mirror files
  (byte-identity verified by round-trip exec), now also carrying
  verify_selftest.py; SYNC RULE documented in the module docstring.
- transparency_log.publish() now writes verify_selftest.py too.
- NEW tests/test_published_assets.py pins the security-critical markers
  (fail-closed FATAL, RECEIPT_TYPE, verify_receipt, --all receipt
  coverage, required fingerprint) so template drift fails CI instead of
  shipping.
- test_web_and_witness updated to the hardened verifier's markers —
  the published test log now passes FULL signature mode end to end
  ('RESULT: OK [full]'), a stronger assertion than the old string.

Doc refresh in the same pass:
- llms.txt: thirteen leaves + entry-13 self-attestation + fail-closed
  verifier; paper line -> new title, 23 pages, v0.2/v0.1 archives.
- Course (generator + generated 06b notebook): 'the git hash IS the
  content hash' -> 'the commit pins the exact source tree';
  'irrevocably part of the log every other agent sees' -> 'committed to
  the log's signed view, which any agent can compare' (the two Tier-2
  scope corrections had never reached the teaching material).
- test_paper_verifiers.py docstring rescoped: its 164k counts are the
  archived v0.2 report's citation; the current paper cites the corpus
  harness and makes no extensional-equality claim.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-19 11:10:55 +00:00
+								- Transparency log (RFC 9162): https://ltl.zkdefi.org — signed replay attestations of the Lean proofs. Thirteen leaves: three replay generations over four Ed25519 forks, plus entry 13 attesting the Lean mechanization of the log's own accumulator model. The mirror ships a fail-closed offline verifier (verify.py --all covers every leaf, signed head, and receipt) with an adversarial self-test.
 								- The paper: https://ltl.zkdefi.org/paper — "Accountable Distribution of Machine-Checked Correctness Evidence: A Transparency Model and the Lean Transparency Log" (23 pages: trust decomposition, scheme-level accountability games with explicit reductions, live deployment, and the measured model/deployment divergence reported as a result). Earlier versions archived at /paper/v0.2 (19 pages) and /paper/v0.1 (4 pages).
-												warden docs + study material: WALLET.md, products lineup, llms.txt, lecture 10

- WALLET.md: the product manual (one idea, trust posture table, R4 gate,
  quickstart, MCP surface, self-proving card, firewall, taxonomy)
- docs/products.md: four production-ready deployment profiles
  (solo/airgap/treasury/choir) with honest built-vs-wired boundaries
- llms.txt: agent-native discovery manifest at repo root
- README: warden intro + lecture 10 pointer
- notebooks/10_verified_custody_wallet.ipynb: ratchet-rule lecture (toy
  3-of-3 -> real four proven forks -> counterparty recomputes a card's
  inclusion proof); course README + notebook test updated
- 83 tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

											
										
										
											2026-07-06 21:46:27 +00:00
 								## For agents
 								warden speaks MCP over stdio: `pacta wallet mcp --wallet <dir>`. Tools:
 								`wallet_status`, `verify_inbound`, `request_signature`, `custody_card`,
 								`posture_challenge`, `list_incidents`, `explain_refusal`. Errors are
 								structured objects (code / missing / remediation). The custody card at
 								`.well-known/custody-card.json` is self-proving: it embeds transparency-log
 								inclusion proofs a counterparty recomputes rather than trusts.
 								## Honesty boundary
 								Verification paths are certificate-covered; signing is trusted base (the
 								attested artifact, fenced by the firewall). SHA-512 is an opaque oracle;
 								wire parsers are hypotheses; reproducible builds and side channels are R5,
 								not claimed; ML-DSA (PQC) fails closed — no proven implementation exists.