Verification
What is proved, by what, and — the part that usually goes missing — what is not.
The chain is the authority
Facts on this site come in three strengths, and they are labelled wherever they appear rather than blended together.
| chain-attested | Read from pearl-1 and proved by verify_catalog.py: deploy transactions, heights, deployers, gas, storage, and the digest of the deployed bytes. |
|---|---|
| chain-derived | Produced by the node from the deployed bytes via vm/qdoc: every signature, type and doc comment in the API sections. The node derives it from the code, so it cannot disagree with the code. |
| curated | Written by people: summaries, categories, roles and the limitation lists. Useful, and not attested by anything. The manifest says so itself, in its own about field. |
The tools
Each of these has its own test suite, and each is run before its verdict is quoted. A checker that only ever reports success is worse than no checker, so the suites include deliberate sabotage runs that confirm the tests actually bite.
tools/verify_catalog.py | Proves the manifest against the chain, two-sided: every entry must exist on chain with matching bytes, and every package in the namespace must appear in the manifest. An undocumented deploy and a phantom record both fail it. |
tools/gen_api_docs.py | Generates the API reference from the node's own vm/qdoc, and --check re-derives it to detect drift between the committed pages and the chain. |
tools/verify_depclosure.py | Proves that the dependencies a package compiled against are the ones the chain holds. Byte-verifying a root package proves nothing about its imports, and dependency fetches resolve to mainnet by default whatever the deploy target is. |
tools/gen_site.py | Builds this site, offline, from the artifacts the three tools above produce. It has no network access, so it cannot introduce a fact none of them checked. |
Source against chain
16 of 21 packages have committed source that is byte-identical to what the chain runs.
The other 5 diverge deliberately, and the reason is recorded rather than hidden. A package's bytes are immutable once deployed, so where the working tree has moved on, the live version stays as it was:
- bounties — Local pearl/r/bounties is a vNext refactor onto coinio plus three recorded audit deltas; the deployed v1 predates coinio and is frozen.
- cointest — No committed source; throwaway validation helper.
- cointest2 — No committed source; throwaway validation helper.
- fee_split — Local pearl/r/feesplit/fee_split.gno carries the undeployed yellow-remediation. fee_split v1 is frozen and no fee_split_v2 is authorized. Do not reconcile by redeploying.
- vault — Local pearl/r/vault is a vNext refactor onto coinio; the deployed v1 predates coinio and is self-contained and frozen.
What this site does not prove
Stating the boundary is the point of having one.
- This site is generated offline from committed artifacts. It shows what the gates concluded when they last ran; it does not re-run them, and it is not a live view of the chain. For that, follow any of the gnoweb links.
- The curated fields — summaries, categories, limitation lists — are human-authored and unattested. They are marked curated everywhere they appear.
- An empty limitations list means no caveat was recorded, not that none exists. The deployment records are the fuller account and each carries an explicit "what was not verified live" section.
- Where the records say a package was audited, they mean an adversarial review conducted inside this project, against the bug classes in
docs/SECURITY.md, with the findings and the refusals written down. No third party has audited any of this code. Read the findings rather than the word. - Dependency-closure equivalence covers packages fetched from the chain. Standard-library packages execute from the node binary and are outside that check; the residual is stated in the records.
- These packages are deployed on a testnet. Nothing here is on mainnet, and testnet state can be reset by its operators.
Reproduce the whole thing
From a checkout of the project repository, every claim on this site re-derives with four commands:
/usr/bin/python3 tools/verify_catalog.py
/usr/bin/python3 tools/gen_api_docs.py --check
sh tools/portfolio_depclosure.sh
/usr/bin/python3 tools/gen_site.pyThe first three talk to pearl-1. The fourth does not, and rebuilds this site. The repository is not currently public, so this path is open to the maintainers rather than to every reader — which is exactly why the checks that need no repository come first on this page: the byte-digest command, and every gnoweb and RPC link on this site, work for anyone.
The written record
Behind every verdict on this page sits a committed document: deployment records with transactions, costs and live-verification transcripts; discovery records behind each decision to build or not to build; audit findings and their fixes; the standards the work is held to. All 33 are rendered here, verbatim.