VAP research, SDK updates and external reproduction notes
VeritasChain Standards Organization (VSO), operated by VeritasChain Co., Ltd., records merged GitHub updates as of 5 November 2026. This notice brings together the research scope, fixes and instructions for future reproduction without combining results from different experiments.
Research status and limits
Experimental extensions remain unadopted; independent third-party reproduction has not been established. The results below are first-party CI and internal research checks, not an independent assessment, certification, production-readiness determination or proof of complete observation.
Control-state evidence: observations are separate from safety conclusions
VAP PR #46 adds an isolated, unadopted controller-observation experiment. Its Linux/Docker run matched the expected outcomes for 16 cases; 69 companion tests also passed in both normal and optimized Python runs. These are the same 69 tests run in two modes, not 138 distinct tests. A signed envelope binds recorded observations to run identifiers and artifacts. The intentional bypass case remains VIOLATED_IN_NEGATIVE_CONTROL / BYPASS_EFFECT_OBSERVED; the external anchor is NOT_ESTABLISHED and overall safety is NOT_ASSESSED. Matching that negative control does not establish that bypass is prevented.
Wallet evidence: bind observations to the bytes actually signed
VAP PRs #48–#50 separate integrity, authorization, execution_match and delegation_state. The local EVM adapter now derives the target, action, chain ID and nonce from the actual signed authorization bytes, preventing stale signed targets from being relabelled as intended operations. The final PR #50 CI records 43 signed-evidence tests and 17 local-EVM tests separately. This is an offline/local research experiment, not a live transaction gate or production wallet monitor; no public RPC or real funds are used. ALLOW is limited evidence acceptance, not a general authorization guarantee.
SDK: corrected development snapshot and an offline companion demo
Merged SDK changes reject fractional and otherwise invalid Merkle indices before recursion, require reviewed installer hashes and signing-certificate checks, and document the corrected development snapshot. Package metadata remains 0.1.0 pre-release; these changes are not a new PyPI/npm release or a replacement of the historical v0.1.0 tag. The optional wallet demo separates SDK record integrity from the four wallet-evidence claims. PR #13 pins its companion to VAP 7bdec51; its four sealed records and signatures remain unchanged. SDK CI is first-party evidence, not an external implementation or independent reproduction.
External reproduction notes: a procedure, not a reported result
The merged VSO notes describe how a reviewer can select trusted keys, use an environment they control, record versions and observation boundaries, and distinguish detected mismatches from missing evidence or legacy format differences. They are instructions for future reproduction and critique, not confirmation that a reviewer has accepted or completed a run. The notes distinguish current VAP §4.1.3 VALID / INVALID from the unadopted three-valued discussion and its implementation vocabulary. Missing external-anchor proof is not a pass and is not, by itself, evidence of tampering.
Website maintenance: align CSP checks with publication scope
The site security check was attempting to parse extension development pages and synthetic HTML fixtures as published website pages. The targeted correction excludes tools/browser-recorder/ from website publication and the website CSP/CSS collectors. Public pages and versioned downloads remain in scope; source-scope regression coverage checks that similarly named public paths are still included. No CSP protection on published pages is weakened.
Merged sources and first-party CI
- VAP #46 — control-state evidence
- VAP #48–#50 — wallet evidence (latest correction #50)
- Control-state first-party CI
- Wallet first-party CI: 43 signed-evidence / 17 local-EVM tests
- SDK #8 — installer integrity
- SDK #10 — Merkle indices
- SDK #11 — development snapshot
- SDK #12 — offline wallet demo
- SDK #13 — companion pin
- SDK wallet-demo first-party CI
- VSO #3 — external reproduction notes
Historical records stay attached to their original versions
Earlier notices, including the 159-test Explorer checkpoint and the fixed reproduction kit, retain their original dates and results. This publication does not change normative requirements, existing research implementations, signed data, fixed distributions or K3. The current VAP specification reference and hash are unchanged. A merged research proposal is not formal adoption.