dalek:"static repo — proofs replay on demand",anza:"static repo — proofs replay on demand",
risc0:"static repo — proofs replay on demand",bet:"static repo — proofs replay on demand",
pasta:"static repo — open work, run manually",corpus:"frozen repo — replay on demand",
provider:"SPLIT: the write side (check/append/publish) runs ON DEMAND on the operator machine, only during a ceremony; the read-only web face runs ALWAYS ON in the droplet container",
signer:"on demand — invoked only while signing during a ceremony; key offline otherwise",
wardenCode:"NOT RUNNING — implemented prototype; no deployed instance",
paper:"static files, served by the always-on site",
course:"static; regenerated manually",
key:"OFFLINE — touched only during signing ceremonies, with per-command operator grant",
opstate:"dormant files between ceremonies — no process",
sd:"offline medium",
mirror:"static git repo — no process; consumers run verify.py themselves",
site:"ALWAYS ON — droplet container (pacta_provider serve), read-only mounts, read_only:true, no key material",
forgejo:"ALWAYS ON — droplet container; one cron: 03:00 mirror reconcile",
pcs:"config files — deployed by hand",
book:"static repo",
cloner:"external, episodic",
wardenRun:"NOT RUNNING — starts only when the operator or an agent launches MCP or the cockpit, stops with them",
agents:"external, episodic",swiss:"external, dormant since 2026-07-07",
reviewers:"external, per review round",
};
constDOSSIER={
srcDalek:{lane:"Upstream inputs",mut:"frozen",facts:["Pinned clone of upstream curve25519-dalek + ed25519-dalek (one implementation: curve crate + signature crate).","Input to Aeneas/Charon extraction; never modified here.","Excluded from all maintenance passes by standing order."]},
srcAnza:{lane:"Upstream inputs",mut:"frozen",facts:["Pinned clone of the Solana/Anza cryptography fork.","Input to extraction; never modified."]},
srcRisc0:{lane:"Upstream inputs",mut:"frozen",facts:["Pinned clone of the RISC Zero dalek fork.","Input to extraction; never modified."]},
srcBet:{lane:"Upstream inputs",mut:"frozen",facts:["Pinned clone of the Betrusted dalek fork.","xous-core and litex-boards sit alongside as platform context.","Input to extraction; never modified."]},
srcPasta:{lane:"Upstream inputs",mut:"frozen",facts:["Pinned clone of the Pasta curves crate.","Feeds pasta-pallas-verified; never modified."]},
dalek:{lane:"Verified subjects",mut:"frozen",facts:["16 reviewed certificates: field, group law, scalars, signature apex (T1–T4).","Attested in all three log generations; current leaf 8.","LOOP 1 anchor: the dogfood signer binary is built from this source — the log's heads are signed by code whose proofs are inside the log.","Attestation pins a commit; the branch only moves for docs."]},
anza:{lane:"Verified subjects",mut:"frozen",facts:["16 reviewed certificates; current leaf 9.","Same proof pyramid as dalek, rebuilt for the fork's code structure."]},
risc0:{lane:"Verified subjects",mut:"frozen",facts:["16 reviewed certificates; current leaf 10.","Differs from Betrusted's corpus by 27 changed proof lines (the paper's portability datum)."]},
bet:{lane:"Verified subjects",mut:"frozen",facts:["16 reviewed certificates; current leaf 11."]},
pasta:{lane:"Verified subjects",mut:"free",facts:["Field layer proven from own extraction; curve layer (group law + scalar mul) is the one open verification task in the estate.","NOT attested — the log carries only the four Ed25519 forks + the corpus."]},
corpus:{lane:"Verified subjects",mut:"frozen",facts:["61 certificates over one boundary axiom (LTLAcc.sha256); 222-constant environment inventory; 15-gap honest ledger.","Mechanizes the archived report's §6: extractors, consistency binding, per-step pin safety.","LOOP 2 anchor: attested INTO the log as entry 13 — the log carries kernel-checked proofs about its own accumulator model.","Frozen at 172a1d0 (the attested commit); doc-only commits may move the branch.","Docs carry numbering notes: paper references are v0.2 numbering."]},
provider:{lane:"pacta · machinery",mut:"free",facts:["pacta_provider: attestation check → log-append → log-publish; webdocs homepage + /v1 API code.","Holds the publish TEMPLATES for the mirror's verify.py / selftest / README — since 2026-07-19 pinned by CI (test_published_assets) after the audit caught a stale fail-open template.","Deploys to the droplet as the ltl container."]},
signer:{lane:"pacta · machinery",mut:"free",facts:["verified-dalek-serial: the Ed25519 binary built from the attested dalek source.","Signs every tree head; before signing, the provider re-checks inclusion of the signer's own leaf.","LOOP 1: signature vouches for the tree; the tree contains the attestation of the signer's source (leaf 8). Execution provenance is reported, not proven — stated in the paper."]},
conslib:{lane:"pacta · machinery",mut:"free",facts:["src/pacta: receipt verification, pin store (rollback rejection, fork evidence), R0–R5 risk model, claim cards.","The deployed iterative verifiers the paper differential-tests against the recursive model live here."]},
wardenCode:{lane:"pacta · machinery",mut:"free",facts:["WALLET.md: custody capsule, hash-chained ledger, inbound quorum boundary, outbound signing firewall.","Inbound: accepts log-derived statements only when independently attested verifier backends agree.","Agent surfaces: MCP over stdio, custody card, posture challenge, refusal receipts."]},
paper:{lane:"pacta · machinery",mut:"free",facts:["paper/ltl.tex — v0.9 camera-ready, 23 pages: trust decomposition, accountability games with explicit reductions, deployed evaluation.","Archives: v0.1 (4 pp) and v0.2 (19 pp, the corpus's numbering reference) kept and served.","Submission package + webform field set staged on the SD archive."]},
course:{lane:"pacta · machinery",mut:"free",facts:["14 Jupyter notebooks generated from scripts/build_curriculum_notebooks.py (fix the generator, then the notebook).","llms.txt: the agent-readable index of the whole endeavour."]},
key:{lane:"Operator-held",mut:"operator",facts:["Ed25519 signing key, fingerprint 874c8a00… — the log's identity.","Offline; never on the server; the agent never touches it without an explicit per-command grant.","Public half published at two independent locations (site + mirror) for TOFU comparison."]},
opstate:{lane:"Operator-held",mut:"operator",facts:["provider/state/transparency-log-main: the true accumulator — appends happen HERE, the mirror is its projection.","Lesson learned in rehearsal: rebuild the tree from operational state, never from published projections."]},
sd:{lane:"Operator-held",mut:"operator",facts:["Review kits (rounds 1–15), stamped artifacts (_timestamp_hash8 convention), and execution evidence records.","Kept offline; never in any git repo."]},
mirror:{lane:"Published faces",mut:"generated",facts:["The git-published log: 13 leaves, 6 signed heads (sizes 8–13), receipts, provider key, fail-closed verify.py + 11-case selftest.","GENERATED by log-publish from operational state + pacta templates — direct commits here must be mirrored back into the templates (that is the defect the 2026-07-19 audit caught).","Cloning it makes anyone a witness: verify.py --all re-verifies everything offline."]},
site:{lane:"Published faces",mut:"generated",facts:["Droplet: caddy → docker (cloud-ltl-1). Homepage rendered live from real leaves — the counts on the page ARE the accumulator.","/v1/sth, /v1/attestation, /v1/proof, /log-public-key; /paper serves v0.9, /paper/v0.2 and /paper/v0.1 the archives.","Read-only; no key material on the server."]},
forgejo:{lane:"Published faces",mut:"generated",facts:["cloud-forgejo-1 on the droplet: nightly (03:00) mirror of the ENTIRE saymrwulf GitHub account — disaster-recovery copy, not a curated set."]},
pcs:{lane:"Published faces",mut:"free",facts:["The droplet's deployment configuration (compose stack, reverse proxy, reconstruct step), maintained in a private repository.","Deliberately unnamed here: the public estate lists only entities whose existence must be public for trust.","Captured under version control after an audit found the deployment was not."]},
book:{lane:"Published faces",mut:"free",facts:["The undergraduate book (twelve chapters + solutions): from 1+1=2 to reading the estate's real proofs.","Audited 2026-07-19: zero coupling to log/paper state — safely independent."]},
cloner:{lane:"Consumers",mut:"external",facts:["Anyone: git clone the mirror, run verify.py --all (stdlib + openssl; FAILS CLOSED without signature capability).","Retention makes them a witness: their clone can later expose an equivocating head."]},
wardenRun:{lane:"Consumers",mut:"free",facts:["The estate's own dogfood consumer: signs nothing inbound unless a quorum of independently attested verifier backends agrees.","Code lives in pacta (left lane); shown here in its consuming role. The paper calls it the implemented internal prototype."]},
agents:{lane:"Consumers",mut:"external",facts:["MCP tools (wallet_status, verify_inbound, request_signature, …) and the self-proving custody card: embedded inclusion proofs a counterparty recomputes rather than trusts."]},
swiss:{lane:"Consumers",mut:"external",facts:["The operator's Go PoC of the Swiss Post e-voting system.","Its vendored dalek dependency matches an attested subject at FAMILY level, not the attested version — the paper's version-exactness negative (kept anonymous there).","No receipt code yet; strictly prospective."]},
reviewers:{lane:"Consumers",mut:"external",facts:["GPT-5.6 + a Claude reviewer: fifteen adversarial rounds over corpus, log, site, and paper.","Fed via SD kits; findings drove every hardening round; both re-derived the log's cryptography independently."]},
