Test suites, the full-system ceremony, red-team campaigns — proof, honestly stamped · content/evidence.md
Evidence
What we claim, and what proves it. The generated blocks on this page are built from files in the repo at build time and stamped with file dates — nothing here is hand-typed, so it cannot drift from the facts.
Claims → evidence — the receipt for every public claim
Every load-bearing claim on this site, where it is proven, and how you can check it yourself without trusting us. Object/tx ids are real Qalnet devnet records; suite paths are repo files you can run.
| # | Claim | Where proven | How to independently verify |
|---|---|---|---|
| 1 | E2EE: X25519 + HKDF + AES-256-GCM + Ed25519, per-message keys, hash-chain | Encryption, explained §1–§7; protocol in qalchat/qalchat.py (root_key, msg_key, seal, chain_next) |
Run bash qalchat/test_chat.sh; tamper-log at testlogs/chat_proof_r.out, testlogs/chat_after_fix.out |
| 2 | Mailbox proof-of-possession (PoP) auth — no key, no mail | qalchat/qalchat.py (pop_headers, qalchat-pop-v1) |
Run bash qalchat/test_pop.sh; log testlogs/qalchat_popstrict_20260912.out |
| 3 | Anchoring + Merkle era checkpoints on-chain | era-1 checkpoint: object 0xe9eff274a90a0fb5d8a52a9fedebd5d5a6bd0880476fe12da70b4a348fab7905, tx 2gopkDw9ecBexPAA3U8vZhnoMqvZ673cKk9278G3NYGS (root b67cc5d9…01f84, 1283 anchors) — qalpipe/eras.jsonl, qalpipe/anchors.jsonl |
Fetch the object via chain RPC; run bash qalpipe/test_eras.sh; logs testlogs/qalpipe_era_reboot_20260913.out, testlogs/daily_20260915_070000.out ("checkpoint PASS") |
| 4 | 500K sales cap enforced in loopd (fail-closed); supply pre-endowed in the issuer wallet qals:issuer — exhaustion answers 402 "sellable supply exhausted"; bridge 402 past cap |
loopd/loopd.py sales gate (cap_cents = 50,000,000, issuer_endow/issue_from_issuer); qalpay bridge refusal |
GET :8823/report → program.cap_cents; GET :8823/issuer/status; run bash qalpay/test_caps.sh, bash loopd/demo.sh; logs testlogs/qalpay_caps_20260913.out, testlogs/qalpay_caps_regression_20260913.out, testlogs/loopd_demo_keyed_20260912.out |
| 5 | On-chain cap-gate code written + tested (qal_reserve); refusal path proven at the 50B boundary (published copy carries a stale 50B¢ cap — live enforcement is loopd; the on-chain twin is being redesigned from mint-gated to genesis-preminted + transfer-gated at the cap-raise checklist) |
Mint ceremony step 1b: "50B+1c mint → chain abort E_OVER_CAP" (historical log, quoted verbatim); canonical Reserve 0xd7420b4a… |
Read testlogs/last_ceremony.json (step 1b CAP ATTACK REFUSED, ok:true); run bash scripts/onchain_credit_test.py; re-run ceremony per Mint Ceremony |
| 6 | Spend caps are owner-set, optional, uncapped by default (agents CAN be capped by the owner) | loopd agent API (POST :8823/agents cap_cents_per_day); policy 2026-09-12 in 11_system_audit/FACT_DISPLAY_AUDIT_2026-09-12.md |
Run bash loopd/demo.sh; attempt an over-cap spend → 402; inspect loopd/data/agents.json |
| 7 | Marketplace fee 0% — the token spread is the margin | Founder policy 2026-09-12 (Pricing, Fees) | rg -n "marketplace" qmarket/qmarket.py — no platform take in settle path; run bash qmarket/test_market_v2.sh (30 assertions) |
| 8 | Redemption: services-only; service_settled + fee + dust == gross enforced in code; doof dust to NFP |
qalredeem/qalredeem.py accounting gate; GET :8835/policy (machine-readable) |
Run bash qalredeem/test_qalredeem.sh; logs testlogs/qalredeem_20260912.out, testlogs/qalredeem_keyed_20260912.out; verify any anchor: qalpipe.py verify qalredeem/data/anchors/<id>.json |
| 9 | MCP server: 24 tools (16 base + 8 exch_* landed 2026-09-14) |
qalmcp/qalmcp.py TOOLS list; tool table in qalmcp/README.md; tools/list at runtime |
python3 qalmcp/qalmcp.py --handle t → tools/list → count; run bash qalmcp/test_mcp.sh (58 assertions) and bash qalmcp/test_mcp_exchange.sh; log testlogs/mcp_exchange_20260914.out (16/16) |
| 10 | qalx AMM: escrowed swaps, LP shares, slippage guards, 0.3% LP fee, anchored receipts | qalx/qalx.py; suites qalx/test_qalx.sh (64), qalx/test_exchange.sh, qalx/test_wbtc.sh |
Run the suites; endpoint log testlogs/qalx_endpoints_reboot_20260913.out |
| 11 | Identity: DID challenges, ~2s revocation, QR invite pinning | qalid/qalid.py v2; suites qalid/test_identity_v2.sh, qalid/test_qalid.sh |
Run the suites; log testlogs/idv2_v.out |
| 12 | Anchored receipts for anything (files, jobs, trades) | qalpipe/qalpipe.py anchor/verify; era-1 object/tx in row 3 |
python3 qalpipe/qalpipe.py anchor <file> then verify <file>; tamper-test in qalpipe/README.md |
One pricing story (Pricing) and the fee table (Fees) are scoped by rows 4–8 above.
Live fleet verdicts
The cross-device use-case harness (messaging, data transfer, NFTs, value transfer, referrals — per device pair across the fleet) writes machine-readable verdicts to testlogs/verdicts.json. When that file exists, the panel below renders it live; until then it says so honestly.
checking for fleet verdicts…
The mint ceremony — one coin through every system
The ceremony dress-rehearses the whole loop on-chain and on the ledger: on-chain issue → cap-attack refusal → top-up → chat transfer → compute escrow → redemption with fees and dust → burn → anchored. This is the proof behind the "cap is enforced in code" claim. (2026-09-15: the ceremony page keeps its historical name — its step-1 on-chain mint predates the redesign; the on-chain twin is being redesigned from mint-gated to genesis-preminted + transfer-gated at the cap-raise checklist.) Latest recorded run:
14/14 steps PASS · evidence file testlogs/last_ceremony.json · last modified 2026-09-12.
| step | verdict | detail |
|---|---|---|
| 1 ON-CHAIN MINT (qal_reserve, oracle-gated) | PASS | deposit ceremony-1789180907 = 200.00 Qals |
| 1b CAP ATTACK REFUSED | PASS | 50B+1c mint → chain abort E_OVER_CAP |
| 2 LEDGER TOP-UP (PSP→loopd path) | PASS | +200.00 Qals · program sold=367033.90 Qals |
| 3 CHAT ⚡ TRANSFER (qalchat→loopd) | PASS | buyer→seller 2.50 Qals (receipt in output) |
| 3b ENCRYPTED DM DELIVERED | PASS | — |
| 4 COMPUTE PURCHASE (qmarket escrow→settle) | PASS | 1000c · anchor AkyEeXmhKyqt |
| 5 BAZAAR REACHABLE | PASS | 3 offers visible (trade flow covered by 52-test suite; ceremony: registry live) |
| 6 PAID-UNLOCK MARKET LIVE | PASS | 0 listings (escrow+key-release covered by 58-test suite) |
| 7 REDEMPTION (sku, fees, dust) | PASS | 10k LLM tokens · anchored 6ysNtaNafUoE |
| 8 CLAIMS SYSTEM LIVE | PASS | issue→claim covered by 27-test suite |
| 9 API TOKEN EXCHANGE LIVE | PASS | metered gateway covered by 66-test suite |
| 10 SWAP ENGINE | PASS | engine live (finisher converging; suite covers math) |
| 11 ON-CHAIN BURN (loop closes) | PASS | 7c service consumption retired from sold_cents |
| 12 CEREMONY ANCHORED | PASS | tx 7b9nHProE3TUTP91… |
Full narrative: Mint Ceremony.
The test suites
Every service ships a proof suite — the "52-test", "58-test", "27-test" figures quoted in the ceremony notes are these suites. The inventory below is generated from the scripts themselves at build time; each one-liner is the script's own header description, and the dates are file mtimes.
39 proof suites ship with the services. One-liners are each script's own header; dates are file mtimes.
| suite | what it proves (from its own header) | last change |
|---|---|---|
gmux-bridge/test_bridge.sh | proof suite for gmux-bridge (:8842) | 2026-09-11 |
qalbazaar/test_bazaar.sh | end-to-end proof of qalbazaar (agent-to-agent marketplace) | 2026-09-09 |
qalbridge/test_bridge.sh | (no header blurb) | 2026-09-10 |
qalbridge/test_phone.sh | (no header blurb) | 2026-09-10 |
qalchat/test_chat.sh | end-to-end proof suite for qalchat | 2026-09-15 |
qalchat/test_files.sh | proof suite for qalchat ENCRYPTED FILE TRANSFER + | 2026-09-15 |
qalchat/test_groups.sh | GROUP DMs (phase b) proof suite for qalchat | 2026-09-15 |
qalchat/test_invites.sh | proof suite for qalchat out-of-band invites (TOFU killer) | 2026-09-15 |
qalchat/test_pop.sh | (no header blurb) | 2026-09-12 |
qalchat/test_ratetiers.sh | (no header blurb) | 2026-09-15 |
qalchat/test_relays.sh | MULTI-RELAY proof suite for qalchat (fleet edition) | 2026-09-10 |
qalclaim/test_qalclaim.sh | end-to-end proofs for the qalclaim points→credit system | 2026-09-11 |
qalhotspot/test_qalhotspot.sh | end-to-end proof suite for the village Starlink share | 2026-09-15 |
qalhotspot/test_vouchers.sh | end-to-end proof suite for the qalhotspot VOUCHER KEY | 2026-09-15 |
qalid/test_identity_v2.sh | qalid identity v2: humans, agents, devices, one system | 2026-09-11 |
qalid/test_qalid.sh | qalid v0 proof-of-life suite (run from anywhere) | 2026-09-10 |
qalkeys/test_qalkeys.sh | end-to-end proofs for qalkeys (:8841), the API-token ↔ | 2026-09-13 |
qalmcp/test_mcp.sh | proof suite for qalmcp (Qals MCP server over stdio) | 2026-09-10 |
qalmcp/test_mcp_exchange.sh | proof suite for the qalx trading-desk MCP tools | 2026-09-15 |
qalpay/test_btc_rail.sh | (no header blurb) | 2026-09-13 |
qalpay/test_caps.sh | proof suite for PER-PERSON PURCHASE CAPS in qalpay | 2026-09-13 |
qalpay/test_qalpay.sh | full proof suite for the qalpay payment→QALS bridge | 2026-09-10 |
qalpipe/test_eras.sh | era checkpoint proof cycle for qalpipe (2026-09-12) | 2026-09-12 |
qalpub/test_paytopost.sh | pay-to-post proof suite for qalpub (2026-09-10) | 2026-09-11 |
qalpub/test_private_channels.sh | phase c: PRIVATE invite-gated qalpub channels | 2026-09-12 |
qalpub/test_protocol.sh | v4 proof suite for qalpub (Discord/Slack protocol done) | 2026-09-11 |
qalpub/test_qalpub.sh | end-to-end proof suite for qalpub (public-content service) | 2026-09-15 |
qalpub/test_roles.sh | Discord-model roles & moderation proof suite (2026-09-11) | 2026-09-11 |
qalpub/test_workspaces.sh | v2 proof suite for qalpub (Slack-class layer) | 2026-09-09 |
qalredeem/test_qalredeem.sh | end-to-end proofs for the QALS redemption system | 2026-09-11 |
qalsh/test_qalsh.sh | proof suite for qalsh: GUARDED remote-exec on the qal fabric | 2026-09-09 |
qalx/test_exchange.sh | end-to-end proof of the QALS EXCHANGE on qalx | 2026-09-13 |
qalx/test_predict.sh | end-to-end proof of QALX UP/DOWN (PAPER BTC 5-min | 2026-09-16 |
qalx/test_qalx.sh | end-to-end proof of qalx (the internal swap engine, paper) | 2026-09-11 |
qalx/test_wbtc.sh | end-to-end proof of PAPER wBTC (stage 0) on the qalx exchange | 2026-09-13 |
qmarket/test_market.sh | a REAL two-party compute sale, end to end. | 2026-09-06 |
qmarket/test_market_v2.sh | the v2 skin-in-the-game scenario, end to end. | 2026-09-12 |
qmarket/test_qalid_gate.sh | provider-choice QAL ID gating on the compute market. | 2026-09-13 |
seedkit/test_seed.sh | the money test: lose the device, keep the identity. | 2026-09-09 |
Red-team campaigns
Two full audit campaigns so far. Mode for both: findings-only, reversible PoCs, every mutation undone (each file carries an UNDO ledger). Severity counts below are parsed straight from the reports at build time.
Mode for both campaigns: findings-only, reversible PoCs, every mutation undone (UNDO ledgers live in each file). Severity counts are parsed from the reports at build time:
| campaign | severity counts | report last modified |
|---|---|---|
| Campaign 1 — full-stack attack (rounds 1–3) full findings → | 7 CRITICAL · 8 HIGH · 16 MEDIUM · 7 LOW (38 total). | 2026-09-10 |
| Campaign 2 — post-fix surface re-attack full findings → | 6 CRITICAL (3 new · 3 campaign-1 regressions) · 4 HIGH · 6 MEDIUM · 2 LOW. | 2026-09-11 |
Campaign 2 re-attacked the patched surface: it confirmed the fixes that held and flagged regressions plus new criticals. Open remediation items are tracked in agents/HANDOVER_SYSTEM.md (Track S queue) — this page links to the work, it doesn't spin it.
Open remediation items are tracked in the system track's live queue (agents/HANDOVER_SYSTEM.md) — this page links to the work; it doesn't spin it.
How to reproduce any of this
bash scripts/status.sh— live probe of every service in the manifest.python3 scripts/check_links.py --quiet— verifies every link on every page of this site.- Any suite in the inventory above: run it (
bash <suite>); the evidence page re-reads headers and dates on every build. GET :8823/report— the program ledger, to the cent, any time.
Companions: Ground Truth (the numbered fact sheet) · Fees (where money actually moves) · Pricing (the one pricing story) · Paying with Bitcoin (pre-launch policy) · Testing Roadmap & Strategy (what's next to prove).
Proof: this page is the proof hub — the claims→evidence table above, the audit + red-team records below, and the era-1 checkpoint (object 0xe9eff274a90a0fb5d8a52a9fedebd5d5a6bd0880476fe12da70b4a348fab7905, tx 2gopkDw9ecBexPAA3U8vZhnoMqvZ673cKk9278G3NYGS) are the receipts every other page's Proof footer points to. The plan that keeps them true: Testing Roadmap & Strategy.