fix(safety-score): recover missing producer and reviewed evidence

.gitleaks.toml

@@ -112,3 +112,16 @@ regexes = [
   '''0x6a4854078428eea517e8013827cba9f90583f8a9fdf8610c8791d1b04feb6a3eee428bf506c98ead1e870918f26a1d41f5bfb792b1e4f331679d1ad3e527326f''',
 ]
 paths = ['''(?:^|/)shared/data/stablecoins/domains/risk-review/usdcx-movement\.json$''']
+
+# Exact Cardano policy-id + asset-name identifiers, pinned to the published
+# Cardano Foundation token registry in each transfer review's sources.
+[[allowlists]]
+description = "Reviewed USDA and USDM Cardano asset identifiers are public, not credentials"
+targetRules = ["generic-api-key"]
+condition = "AND"
+regexTarget = "secret"
+regexes = [
+  '''^fe7c786ab321f41c654ef6c1af7b3250a613c24e4213e0425a7ae45655534441$''',
+  '''^c48cbb3d5e57ed56e276bc45f99ab39abe94e6cd7ac39fb402da47ad0014df105553444d$''',
+]
+paths = ['''(?:^|/)shared/data/safety-score-v9/transfer-review-overlays-v1\.json$''']

docs/live-reserves.md

@@ -528,6 +528,8 @@ the `re-metrics` adapter parses Re Protocol's official metrics page and now extr
 
 `solstice-attestation` and `river-protocol-info` are proof-class reserve-sync adapters. They make current issuer/protocol telemetry visible on reserve detail and status surfaces, but their registry evidence class is `weak-live-probe`, so they do not become V9 Backing reserve evidence. Solstice remains proof-class until its aggregate solvency feed exposes timestamped asset-category composition; River remains proof-class because its protocol-info endpoint exposes aggregate TVL/circulating-supply telemetry rather than asset-level collateral composition. River snapshots degrade when the aggregate TVL is below circulating satUSD, and timestampless protocol-info payloads remain freshness-unverified.
 
+`audx-independent-assurance` uses the reviewed July 31, 2026 report: AUD 3,231,371.79 in designated bank accounts against AUD 3,208,057.00 issued supply. Aura Partners signed its limited-assurance report on August 20, 2026; the posting date is unknown. The manifest retains the report's printed AEDT timestamp and exact PDF hash, with freshness measured from the examined period rather than the signature or fetch date.
+
 `usdgo-transparency` is now independent: the Deloitte examination is the authoritative composition/liability source through the independent-assurance manifest (exact PDF SHA-256 binding), with the Avalanche BUIDL balance pinned on-chain and the issuer transparency API demoted to a cross-check that raises informational warnings on later-period drift.
 
 `anzen-usdz` is now independent: it reads USDz `totalPooledSPCT()` and actual SPCT holdings on-chain and reconciles them against bridge-adjusted USDz liabilities across the five issuance chains, failing closed on shortfall instead of trusting global SPCT supply.
@@ -545,6 +547,8 @@ Yuzu's Fasanara `mGLO` loop remains a high-risk named reserve slice but carries
 Chainlink NAV note:
 `chainlink-nav` now supports both standard AggregatorV3 feeds and Ondo router-style NAV lookups. When `oracleMethod = "getAssetPrice"`, the adapter calls `getAssetPrice(token)` on the router and, when available, follows `tokenToRWAOracle(token) -> getPriceData()` to recover a verified freshness timestamp instead of treating the feed as permanently timestampless.
 
+USDY's scalar NAV configuration is suspended: its price and token-supply reads do not measure the multi-asset holdings published by Ondo. Scoring uses the separately dated reviewed holdings composition with the existing static-evidence admission and freshness limits; resumption requires a producer that consumes the holdings themselves. Felix's kHYPE branch uses the reviewed Kinetiq label so the next live observation joins its existing collateral classification.
+
 Chronicle NAV note:
 `chronicle-nav` reads Chronicle Labs Proof-of-Asset VAO consumer contracts via `readWithAge()` (value + age), validating the value, rejecting stale or future-dated ages, and reading the coin token's on-chain supply with its actual decimals. The v1 path is scalar-only: it emits one configured 100% NAV slice with verified freshness from the consumer age, mirroring `chainlink-nav`'s single-bucket model. Chronicle's IPFS `UPoked` proof objects (position-level composition) are a documented future enhancement, not consumed today. ACRDX and STAC bind this adapter.
 

scripts/maintenance/refresh-independent-assurance-reports.ts

@@ -54,9 +54,9 @@ function profile(product: IndependentAssuranceProduct): CompilerProfile {
         product,
         profile: "audx-v1",
         officialIndexUrl: "https://www.audxtoken.com/transparency",
-        reportUrl: "https://www.audxtoken.com/_files/ugd/539754_f60cd94b9a5148cfafd351f6157c8036.pdf",
-        reportDate: "2026-06-30",
-        reportAsOf: "2026-06-30T23:59:00+11:00",
+        reportUrl: "https://www.audxtoken.com/_files/ugd/539754_d2b6ce0bfdd947bda8375fe3283a0491.pdf",
+        reportDate: "2026-07-31",
+        reportAsOf: "2026-07-31T23:59:00+11:00",
         reportTimeZone: "AEDT (as printed in the report; normalized conservatively to UTC)",
         attestor: "Aura Partners",
         engagement: "Independent limited assurance engagement under ASAE 3000 and ASAE 3100",
@@ -82,19 +82,19 @@ function profile(product: IndependentAssuranceProduct): CompilerProfile {
           { label: "Aura Partners", pattern: /AURAPARTNERS|Aura Partners/i },
           { label: "ASAE 3000", pattern: /ASAE 3000/i },
           { label: "ASAE 3100", pattern: /ASAE 3100/i },
-          { label: "AUDX report date", pattern: /30(?:th)? of June 2026/i },
+          { label: "AUDX report date", pattern: /31(?:st)? of July 2026/i },
           { label: "favorable AUDX conclusion", pattern: /nothing has come to our[\s\S]*attention/i },
         ],
         rejectedText: [
           { label: "qualified/adverse/disclaimed conclusion", pattern: /qualified opinion|adverse opinion|disclaimer of opinion|except for/i },
         ],
         reportedTotals: [
-          { label: "AUDX supply total", expected: "3008057.00", pattern: linePattern("TOTAL AUDX Supply") },
-          { label: "AUDX reserve total", expected: "3231280.83", pattern: linePattern("TOTAL Australian Dollar Reserves") },
+          { label: "AUDX supply total", expected: "3208057.00", pattern: linePattern("TOTAL AUDX Supply") },
+          { label: "AUDX reserve total", expected: "3231371.79", pattern: linePattern("TOTAL Australian Dollar Reserves") },
         ],
-        reportedAssetTotal: "3231280.83",
-        computedAssetTotal: "3231280.83",
-        reportedLiabilityTotal: "3008057.00",
+        reportedAssetTotal: "3231371.79",
+        computedAssetTotal: "3231371.79",
+        reportedLiabilityTotal: "3208057.00",
       };
     case "EUROP":
       return {

shared/data/live-reserves/independent-assurance/audx.json

@@ -3,11 +3,11 @@
   "product": "AUDX",
   "profile": "audx-v1",
   "officialIndexUrl": "https://www.audxtoken.com/transparency",
-  "reportUrl": "https://www.audxtoken.com/_files/ugd/539754_f60cd94b9a5148cfafd351f6157c8036.pdf",
-  "reportSha256": "6f310bc328c9373bb8e645a580d5e2ec5313086a50671ce4ea0e142619cc7eca",
-  "reportByteLength": 393979,
-  "reportDate": "2026-06-30",
-  "reportAsOf": "2026-06-30T23:59:00+11:00",
+  "reportUrl": "https://www.audxtoken.com/_files/ugd/539754_d2b6ce0bfdd947bda8375fe3283a0491.pdf",
+  "reportSha256": "e6a260f26d38a318ad36c3d0ed6539b36d053c9a68bce844c6d358db282a3913",
+  "reportByteLength": 615133,
+  "reportDate": "2026-07-31",
+  "reportAsOf": "2026-07-31T23:59:00+11:00",
   "reportTimeZone": "AEDT (as printed in the report; normalized conservatively to UTC)",
   "attestor": "Aura Partners",
   "engagement": "Independent limited assurance engagement under ASAE 3000 and ASAE 3100",
@@ -17,25 +17,53 @@
     {
       "code": "designated-bank-accounts",
       "label": "Australian Dollar reserves held in designated TAU accounts",
-      "amount": "3231280.83"
+      "amount": "3231371.79"
     }
   ],
   "liabilities": [
-    { "code": "polygon", "label": "Polygon AUDX supply", "amount": "1321016.00" },
-    { "code": "ethereum", "label": "Ethereum AUDX supply", "amount": "1435040.00" },
-    { "code": "conflux", "label": "Conflux AUDX supply", "amount": "52000.00" },
-    { "code": "redbelly", "label": "Redbelly AUDX supply", "amount": "100000.00" },
-    { "code": "xdc", "label": "XDC AUDX supply", "amount": "50000.00" },
-    { "code": "ink", "label": "Ink AUDX supply", "amount": "50000.00" },
-    { "code": "solana", "label": "Solana AUDX supply", "amount": "1.00" }
+    {
+      "code": "polygon",
+      "label": "Polygon AUDX supply",
+      "amount": "1321016.00"
+    },
+    {
+      "code": "ethereum",
+      "label": "Ethereum AUDX supply",
+      "amount": "1635040.00"
+    },
+    {
+      "code": "conflux",
+      "label": "Conflux AUDX supply",
+      "amount": "52000.00"
+    },
+    {
+      "code": "redbelly",
+      "label": "Redbelly AUDX supply",
+      "amount": "100000.00"
+    },
+    {
+      "code": "xdc",
+      "label": "XDC AUDX supply",
+      "amount": "50000.00"
+    },
+    {
+      "code": "ink",
+      "label": "Ink AUDX supply",
+      "amount": "50000.00"
+    },
+    {
+      "code": "solana",
+      "label": "Solana AUDX supply",
+      "amount": "1.00"
+    }
   ],
-  "reportedAssetTotal": "3231280.83",
-  "computedAssetTotal": "3231280.83",
-  "reportedLiabilityTotal": "3008057.00",
+  "reportedAssetTotal": "3231371.79",
+  "computedAssetTotal": "3231371.79",
+  "reportedLiabilityTotal": "3208057.00",
   "extraction": {
     "tool": "Poppler pdftotext -layout",
     "parserVersion": "26.08.0",
-    "normalizedTextSha256": "0897c66b54cf3c964643cfcd7ed73e9fcf4e29d42256eb67b76c2469b9d25aa2",
+    "normalizedTextSha256": "4989b32c3d379e755f5715f4d4cbb5013d113422648b5e146362f5149860204e",
     "pageCount": 4
   }
 }

shared/data/safety-score-v9/evaluation-build-manifest-v1.ts

@@ -10,7 +10,7 @@ export const SAFETY_SCORE_V9_EVALUATION_BUILD_MANIFEST = {
     },
     {
       "path": "shared/data/safety-score-v9/mechanism-review-overlays-v1.json",
-      "sha256": "e573e4bd61f70a6ada918cd9c980e4d092de1fda5c8cb7791b3797c7f191fb83"
+      "sha256": "2da505ee315106f16268ffa1acd16fe27c45d3109dbb9cd467482ba937e6ed2d"
     },
     {
       "path": "shared/data/safety-score-v9/methodology-policy-candidate-v1.json",
@@ -603,7 +603,7 @@ export const SAFETY_SCORE_V9_EVALUATION_BUILD_MANIFEST = {
       "r2Key": "captures/lusd-liquity/2026-09-03-block-25895460-shock-coverage.json.gz"
     }
   ],
-  "digest": "b2a6be46f7d1369f6f9a27002833d6b3a75344d16a69f5d970d9814b31c0756d"
+  "digest": "e6b6868f9787a544a8ec28ce685469047ab67cfd73cc53e6a8d5c16f46e78b38"
 } as const;
 
 export const SAFETY_SCORE_V9_EVALUATION_BUILD_DIGEST =

shared/data/safety-score-v9/mechanism-review-overlays-v1.json

@@ -829,64 +829,41 @@
     },
     {
       "assetId": "zarm-mento",
-      "archetype": "cdp",
-      "reviewedAt": "2026-07-15",
+      "archetype": "fiat-cash",
+      "reviewedAt": "2026-09-05",
       "sources": [
         {
-          "label": "Mento BiPoolManager and FPMM conversion state on Celo",
-          "url": "https://celoscan.io/address/0x22d9db95e6ae61c104a7b6f6c78d7993b94ec901"
+          "label": "Mento itemized reserve assets, custody wallets and positions (fetched 2026-09-05)",
+          "url": "https://mento-analytics-api-12390052758.us-central1.run.app/api/v2/reserve"
         },
         {
-          "label": "Mento V3 reserve conversion documentation",
-          "url": "https://docs.mento.org/mento-v3"
-        }
-      ],
-      "notes": "Pinned Celo block 72202985; journaled evidence: shared/data/safety-score-v9/mechanism-measurements/zarm-mento/2026-07-15-block-72202985.json. The producer enumerated all 16 live exchange IDs, found the configured token/USDm pair exactly once, and measured 10000000 USDm of counter-bucket capacity at the journaled 30 bps fee. Conversion capacity is an analogous exit metric rather than dedicated liquidation capital. The bounded virtual USDm counter-bucket provides limited conversion support; pair buckets limit flow but Broker, USDm, reserve, and oracle failure domains remain shared; BreakerBox and trading limits can halt unsafe conversion without supplying an unconditional residual-deficit recapitalization path. Backstop, branch isolation, and shutdown/bad-debt handling are therefore limited.",
-      "metrics": {
-        "collateralizationRatio": null,
-        "liquidationCapacityRatio": null
-      },
-      "metricApplicability": {
-        "collateralizationRatio": {
-          "state": "not-applicable",
-          "rationale": "This reserve/conversion token has no independently collateralized per-token vault system.",
-          "sourceUrl": "https://docs.mento.org/mento-v3"
+          "label": "Mento protocol-wide reserve, liquidity and governance risk disclosure",
+          "url": "https://docs.mento.org/mento-v3/dive-deeper/security/risk-overview.md"
         },
-        "liquidationCapacityRatio": {
-          "state": "not-applicable",
-          "rationale": "The measured counter-asset conversion inventory is redemption liquidity, not capital committed to debt-offset liquidation.",
-          "sourceUrl": "https://docs.mento.org/mento-v3"
-        }
-      },
-      "analogousMetrics": {
-        "conversionCapacityCounterUnits": 10000000
-      },
-      "components": {
-        "collateralizationParameters": {
-          "applicability": "not-applicable",
-          "rationale": "This reserve/conversion token has no independently collateralized per-token vault system.",
-          "sourceUrl": "https://docs.mento.org/mento-v3"
+        {
+          "label": "Mento shared V2/V3 Reserve and StableTokenZAR deployment inventory",
+          "url": "https://docs.mento.org/mento-v3/build/deployments/addresses.md"
         },
-        "liquidationMechanics": {
-          "applicability": "not-applicable",
-          "rationale": "The measured counter-asset conversion inventory is redemption liquidity, not capital committed to debt-offset liquidation.",
-          "sourceUrl": "https://docs.mento.org/mento-v3"
+        {
+          "label": "Sourcify verified ZARm proxy source on Celo",
+          "url": "https://sourcify.dev/server/v2/contract/42220/0x4c35853a3b4e647fd266f4de678dcc8fec410bf6?fields=abi,metadata,sources"
         },
-        "backstop": {
-          "applicability": "measured",
+        {
+          "label": "Celo finalized block 76721442 (ZARm and Reserve code; ZARm totalSupply reads)",
+          "url": "https://celoscan.io/block/76721442"
+        }
+      ],
+      "notes": "Reviewed 2026-09-05: replaces the stale CDP overlay to match the existing fiat-cash classification for shared protocol-reserve inventory. The official deployment inventory identifies StableTokenZAR at 0x4c35853a3b4e647fd266f4de678dcc8fec410bf6 and the shared Reserve at 0x9380fa34fd9e4fd14c06305fd7b6199089ed4eb9. The itemized reserve API disclosed $19,959,907.699599963 of collateral across named hot, cold and operational wallets and deployed positions; its CDP rows contain no ZARm debt. At finalized Celo block 76721442, both deployment addresses had contract code and ZARm totalSupply was 10925.176443780387 tokens. These primary disclosures and on-chain anchors support limited claim/segregation, custody continuity, and assurance/reconciliation under the same shared-reserve framing as CADm, KESm and BRLm. Claim/segregation is limited to observable protocol reserve inventory, not a direct legal holder claim or a ZARm-specific partition. Custody continuity is limited because the disclosed reserve wallets and protocol governance remain shared failure domains. Assurance is limited to itemized self-reported assets corroborated by contract and token-supply reads, not an independently attested reserve-to-liability reconciliation or a complete cross-chain balance audit. No independent auditor, enforceable holder seniority, bankruptcy-remoteness, or dedicated ZARm recovery commitment is established. The broad fiat-cash classification is economically broader than ordinary custodial fiat cash. Raw primary responses and block reads are retained in agents/2026-09-05-safety-score-gap-campaign/evidence/zarm-*. No current CDP ratio, liquidation capacity or historical virtual conversion inventory is carried into the fiat-cash overlay.",
+      "metrics": {},
+      "components": {
+        "claimAndSegregation": {
           "quality": "limited"
         },
-        "branchIsolation": {
-          "applicability": "measured",
+        "custodyContinuity": {
           "quality": "limited"
         },
-        "shutdownAndBadDebt": {
-          "applicability": "measured",
+        "assuranceAndReconciliation": {
           "quality": "limited"
-        },
-        "structuralRedemption": {
-          "applicability": "measured",
-          "quality": "adequate"
         }
       }
     },