Know what a transaction does before you sign it.
RustAG rehearses any Robinhood Chain transaction against faithful mainnet state in a sealed sandbox — then emits a cryptographically signed EvidenceBundle with a semantic diff, invariant alarms, and compute used. Verify it offline, before a single multisig signer approves.
Preload real mainnet state from the protocols you build against
"Pinned before execution. Sealed during. Signed after."
Every account in the rehearsal closure carries a sync state. This is how RustAG produces a content-addressed, tamper-evident pre-state root — the cryptographic foundation that makes an EvidenceBundle independently verifiable by anyone, with no trust in the rehearser.
Never fetched. Pulled on first access during rehearsal closure resolution.
Content-addressed snapshot from mainnet. Used as the sealed pre-state root.
Modified by the rehearsed payload. Frozen — captured in the post-state root.
Explicitly overridden via --patch in forensics mode. Locked to the patched ELF.
The GroundTruth assurance stack
From multisig proposal decoding to counterfactual forensics — the complete toolkit for pre-execution assurance on Robinhood Chain.
Sealed pre-execution rehearsal
Two-pass deterministic execution in a sealed EVM sandbox. Pass 1 discovers all touched accounts. Pass 2 re-executes with zero live RPC calls, producing a SHA-256 content-addressed state root — Grade A means anyone can re-verify.
multisig native
Paste a VaultTransaction proposal pubkey. RustAG fetches, Borsh-decodes, and rehearses it — threshold, approval count, and all — before a single signer touches Approve.
6-rule invariant policy
Upgrade authority rotation, program freeze, new durable-nonce, ETH drain (>80%), and the Drift attack pattern (nonce + authority combo) all trigger typed alarms.
N-of-M RPC provenance
Cross-fetch the closure from N independent RPC endpoints, require M-of-N agreement. InputProvenance is embedded in every bundle — the closure can't be silently manipulated.
Counterfactual forensics
Re-execute a historical transaction by signature. Use --patch to substitute a candidate ELF — get back BLOCKED or REPRODUCED. Answer: would our fix have stopped the Drift attack?
Upgrade-rehearsal CI gate
GitHub Action records real mainnet traffic for a watched program, replays against the candidate bytecode, and fails CI on new invariant alarms. PR comment shows the semantic diff.
Ed25519-signed EvidenceBundle
Every rehearsal produces a tamper-evident, offline-verifiable bundle: pre/post state roots, semantic diff, alarms, compute, signer pubkey. Verify with zero network dependency.
Time-series analytics
TVL, transaction volume, and mirror growth — sampled and charted in real time against the live demo.
Fork, stress & replay
Fork the stagenet, replay real traffic corpora, and compare outcomes across candidate program versions without mutating the base.
Rehearse, attest, and verify in minutes
Paste a multisig proposal address — RustAG fetches it, rehearses it against live mainnet state, and returns a signed EvidenceBundle you can verify offline.
# rehearse a multisig multisig proposal rustag rehearse \ --proposal 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU \ --rpc $ALCHEMY_RPC # forensics: was this exploit stoppable? rustag forensics <SIGNATURE> \ --rpc $RPC \ --patch ./patched-program.so # verify the bundle offline (no RPC needed) rustag verify groundtruth-bundle.json \ --closure groundtruth-closure.json ✓ Grade A · signature valid · pre-state root matches
Pre-execution assurance in three steps
Paste the proposal
Give RustAG a multisig proposal address (or a raw base64 transaction). It fetches the exact pre-state — every account, every ProgramData, the Clock sysvar — from N independent mainnet RPC endpoints.
Sealed rehearsal
The payload runs in a sealed, deterministic EVM sandbox against the pinned pre-state snapshot. Two-pass execution: discover all touched accounts, then re-execute with no live RPC calls.
Sign and verify
Get back a signed EvidenceBundle: semantic diff (11 change types), invariant alarms (ownership, freeze, nonce, drain), compute used, and SHA-256 state roots. Verify offline — independent of the rehearser.
Spin up your mirror.
RustAG is open source, and a live mainnet-mirroring demo is running right now. Open it, read the code, or join the early-access list.