Wayfinder: real Bitcoin anchoring with independent verification #279

Destination

Any boop list (and later, a note) can be committed to Bitcoin as an exact, versioned snapshot. Anyone can independently confirm that the committed bytes match that snapshot, by pulling Bitcoin evidence themselves rather than relying on a status flag boop stores. Simulated anchoring is removed from production. Historical rows stay readable and are clearly labeled genuine / simulated / pending / unverifiable.

A Bitcoin commitment is evidence about bytes, not about who acted. Signed action records (#237 / PR #277) supply identity; the snapshot references them.

Full requirements and acceptance criteria: #240 (this map supersedes it as the tracking issue for the effort).

Route

1. Decisions (grilling): Bitcoin anchoring decisions: network, budget, custody, triggers, worker #280. Blocks real submission. Does not block snapshot work.
2. Canonical snapshot + hashing: Versioned canonical snapshot and stable hashing for anchoring #281. Can start now.
3. Submission, durable attempt state, idempotent retry: Real anchor submission with durable attempt state and idempotent retry #282. Needs 1 and 2.
4. Confirmation tracking + reorg policy: Anchor confirmation tracking and reorg handling #283. Needs 3.
5. Independent verification + evidence labeling; remove simulation: Independent anchor verification, evidence labeling, and removal of simulation #284. Needs 2; finishes after 4.
6. Testnet demo + release readiness: Bitcoin anchoring: testnet demo and release readiness #285. Needs everything above.

Constraints

• Use the latest published @originals/sdk at release time; reuse its anchoring/verification APIs before writing custom ones (see [P1] Ship real Bitcoin anchoring with canonical snapshots and independent verification #240).
• No spending of funds without an agreed budget (decided in Bitcoin anchoring decisions: network, budget, custody, triggers, worker #280).
• Depends on [P0] Enforce authenticated identity across browser and agent operations #236 for authorization and [P1] Replace unsigned credential placeholders with consistent signed action records #237 for signed-record references.
• boop Receipts: exportable, third-party-verifiable activity reports #206 (Receipts) must not claim anchoring exists until Independent anchor verification, evidence labeling, and removal of simulation #284 lands.