From b923b66a2706f1b2eec208904f6a985f79fdc846 Mon Sep 17 00:00:00 2001 From: Fred E <7602667+wallscaler@users.noreply.github.com> Date: Fri, 28 Aug 2026 18:50:40 -0400 Subject: [PATCH 1/4] docs(validator): state the default policy pin The operator guide said the validator accepted every signed vector shape by default, but the shipped CLI pins validated_supply_v1. Correct the guidance so confidential-primary operators know they must opt into that policy explicitly. --- docs/VIOLET_EXTERNAL_SCORES.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/VIOLET_EXTERNAL_SCORES.md b/docs/VIOLET_EXTERNAL_SCORES.md index 820cf23..8ff2672 100644 --- a/docs/VIOLET_EXTERNAL_SCORES.md +++ b/docs/VIOLET_EXTERNAL_SCORES.md @@ -90,7 +90,8 @@ CATHEDRAL_EXTERNAL_SCORES_TOKEN_CATHEDRAL_CONFIDENTIAL_TDX= # Per-sourc **Validator policy pin (`confidential_primary_v1`):** operators who run confidential-primary can pin the thin validator so it applies ONLY this contract: ```bash -# CLI flag or env; default is unpinned (accepts legacy, v3, and confidential_primary) +# CLI flag or env. The default pins validated_supply_v1, which rejects a plain +# confidential_primary or v3 vector. Set this explicitly to accept confidential_primary. cathedral-validator serve --require-policy confidential_primary_v1 export CATHEDRAL_VALIDATOR_REQUIRE_POLICY=confidential_primary_v1 ``` From fdf79967b6ddef4071a7b0252866a8b2b6b6e77a Mon Sep 17 00:00:00 2001 From: Fred E <7602667+wallscaler@users.noreply.github.com> Date: Fri, 28 Aug 2026 18:54:29 -0400 Subject: [PATCH 2/4] docs(validator): close remaining launch guidance gaps Date the last reproduced verifier mismatch, require a fresh live reproduction before broadcast, remove the last operator-facing authority-gate reference, and state the exact confidential-primary policy and Finney broadcast boundary. --- VALIDATOR.md | 13 +++++++------ docs/SN39_VERSIONED_RELEASES.md | 2 +- docs/VIOLET_EXTERNAL_SCORES.md | 15 +++++++++++---- 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/VALIDATOR.md b/VALIDATOR.md index 34d17cc..5dd5f88 100644 --- a/VALIDATOR.md +++ b/VALIDATOR.md @@ -30,7 +30,7 @@ UID-aligned Bittensor weight decision. It supports two concurrent paths: | Validator thin-path checks | Implemented | | Concurrent shadow provenance audit | Implemented; the only recurring runtime | | Authority/full operator mode | Removed from profiles and command-line entrypoints | -| Current deployed vector vs independent verifier | `FAIL`: public v1/GPU-allocation contract does not match the v2/fixed-burn/body-binding verifier | +| Last re-derived deployed vector vs independent verifier, 2026-08-28 | `FAIL`: public v1/GPU-allocation contract did not match the v2/fixed-burn/body-binding verifier. Re-derive against the live signed vector before any broadcast. | | General validator launch | Pending a scoreable corpus and final acceptance | ### Launch truth, 2026-08-28 @@ -44,10 +44,10 @@ The shipped recurring relay policy is not the consumed UID30 100/0 launch vector. Do not start it with `--broadcast` until a no-write preview proves the exact intended UID row and burn allocation. Any mismatch fails the launch gate. -The current public contract mismatch is a launch blocker. Shadow mode reports -it but does not veto an otherwise valid thin vector, which is why operators -must remain in non-writing preview modes until the supported release -converges. +The last verified public contract mismatch is a launch blocker. Shadow mode +reports it but does not veto an otherwise valid thin vector. Do not infer that +a later deployment resolved it. Remain in non-writing preview until a fresh +reproduction against the live signed vector passes. ## What happens on each tick @@ -572,7 +572,8 @@ Do not add `--broadcast` until all of the following are true: - [ ] You verified the source/package digest and all signing-key pins. - [ ] Synthetic-map and metagraph-backed dry runs passed on your machine. - [ ] The current vector, evidence index, and provenance outcome match your - intended assurance level; the known public contract mismatch is resolved. + intended assurance level; a fresh reproduction proves the last verified + public contract mismatch is resolved. - [ ] Your validator hotkey, permit, wallet isolation, RPC, and rollback-state backup are confirmed. - [ ] You have explicit operator authorization for a mainnet transaction. diff --git a/docs/SN39_VERSIONED_RELEASES.md b/docs/SN39_VERSIONED_RELEASES.md index a233d96..9748cb0 100644 --- a/docs/SN39_VERSIONED_RELEASES.md +++ b/docs/SN39_VERSIONED_RELEASES.md @@ -82,6 +82,6 @@ A passing source test does not authorize a seal. Before preflight, prove: receipt being sealed. 4. A claimed replay checkpoint has matching controlled envelopes, public evidence, candidate set, and pinned verifier bytes. -5. The shadow or authority provenance gate is currently passing. +5. The supported shadow provenance gate is currently passing. 6. An independent operator can reproduce the versioned release from a clean checkout after publication. diff --git a/docs/VIOLET_EXTERNAL_SCORES.md b/docs/VIOLET_EXTERNAL_SCORES.md index 8ff2672..ffb01e1 100644 --- a/docs/VIOLET_EXTERNAL_SCORES.md +++ b/docs/VIOLET_EXTERNAL_SCORES.md @@ -87,16 +87,23 @@ CATHEDRAL_EXTERNAL_SCORES_TOKEN_CATHEDRAL_CONFIDENTIAL_TDX= # Per-sourc **Thin-validator contract (mass=1):** The signed vector must carry `mode=confidential_primary`, `complete=true`, `fresh=true`, and `confirmed=true` in its policy metadata. Rows must explicitly include both `base_component` (always 0.0) and `external_component` (equals weight). Any deviation raises `VectorError` and aborts the tick. -**Validator policy pin (`confidential_primary_v1`):** operators who run confidential-primary can pin the thin validator so it applies ONLY this contract: +**Validator policy pin (`confidential_primary_v1`):** offline or non-Finney +consumers that validate confidential-primary can pin the thin validator so it +applies ONLY this contract: ```bash -# CLI flag or env. The default pins validated_supply_v1, which rejects a plain -# confidential_primary or v3 vector. Set this explicitly to accept confidential_primary. +# Explicit offline or non-Finney validation pin. The default is validated_supply_v1. +# Set confidential_primary_v1 to validate only that exact policy contract. cathedral-validator serve --require-policy confidential_primary_v1 export CATHEDRAL_VALIDATOR_REQUIRE_POLICY=confidential_primary_v1 ``` -When pinned, every vector lacking a valid `confidential_primary` v1 policy block is rejected with `VectorError`, and the legacy and v3 fallback mapping paths are unreachable. Validators that do not set the pin keep the existing behavior (all signed shapes accepted). +When explicitly pinned, every vector lacking a valid `confidential_primary` v1 +policy block is rejected with `VectorError`, and the legacy and v3 fallback +mapping paths are unreachable. Omitting the flag does not unpin the validator. +It keeps the `validated_supply_v1` default. Finney SN39 broadcast accepts only +`validated_supply_v1` or `validated_supply_v3`; `confidential_primary_v1` is +not an accepted SN39 broadcast pin. ### Per-Source Tokens (Optional) From cdf3683e4ce56b6c550516bb56b75f7191d70027 Mon Sep 17 00:00:00 2001 From: Fred E <7602667+wallscaler@users.noreply.github.com> Date: Fri, 28 Aug 2026 18:56:43 -0400 Subject: [PATCH 3/4] docs(validator): mark live verifier agreement unproven The earlier FAIL and later AGREE records describe different deployments, and the live endpoint did not answer this review. Report NOT PROVEN and keep broadcast gated on a fresh reproduction. --- VALIDATOR.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/VALIDATOR.md b/VALIDATOR.md index 5dd5f88..85cede7 100644 --- a/VALIDATOR.md +++ b/VALIDATOR.md @@ -30,7 +30,7 @@ UID-aligned Bittensor weight decision. It supports two concurrent paths: | Validator thin-path checks | Implemented | | Concurrent shadow provenance audit | Implemented; the only recurring runtime | | Authority/full operator mode | Removed from profiles and command-line entrypoints | -| Last re-derived deployed vector vs independent verifier, 2026-08-28 | `FAIL`: public v1/GPU-allocation contract did not match the v2/fixed-burn/body-binding verifier. Re-derive against the live signed vector before any broadcast. | +| Current deployed vector vs independent verifier | `NOT PROVEN`: dated sources disagree, and no fresh live reproduction passed during this review. Re-derive against the live signed vector before any broadcast. | | General validator launch | Pending a scoreable corpus and final acceptance | ### Launch truth, 2026-08-28 @@ -44,10 +44,11 @@ The shipped recurring relay policy is not the consumed UID30 100/0 launch vector. Do not start it with `--broadcast` until a no-write preview proves the exact intended UID row and burn allocation. Any mismatch fails the launch gate. -The last verified public contract mismatch is a launch blocker. Shadow mode -reports it but does not veto an otherwise valid thin vector. Do not infer that -a later deployment resolved it. Remain in non-writing preview until a fresh -reproduction against the live signed vector passes. +Current agreement between the deployed vector and independent verifier is not +proven. Dated records disagree across different deployments. Shadow mode +reports a mismatch but does not veto an otherwise valid thin vector. Treat the +unknown state as a launch blocker and remain in non-writing preview until a +fresh reproduction against the live signed vector passes. ## What happens on each tick @@ -572,8 +573,8 @@ Do not add `--broadcast` until all of the following are true: - [ ] You verified the source/package digest and all signing-key pins. - [ ] Synthetic-map and metagraph-backed dry runs passed on your machine. - [ ] The current vector, evidence index, and provenance outcome match your - intended assurance level; a fresh reproduction proves the last verified - public contract mismatch is resolved. + intended assurance level; a fresh live reproduction proves the deployed + vector and independent verifier agree. - [ ] Your validator hotkey, permit, wallet isolation, RPC, and rollback-state backup are confirmed. - [ ] You have explicit operator authorization for a mainnet transaction. From e780ce97a8b7c7af8d5eb36a0995aa3a9ae17c12 Mon Sep 17 00:00:00 2001 From: Fred E <7602667+wallscaler@users.noreply.github.com> Date: Fri, 28 Aug 2026 18:57:33 -0400 Subject: [PATCH 4/4] docs(validator): describe shadow mismatch handling conditionally Avoid implying that a mismatch is presently observed while the live agreement status remains NOT PROVEN. --- VALIDATOR.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/VALIDATOR.md b/VALIDATOR.md index 85cede7..29b4664 100644 --- a/VALIDATOR.md +++ b/VALIDATOR.md @@ -46,9 +46,9 @@ exact intended UID row and burn allocation. Any mismatch fails the launch gate. Current agreement between the deployed vector and independent verifier is not proven. Dated records disagree across different deployments. Shadow mode -reports a mismatch but does not veto an otherwise valid thin vector. Treat the -unknown state as a launch blocker and remain in non-writing preview until a -fresh reproduction against the live signed vector passes. +reports mismatches when they occur but does not veto an otherwise valid thin +vector. Treat the unknown state as a launch blocker and remain in non-writing +preview until a fresh reproduction against the live signed vector passes. ## What happens on each tick