Trust & security

Security & threat model

The primary adversary in the GroundTruth threat model is a malicious or compromised transaction proposer — not the rehearsal service itself. A multisig signer should be able to verify an EvidenceBundle without trusting:

• The proposer's UI or wallet.
• The rehearsal service that produced the bundle.
• The RPC endpoint the rehearsal service used.

The hosted service threat model (Phase 2+) also covers tenant isolation: each rehearsal runs in its own context with no shared account namespace. The local CLI runs entirely on your own machine and is out of scope for multi-tenant isolation.

EvidenceBundle integrity

The rustag-attest crate signs a structured digest — not a JSON blob. The signing input is built from a fixed field order with length-prefixed, domain-tagged fields:

1. pre_state_root — SHA-256 Merkle root over the pubkey-sorted closure. Leaves are domain-separated with 0x00; nodes with 0x01 to prevent second-preimage attacks. Account leaves commit to consensus-visible fields only (lamports, data, owner, executable, rent_epoch); the internal dirty/clean/pinned bookkeeping is deliberately excluded.
2. payload_hash — SHA-256 of the raw bincode-serialized transaction bytes.
3. post_state_root — same Merkle construction over post-execution accounts.
4. semantic_diff_hash — SHA-256 of the canonical JSON-serialized diff.
5. alarms_hash — SHA-256 of the canonical JSON-serialized alarm list.
6. fidelity_grade — 1 byte: 0x41 = A, 0x42 = B.

use rustag_attest::EvidenceBundle; let bundle: EvidenceBundle = serde_json::from_str(&bundle_json)?;let closure = PortableBundle::from_file("groundtruth-closure.json")?; // Re-derives pre_state_root from closure, re-executes payload,// checks Ed25519 signature — exits Err if INVALID.let report = bundle.verify_against(&closure)?;assert!(report.grade == FidelityGrade::A);assert!(report.alarms.is_empty() || report.alarms.iter().all(|a| a.severity < Severity::High));

Grade A verification

A Grade A bundle is deterministically re-executable by any verifier who has the portable closure.json. The verification steps are:

1. Re-derive pre_state_root from closure → confirm it matches the bundle.
2. Execute the payload in a fresh EVM sandbox instance loaded from the closure.
3. Re-derive post_state_root → confirm it matches the bundle.
4. Check the Ed25519 signature over the structured digest described above.

Steps 1–4 require zero network access — just the bundle + closure files and a Rust binary. The attester's pubkey is embedded in the bundle and is the only trust anchor a verifier needs to establish out-of-band (e.g., from the multisig multisig's governance configuration).

# Three-command verification workflowrustag rehearse --proposal <PUBKEY> --rpc $RPC    # produces bundle + closurerustag verify bundle.json --closure closure.json   # offline, exit 1 if INVALID# ✓ Grade A · Signature valid · pre/post roots match

Audit-log tamper-evidence

AuditLog is an append-only, hash-chained log — the SOC 2 groundwork. Each entry carries a monotonic seq, a prev_hash, and its own hash; the chain is genesis-anchored at the all-zero hash. Any insertion, deletion, or edit anywhere in the log breaks the chain from that point forward, and verify() returns Err(index) at the exact first inconsistent entry.

Service levels

SLO targets apply to the hosted service (Phase 2+). Local CLI rehearsals run on your own machine with your own RPC key and are best-effort. Targets are deliberately modest; under-promising at this stage is intentional.

Known limitations

Other known limitations in Phase 1:

• Foreign program execution — the closure resolver fetches program accounts verbatim (readable and present), but does not yet JIT-load BPF bytecode from the program-data account. Rehearsing a multisig proposal that itself invokes a complex foreign program (e.g., a full Uniswap swap CPI) may produce a Grade B bundle if the bytecode is unavailable. Your own deployed program reading real mainnet state works today.
• Address lookup tables — v0 transactions with ALTs are resolved via a mirror fetch; ALT-heavy DeFi bundles are resolved but may produce Grade B if any ALT account is unavailable.
• Datastore — SQLite + moka in the stagenet runtime (not Postgres); correct for the single-node local MVP.
• Observability — tracing spans + a JSON /api/metrics time-series; Prometheus scrape endpoint deferred.
• Supply-chain CI — cargo audit / cargo deny are not yet wired into CI; crates not yet published to crates.io / npm.

FAQ

rustag rehearse --proposal <PUBKEY> --rpc $RPC   # → bundle.json + closure.json (signed, Grade A)rustag verify bundle.json --closure closure.json  # offline; exits non-zero if INVALIDrustag rehearse --proposal <PUBKEY> --rpc $RPC --fail-on high  # CI gate: exit 1 on HIGH/CRITICAL alarms