Release evidence
This page records the evidence-backed pilot baseline and the validation path toward external audit and production approval.
Documentation and whitepaper baseline
Synchronized on October 31, 2026 against engineering commit 70b334dd2bbf2ede5a2c1c825eaa298e7acc2e51. The Chinese whitepaper (35 pages) and English whitepaper (34 pages) use the same engineering baseline. Their source files, PDF checksums and publication record are versioned in the core repository. Existing PDF links and access permissions are retained.
This revision aligns V3 state observation, independent approval, API fallback, recovery governance, release packaging and maintainer handoff. It records existing engineering evidence; the documentation update did not rerun those tests.
| Validation record | Recorded result | Scope |
|---|---|---|
Clean checkout 9380b7aa5f54a2b700c5d89935a808a58576fcee | Rust 503 passed, 3 ignored; Node 144; Lit 14; Zod regression 9 | Full local release gate on macOS ARM64; eight release binaries, independent SDK and default V3 candidate |
Subsequent targeted validation, recorded in 52d2bdc030b7367f12e25e8033996588c2ad6e29 | Rust 47; Node 13; browser 10; six integration groups | Local API fallback, state observation, recovery and real UUPS proxy; Lit test double |
| October 31 public testnet run | Two scripted approvals, 22/33 FROST and real Lit PKP execution | Separate BSC testnet run described below |
The dependency gate passed under a tested Zod backport policy. Raw npm audit still reports 13 high-severity dependency entries for the same upstream advisory, GHSA-mrhx-c7xc-m3w5; these are not recorded as zero alerts. Target Linux deployment acceptance remains separate. The full release gate and later targeted tests are different runs.
October 31 V3 validation
Source and test records were committed in 52d2bdc030b7367f12e25e8033996588c2ad6e29. The local integration suite covers six groups of approval, upgrade, API fallback and recovery scenarios using a real ERC1967/UUPS proxy and a Lit test double. A separate BSC testnet run used the real Lit service.
| Testnet item | Result |
|---|---|
| Authorization | Two scripted test approvers and 22/33 FROST |
| Execution | Real Lit PKP, Gate V3, 60-second test delay, UUPS V1 → V2 |
| Storage | Value 7 → 42; preserved value 99 |
| Rejection | Missing approval rejected; deployer direct upgrade rejected |
| Environment | One Mac host, dealer-generated shares, BSC testnet chain 97 |
View the testnet execution transaction.
Gate: 0xC3fd2a645CF4540328ba30585aD6b5D3025bE700. Test proxy: 0x6a63EA3790B12c198902FD3047E89Afa80d66A84.
This run proves the tested chain of validation and execution. Independent operators, separate approval devices, cross-host DKG, the public recovery-delay drill and customer permission migration remain unverified. Current scope is summarized in implementation status.
Historical October 23–27 records
The earlier documentation revision was reconciled on October 27, 2026 with the October 25 whitepaper and the recorded results below.
| Record | Source or baseline | Result and scope |
|---|---|---|
| October 24 core authorization | f8184a830d49032e86c67b7b2ed92532c66a60cb, authorization module | 13/13 controlled unit tests. |
| October 24 FROST backend | Same core baseline, FROST Ed25519 backend | 12/12 controlled tests, including 3/5, 5/7 and 22/33 certificate profiles. Test shares are held in-process. |
| October 23 workflow comparison | Local chain 31337, Safe 1.5.0, OpenZeppelin 4.9.6, solc 0.8.36 | 26/26 synthetic contract checks for the 20-to-32 receive-configuration change. |
| Public sample contract checks | Example repository and reference report | Contract source hashes and recorded checks; the standalone runner uses a synthetic attestation. |
The public sample's reference report is a separate record from the October 23 comparison and the October 24 private-core tests. The walkthrough explains how the hosted workflow connects business approvals, local FROST, attestation and the Gate.
Historical execution gas comparison
| Configuration | Execution transactions | Gas |
|---|---|---|
| Safe | 1 | 116,070 |
| Safe + Timelock | 2 | 185,183 |
| Safe + Timelock + state adapter | 2 | 192,698 |
| Luvion demonstration Gate | 2 | 293,708 |
These October 23 values cover this local synthetic operation's execution transactions, excluding deployment, FROST-service time, browser time, human review and infrastructure. Safe also rejected altered calls, replay and insufficient approvals. Its state adapter rejected stale baselines and out-of-range parameters. The Luvion Gate consumed more gas; this comparison does not establish overall security equivalence between configurations.
A partner workflow comparison should measure preparation steps, tool switches, manual-review time, integration effort, recovery and evidence compilation. No measured human-time or customer-cost saving is available from these contract tests.
Evidence coverage
Core tests, standalone Gate checks, a hosted session and historical BSC testnet runs are distinct evidence sets. Identify the specific revision, environment and tested property when reviewing a capability. Public sample licensing applies to that sample; access to the private core and its internal test records is arranged separately through Source and documentation access.
Historical release baseline
| Item | Value |
|---|---|
| Pilot version | 0.1.0-rc.1 |
| Release-gate baseline | 1b6a8d42a8f582a7563c7b9c65de5b72e15262d6 |
| Release-gate date | August 9, 2026 |
| Implementation status baseline | e4eb993a041fea7012e3e0e28c5db21b4a05eb17 |
| Historical status review date | August 15, 2026 |
| Execution boundary | Non-production sandbox |
| Working tree at baseline | Clean |
The baseline release gate recorded exact JavaScript dependency installation, Rust formatting and strict linting, the full Rust test suite, console and pilot script tests, deterministic browser-bundle rebuilds, secret scanning, locked release builds, build metadata, and SHA-256 checksums.
Dependency hygiene runs as a separate CI job. External dependency review and security audit remain dedicated production-readiness gates.
The August 15 implementation evidence report updates the whitepaper-to-code status review against commit e4eb993a041fea7012e3e0e28c5db21b4a05eb17.
The September 12 documentation review also checked the September 2 engineering status record, adding the profile-specific updates below. Supporting records may be requested for review.
Historical August integration validation
The Lit validation sidecar and deployed recovery drill were advanced through
commit a8b8efe48fbc8962a55d8f2664f1bb06cd3065cf on August 1, 2026. Those changes formed the integration-validation track at that time. The subsequent August release gate is recorded below; the current October baseline appears above.
On August 9, 2026, the complete local release gate passed at commit
1b6a8d42a8f582a7563c7b9c65de5b72e15262d6 with a clean working tree. It
completed 436 Rust tests with zero failures and 3 ignored tests, 40 Node console
and script tests with zero failures, and 12 Lit Action tests with zero failures.
Formatting, strict linting, browser-bundle rebuilds, credential scanning, locked
release builds, build metadata, and SHA-256 checksums also passed. The resulting
artifact remains a non-production release candidate. A dedicated Lit Group,
PKP, immutable Action, and least-privilege usage key completed a live Chipotle
authorization run.
Historical testnet and rotation profiles
August 9–10 records cover the old immutable-PKP Gate on BSC testnet: test proxy deployment, exact scheduling and execution, a separate cancellation flow, event reconciliation, main-RPC failure fallback, and forced process restart recovery. That flow used an internal 1-of-1 sandbox authorization certificate, not a distributed FROST end-to-end deployment.
The new signer-epoch / PKP-rotation Gate has local implementation and EVM test evidence, but its public-testnet deployment and rotation drill remain pending in the reviewed September 2 record. Separate 3-of-5, 5-of-7, and 22-of-33 FROST tests do not change the old testnet flow's authorization profile. Partner bypass closure, independent operators, whole-host operational drills, and external audit remain unaccepted. See Current implementation status.
Evidence available to an approved reviewer
- build metadata and artifact checksums;
- automated test and CI results;
- pilot acceptance report and companion JSON exports;
- authorization certificate and public transcript evidence;
- terminal execution or validation receipt;
- independent witness receipt when configured; and
- known-limitations and whitepaper-to-code alignment records.
Production evidence roadmap
- third-party audit report and remediation closure;
- named partner acceptance sign-off;
- HSM/KMS/TEE key-custody attestation;
- independently administered multi-host signer evidence;
- production SLO and incident history; and
- immutable, versioned review artifacts tied to an approved signed release; publication and source licensing require separate approval.
The cryptographic-core repository is private and has not been open-sourced. Source access and commercial pilot materials require separate approval; public documentation is not an open-source licence. See Source and documentation access.