- Wallet.init is the R4 gate in executable form: per member, the built
binary's source commit must match an attestation whose verdicts are
re-derived locally, scored >= R4, and Merkle-bound to a verified STH
under the log key (explicit --trusted-provider required, never inferred)
- append-only hash-chained ledger; latch semantics (tamper => custody
frozen; unlatch is a deliberate operator act recorded with a note)
- outbound: intent envelope bound to payload bytes -> signer (local
dogfood or airgap/Precursor-style outbox) -> quorum firewall; a
rejected self-signature is quarantined, never released, and latches
- refusal receipts: signed machine-actionable artifacts (code, missing,
remediation); unsigned-by-design while latched
- live end-to-end against ltl.zkdefi.org: 4 members R4 (leaves 4-7),
release firewall unanimous-accept, inbound unanimous-accept, refusal
signed, ledger chain verified
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
