# OpenCSV Master Plan (2026-08-15, rev 14) — D5 and production release gates ## Plan of record This revision reconciles the owner-approved **OpenCSV Rev 4 — Permanent Test USD and Final Signal Acceptance** plan with the real Carol→Bob→Carol path, the first explicit shared-transaction batch, and the first protocol-safe fee replacement in Signal simulators. Coordination state lives in repositories and GitHub issues, not chat. Earlier roadmap revisions and failed approaches remain in Git history and the public journal. The execution order is still: 1. formal/kernel 2. prover 3. batching 4. reference signet/mainnet readiness 5. Signal/iOS integration last Tracks 1–4 have reached their reference implementation baselines. Signal PR #6 is merged at `db818658`; the solo two-hop, true zero-confirmation child, shared batch, and protocol-safe RBF have all settled on signet. A fresh live audit opened and closed two narrow fix-forwards: Signal PR #8 for canonical presentation lookup and Rust PR #16 for verified spent-coin reselection. Signal PR #9 pins the merged Rust SHA; its PR-tip jobs passed, but its post-merge default Build and Test failed while recovery passed. Neither merge implies a release, upstream Signal submission, physical-device rollout, or mainnet readiness. The public execution view is a separate evidence page at [`roadmap.html`](roadmap.html), with a versioned snapshot in [`web/data/roadmap-v1.json`](web/data/roadmap-v1.json). ## Verified completed baselines ### Formal and kernel - **A3 — reproducible Aeneas refinement: complete.** `formal-aeneas@3bcafed` pins its dependency, builds without `sorry`/`admit`, removes the duplicated theorem, and publishes a 15-declaration axiom audit. Default-branch CI: [run 30835243209](https://github.com/opencsvnet/formal-aeneas/actions/runs/30835243209). - **A4 — staged kernel adoption: complete.** Production binding, occurrence/well-formedness, first-occurrence, and supply decisions use the adopted kernel, with generated valid/mutated differential tests retaining a test-only independent oracle. - **A5 — pure accept decision boundary: complete.** Explicit observed input state maps to deterministic accept/reject results and stable reasons; proof, chain, storage, and transport I/O remain in the driver. - A4/A5 are integrated in `opencsv-rs@e4265b9`; exact-tip CI passed in [run 30830366654](https://github.com/opencsvnet/opencsv-rs/actions/runs/30830366654). - The public formal ledger contains **72 audited declarations** at `opencsv-formal@dc7e8eb`; default-branch CI passed in [run 31044400073](https://github.com/opencsvnet/opencsv-formal/actions/runs/31044400073), and the generated site deployed at `opencsv@75de1b7` in [run 31044493886](https://github.com/opencsvnet/opencsv/actions/runs/31044493886). The standing bridge remains executable differential testing. The Lean/source correspondence gate is fail-closed source-drift evidence; it is not represented as a proof of the Rust AIR, FRI, storage, networking, or iOS implementation. ### Prover implementation baseline and remaining D5 gate - **D1 — setup caching: complete** at `ca8ad37`, keyed by complete setup and verification-key identity with cold, warm, invalidation, and concurrency coverage. - **D4 — predecessor verification-key hard binding: complete** at `97187e6`. - **D3 — AIR-native issuer authorization: complete** at `8ee7a81`. - **D2 — production FRI profile: complete** at `d18c235`, with a 94-bit conservative enforced floor and explicit proof-version boundaries. - Proof-lineage v4 one-input forwarding is on `opencsv-rs/main` through `46a3e48`. The measured physical iPhone 16e release receipt is 6.435 seconds proving, 19.75 ms verification, and 788,047 bytes. Debug multi-minute proofs are development behavior and are never product performance claims. - **D5 — root verification-key authentication: open and blocking mainnet.** D4 prevents a fixed successor circuit from accepting a foreign predecessor, but v4 still reconstructs the root native verifier from proof-carried common data. The static verifier-set tag is not a root of trust. Issue [opencsv-rs#32](https://github.com/opencsvnet/opencsv-rs/issues/32) owns the v5 design and adversarial custom-root regression. Until it closes, shipped mainnet wallets fail fresh writes with `production_root_vk_authentication_required`; v4 remains signet-only. ### Batching v2 - **C0 — protocol/threat model: complete** at `d51d139`. - **C1 — co-funded deterministic batches: complete** at `0af0258`, followed by the reviewed remediation integrated at `e4265b9`. - **C2 — authenticated two-round gossip: complete** at `54c0833`, with live relay admission, identity quotas, replay rules, durable reservations, abort guards, and gossip-to-broadcast/replacement receipts integrated at `e4265b9`. - **C3 — Lean batch model: complete** at `opencsv-formal@c4f970d`; subsequent formal work is included in the 72-declaration ledger. Current batching combines recipients collected before one proposal freezes. It does not yet put a dependent Alice→Bob→Carol chain inside one underlying Bitcoin transaction; that remains a separately versioned research item. ### Reference signet readiness - Reference cold/hot sync, bandwidth, latency, recovery, fee, marker, and batch amortization receipts are integrated through `cfb902b`, `a7fe2e0`, and `e4265b9`. - Reproducible reference builds and the release checklist exist. They are evidence and preparation, not a release. - Independent mainnet security review, release signing/distribution, and any mainnet broadcast remain open. ### Domain - Cloudflare delegation, GitHub organization verification, apex and `www` Pages records, TLS, and enforced HTTPS are complete. Current public checks return HTTP 200 for the homepage, journal, and formal ledger; `www` resolves to the canonical apex. - DNSSEC remains open. No DS record is currently published for `opencsv.net`; completion requires enabling DNSSEC in Cloudflare and publishing the exact DS at Namecheap. ## Permanent Test USD product boundary Signal exposes one user-facing product: **Test USD**. - The wire unit code remains `USD`; no protocol encoding changes. - Presentation becomes **Test USD** only when the account is signet and the exact reviewed manifest is marked `testOnly`. - Test USD has no monetary or redemption value and is permanently bound to the signet account database, backup namespace, asset checkpoint, and BIP84 fee tree. It is never promoted to mainnet. - Every underlying issuer retains its own exact asset ID, authorization key, terms, supply, priority, and claim. Signal may aggregate reviewed issuer balances for display, but one send selects one exact issuer instrument and records it in review and receipt details. - The currently reviewed asset is `1d58a8145eedac17efe66371293eb472a4c68554141cc14380360e6eb720b507`. No Tether asset or redemption claim exists in this test registry. - Unknown, removed, or ticker-lookalike instruments remain visible and read-only. New unsigned work fails with stable `asset_not_reviewed`. - Signal cannot mint or create assets. Privileged signet/regtest issuance remains available only through the non-default headless `opencsv-issuer` tool. The stacked mainnet candidate admits issuance only through a registry-v2-committed threshold policy, an exact signed mint authorization, a canonical confirmed funding outpoint, and a replay-safe per-asset sequence/supply floor. The signed outpoint prevents old-backup replay from retargeting the same approval to fresh Bitcoin funding. Missing material returns `production_issuance_not_authorized`. Signal exposes none of this surface. - Production USD requires a new reviewed asset and registry, separate account database and backup namespace, and a separately initialized mainnet fee tree. The fail-closed namespace, registry lifecycle, activation states, evidence gates, and still-open human decisions are specified in [`PRODUCTION_MAINNET.md`](PRODUCTION_MAINNET.md). That document is a review contract, not an activation or issuer claim. - The current Rust candidate rejects loose mainnet issuer lists. A production registry is a versioned, deployment-bound release input whose ordered exact manifests/priorities, source revision, and public HTTPS approval receipts recompute to its exposed commitment. This makes the selected policy reproducible; it does not establish issuer backing or authority. - The highest accepted registry version and commitment persist in both the account database and production Secure Backup. Older or conflicting policy remains readable but cannot start unsigned work; older checkpoints cannot lower the floor. - The release commitment also binds a `candidate`, `limited`, or `general` phase and exact transfer, batch, rolling-day, recipient, reserve-allocation, and miner-fee ceilings. Candidate releases return `production_activation_not_authorized`; activated releases recheck their ceilings at intent creation and before proof/signing. Signed solo, batch, and reserve transactions snapshot the complete authorizing release, and RBF revalidates that commitment before applying its original fee ceiling. A wallet-derived signature binds that commitment to the stable solo, batch, or reserve operation identity. Missing or substituted mainnet authorization is database corruption rather than permission to fall back to live host policy. Crash resume revalidates it before transaction parsing, chain lookup, or relay; fee bump does so before chain verification or replacement signing. The separately featured, secret-free `opencsv-registry` tool uses the same Rust serializer and verifier as account open. It requires the expected application deployment, distinguishes structural validity from activation authority, and refuses to overwrite an existing release. Its checked-in candidate has zero issuers and cannot arm writes; limited/general validation rejects empty issuer sets and all-zero placeholder revisions. Registry v2 additionally commits sorted exact asset-to-issuance-policy hashes while v1 bytes remain unchanged and cannot authorize minting. The headless wallet atomically consumes each threshold-signed authorization with its mint operation, enforces contiguous sequence and supply transitions, carries the ledger in Secure Backup, and verifies signed historical policy snapshots on resume/RBF after policy rotation. Consumer policy alone never authorizes supply. The exact published draft is [opencsv-rs PR #31](https://github.com/opencsvnet/opencsv-rs/pull/31) at `cd9a71f7ab4703162b47848dc1fdda0f9841b7b3`, stacked on still-unmerged PR #30. An exact-tip adversarial pass found and closed a threshold alias: authority keys now require one lowercase compressed canonical encoding, so one signer cannot occupy two slots through upper/lowercase hex. A second pass bound each authorization to one exact funding outpoint so restoring an older valid backup cannot replay it with a different UTXO. Pre-sign, resume, and RBF independently recheck the operation row and persisted transaction input. A crash after atomic admission resumes the same `planned` or `fee_reserved` operation after reopen and can reserve only that signed outpoint. D5 now additionally blocks every shipped mainnet write because v4 does not independently authenticate the recursive root verification key. FFI is 127 passed / 0 failed / 3 intentional ignores; those three pass explicitly in release mode. The preceding complete warnings-denied workspace had no executed failure; the proof-heavy PCD node and redeem suites took 957.31 and 430.63 seconds. Registry and issuer tool suites pass 4/0 and 8/0. Hosted runs 31913977221 and 31913959340 are superseded; exact-head runs 31919832350 and 31919834317 are executing, and independent review remains absent, so nothing here is merge or activation authority. - The current local production candidates additionally fail closed unless mainnet has two required pinned raw-byte observer hosts, visible direct relay, and two distinct compact-filter peers. These candidates are not published product state until their prior PRs merge and the exact rebased tips pass hosted CI and independent review. ## Completed Rust merge gate [opencsv-rs PR #10](https://github.com/opencsvnet/opencsv-rs/pull/10) is merged by exact fast-forward on `opencsv-rs/main` at `3295cd5896aa2615c992faf45a9075ad138094ca`. It adds: - exact `usd_issuers` enforcement at planning, before proving, at proof commit, and before pre-broadcast signing; - atomic cancellation of a revoked unsigned solo operation or frozen batch; - recovery of already signed/broadcast operations despite later registry changes; - issuer C symbols absent from the default Signal archive/header and available only under `issuer-tools`; - separate proof, verification, signing/persistence, relay, observer, and SPV timing receipts. Local default, recovery, issuer, integration, Clippy, formatting, and archive surface gates passed. Hosted push [run 31113193237](https://github.com/opencsvnet/opencsv-rs/actions/runs/31113193237) and PR [run 31113199886](https://github.com/opencsvnet/opencsv-rs/actions/runs/31113199886) both succeeded at the exact tip, including twice-built byte-identical reference binaries. Signal PR #6 pins this merged SHA. ## Merged Signal integration — fix-forward gates Signal work was consolidated in [Signal-iOS PR #6](https://github.com/opencsvnet/Signal-iOS/pull/6) and merged at exact commit `db818658f1511eed0dc98df42affce1be78b486f`. PRs #4 and #5 remain historical stacked reviews. The live acceptance build starts from Rust `3295cd5` and Signal `c14f02025daa557ca9149325dfc3199bced1012b`. It preserves Test USD presentation, queues a durable chat intent before proving, moves proof work off the sheet's critical path, and resumes by operation id. The real run produced two confirmed signet anchors and a verified provisional return. It also found repairs—signed limb borrows in the value gadget, canonical confirmed-parent snapshot handling, and corrupt BIP158 cache refetch—now consolidated in merged Rust and the merged Signal integration. The post-merge hosted run is the current gate, not the earlier branch candidate. The consolidated Rust implementation is merged on `opencsv-rs/main` at [`28010d8`](https://github.com/opencsvnet/opencsv-rs/commit/28010d8f714c361a6f4a94ded1ed8708affe70dd) by exact fast-forward after hosted runs [31231128052](https://github.com/opencsvnet/opencsv-rs/actions/runs/31231128052) and [31231129868](https://github.com/opencsvnet/opencsv-rs/actions/runs/31231129868) passed on that SHA. Signal is merged at [`db818658`](https://github.com/opencsvnet/Signal-iOS/commit/db818658f1511eed0dc98df42affce1be78b486f). They include the corrected two-required-observer policy, the true unconfirmed parent/child receipt, batch-envelope verification and account identity fixes, cryptographic replacement identity, and a canonical logical-payment identity that keeps an RBF replacement to one payment bubble while retaining both exact attachments. The exact Rust recovery-feature suite passes 71 tests with two explicitly ignored slow release-only cases; the warning-denied Signal store suite passes 27 tests and the full simulator app builds against the exact Rust XCFramework. In post-merge [run 31262161093](https://github.com/opencsvnet/Signal-iOS/actions/runs/31262161093), the recovery job and OpenCSV wallet tests passed while the default Xcode build stopped at the upstream Signal fixture assertion `OWSSwiftUtils.swift:56: Missing attachment file`. That failure is a fix-forward gate and prevents any release claim. Rust `main` subsequently advanced to [`ad8a45e`](https://github.com/opencsvnet/opencsv-rs/commit/ad8a45e9f99fc028f31015420be41820b0d9f6ee), adding owner-only consignment export to the headless issuer CLI and keeping Presage/AGPL Signal transport opt-in; default-branch CI [31266597981](https://github.com/opencsvnet/opencsv-rs/actions/runs/31266597981) passed on that exact tip. The 2026-08-08 45/10 Test USD repeat then found two boundary edges. Signal PR [#8](https://github.com/opencsvnet/Signal-iOS/pull/8) makes outgoing presentation lookup use the same canonical payment identity as verdict storage; the focused suite passes 28 tests and live relaunch suppressed prior operations. Rust PR [#16](https://github.com/opencsvnet/opencsv-rs/pull/16) reconciles locally available coins against the registered PoW-verified spent set and retries the next deterministic candidate, including a batch pre-sign check. Its local default/recovery suites pass 71/73 tests with two deliberate slow ignores in each. At discovery time both were locally green but still awaited hosted CI; the intended sequence was Rust merge, Signal repin, then a hosted Signal build. That sequence is now complete through the pin but not through the final hosted gate. Signal PR #8 merged at `1e3472b9`; Rust PR #16 merged at `908bbb53` with green PR and post-merge Rust CI; Signal PR #9 pins `908bbb53` at `9b72d86d`. PR-tip default/recovery jobs passed, but post-merge Signal run [31283234786](https://github.com/opencsvnet/Signal-iOS/actions/runs/31283234786) failed its default Xcode job while the recovery build passed. A clean default-branch rerun or fix remains required. Required product behavior: - show **Test USD** on balance, send, review, pending, verified receipt, notification, activity, and explorer surfaces; - keep exact issuer identity and “no monetary value” in details; - expose receive, send, evidence, fee reserve, and recovery state—never mint or custom-asset UI; - render cached state in under one second as `Cached