Building decentralized, AI-assisted threat intelligence on Kaspa.
Prometheus is an open protocol project targeting a decentralized threat-intelligence network on Kaspa. The repository contains tested development foundations, but no production Prometheus network is operating today. Current execution depends on owner-operated policies, membership files, local trust anchors, same-host evidence, and one bounded operator-attested distinct-host Development/Testnet-10 transport demonstration. Real Phi-3/ONNX inference, independently evaluated 8B/70B Guardian models, operated public multi-host networking, externally trusted decentralized membership authority, Sybil resistance, and on-chain attestation remain rollout gates. GH-253 locally exercises dual-signed transition-authority succession but does not prove those external properties.
See the 2026-08-14 public claim audit and its machine-readable status. The audit baseline is exact main 5cd13bf; Prometheus CI 31747553871, Security Audit 31747553891, and Pages 31747553216 pass on that commit.
Public project status was reviewed through 2026-10-09. The immutable claim-audit baseline remains 2026-08-14; later exact-main updates, including GH-253 and the planned GH-258/GH-261 safety track, are recorded below and in the machine-readable post-audit ledger.
October 2026 checkpoint: A1-A8 repository repairs are merged; #270 remains open. Contract bundle v2 (#276) remains an unmerged, non-promotable draft. D5 acceptance stays closed; the Rust deployer remains v1-pinned. No production deployment or achieved under-60-second lifecycle is claimed. See the claim reconciliation and machine-readable post-audit ledger.
- The Light Client has bounded development scanning and owner-pinned rule-sync tooling. Phi-3 has no ONNX session; the custom byte-pattern matcher is not a production YARA engine or malware detector.
- Guardian machinery includes compile-only YARA-X validation, explicitly non-actionable drafts, authenticated intake and a real Groth16 verifier with pinned test-artifact trust anchors. No independently evaluated real-model detection quality or production proof approval is demonstrated.
- Validators are tested library state machines, not a runnable validator network.
PeerIdis transport metadata, not decentralized identity, stake or membership authority. - The keyless genesis operator exports public preparation/signing files before external signing. Signature import and broadcast rebuild and verify the transaction; only one non-promotable H-001 Testnet-10 canary is confirmed. No wallet or private-key input is accepted.
Commands below exercise development components, not a production threat-intelligence network. See the October claim reconciliation for exact evidence and remaining gates.
Select PROMETHEUS_RUNTIME=development explicitly for local development.
Missing, empty, invalid or unreadable values forbid security-critical stubs;
the restrictive Beta fallback is not deployment authorization. Commands with
explicit-profile requirements still reject missing or invalid configuration.
| Development component | Target hardware | Command |
|---|---|---|
| Light Client foundation | Development host; explicitly select the development profile | PROMETHEUS_RUNTIME=development cargo run -p prometheus-client |
| Validator state-machine foundation | Development host; library crate only (no validator binary or network node yet); target stake is 10,000 KAS | cargo test -p prometheus-validator |
| Guardian 8B runtime scaffold | Target: NVIDIA GPU with 24 GB VRAM | See Guardian runtime preflight |
| Guardian 70B runtime scaffold | Target: 4x A100/H100 80 GB, 256 GB system RAM | Opt-in Compose profile 70b; no completed real-model evaluation is claimed |
git clone https://github.com/NeaBouli/prometheus-.git
cd prometheus-
cargo build --releaseKaspa mining is ASIC-dominated and normally uses Stratum, while Prometheus reads Kaspa node state through wRPC. The first integration is therefore an opt-in sidecar for operators who already run a local Testnet-10 node; it is not ASIC firmware and does not reuse a Stratum session.
cargo run -p prometheus-client -- \
miner-companion preflight \
--config modules/client/miner-companion.example.tomlThe companion currently validates a strict credential-free, loopback-only configuration and can monitor local BlockDAG health. It is development-only: host scanning, threat reporting, validator/honeypot modes, and PROM rewards are disabled. Reporter allocation is reserved for future verified security contributions, not passive mining uptime.
Layer 1 target: ValidatorStaking | GuardianReputation | RuleStorage | GovernanceAutoTuning
Tested state machines; only the non-promotable H-001 canary is on Testnet-10
Layer 2 (P2P): Guardian ballot request/response over QUIC (implemented core)
Rule distribution and client/validator carriers remain rollout work
Off-Chain target: Phi-3-mini | LLaMA 3 8B-first/70B-escalation | Fed-DART
Current Phi-3 and Fed-DART paths are development stubs; no real model quality is proven
GH-258 and its GH-261 clarification track a future, evidence-gated endpoint-security layer for coordinated compromise, including unauthorized compute conscription: attempts to commandeer endpoints, accelerators, servers, or data-center capacity into a distributed compute mesh. Detection would use observable process, file, network, persistence, credential-access, model/tool, unexpected CPU/GPU workload, scheduler/orchestrator, workload-identity, and bounded cross-device correlation signals. Prometheus cannot reliably attribute an attack to AI, AGI, a specific actor, or intent from those signals alone.
The planned order is: observe only, warn only, operator-confirmed reversible containment, then separately approved limited automation after independent privacy, false-positive, rollback, adversarial, resource, and multi-host evaluation. No real-time endpoint sensor or response engine is implemented today. Automatic process termination, quarantine, firewall changes, credential rotation, remote commands, deletion, and host isolation remain disabled and unauthorized.
GH-264 repository candidate: the first observe-only implementation slice is a 512-byte-capped canonical endpoint observation statement, parsed independently in Rust and Python from one shared exact-byte corpus. It permits only seven closed behavior domains, 15 matching closed signals, bounded counts and windows, an opaque nonce, minute-granularity time, and a separately trusted network. It has no path, process name, command line, address, host identifier, prompt, credential, file content, arbitrary label, or free text. This parser collects no endpoint data and proves no event truth, maliciousness, provenance, privacy safety, AI/actor attribution, or authorization. No correlation, warning, transport, response authority, or production behavior is added. See the Endpoint Observation Statement v1 specification.
GH-267 repository candidate: a machine-readable pre-producer privacy and threat model plus a fail-closed Security-CI drift gate now pins explicit per-host opt-in, least privilege, local aggregation/redaction, the eight GH-264 output fields, prohibited raw-data classes, no current retention or transport, and the reviews required before any future producer. This repository gate does not implement or authorize endpoint collection or any runtime behavior, prove privacy/anonymity or the absence of a hidden sensor, grant response authority, or change production status.
| Token | Role | Details |
|---|---|---|
| KAS | Validator Staking | Kaspa native token. Specified: validators stake KAS (min 10,000) and are slashed on misbehavior. Staking and slashing are tested state machines; no operated network locks or slashes KAS today. |
| PROM | Planned Rewards & Governance | Tokenomics specify 0% pre-mine and 20M Year-1 emission; minting, emission, liquidity, and trading are not implemented, deployed, or active. |
Important: Validators stake KAS, never PROM. Planned primary PROM issuance rewards verified contributions; a planned KAS/PROM pool would permit secondary-market purchases after issuance. No ICO, presale, founder allocation, foundation allocation, or pre-mine exists in the specification. The predefined Year-1 split is Validators 40%, Guardians 30%, Reporters 20%, Dev Pool 5%, and Community 5%.
Guardian reputation is a separate canonical Kaspa L1 state in GuardianReputationState; it is not a PROM balance, badge, or NFT.
Sprint status labels are review-process labels: ACCEPTED means the sprint's scoped deliverable passed review, not that the component is production-ready. The descriptions state what each component actually is.
Audit remediation blocks A1–A8 (repository): the first repository remediation blocks from the community audit register #270, which remains open. A1–A8 and the fail-closed toolchain pin gate merged via PR #284 (exact main 3a79bfe; CI 36766270695, Security 36766270804, Pages 36766269974). The reviewed integration of dependency hash locking, compiled semantic gates, pinned CI actions and accessibility fixes merged via PR #285 (exact main e6d5464; CI 36769372160, Security 36769372493, Pages 36769371268). Contracts, H-001 evidence, tokenomics and production state are unchanged. The remaining PRM findings and pre-deployment gates stay open; there is no deployment or production claim.
Contract bundle v2 decisions (MS-B, #276): a proposed draft on reviewed worker branches, not merged.
- A closed bundle registry keeps v2 non-promotable, and the Rust deployer still pins only the H-001 v1 manifest.
- D5 instance binding adds an offline covenant-id calculation and observed-only evidence candidates; the acceptance gate stays closed.
- The independent security review of
61549b1completed with changes requested. The bounded C2 documentation/runtime follow-up passed on worker head3e94ce0: CI37988100086, Security37988101662, including all four new boundary cases and 109 runtime tests. This follow-up is not merged; full contract/security acceptance remains open. - There is no deployment, chain action or production claim.
GH-216 local binary evidence: Merged and exact-main-verified GH-216/PR #217 at 13c1812 adds a test-only real-prometheus-client loopback E2E harness for offline/connected preflight, private checkpoint commit, SIGTERM/SIGINT drain, restart exact replay, rollback/equivocation rejection, and malformed, timed-out, or disconnected peers. CI 31978132036, Security 31978132044, and Pages 31978131647 pass. This is local Development evidence only, not public Testnet operation, independent RPC/IPFS truth or availability, deployment, Mainnet, or production readiness.
GH-226 Light Client v1 ThreatHint submission (Development-only): The real prometheus-client binary now reuses the existing Guardian P2P stack to send one exact canonical v1 ThreatHint over a single owner-configured literal-loopback QUIC route. Strict private files, an offline non-mutating preflight, persistent owner-only transport identity, a 1–60 second bound, redacted JSON, and accepted/duplicate/rejected/busy/transport-failure mapping are tested against a real same-host Guardian library and owner-only mock verifier. PR #227 merged as exact main 6c39af5; Prometheus CI 32675287618, Security Audit 32675287530, and Pages 32675287300 pass. Beta and Mainnet reject before network activity. This is repository and same-host engineering evidence only: it adds no proof generation or proof authority, reporter membership, discovery, relay, retry, public/multi-host operation, wallet, chain write, reward, deployment, or production readiness.
GH-229 controlled distinct-host evidence (Development/Testnet-10 only): Merged PR #230, exact main fba8bb4, preserves loopback as the default and adds one explicit controlled-remote-testnet10 route for a single canonical direct literal-IP/UDP/QUIC-v1 Guardian peer. Unsafe, mapped, reserved, DNS, TCP, relay and mismatched routes fail closed; Beta and Mainnet still reject before identity mutation or networking. At 2026-08-26T23:36:04Z (2026-08-27 operator-local), one operator-attested run from source commit 27e8b02 delivered one canonical hint between two distinct controlled hosts: sender and Guardian both recorded non-authorizing rejected, with zero retries, no persistence and acknowledgement authority none. The temporary sender-restricted UDP rule was removed immediately; no listener or public service remains. The redacted evidence record does not independently prove host separation and does not establish public networking, relay/v2 operation, proof or membership authority, deployment, Mainnet or production readiness.
GH-234 Light Client ThreatHint-v2 submission (Development/Testnet-10 only): Merged and exact-main-verified GH-234/PR #235, code commit b450740, exact main f146fb2, adds one separate one-shot sender for an owner-prepared canonical ThreatHintV2TransportPayload. The client parses the shared proof-envelope, Observable Bundle, approval-shape and report-nonce framing against separately trusted testnet-10 before identity or network activity, then sends exactly once over /prometheus/threat-hint/2.0.0. Owner-only files, offline preflight, accepted/rejected/busy/transport-failure mapping, redacted output, Beta/Mainnet rejection and v1 regression are covered locally, including a real same-host binary/QUIC/Guardian test. Exact-main CI 33272578070, Security Audit 33272577951, and Pages 33272577407 pass. This verifies a repository development boundary only: the client does not generate proofs, verify approval authority, establish membership, run models/YARA, retry or persist, and it adds no public multi-host, wallet, chain, reward, deployment, Mainnet or production claim.
GH-238 controlled distinct-host ThreatHint-v2 preparation (repository-only): Merged and exact-main-verified GH-238/PR #239, exact main 912d96d, implements and locally tests repository-only preparation for one later controlled distinct-host Development/Testnet-10 ThreatHint-v2 attempt. The tooling uses challenge-bound, role-specific operator attestations over the source commit, the actual executable digest, the exact canonical payload digest, the exact v2 protocol, one shared observed UTC time, the actual rejected status, one attempt, zero retries and no persistence, with strict owner-only/no-symlink files, the exact 9,265-byte Rust wire bound, atomic no-clobber record output, a closed redacted verifier and CI test wiring. Exact-main CI 33279351831, Security Audit 33279351822, and Pages 33279351387 pass. No real GH-238 remote run has occurred and no GH-238 evidence record exists; host separation is not independently proven. This repository preparation is not a deployment or remote demonstration and adds no port, firewall, host, IAM, wallet, chain, deployment, Mainnet or production action or authority; a later real run requires separate explicit authorization.
GH-135 merged and exact-main verified — model-confidence hardening: the local YARA path now obtains source
confidence through a separate bounded model call and accepts exactly one
closed JSON object containing integer confidence_bps in 0..10000.
Malformed completion envelopes, duplicate or extra keys, non-integer values,
and out-of-range values fail closed. Indicator count and YARA text shape no
longer set confidence, and accepted basis points reach ensemble commitments
without a float round trip. This is strict format validation, not proof of
semantic quality or calibration; live model operation, adversarial evaluation,
calibration, and production authority remain open.
Protected PR #136 merged without bypass as exact main 3ff3fa1; Prometheus CI
30694395348, Security Audit 30694395356, and Pages 30694394857 pass on
that SHA.
GH-138 merged and exact-main verified — deterministic confidence
evaluation: a standalone offline Guardian evaluator consumes a canonical
24-case synthetic YARA benchmark, exact integer-bps predictions, a fixed
development policy, and a
co-versioned SHA-256 consistency manifest. It reproduces a byte-exact report with the unchanged 8500-bps
decision boundary, confusion matrix, exact-ratio precision/recall, Brier score,
and ten-bin expected calibration error. Missing, duplicate, reordered,
noncanonical, weakened-policy, or internally hash-inconsistent evidence fails
closed. The manifest detects accidental or partial fixture drift inside one
reviewed revision. It is neither signed nor externally anchored, so it does
not provide independent tamper evidence. CI
evidence is explicitly synthetic_ci_only with production_authorized=false;
it validates the evaluation machinery, not live-model quality, production
calibration, or authorization.
Protected PR #139 merged normally without bypass as exact main 52209cc;
Prometheus CI 30697333650, Security Audit 30697333643, and Pages
30697333307 pass on that SHA.
GH-141 local model candidate evidence (merged and exact-main verified): the
Guardian can run the same canonical benchmark through an explicitly
literal-loopback vLLM service,
capture one validated integer-bps prediction per case, and write canonical
owner-only JSONL without overwrite or partial output. The evidence binds the
exact corpus, a public served-model identifier, a caller-supplied model
artifact SHA-256, and the repository-pinned prompt specification. A separate
offline --candidate evaluator emits exact metrics as
local_model_candidate_only with production_authorized=false. Environment
proxies and arbitrary endpoint URLs are excluded. This is machinery for a
future real run, not evidence that one occurred: artifact provenance,
semantic/adversarial quality, prompt-injection robustness, production
calibration, and authorization remain open.
GH-161 local model artifact provenance (merged and exact-main verified): the preferred candidate-capture mode now derives its artifact digest from a canonical manifest of exact bytes in one bounded trusted-owner local model directory. Descriptor-relative traversal rejects a symlink root plus symlink, writable, special, linked, aliased, oversized, or mid-scan-mutated tree entries, and capture re-hashes the directory before constructing the local model adapter. The caller-supplied digest remains only as explicit legacy compatibility. This proves local disk-byte consistency, not upstream authenticity, model approval, live served-model identity, semantic quality, calibration, or production authority.
Protected PR #162 squash-merged normally as exact main d468426; Prometheus
CI 31340112225, Security Audit 31340112204, and Pages 31340111625 pass on
that SHA.
Protected PR #142 squash-merged normally without bypass as exact main
bf3f74f; Prometheus CI 30727224584, Security Audit 30727224572, and Pages
30727224235 pass on that SHA.
GH-144 Guardian vLLM runtime hardening (merged and exact-main verified): the Compose boundary pins the official vLLM release by tag and registry digest, publishes only literal-loopback ports, forces local offline model resolution, and separates the public served-model identifier from read-only caller-provisioned weights. The 8B default and opt-in 70B profile run non-root with no added capabilities, no-new-privileges, an internal network, bounded resources, and a repository-owned structured gate. This work does not pull an image or model, run inference, prove model-artifact provenance or quality, calibrate a model, or grant production authority.
Protected PR #145 squash-merged normally without bypass as exact main
95d05cc; Prometheus CI 30858991436, Security Audit 30858991557, and
GitHub Pages 30858990507 pass on that SHA.
GH-147 canonical Guardian membership source (merged and exact-main
verified): one exact schema-v1, network-bound and epoch-labelled JSON
document now binds 5–1024
sorted unique Guardian IDs one-to-one to structurally valid public BIP340
x-only keys, the fixed 8b tier, and model-artifact digests. Its raw-byte
SHA-256 derives the existing MembershipSnapshot, while the same validated
members derive the existing BallotSigner bindings. Parsing rejects duplicate,
missing, extra, reordered, malformed, noncanonical, shared-key, and wrong-network
input; loading is POSIX-only through an owner-only, no-symlink, bounded,
descriptor-verified file boundary. This proves local structural and assignment
consistency only. It does not establish who may author the source, key ownership
or rotation, Sybil resistance, multi-host operation, on-chain attestation,
signing capability, or production authority.
Protected PR #148 passed all eleven final contexts with all review threads
resolved and squash-merged normally without bypass as exact main aeecffb.
Prometheus CI 30863940497, Security Audit 30863940502, and GitHub Pages
30863940053 pass on that SHA.
GH-242 membership-bound ballot session establishment (merged and exact-main
verified): the operated local BallotIngress API no longer accepts a
caller-constructed committee context. It owner-loads one canonical GH-147
source exactly once, checks a separately trusted network plus expected epoch,
derives the membership snapshot and public BIP340 signer map internally, and
registers the unchanged signed-ballot session. Direct BallotContext
construction and the former public arbitrary registration path are disabled;
all establishment failures use one data-minimal error. The epoch is only an
operator-pinned committee identity, not time, finality, rotation, source or
chain authority. This closes a local caller-assertion gap only: external source
authority, key ownership/rotation, Sybil resistance, multi-host operation,
on-chain attestation and production trust remain open.
Protected PR #243 merged normally as exact main
5cb132c670d1e7771ccaf6dab2ddf5b1a6fd905a. Prometheus CI 33433012614,
Security Audit 33433012605, and GitHub Pages 33433011653 pass on that SHA.
GH-246 signed Guardian membership continuity (merged and exact-main
verified): one exact owner-only policy pins the network, a public
BIP340 authority key, the bootstrap epoch/source digest, and a private SQLite
ledger. Canonical signed transitions bind the exact previous and next source
digests, strictly advancing epoch, validity window, and nonce. The ledger
atomically stores accepted source bytes and durable clock/epoch/replay
high-water state; rollback, same-epoch equivocation, replay, source
substitution, restart, and concurrent duplicates fail closed. BallotIngress
now requires this authority and derives each new session from the stored
current source while the same ledger lock is held. Existing bounded sessions
remain unchanged. This is public-signature verification and owner-local
continuity only: the repository includes no signer/private-key path and proves
no external or decentralized membership authority, key ownership/rotation,
Sybil resistance, L1 attestation, multi-host operation, deployment, or
production trust. PR #247 squash-merged normally as exact main
f12e821bb492caae3b94e5b3c882488eb7f2982d; CI 33452085421, Security Audit
33452085419, and Pages 33452084065 pass on that SHA.
GH-253 Guardian transition-authority rotation (merged and exact-main verified):
the owner-only continuity ledger now accepts an exact canonical rotation only
when the durable current authority authorizes succession and the proposed
public key independently proves possession under a separate BIP340 digest
domain. Rotation binds the current membership identity, a gapless authority
epoch, bounded validity and nonce, advances durable key/history/clock state in
one transaction, rejects replay and historic key reuse, and makes later
membership transitions verify only against the durable current key. Exact
schema-v1 ledgers migrate transactionally to schema v2 or fail closed
unchanged. The repository exposes no signer/private-key path. This proves
owner-local cryptographic succession consistency only, not real-world key
ownership, external or decentralized authority, Sybil resistance, L1
attestation, deployment, or production trust. PR #254 squash-merged normally as
exact main 5920cb4bb737376977f762beb0d5e3108519c7a0; Prometheus CI
34031999904, Security Audit 34031999907, and Pages 34031999575 pass on
that SHA.
GH-103 merged and exact-main verified — local ELF import extraction: the Rust Threat Observable boundary can derive one checked api_import from exact caller-supplied Linux ELF bytes. It uses the pinned read-only object parser, accepts no path, import string, platform, format, or generic observable value, and derives linux/elf internally. Inputs are capped at 16 MiB and 4096 dynamic symbols; names must match the existing closed ASCII grammar, are byte-sorted and deduplicated, and one checked index is selected. Every result is local-only review_required_v1, with shared exact-byte vectors independently parsed by Python. This neither proves external artifact provenance nor authorizes disclosure, transport, proof acceptance, analysis, or publication.
GH-121 merged and exact-main verified — Windows PE import extraction: the same isolated boundary derives one checked api_import from exact caller-supplied PE32 or PE32+ bytes. It fixes scope to windows/pe, caps input at 16 MiB, 4096 import descriptors, and 4096 thunk entries, rejects ordinal or grammar-invalid imports, and byte-sorts/deduplicates named functions before selection. Rust exercises both PE architectures and Python independently parses the synthetic shared PE32+ vector. Library names never become observables, every result remains local-only review_required_v1, and no path/string/generic, transport, proof, analyzer, wallet, chain, or promotion API is added. Protected PR #122 is merged as exact-main 2e3e1e1; CI, Security, and Pages pass on that SHA.
GH-107 merged and exact-main verified — local Observable Approval verification: Rust and Python verify the same canonical, short-lived BIP340 statement for one exact review_required_v1 bundle against a separately trusted approver key, recipient-scope digest, network, report nonce, and separately trusted current time that must never be attacker-controlled. The verifier recomputes the observable commitment, enforces a maximum one-hour inclusive validity window, and returns a deterministic approval ID. It contains no signer and performs no transport, persistence, promotion, disclosure, analysis, proof, wallet, or chain action. The signed nonce and approval ID identify repeats but do not prevent replay; durable one-time consumption and authority/policy management remain mandatory promotion gates.
GH-111 merged and exact-main verified — local durable Observable Approval consumption: Guardian Node now loads one exact network/approver-key/recipient-scope tuple from an owner-only policy file, invokes the GH-107 verifier itself, and atomically records both the approval ID and authority-bound nonce in a separate owner-only SQLite ledger. Persistent clock high-water, full synchronous transactions, restart/concurrency handling, and closed busy/replay failures prevent local reuse without trusting a caller-supplied verified object. This is only a local consumption receipt: key ownership/rotation, recipient-scope semantics, hint/bundle pairing, privacy approval, transport, analyzer invocation, promotion, outbox delivery, wallet, and chain effects remain outside the implementation.
Merged and exact-main-verified GH-114 local canonical ThreatHint v2 statement: separate Rust and Python parsers now accept only one exact 1024-byte-bounded canonical statement shape with distinct artifact hash and observable commitment plus confidence, structural disclosure class, report nonce, observed time, and a network that must equal separately trusted local context. One shared byte-exact corpus fixes field order, scalar bounds, invalid forms, and the domain-separated statement digest. This boundary performs structural binding only: it does not prove artifact derivation, truth, maliciousness, privacy safety, approval, anonymity, proof validity, or replay prevention, and it is not connected to v1, transport, proof acceptance, pairing, analyzer, outbox, wallet, or chain behavior.
Merged and exact-main-verified GH-117 ThreatHint v2 proof binding (not production-deployed): Rust and Python now share strict canonical parsers for a bounded opaque-proof envelope and a 19-field RelationManifest-v2, plus one atomic data-only binding that requires a separately trusted network and raw-manifest SHA-256 before either object can be paired. The binding reparses both wires, closes protocol/relation/network/domain/public-input identities, and derives two claimed 16-byte big-endian digest halves. It does not verify Groth16, load or approve relation/key artifacts, authorize disclosure, connect transport or analysis, or establish rollout readiness.
Merged and exact-main-verified GH-117 ThreatHint v2 Groth16 verifier (not production-deployed): prometheus-threat-proof verify-v2 owner-loads one canonical manifest plus fixed sibling relation-source.bin and verifying-key.bin files, binds every size/SHA-256 anchor, requires canonical compressed BN254 keys/proofs and exactly two public inputs, and verifies only the inputs derived by the existing v2 binding. It never resolves or loads a proving key and emits only silent exit status. Its deterministic keys, proofs, and equality relation are test-only. No production relation, verifying/proving key, ceremony approval, privacy authority, approval consumption, transport, analysis, chain action, or rollout evidence is supplied.
Merged and exact-main-verified GH-117 ThreatHint v2 privacy/proof preflight (not production-deployed): Guardian Node now has a separate owner-only, read-only policy that pins the network, BIP340 approval key, opaque recipient scope, and exact raw-manifest SHA-256. One Python call binds the envelope/manifest, derives the statement only from that envelope, recomputes the review-required bundle commitment, and verifies the short-lived approval against the same network and trusted report nonce. It returns only data hashes and IDs. It does not verify the opaque Groth16 proof, consume the approval, open or migrate SQLite, authorize disclosure or privacy, or trigger transport, analysis, promotion, wallet, chain, or rollout behavior. Durable acceptance remains blocked until approved v2 proof verification runs in the same trusted call path before the final atomic ledger write.
Merged and exact-main-verified GH-117 ThreatHint v2 verified-preflight composition (not production-deployed): Guardian Node now also has one owner-configured, executable-SHA-pinned, POSIX-only service that reads the exact policy-anchored manifest, runs the existing approval/privacy preflight first, and then sends the same exact envelope bytes to the silent Rust verify-v2 process. The child uses an absolute executable, closed argument set, scrubbed environment, bounded timeout, process-group cleanup, and fail-closed exit mapping; concurrent calls on one service instance fail closed. The returned receipt is non-constructible, non-serializable data only. This layer deliberately opens no SQLite file and consumes no approval; the separate merged atomic-acceptance boundary below adds that final mechanical step. Neither layer approves production artifacts or grants privacy/disclosure, transport, analysis, promotion, wallet, chain, or rollout authority.
Merged and exact-main-verified GH-117 ThreatHint v2 atomic acceptance (not production-deployed): one raw-input-only Guardian service now proves exact preflight/consumption network, approver-key, and recipient-scope identity before opening the ledger, runs the verified proof/privacy preflight first, and re-verifies the approval ID and observable commitment before the existing durable SQLite consumption runs as the final state-changing step. Invalid, unavailable, replay, and busy outcomes remain stable and redacted; failed proof or privacy checks never consume an approval or advance ledger time. The receipt is non-constructible and non-serializable data only. This closes the local mechanical verify-plus-consume path, but it does not approve production relation/key/ceremony artifacts, privacy promotion, transport, actionable analysis, signing, chain activity, or rollout.
Merged and exact-main-verified GH-117 ThreatHint v2 owner-policy promotion (not production-deployed): one raw-input-only Guardian boundary now owner-loads a separate exact-schema promotion policy, requires review_required_v1, exact platform and format, an allowed observable-kind set, and a maximum count before the same original envelope, bundle, and approval bytes may enter atomic acceptance. Check-to-open policy races are bounded with O_NOFOLLOW, descriptor identity/mode/size checks, and a capped read. Rejected promotion never invokes the proof verifier or changes approval-consumption count or ledger high-water. Success returns only a frozen, non-constructible, non-serializable local result containing accepted IDs/time, pinned scope, and canonical observable string pairs. This closes local mechanical pairing and owner-policy restriction only; it is not semantic per-kind privacy review, authority/key governance, production artifact approval, transport, analysis, publication, an external effect, or rollout evidence.
Merged and exact-main-verified GH-117 outbox retention governance (not production-deployed): a pure read-only Guardian loader now requires one owner-only exact-schema policy bound to the expected network, approver key, and recipient scope. It fixes the local-only retention purpose, canonical Observable Bundle payload form, a default-deny durable-kind allowlist, at most 100,000 pending records, and at most 30 days of retention. The policy records that file hashes remain corpus-matchable, API imports fingerprint software capabilities, and byte patterns may retain proprietary content. The loader itself creates no database or outbox row and proves no key ownership, recipient authorization, extractor provenance, or privacy safety; the governed promotion composition below is the only local boundary allowed to use this policy for durable enqueue.
Merged and exact-main-verified GH-117 ThreatHint v2 enforceable governance (not production-deployed): one owner-only policy now binds the exact network, approver key, recipient scope, authority epoch and inclusive validity window, fixed same-Guardian local-analysis purpose/boundary, denied external disclosure, and one explicit deny-or-kind-specific-risk decision for every closed observable kind. Promotion, governance, and retention allowed-kind sets must be exactly equal before the ledger opens. The first valid governed acceptance atomically pins all three exact raw policy digests plus authority identity/window; a higher epoch advances only with a valid signed approval in the same BEGIN IMMEDIATE transaction as replay high-water and consumption. Lower epochs, same-epoch policy equivocation, overlapping same-identity windows, hidden legacy authority state, replay, and failed inserts are fail-closed. This closes local policy enforcement only and grants no analyzer execution, transport, disclosure, publication, chain action, or production relation/key/ceremony approval.
Merged and exact-main-verified GH-117 ThreatHint v2 durable analysis substrate (not production-deployed): governed schema v4 stores the canonical statement, its digest, trusted report nonce, Observable Bundle, approval binding, and retention in the same BEGIN IMMEDIATE transaction as authority state, replay high-water, and approval consumption. Claims revalidate every network/nonce/commitment binding and derive a lease-bound input identity. Atomic complete(...) persists one canonical explicitly non-actionable result before deleting the outbox row; exact post-commit retries are idempotent, while stale leases or changed inputs, tokens, results, and retention fail closed. Empty schema-v3 queues migrate; nonempty v3 queues remain unchanged and fail closed because their missing statement/nonce cannot be reconstructed. The included bounded worker uses only a deterministic test analyzer: no LLM, YARA, confidence, should_submit, transport, publication, wallet, chain, deployment, or external effect.
Merged and exact-main-verified GH-152 governed ThreatHint v2 identity hardening (not production-deployed): schema v5 permanently records the exact statement digest, approval ID, and observable commitment as a database-enforced one-to-one-to-one pairing in the same atomic promotion transaction. Reusing any member with a fresh counterpart is a closed replay even after outbox or result retention. A v4 ledger migrates only when its outbox and result tables are empty; authority, replay high-water, and approval-consumption state are preserved. Any retained v4 outbox or result row remains unchanged and fails closed. Legacy and governed non-outbox consumption keep their prior behavior. PR #153 published exact main 3d203aa; Prometheus CI 31306353671, Security Audit 31306353670, and Pages 31306353328 pass. This adds no proof authority, analyzer output, transport, disclosure, wallet, chain, reward, deployment, or production effect.
Merged and exact-main-verified GH-167 bounded ThreatHint v2 transport substrate (not production-deployed): Rust and Python now share one exact canonical transport frame and valid/invalid corpus for the v2 proof-envelope, Observable Bundle, approval wire, and untrusted report-nonce lookup key. The independent /prometheus/threat-hint/2.0.0 libp2p channel reparses every inbound frame against an explicitly trusted local network before owner-only IPC. The Python ingress reparses again, resolves the nonce only through trusted active-session state, obtains trusted time locally, and then calls the existing governed promotion boundary with the original wires. Global request/stream budgets, strict accepted/rejected/busy acknowledgements, adversarial tests, and real separate-process same-host delivery evidence are included. PR #168 published exact main 7c62608; Prometheus CI 31645624623, Security Audit 31645624601, and Pages 31645623547 pass. This closes the repository transport substrate only: it does not approve production relation/key/ceremony artifacts, authorize semantic/actionable analysis or disclosure, run LLM/YARA, prove public multi-host operation, or perform wallet, chain, reward, deployment, or external effects.
GH-170 merged and exact-main verified - bounded YARA-X validation (not production-deployed): Guardian candidate rules now pass a real compile-only yara-x==1.4.0 boundary instead of substring checks. The in-memory validator accepts exactly one bounded ASCII rule, disables includes, rejects imports, multiple rules, compiler errors and warnings, and never scans a file, process, or data buffer. PR #171 published exact main 8d8e29c; Prometheus CI 31650123073, Security Audit 31650123055, and Pages 31650122593 pass. This is structural syntax hardening only; it does not establish semantic detection quality, invoke a model, make a rule actionable, publish or submit anything, or grant production authority.
GH-173 merged and exact-main verified - deterministic non-actionable semantic draft (not production-deployed): The governed v2 worker can deterministically map already approved local api_import and byte_pattern observables into one bounded memory-only YARA draft, compile-check it through the GH-170 boundary, and atomically retain only exact input bindings, per-kind counts, a nonce-bound candidate-binding SHA-256, and the compile verdict. file_sha256 values are counted but never embedded, existing v1 results remain readable, and no rule source, model output, confidence, should_submit, scan, disclosure, publication, wallet, chain, reward, or deployment effect is stored or triggered. PR #174 published exact main 1107b11; Prometheus CI 31654308969, Security Audit 31654308964, and Pages 31654308875 pass. This does not establish semantic quality, actionable analysis, model calibration, or production authority and does not change rollout estimates.
GH-177 merged and exact-main verified - isolated synthetic YARA semantic-quality gate (not production-deployed): A standalone offline evaluator compiles one fixed GH-173-shaped synthetic rule with pinned yara-x==1.4.0 and scans only 20 bounded, deterministically generated in-memory buffers. Its canonical report binds the exact corpus, policy, evaluator bytes, engine version, rule digest, confusion counts, and precision/recall/specificity; the committed baseline is 10 true positives, 10 true negatives, and zero false results under a strict 100% development gate. Authority is fixed to none. The module is not imported by worker, outbox, result, model, transport, submission, wallet, chain, reward, or deployment paths. This is not real-world semantic quality, actionable analysis, calibration, certification, or production authority. PR #178 merged as exact main 396d347; CI, Security Audit, and Pages pass on that SHA. Rollout estimates are unchanged.
GH-180 merged and exact-main verified - deterministic offline ThreatHint-v2 pipeline integration gate (not production-deployed): Eight POSIX-only integration tests drive canonical synthetic transport bytes through the real Python ingress, governed promotion, schema-v5 atomic acceptance/outbox, bounded worker, and durable GH-173 non-actionable semantic-draft result. They prove exact statement, approval, observable, nonce, candidate, and result bindings plus fail-closed malformed/oversized input, replay/restart, duplicate concurrency, lease recovery, redacted analyzer failure, and transactional completion rollback. The gate composes existing production classes but adds no product runtime or authority path, and GH-177 remains structurally unwired from the pipeline. Local evidence includes 171 adjacent tests; 1303 Guardian tests passed and 4 intentional live-model tests skipped. PR #181 merged as exact main a28ad00; Prometheus CI 31662874366, Security Audit 31662874399, and Pages 31662873670 pass on that SHA. No real sample, network service, model, scan, disclosure, submission, wallet, chain, reward, deployment, actionable authority, or production certification is involved. Rollout estimates are unchanged.
GH-155 merged and exact-main verified - Guardian sidecar test reliability: process integration tests now serialize shared process cases, retain bounded diagnostics, coordinate collector EOF/ACK shutdown, reserve the relay port until spawn, and deterministically kill and reap a real child on timeout. PR #156 published exact main db33f56; Prometheus CI 31308756777, Security Audit 31308756786, and Pages 31308756387 pass after focused tests, 20 consecutive stress runs, full local gates, and independent review. This changes test infrastructure only and does not advance H-001, core-rollout, protocol, or production readiness.
Current public status (reviewed 2026-09-13; immutable audit baseline 2026-08-14): Exact audit-base main 5cd13bf and its CI/Security/Pages runs pass; later exact-main updates through GH-253 plus the planned GH-258/GH-261 safety track are recorded in this README and the machine-readable post-audit ledger. The isolated H-001 Testnet-10 canary is complete and independently evidenced, GH-167 closes only the bounded repository ThreatHint-v2 transport substrate, and GH-253 proves only owner-local dual-signed transition-authority succession. GH-258 and GH-261 are planning, not endpoint implementation, unauthorized-compute detection, or response authority. No Prometheus protocol component is proven production-deployed. Production proof/artifact approval, privacy-reviewed semantic/actionable analysis, operated multi-host transport, external or decentralized membership authority, remaining deployments, oracle evidence, PROM emission, and release gates remain open.
Deployment status: Prometheus is in post-Toccata rollout verification. All seven current-Silverc fixture compile/ABI/runtime gates pass through the pinned compiler, and the deterministic release archive, keyless genesis request set, request verifier, operation procedure, receipt/evidence guards, handoff auditor, metrics-oracle handoff, and exact-commit release-hardening gates are implemented. Deployment requests carry one of two closed profiles bound to the exact release manifest: full selects all seven release fixtures and requires the public metrics-oracle key; testnet-10-validator-staking-h001 selects only ValidatorStakingH001, requires the TLS-only official Testnet-10 resolver, omits the oracle key, and emits canary-only statuses that cannot satisfy full rollout or metrics readiness. On 2026-08-12 the H-001 signature was imported and fully verified, the exact acknowledged transaction was submitted once, and its covenant output was confirmed by the request-bound node and the independent Testnet-10 REST API. Transaction c85fd1e79607370ff63faabbc3158e011158d2bde1af40d4eecd642189d8c22f created instance :0 with covenant ID 8cdb49adc2511ed5fa11f71317b66f203f37ce376a2603cd9b118236c1f8219f; the public operator_record and evidence verifiers pass. See the confirmed canary evidence. No signature or raw transaction is published. Full rollout remains gated by the other six state deployments, real oracle/sponsor inputs and signatures plus successor evidence, production proof/relation approval and independent review, operated multi-host protocol evidence, and exact-commit release hardening.
Internal engineering estimate (confirmed unchanged 2026-09-13): the isolated H-001 Testnet-10 canary work item is complete. The rollout-capable core is estimated at 84–88% and the complete roadmap vision at 50–55%. GH-258/GH-261 add planned scope but no completed capability, so the estimates do not advance. These are internal, scope-weighted engineering estimates, not evidence of production readiness, calendar progress, network decentralization, or release timing. The 2026-08-14 claim-audit baseline lists the remaining evidence gates.
Covenant genesis operator: prometheus-silverc-deployer implements the official SilverScript genesis shape with Kaspa transaction version 1, compute budget 10, the exact contextual storage_mass commitment, P2SH from the compiled contract script, covenant-ID derivation from the funding outpoint plus the unbound genesis output, and funding-input binding only after the ID is derived. It verifies the exact live unspent funding UTXO during preflight and again immediately before broadcast, models the final 66-byte Schnorr signature script, and binds compute, transient, storage, normalized relay/overall mass, plus pinned relay and conservative operator fee floors into signing-request schema v2 before exporting a 32-byte sighash. A canonical import-signature path accepts only a public 64-byte BIP340 signature as 128 lowercase hex characters, derives every response field from the validated request, rejects normalized input/output path collisions, and writes output only after BIP340 plus complete Kaspa transaction verification. It persists an exclusive crash-recovery intent before submission, reconciles retries by transaction ID, applies per-request wRPC deadlines, and rebuilds the verified transaction before observing its exact covenant UTXO. The CLI has no private-key, seed, wallet, keystore, or raw-transaction input. Fifty unit/security tests, including eleven focused metrics-transition tests and exact-ID typed/remote mempool-absence classification, cover deterministic public vectors, fee/mass and profile tamper rejection, secret-field rejection, resolver/TLS fail-closed behavior, signature-import failure/collision guards, journal recovery, and public-file handoff roundtrips. Pinned v2.0.1 supports testnet-10; public resolver mode is TLS-only and restricted to testnet-10, while testnet-12 and non-Toccata simnet fail closed. See the operator runbook.
Metrics state-transition operator: the same binary now exposes report-metrics-preflight, report-metrics-prepare, report-metrics-import-signatures, report-metrics-broadcast, and report-metrics-observe. A closed transition spec binds the exact predecessor state/outpoint/covenant, pinned source and compiler commit, public metrics request, separate P2PK fee-sponsor UTXO, fee bounds, and canonical hash. The operator recompiles predecessor and successor states, preserves the covenant value exactly, derives both SIG_HASH_ALL digests, commits compute and contextual storage mass, requires external oracle and sponsor signatures, executes both inputs with TxScriptEngine, and revalidates both live UTXOs immediately before a journaled one-shot broadcast. Eleven focused tests cover value preservation, both valid and invalid signers, predecessor-state mismatch, sponsor underflow, request tamper, path collisions, acknowledgement, recorded-result recovery, and pre-network tamper rejection. No wallet or private-key input exists.
Release governance: main is PR-only with strict up-to-date branches, linear history, resolved conversations, ten required CI/Security checks (including the optimized Rust Performance gate), admin enforcement, and blocked force pushes/deletion. While the repository has only one collaborator, formal approvals are set to zero because GitHub does not permit self-approval; the required approval count returns to one when a second collaborator is added.
- Whitepaper v4 — Full technical specification
- Audit Log — Public repository audit history
- Architecture Decisions — 15 binding decisions
- Sprint Planning — Detailed roadmap
MIT licensed. The specification assigns no founder or foundation token allocation. Repository openness does not prove decentralized operation; current operator and trust assumptions are documented above.
Prometheus — The fire belongs to humanity, not to corporations.