> **Publication safety update (2026-08-31):** Full Git-history bundles, bundle fragments, and environment-revealing raw logs are withheld from the public site pending a minimal exact-commit snapshot and completed secret/path review. Existing source/evidence identities remain historical references, not downloadable release approval.

# Vaultfire V3 Portable Tooling and Evidence Release

This immutable evidence directory records source-review and partner-tooling results for the Vaultfire V3 tooling release `v3-tooling-2026-08-30-r2`.

It does not deploy, activate, authorize, or offer V3 payments. The frozen V3 contract source remains unchanged and undeployed.

## Identity boundaries

| Boundary | Tag | Tag object | Commit | Tree |
| --- | --- | --- | --- | --- |
| Frozen V3 source | `v3-source-2026-08-27` | `d9757c125d547968f80d4c61bea08f6638b33dd6` | `bf4b97f65b7032c778d137bb52a432afc4615b51` | `a1fd90c26ae676c87a10e7d3e614e84961b2990c` |
| Tested tooling | `v3-tooling-2026-08-30-r2` | `49b520805f543d72dcaae6d285fade0ec0fc4025` | `241ce24db4c1417acbf936c5b412352531aba2f1` | `4486751cce5bcf3dfdbd34d124d72384916f77e0` |

The `v3-src` subtree is `0a521a25501cd9fe6a74401c99fde450128b22c9` in both releases. The portable tooling changes are outside that subtree.

The evidence publication commit is bound by annotated tag `v3-evidence-2026-08-30-r3`. Its tag annotation names the publication commit and tree and binds the SHA-256 digest of this directory's `SHA256SUMS`. This avoids falsely embedding a commit's own not-yet-known identity inside itself.

The production website commit is a separate deployment identity exposed by `/api/health` and `/.well-known/production-release.json`. It must not be treated as the commit that produced these historical test results.

## Recorded results

| Suite | Result | Boundary |
| --- | --- | --- |
| PR7 | 21 files, 136/136 tests | Tested tooling |
| SDK | 6 suites, 68/68 tests; offline install and network-denying unit-test guard | Tested tooling |
| Partner sandbox | 11/11 tests; no wallet or RPC | Tested tooling |
| Settlement recovery | 5/5 tests; one settlement, reconciliation, replay rejection, fail-closed outage, alert assertion | Tested tooling |
| V2 x402 source conformance | 12/12 tests | Tested tooling |
| Public truth and V3 fail-closed | 46/46 tests | Tested tooling |
| Portable frozen-source verifier | Pass under Python 3.12.13 | Tooling verifier applied to frozen source |

`evidence/result.json` is the sanitized machine-readable summary. Raw logs are
retained privately and are not public downloads.

## Public reproduction boundary

The complete Git-history bundle and its eight transport fragments are
withheld. They are not advertised by machine discovery and cannot be
reconstructed from this public directory. Verify only the files currently
listed by `SHA256SUMS`; use the public, history-free source archive for source
review.

The SDK unit suite is intentionally tied to the tested tooling tag, not the older frozen source tag:

```bash
cd repos/vaultfire-sdk
node --version   # v20.20.1
npm --version    # 10.8.2
npm ci --offline --ignore-scripts --no-audit --no-fund
npm run lint
npm run build
npm test -- --runInBand
```

## Safety

The retained evidence contains no Redis credentials, wallet secrets, payment signatures, authorization payloads, or private keys. No wallet, signing, payment, broadcast, contract deployment, or activation action was performed.