fix(fairness): make the anchored ledger publicly verifiable, and stop misreporting an empty one - #9959
Merged
loopover-orb[bot] merged 2 commits intoJul 30, 2026
Conversation
Refs #9940. Both produced the same sentence -- 'anchor signing not configured, or the ledger is empty' -- and the difference is the entire diagnosis. It sent me looking for a missing secret on edge-nl-01, whose anchoring was working perfectly: the surface the verifier defaults to simply holds no ledger, because decisions are recorded on the ORB and only aggregate outcomes travel to the public API. The check now reads the ledger's own size and reports three distinct states: an empty ledger (nothing to anchor -- not a failure, and it names --base-url as the fix), records present with nothing signed (a real gap), and an unreachable ledger endpoint. Verified end to end against production: api.loopover.ai reports the empty-ledger skip, and the ORB's own surface PASSES -- checkpoint at seq 2190 verifies offline against published key 6b6490126ad44b51, which is also the first proof this verifier's crypto path works against a real signature.
Contributor
|
Tip ✅ LoopOver review result - approve/merge recommendedReview updated: 2026-07-30 22:02:58 UTC
Review summary Nits — 6 non-blocking
Decision drivers
Context & advisory signals — never blocks the verdict
Linked issue satisfactionPartially addressed Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://loopover.ai/docs/loopover-commands 🧪 Experimental — new and may change. Visual preview
Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy. Scroll preview
A short scroll-through clip (desktop) — click either thumbnail to open the full animation. Evidence for scroll-linked behavior a single screenshot can't show. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
The public API's ledger is empty by design -- it aggregates outcomes Orbs report rather than holding their chains -- so /fairness and the walkthrough were sending readers to a surface that structurally could not answer the ledger question. Both pages now name the two surfaces and what each answers, and say plainly that a skipped ledger check against the aggregate is expected rather than a failure.
JSONbored
changed the title
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | 1f2d483 | Commit Preview URL Branch Preview URL |
Jul 30 2026, 09:42 PM |
Bundle ReportChanges will increase total bundle size by 6.83kB (0.09%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: loopover-uiAssets Changed:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9959 +/- ##
==========================================
- Coverage 91.88% 91.87% -0.01%
==========================================
Files 928 928
Lines 113675 113679 +4
Branches 27412 27415 +3
==========================================
Hits 104445 104445
Misses 7931 7931
- Partials 1299 1303 +4
Flags with carried forward coverage won't be shown. Click here to find out more.
|
![loopover-orb[bot]](https://avatars.githubusercontent.com/in/4139483?s=60&v=4){kind=small}
loopover-orb
Bot
deleted the
fix/verifier-distinguishes-empty-ledger-9940
branch
July 30, 2026 22:03
This was referenced Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #9940.
What was wrong
The anchoring mechanism was never broken.
edge-nl-01signs its ledger and anchors to Rekor on schedule. The problem was topological: the deployment holding the anchored ledger was bound to127.0.0.1, and the deployment the world can reach has an empty one.api.loopover.ai(Worker)edge-nl-01(Orb)decision-ledger/verifytotalCount: 0totalCount: 2190+,ok: trueanchor-keyunconfigured, 0 keys6b6490126ad44b51anchor-payloadnot_foundSo
/fairness,verify-this-review, and the verifier from #9723 all pointed at a surface that could not serve what they described.Three fixes
1. The Orb's public surface is now reachable. Extended the existing Cloudflare Tunnel's ingress with a second path rule (
^/v1/public/.*$→localhost:8787) on the hostname it already serves. No new DNS, no new credentials, no inbound port.Scoped deliberately — verified from the open internet that everything else stays sealed:
And the end-to-end proof, run from outside:
That is also the first time #9723's crypto path has verified a real production signature rather than a fixture.
2. The verifier no longer misattributes an empty ledger. Both states produced one sentence — "anchor signing not configured, or the ledger is empty" — and that ambiguity is what sent me looking for a missing secret on a deployment whose anchoring worked fine. It now reads the ledger's size and reports three distinct states: empty (nothing to anchor, and it names
--base-urlas the fix), records-present-but-unsigned (a real gap, with the count), and size-unknown.3. The docs name both surfaces.
/fairnessmethodology and the walkthrough now say which surface answers which question, and that a skipped ledger check against the aggregate is expected rather than a failure.Validation
EMPTY.docs:drift-check,typecheck,import-specifiers,dead-exports,checkers-wired,contract:api-schemaspass;ui:test692 passing.cloudflared tunnel ingress validatebefore reload; previous config backed up on the box.Not included
The corpus-commitment half of the original issue (a
corpusChecksumpublished forai_consensus_defectwith no downloadable corpus) is a separate defect in#9805's omission logic and gets its own issue rather than being folded in here.