> ## Documentation Index
> Fetch the complete documentation index at: https://docs.giwa.tokscale.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Verification Log

> What the maintainers' harness runs, what each target proves, and the exact pass marker it prints on success.

Each target below names what it proves, the network it applies to, and the marker it prints. "Local" means the hermetic Anvil localnet (Anvil borrows chain ID 91342; it is not public GIWA Sepolia). "Public" means a check against real GIWA Sepolia. A local target proves the mechanism; a public one proves it on the live chain, and [Live Evidence](/overview/live-evidence) keeps the two separate.

<Info>
  These are maintainer-run harness results. The gateway stack and its harness are not publicly available, so the markers here are attributed evidence rather than reader instructions. The shipped client surface is the open-source CLI (see [Quickstart: Track Your Usage](/usage-tracker/quickstart)).
</Info>

## 2026-07-31: Public GIWA Sepolia re-verification (public read)

A read-only pass against the public RPC `https://sepolia-rpc.giwa.io` confirmed GIWA Sepolia chain ID `91342` at observed head block `32133446`. Every address and transaction it covers is listed with its explorer link on [Live Evidence](/overview/live-evidence); this entry records the result of re-checking them rather than restating them.

* **Transactions:** all 6 transactions linked on that page are confirmed on-chain with `status 0x1`, at the blocks recorded there.
* **Addresses:** all 11 addresses linked on that page hold contract code.
* **Deployment records:** all 5 runtime code hashes recorded in the product repository's deployment records match the live chain: the tUSD deployer and token, the CREATE2 deployer, Permit2, and the Upto Permit2 proxy.

The deployed contracts are therefore current, not stale, and no redeployment was performed. Redeploying would produce identical bytecode and invalidate the pinned runtime hashes the test fixtures assert against.

This entry records a read-only on-chain verification pass only. It does not establish a public product route or an end-to-end payment lane.

## The authoritative full proof (local)

```sh theme={null}
BUILDX_BUILDER=desktop-linux bun run local:e2e
```

The complete hermetic proof: gateway, Stage A credit top-up, Stage B x402 settlement, receipts, attestation pipeline, and browser checks, all inside Docker. Pass marker: `GIWA_LOCAL_E2E_OK`. Browser artifacts carry `verified=receipt,passport,transactions`. For what one pass covers stage by stage, see [Gateway Overview](/gateway/overview).

## Crash and fault recovery (local)

```sh theme={null}
bun run local:stage-a:crash:e2e
```

Proves Stage A credit recovery survives a crash after settlement: the reconciler resumes from durable state instead of double-crediting or losing the top-up. Pass marker: `GIWA_LOCAL_STAGE_A_CRASH_E2E_OK ... authorization_used=1 credited=1`.

```sh theme={null}
bun run local:x402:fault:e2e
```

Proves Stage B fault behavior through a settlement fault proxy: a failed or ambiguous adapter response never becomes a double settlement, and recovery replays read-only. Pass marker: `GIWA_LOCAL_X402_FAULT_E2E_OK`.

## Installed AI clients (local)

```sh theme={null}
bun run local:installed-clients:e2e
```

Runs the acceptance suite against really installed clients rather than mocked HTTP: the native SDK, Codex, and Claude Code each complete a paid request through the gateway. Pass marker: `GIWA_INSTALLED_CLIENT_ACCEPTANCE_OK clients=2 ... accounting=verified privacy=verified`. Scoped variants exist for one surface at a time:

```sh theme={null}
bun run client-acceptance:all      # marker: GIWA_CLIENT_ACCEPTANCE_ALL_OK
bun run client-acceptance:sdk      # marker: GIWA_CLIENT_SDK_ACCEPTANCE_OK checks=28
bun run client-acceptance:codex
bun run client-acceptance:claude
```

Every mode ends by verifying that each terminal request produced a settled ledger entry and a fetchable receipt.

## Interactive topology (local)

```sh theme={null}
bun run local:gateway
bun run local:gateway:down
```

Brings up a disposable stack that publishes only the API-key gateway and the console on loopback, leaving payment and chain services internal. Ready marker: `GIWA_LOCAL_GATEWAY_READY`. This is maintainer tooling for driving the stack by hand, not a proof.

## Public GIWA Sepolia contract validation (public)

```sh theme={null}
bun run contracts:giwa:sepolia:validate
```

Re-reads the tUSD deployment record against live GIWA Sepolia state through the public RPC: address, runtime code hash, domain separator. Pass marker: `GIWA_TUSD_LIVE_VALIDATION_OK`.

```sh theme={null}
bun run contracts:giwa:sepolia:multicall3:validate
```

Read-only validation of the Multicall3 deployment at its canonical address. Pass marker: `GIWA_MULTICALL3_READ_ONLY_VALIDATION_OK`. Addresses and records: [The Public Chain](/gateway/public-chain).

```sh theme={null}
bun run contracts:local:verify
```

Verifies the localnet contract deployments against their source-locked hashes (local).

## Protocol vectors (local)

The wire formats are verified three ways: Rust (Alloy), TypeScript (viem), and Solidity (forge). Three independent implementations must reproduce identical bytes, so no single library is trusted twice.

```sh theme={null}
bun run receipt-vectors:verify
```

Runs the receipt vector suite: `cargo test -p giwa-onchain --test receipt_vectors`, then the web-side verifier. Proves UsageReceiptV1 encoding and EIP-712 signing match across implementations. It exits non-zero on a digest or signature mismatch; the leaf, root, and commitment checks belong to `attestation-vectors:verify` below.

```sh theme={null}
bun run attestation-vectors:verify
```

Runs the attestation vector suite: Rust vectors, TypeScript vectors, then `forge test --match-contract ReceiptAttestationV1Test`. Proves the EAS attestation encoding matches across all three.

```sh theme={null}
bun run protocol-vectors:verify
```

Runs the web-side protocol vector verifier end to end.

## Dojang on GIWA (public read)

```sh theme={null}
bun run dojang:giwa:validate
```

Reads GIWA's Dojang attestation surface on public Sepolia: resolves the Testnet Faucet attester, calls `isVerified(address, attesterId)` on DojangScroll, decodes the attestation, and runs negative controls (a random wallet and attester ID must read unverified). Prints `Dojang GIWA validation: valid informational evidence at block <n>` plus the artifact path. This validates the read path; gating Passport eligibility on Dojang is Phase 2.

```sh theme={null}
bun run dojang:giwa:issuer-label:validate
```

Validates the issuer-label metadata handling used when rendering Dojang evidence (labels are display-only, never a verification input).

## Topology validators (local, static)

Each validator fails loudly on a regression and exits 0 with a summary line on success.

```sh theme={null}
bun run topology:validate
```

Validates the default localnet Compose file: loopback-only web console, web excluded from the private Anvil network, bounded read-only RPC proxy, internal payment services, pinned facilitator and Playwright images, immutable migration snapshots. Pass line: `Compose topology is valid: loopback web console only, web excluded from private Anvil, bounded read-only RPC proxy, internal payment services, local deployment manifest, pinned facilitator and Playwright, immutable migration snapshots.`

```sh theme={null}
sh infra/scripts/validate-giwa-sepolia-compose.sh
```

Validates the public-chain topology definition without starting it (service count, fail-closed secrets, no stray ports). Pass marker: `GIWA_SEPOLIA_TOPOLOGY_OK services=6 database_service=giwa-sepolia-postgres volume=giwa-sepolia-postgres secrets=redacted`.

```sh theme={null}
bun run topology:local-gateway:validate
bun run topology:stage-a:crash:validate
bun run topology:x402:fault:validate
```

Validate the loopback-gateway overlay and the two fault-injection overlays used by the recovery proofs above (bounded markers, single fault proxy, no extra published services).

## Next steps

* For which of these proves a public claim and which proves a local one, see [Live Evidence](/overview/live-evidence).
* For a walkthrough of the authoritative full proof, see [Gateway Overview](/gateway/overview).
* For the contract records the public validators check against, see [The Public Chain](/gateway/public-chain).