Harden verification and automate judge-verifiable Canton delivery

.devcontainer/devcontainer.json

@@ -0,0 +1,32 @@
+{
+  "name": "CommitLedger Canton Proof",
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+  "features": {
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "22"
+    },
+    "ghcr.io/devcontainers/features/java:1": {
+      "version": "21"
+    },
+    "ghcr.io/devcontainers/features/python:1": {
+      "version": "3.12"
+    }
+  },
+  "postCreateCommand": "bash scripts/bootstrap-codespace.sh",
+  "forwardPorts": [4173, 3975],
+  "portsAttributes": {
+    "4173": {
+      "label": "CommitLedger judge UI",
+      "onAutoForward": "notify"
+    },
+    "3975": {
+      "label": "Canton JSON Ledger API",
+      "onAutoForward": "silent"
+    }
+  },
+  "customizations": {
+    "vscode": {
+      "extensions": []
+    }
+  }
+}

.env.example

@@ -1,27 +1,18 @@
-# Canton JSON Ledger API.
-CANTON_JSON_API_URL=http://localhost:3975
+# Secrets stay in your shell or an ignored local .env file, never in Git.
+GITHUB_TOKEN=
+CANTON_JSON_API_URL=http://127.0.0.1:3975
 CANTON_PACKAGE_ID=
-
-# Three distinct Canton parties are required for the full competition proof.
 CANTON_MAINTAINER_PARTY=
 CANTON_CONTRIBUTOR_PARTY=
 CANTON_VERIFIER_PARTY=
-
-# LocalNet may use one token with rights for all demo parties.
 CANTON_TOKEN=
-
-# Or provide role-specific tokens for stronger separation.
 CANTON_MAINTAINER_TOKEN=
 CANTON_CONTRIBUTOR_TOKEN=
 CANTON_VERIFIER_TOKEN=
-
-# Optional GitHub token. Required while this repository is private.
-GITHUB_TOKEN=
-
-# Optional full-demo overrides.
+CANTON_USER_ID=
+# Explicit local sandbox only. Never enable for a remote/production service.
+CANTON_INSECURE_LOCAL=false
 COMMITLEDGER_ISSUE_URL=https://github.com/Saidur-droid/CommitLedger/issues/5
 COMMITLEDGER_PR_NUMBER=6
 COMMITLEDGER_CONTRIBUTOR_GITHUB=Saidur-droid
-COMMITLEDGER_REWARD_AMOUNT=100
-COMMITLEDGER_BASE_BRANCH=main
-COMMITLEDGER_EVIDENCE_FILE=
+COMMITLEDGER_EVIDENCE_FILE=./evidence/canton-proof.json

.github/workflows/ci.yml

@@ -1,54 +1,76 @@
-name: Manual Verification
-
+name: Verified Delivery
 on:
+  push:
+    branches: [main, 'fix/**']
+  pull_request:
   workflow_dispatch:
-
 permissions:
   contents: read
-
+  issues: read
+  pull-requests: read
+concurrency:
+  group: verification-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
-  node-verifier:
+  node:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: "22"
-      - run: npm test
-
-  daml:
+          node-version: '22'
+      - name: Run every Node test
+        run: |
+          mkdir -p evidence
+          set -o pipefail
+          npm test 2>&1 | tee evidence/node-tests.log
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: node-evidence-${{ github.sha }}
+          path: evidence/node-tests.log
+  canton-proof:
+    # Untrusted fork PRs never receive a private-repository read token.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4
-      - name: Install DPM SDK 3.5.12
-        run: |
-          curl -sSL https://get.digitalasset.com/install/install.sh | DPM_EDITION=open-source bash -s 3.5.12
-          echo "$HOME/.dpm/bin" >> "$GITHUB_PATH"
-      - name: Build Daml
-        working-directory: daml
-        run: DPM_SDK_VERSION=3.5.12 dpm build --all
-      - name: Test Daml
-        working-directory: daml
-        run: DPM_SDK_VERSION=3.5.12 dpm test
-
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: Install pinned open-source DPM
+        run: bash scripts/bootstrap-dpm.sh
+      - name: Build, test, deploy and capture a real local Canton lifecycle
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: bash scripts/run-local-proof.sh
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: canton-evidence-${{ github.sha }}
+          path: |
+            evidence/*.log
+            evidence/*.json
+          if-no-files-found: warn
+          retention-days: 30
   repository-gates:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
-      - name: Required competition files exist
+      - name: Required files and constraints
         run: |
           test -f LOCKED_DECISIONS.md
           test -f docs/COMPETITION_COMPLIANCE.md
-          test -f docs/WINNING_STANDARD.md
-          test -f docs/RULES_SNAPSHOT.md
+          test -f docs/EVIDENCE_MANIFEST.md
+          test -f docs/DEMO_SCRIPT.md
+          test -f docs/SUBMISSION_DRAFT.md
           test -f daml/daml/CommitLedger.daml
-          test -f daml/daml/Test.daml
-          test -f src/github-verifier.mjs
-          test -f src/canton-json-api.mjs
-          test -f web/index.html
-      - name: No forbidden runtime dependencies
-        run: |
-          ! grep -RniE 'vercel|supabase' package.json src web scripts daml || {
-            echo "Forbidden runtime dependency reference detected"
-            exit 1
-          }
+          ! grep -RniE 'vercel|supabase' package.json src web scripts daml
+          ! git ls-files | grep -E '(^|/)\.env(\.local)?$'

.gitignore

@@ -1,10 +1,10 @@
-.DS_Store
-.env
-.env.*
-!.env.example
 node_modules/
-coverage/
-dist/
+.env
+.env.local
+.env.*.local
 daml/.daml/
-*.dar
-*.log
+evidence/*.log
+evidence/*.json
+!evidence/.gitkeep
+*.webm
+*.mp4

README.md

@@ -2,33 +2,75 @@
 
 **Canton-native settlement infrastructure for verified open-source work.**
 
-CommitLedger binds a real GitHub bounty issue and merged pull request to role-separated Daml authorization and an auditable Canton settlement receipt.
+CommitLedger binds canonical contribution evidence to role-separated authorization and an auditable settlement receipt.
 
-## Competition thesis
+## Active competition targets — 7 October 2026
+
+This sprint has exactly two active submission targets:
+
+1. **HackCanton Season 3**
+   - Submission deadline: **9 Oct 2026, 23:59 UTC**
+   - Bangladesh time: **10 Oct 2026, 05:59**
+2. **Crypto World's Fair — Colosseum**
+   - Contest/submission cutoff: **12 Oct 2026, 23:59 PT**
+   - Bangladesh time: **13 Oct 2026, 12:59**
+
+The 1 October plan that retired HackCanton is superseded by the owner's 7 October instruction to submit CommitLedger to both programs.
+
+See [Competition Targets](docs/COMPETITION_TARGETS.md), [Submission Status](docs/SUBMISSION_STATUS_20261007.md), [Final Checklist](docs/FINAL_CHECKLIST.md), and [Submission Draft](docs/SUBMISSION_DRAFT.md).
+
+## Product thesis
 
 `GitHub Issue -> Bounty -> Claim -> Pull Request -> Merge Evidence -> Canton Settlement -> SettlementReceipt`
 
-Canton is the trust and settlement layer, not a cosmetic integration. Removing Canton removes the product's authorization, provenance, replay protection and final settlement record.
+Canton/Daml is the authorization and workflow-state layer, not a cosmetic integration. GitHub remains the canonical external work-evidence source.
 
 ## Core guarantees
 
 - **Maintainer** creates the bounty, accepts the claim and settles verified work.
-- **Contributor** creates the claim and submits the exact PR.
-- **Verifier** can attest only canonical GitHub merge evidence.
-- Merge evidence includes the **exact bounty issue number**.
-- Wrong issue, wrong SHA, unmerged work and unauthorized actions are rejected.
-- Settlement consumes the verified contract, blocking duplicate settlement.
+- **Contributor** claims work and submits the exact PR.
+- **Verifier** attests canonical merge evidence.
+- Merge evidence is bound to the exact issue and PR metadata.
+- Wrong evidence, unauthorized actions and replay/duplicate settlement are rejected.
+- Settlement consumes the verified contract and creates an auditable `SettlementReceipt`.
 - `DEMO_CREDIT` is explicitly non-production test value.
 
-## Real GitHub fixture
+## Frozen technical proof
+
+The last fully executed, source-bound technical proof is:
+
+`26bd992787401f6458f6685d2ab76aacd05eab4e`
+
+Verified at that exact code commit:
+
+- Node tests: **86/86 PASS**
+- DPM **3.5.12** PASS
+- Daml build PASS
+- Daml Script tests PASS
+- fresh Canton sandbox PASS
+- six ledger transitions PASS
+- `SettlementReceipt` generated
+- wrong-evidence rejection captured
+- unauthorized-settlement rejection captured
+- duplicate/replay rejection captured
+
+External GitHub evidence fixture:
+
+- Repository: `Saidur-droid/MergeEarn`
+- Open issue: `#69`
+- Merged PR: `#73`
+
+**MergeEarn is only the external proof fixture. CommitLedger is the product being submitted.**
 
-The reproducible competition fixture is:
+Canonical proof service:
 
-- Open issue: `#5`
-- Merged PR: `#6`
-- PR #6 references issue #5 without closing it.
+https://commitledger-proof-final.onrender.com
 
-This lets a judge repeatedly prove the issue -> merged PR trust boundary without fake users or fake traction.
+Proof JSON:
+
+https://commitledger-proof-final.onrender.com/api/proof
+
+Planning/documentation commits after the frozen proof do not become runtime-proven automatically. If executable code changes, rerun the complete proof on the exact new commit.
 
 ## Run locally
 
@@ -41,51 +83,35 @@ npm start
 
 Open `http://127.0.0.1:4173`.
 
-Because this repository is currently private, set `GITHUB_TOKEN` with read access before using the canonical GitHub verifier.
-
 ## Run the full Canton proof
 
-Configure `.env.example` values for:
-- Canton JSON Ledger API URL;
-- package ID;
-- three distinct parties;
-- one LocalNet token with rights to all demo parties, or role-specific tokens.
-
-Then:
+Configure the documented Canton environment values, then run:
 
 ```bash
-npm run demo:full
+bash scripts/run-local-proof.sh
 ```
 
-The runner automatically captures each Canton `updateId`, `completionOffset` and active `contractId`, executes negative authorization/replay checks, and finishes at the active `SettlementReceipt`.
-
-See [Judge Runbook](docs/JUDGE_RUNBOOK.md) for the exact operator path.
-
-## Canton / Daml
+The proof path reruns tests, builds/tests Daml, starts a fresh Canton sandbox, captures each ledger transition, executes negative authorization/replay checks, validates one coherent evidence bundle, and finishes at `SettlementReceipt`.
 
-The Daml project is under `daml/` and is pinned to the stable open-source DPM SDK bundle **3.5.12**.
+## Submission assets
 
-Verification commands:
-
-```bash
-bash scripts/bootstrap-dpm.sh
-bash scripts/verify-all.sh
-```
-
-## Competition governance
-
-- [Locked decisions](LOCKED_DECISIONS.md)
-- [Competition compliance](docs/COMPETITION_COMPLIANCE.md)
-- [Winning standard](docs/WINNING_STANDARD.md)
-- [Rules snapshot](docs/RULES_SNAPSHOT.md)
-- [Architecture](docs/ARCHITECTURE.md)
-- [Threat model](docs/THREAT_MODEL.md)
-- [Judge runbook](docs/JUDGE_RUNBOOK.md)
-- [Evidence manifest](docs/EVIDENCE_MANIFEST.md)
-- [Build status](docs/BUILD_STATUS.md)
+- [Rules recheck — 7 Oct](docs/RULES_RECHECK_20261007.md)
+- [Submission status — 7 Oct](docs/SUBMISSION_STATUS_20261007.md)
+- [Competition targets](docs/COMPETITION_TARGETS.md)
+- [Final checklist](docs/FINAL_CHECKLIST.md)
+- [Submission master draft](docs/SUBMISSION_DRAFT.md)
+- [HackCanton pitch](docs/PITCH.md)
+- [HackCanton demo script](docs/DEMO_SCRIPT.md)
+- [Colosseum pitch script](docs/COLOSSEUM_PITCH_SCRIPT.md)
+- [Colosseum demo script](docs/COLOSSEUM_DEMO_SCRIPT.md)
+- [Hackathon work disclosure](docs/HACKATHON_WORK_DISCLOSURE.md)
+- [AI assistance disclosure](docs/AI_DISCLOSURE.md)
+- [Delivery status](docs/DELIVERY_STATUS.md)
 
 ## Integrity
 
-CommitLedger does not claim Canton Coin transfer, fiat settlement, external adoption, mainnet usage, green CI, or runtime Canton success unless that evidence has actually been produced.
+CommitLedger does not claim Canton Coin transfer, fiat settlement, external adoption, MainNet usage, revenue, paying customers, or production custody without evidence.
+
+`DEMO_CREDIT` is test value only.
 
 Canton is a registered trademark of Digital Asset (Switzerland) GmbH. CommitLedger is an independent project and is not sponsored or endorsed by Digital Asset.

daml/daml/CommitLedger.daml

@@ -1,5 +1,7 @@
 module CommitLedger where
 
+import qualified DA.Text as Text
+
 -- CommitLedger intentionally models a demo/test settlement asset.
 -- It does not claim to transfer fiat, Canton Coin, or production funds.
 
@@ -19,6 +21,7 @@ data MergeEvidence = MergeEvidence
     prNumber : Int
     prUrl : Text
     headSha : Text
+    mergeCommitSha : Text
     baseBranch : Text
     merged : Bool
     mergedAt : Text
@@ -175,6 +178,7 @@ template SubmittedBounty
         assertMsg "evidence URL mismatch" (evidence.prUrl == pullRequest.prUrl)
         assertMsg "evidence head SHA mismatch" (evidence.headSha == pullRequest.headSha)
         assertMsg "evidence base branch mismatch" (evidence.baseBranch == pullRequest.baseBranch)
+        assertMsg "merge commit SHA must have 40 characters" (Text.length evidence.mergeCommitSha == 40)
         assertMsg "merge timestamp is required" (evidence.mergedAt /= "")
         assertMsg "evidence hash is required" (evidence.evidenceHash /= "")
         create VerifiedBounty with
@@ -229,6 +233,7 @@ template VerifiedBounty
           pullRequest
           rewardAmount
           rewardUnit
+          mergeCommitSha = evidence.mergeCommitSha
           evidenceHash = evidence.evidenceHash
           settledAt
           settlementRef
@@ -245,6 +250,7 @@ template SettlementReceipt
     pullRequest : GitHubPullRequestRef
     rewardAmount : Decimal
     rewardUnit : Text
+    mergeCommitSha : Text
     evidenceHash : Text
     settledAt : Time
     settlementRef : Text