Repository navigation
Conversation
…that continue its tip On Testnet (2026-10-27) the relay accepted a block at its tip that the main chain then orphaned. The few peers that still continued that block followed a branch whose next headers the relay rejects, and while they were the only ones continuing the tip the relayer kept fetching from them and failed every pass at the gas estimate. A refusal that is not a race now makes the next pass fetch from STEP_BACK below the tip, as after a reorg; a clean pass returns to the tip. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…and the loan token's name on bonds The judge deployment of 2026-10-27 on Base Sepolia, with the real RISC Zero router as its verifier: the deployment records (main, swap, relay, relay checkpoint, paymaster) and their broadcast logs. theft_demo_guard.rs now names its five signers and its Registry, as its test requires once the deployment file exists. The status page, "What the world sees" and the position views named every bond and debt amount "USDC". They now use the deployment's loan token name, as the market page does: MockUSDC here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t deployment too A visitor with no Ironwood wallet of their own can open a loan, pay it and close it from the app alone (the demo payment, "Send my ZEC back to the demo wallet"), but could not buy shielded ZEC without pasting an address from elsewhere. The swap's "DEMO: use the demo wallet's Ironwood address", so far the replay's, now also appears where the demo path is on (GET /demo/status), as on a loan's close. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ule of hooks) f8697b3 called useDemoStatus after `if (!mounted) return …`, so the second render ran one hook more than the first and the swap page failed with React error #310. The hook now runs on every render. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…backend while the run lasts The recorded run is filmed on the site itself. With ZECURED_LIVE_BACKEND (the backend's public HTTPS address while the run's box is up), scripts/deploy-vercel.sh also publishes the live app, unlisted (robots leave it out), at /live/: a static export (app/next.config.ts, ZECURED_STATIC_EXPORT=1) pinned to the committed deployment records like a box's build, with the live build's Content Security Policy sent as a header, its connect-src naming that backend. The replay stays at /app/ for everyone else, and a deployment without the variable drops /live/ when the box goes (D82). The replay's segment-payload aliases move to app/scripts/alias-segments.mjs, which both exports now run, so the router's prefetches find their files on the static host. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…fixes before submission
The system ran live on Base Sepolia on 27 October 2026, every proof made on a rented GPU and checked by RISC Zero's
deployed router. README, SUBMISSION, the judges' FAQ, the site and its docs page, TIER2, TIER3, MAINNET, DEMO and the
app's README said the end-to-end runs used a MOCK verifier on forks only: they now say what ran live, and keep the
MOCK verifier and Pimlico's mock paymaster for the local-fork runs. The replay's "sample data" stays until the
replay plays that run.
Also from three read-only reviews (docs, repository hygiene, code):
- the demo buttons' names as the app shows them ("Pay it with demo TAZ" and the two other demo-wallet uses);
- the demo panel's price presets at the deployment's price ($1,265 and $632.50, not $40 and $20);
- the world page's amounts grouped like the others (100,000.00);
- the harvester's error and the deploy script's comment name public files, not a private runbook;
- README "Running it": .env first, the header updater and the bots built, and the command that seeds the header
file on a clean clone (it reproduces our file's first header);
- .gitignore: what documented commands write where they run (viewing keys, witnesses, receipts, seals);
- the watchdog example names the live relay and paymaster; an unused research example removed;
- DECISIONS explains the review labels found in code comments.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The judges' replay now plays the recorded live run on Base Sepolia and Zcash testnet (app/lib/replay/recording.json, harvested from the run's snapshots and from Base, every check passing): fifteen steps, each linked to its real transaction on Basescan or ZecBlock, with the leak scan of the live deployment (0 matches among 181 identifiers). - docs/TESTING.md § 2c: both live runs, the recorded one step by step with its transactions and timings, and the leak scan; the at-a-glance table and section 2 name the live run. - docs/DECISIONS.md: D111 (amends D110). - README, SUBMISSION, JURY_FAQ, SITE, the site, its docs page, app/README and the Pages workflow: the replay plays the live run, no longer sample data; the video is named by its run, its link to follow. - app: the testnet profile links Zcash transactions to ZecBlock (zcashExplorerTx, never on the mainnet beta), and the demo payment's transaction links there; the replay's captions that said sample data follow the recording (the footer, the privacy page, the home page's public numbers, the real-and-mock list). - app/lib/replay/replay.test.ts: the swap's refused amount names the recording's. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FACTS.md's faucet row (checked on 10-10) gains what we saw on 10-27, and the README's local run says what to do if the faucet still refuses the address the CLI wallet prints. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…relay's record The live run's deployment (b578df5) replaced the Testnet relay's checkpoint file with the live relay's (height 4,547,001), so the test's written-in height (4,490,100) failed. It now reads the expected height and hash from that relay's record, deployments/base-sepolia.relay.json. A test only; no contract changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The landing page's demo section plays the video of the live run of 27 October (site/media: demo.mp4, 1080p, 21 MB; demo-poster.jpg; demo.en.vtt, English captions) and links it on YouTube (https://youtu.be/iyXiao54KWk), as docs/SITE.md planned; the hero's second button says "Watch the demo". The docs page's evidence gains the live run (its Basescan transactions and its Zcash txids) and the video. The README, SUBMISSION and JURY_FAQ link the video. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
On 27 October 2026 the whole system ran live on Base Sepolia and Zcash testnet, every step pressed in a browser and
every proof checked by RISC Zero's deployed router. This branch holds that deployment, the fixes made during it, and
the judges' replay of the recorded run: it now plays that run, each step linked to its real transaction, in place of
sample data. No server of ours runs any more (D82); the contracts stay on Base Sepolia, unoperated.
Changes
The live deployment (b578df5):
contracts/deployments/base-sepolia{,.swap,.relay,.relay-checkpoint,.paymaster}.jsonand their broadcasts; the theft demo's guard names the live signers and registry; the loan token's name on bonds.
Relayer (6ea09af): it steps back when the relay refuses the headers that continue its tip.
App (f8697b3, 18892f7): the swap offers the demo wallet's Ironwood address on the testnet deployment too; the
demo status is read before the swap's loading return (React's rule of hooks).
The live page on Vercel (4b25b3a):
/live/, unlisted, talking to the run's backend while it lasted; the nextdeployment without
ZECURED_LIVE_BACKENDdrops it.Docs and the reviewers' fixes (ef33ce2).
The replay plays the live run (6570f9e):
app/lib/replay/recording.jsonharvested from the run's snapshots andfrom Base (
lib/replay/harvest.ts, every check passing);docs/TESTING.md§ 2c with both runs and the leak scan;D111; the docs, the site and the replay's captions no longer say sample data; Zcash transactions link to ZecBlock
on the testnet profile only (
zcashExplorerTx, never on the mainnet beta).The video (0d5e99b): https://youtu.be/iyXiao54KWk on the landing page (
site/media/demo.mp4, 1080p, 21 MB,with a poster and English captions), in the docs page's evidence with the live run's transactions, and linked from
the README, SUBMISSION and JURY_FAQ.
Faucet (3768b72): the Valar faucet refused an Ironwood-only address on 27 October (FACTS.md, README).
A relay test (414d951): the Base Sepolia checkpoint file is checked against its relay's record, now that the
live relay's checkpoint replaced the old one (a test only).
contracts/srcandtier2are unchanged (frozen).Evidence (docs/TESTING.md § 2c)
0x64197b71…a20862opened, 0.05 TAZ paid Ironwood → Ironwood (Zcash block 4,548,243)Leak scan of the live deployment once both runs were over: 0 matches among 181 Zcash identifiers (the
coordinator's 3 vaults, 5 wallets) in its 89 events and 60 transactions' calldata.
Checks
tsc --noEmitclean;vitest run: 36 files, 464 passed, 1 skipped.NEXT_PUBLIC_BASE_PATH=/app node scripts/build-replay.mjs) andscripts/check-export.mjs: 16 pages, 152 files.the evidence page shows the leak scan; the privacy page, the footer and the real-and-mock list follow the recording.
After the merge
bash scripts/deploy-vercel.sh DIRwithoutZECURED_LIVE_BACKEND, which drops/live/.pages.ymlrun, so that GitHub Pages mirrors the same site.🤖 Generated with Claude Code