Goal
Expose sorseal's on-chain + reproducibility checks as a hosted endpoint so Wave teams get "is this deployed contract still sealed?" as a URL, a webhook, or an alert — without running the CLI themselves.
Scope
- A small read-only HTTP service (
sorseal serve) with one endpoint per contract id that runs onchain-verify/onchain-audit against the configured RPC and returns JSON.
- Polling/monitoring: a
--watch mode that re-checks on a schedule and reports drift (a new unsealed upgrade, an inconsistent lineage).
- Document the trust model honestly: the API answers are only as trusted as the RPC endpoint + provenance data; this is convenience, not a new trust root.
Why
The CLI is the foundation; a hosted check makes provenance verification part of a Wave team's daily ops, catching an unsealed deploy before it becomes an incident.
Success criteria
GET /contracts/:id returns the audit JSON (same shape as the CLI report) with correct exit semantics encoded in the response.- A
--watch mode flags a newly-deployed unsealed version within one poll interval.
- Service remains stateless and single-binary; no database dependency.
Goal
Expose sorseal's on-chain + reproducibility checks as a hosted endpoint so Wave teams get "is this deployed contract still sealed?" as a URL, a webhook, or an alert — without running the CLI themselves.
Scope
sorseal serve) with one endpoint per contract id that runsonchain-verify/onchain-auditagainst the configured RPC and returns JSON.--watchmode that re-checks on a schedule and reports drift (a new unsealed upgrade, an inconsistent lineage).Why
The CLI is the foundation; a hosted check makes provenance verification part of a Wave team's daily ops, catching an unsealed deploy before it becomes an incident.
Success criteria
GET /contracts/:idreturns the audit JSON (same shape as the CLI report) with correct exit semantics encoded in the response.--watchmode flags a newly-deployed unsealed version within one poll interval.