docs(ledger): update the verification contract now that anchoring has shipped - #9420
Merged
loopover-orb[bot] merged 1 commit intoJul 27, 2026
Merged
Conversation
… shipped Row 1 of what-you-can-verify.mdx and the decision-ledger's own doc comments still said external anchoring was tracked-but-not-built (#9122's honest-limit framing), but #9269-9274 landed it. Precisely restate what's actually closed (a wholesale rewrite before an already- published anchor now requires forging its signature or fabricating matching evidence at an external mirror) and what still isn't (a rewrite made since the last checkpoint, followed by ordinary appends, still gets silently absorbed into every future anchor -- anchoring bounds how far back an undetected rewrite could reach, it doesn't make every row checkable in real time). Publish the end-to-end verifier walkthrough as runnable commands, and present the optional Bittensor backend (#9277, not yet shipped) as its own clearly-labeled corroboration, never folded into the default two-backend claim. Closes #9275.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | b0a00a4 | Commit Preview URL Branch Preview URL |
Jul 27 2026, 05:43 PM |
Contributor
|
Tip ✅ LoopOver review result - approve/merge recommendedReview updated: 2026-07-27 17:59:46 UTC
Review summary Nits — 7 non-blocking
Decision drivers
Context & advisory signals — never blocks the verdict
Linked issue satisfactionAddressed Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://loopover.ai/docs/loopover-commands 🧪 Experimental — new and may change. Visual preview
Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy. Scroll preview
A short scroll-through clip (desktop) — click either thumbnail to open the full animation. Evidence for scroll-linked behavior a single screenshot can't show. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Bundle ReportChanges will increase total bundle size by 73 bytes (0.0%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: loopover-uiAssets Changed:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9420 +/- ##
=======================================
Coverage 89.53% 89.53%
=======================================
Files 843 843
Lines 109913 109913
Branches 26184 26184
=======================================
Hits 98411 98411
Misses 10239 10239
Partials 1263 1263
Flags with carried forward coverage won't be shown. Click here to find out more.
|
![loopover-orb[bot]](https://avatars.githubusercontent.com/in/4139483?s=60&v=4){kind=small}
JSONbored
added a commit
that referenced
this pull request
Jul 29, 2026
…9420) (#9776) #9420 updated a doc COMMENT inside migrations/0180_decision_ledger.sql. No DDL changed. It shipped in orb-v3.5.0. runSelfHostMigrations records a sha256 of each applied migration's FULL text and re-hashes on every boot, throwing selfhost_migration_content_drift on a mismatch. Comments are part of that text. So every deployment that had already applied 0180 would REFUSE TO BOOT on upgrade -- not degrade, fail to start, review pipeline down until a human restored the file. Confirmed against the live ORB: its _selfhost_migrations row for 0180 stores 0a95840f..., byte-identical to orb-v3.5.0-beta.10 and different from main. A full sweep of all 199 ledger rows found 0180 to be the only such drift. Restore 0180 verbatim. Nothing is lost: #9420 wrote the same prose into src/review/decision-record.ts's header, which is where it belongs and where it can change freely -- that header now says so, and says why the .sql must not. Add db:migrations:immutable:check: once a migration exists in a released orb-v tag its bytes are frozen, baselined at its FIRST release so a later tag that disagrees (as 3.5.0 does) cannot move the target and block the repair. The 35 files edited before this rule existed are re-frozen at current content rather than exempted, so the guard has no permanent holes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sub-issue of #9267 (external decision-ledger anchoring). Now that #9269-#9274 have all landed on
main, the "tamper-evident, not tamper-proof, external anchoring tracked-but-not-built" framing published in what you can verify (row 1) and stated inmigrations/0180_decision_ledger.sql's own header comment was stale.migrations/0180_decision_ledger.sql's header andsrc/review/decision-record.ts's two matching "HONEST LIMIT" comments (module header +verifyDecisionLedger's own doc comment, which previously said "the exact shape a future external-anchoring job would need") no longer describe anchoring in the present-tense-future; they describe what's actually running today.Closes #9275.
Test plan
ledgerRowHashcomputation, and the actual exportedverifyLedgerAnchorSignature/anchorKeyById/parseAnchorPublicKeys/ledgerRowHashfunctions — confirmednode --experimental-strip-typescannot resolve these modules' extensionless relative imports (house convention: that flag is for self-contained scripts only), switched the walkthrough tonpx tsx -ewith an async IIFE (tsx's-edoesn't support bare top-level await), and re-verified end to end: signature check prints "signature OK", row-hash check prints "row hash OK -- anchor matches the live chain"npx tsc --noEmitcleannpx vitest run test/unit/decision-record.test.ts— 32/32 (comment-only changes, no behavior touched)npx tsx scripts/check-docs-drift.tscleannpx tsx scripts/check-migrations.tsclean (comment-only migration change, still 199 contiguous)npm --workspace @loopover/ui run format:checkcleannpx vitest runondocs-nav.test.tsx,docs-source-server-isolation.test.ts,docs-mdx-eager-scope.test.ts— 58/58