SUPERSEDED HISTORICAL SNAPSHOT — DO NOT USE AS CURRENT STATUS
Superseded by evidence/ARTIFACT_CLOSURE_20260831.txt,
manifests/artifact-status.json, and the current IMPLEMENTATION_REPORT.md.

Vaultfire Solana coordinated remediation — historical disposition 2026-08-31

Scope/branch
- Branch: full-v3/candidate-20260830
- Protected v3-src tree: 0a521a25501cd9fe6a74401c99fde450128b22c9
- No commit, push, deployment, signing, broadcast, wallet creation, payment activation, remote, tag, or git configuration action was performed.

Implemented
- Singleton bootstrap now requires the live BPF Upgradeable Loader ProgramData upgrade authority and exact immutable manifest/domain commitments. Immutable/legacy-loader or mismatched authority/domain paths fail closed.
- Guardian rotation/revocation and authority-only incident resolution lifecycle added.
- Standalone SP1 nonce authorization is deprecated fail-closed. The v2 path binds a canonical protected-state mutation and persists replay only after verification and action mutation in one instruction.
- SP1 public values and Groth16 proof are exact arrays (636 and 260 bytes); malformed slice lengths are exhaustively rejected around both exact bounds.
- SP1 policy/current-scope state, canonical versioned PDA seeds, monotonic config/key rotation, retirement, revocation, and current-policy checks added.
- Reward issuance_digest is an on-chain recomputed v1 commitment over every material issuance/context/provenance field.
- Mutual-aid claim equality is inclusive; recovery remains strictly after equality.
- Terminal reasons persist on aid, reward, reward-program, and isolated-vault state.
- ExecutionReceipt has the backward-compatible MandateConsumptionRecord API alias and an explicit non-execution semantic comment.
- IDL regenerated and exact-set validation added for instruction/account/argument/account-meta/discriminator projections plus source handler/account set comparison.
- Release tree gate now rejects staged, modified, and untracked candidate paths while Git-ignored caches remain allowed.

Validation results
PASS: cargo check --workspace --locked.
PASS: cargo fmt --all -- --check.
PASS: cargo clippy --workspace --all-targets --locked -- -D warnings.
PASS: cargo test --workspace --locked -- --test-threads=1: 19 passed, 0 failed (7 library + 12 adversarial; lifecycle target feature-gated).
PASS: Python IDL + release regression suite: 6 passed, 0 failed.
PASS: exact IDL validation: 59 instructions and 29 accounts; SP1 instructions/accounts included.
PASS: sha256sum -c SOURCE_SHA256SUMS.txt for current source, IDL, manifests, scripts, tests, lock, and toolchain inputs.
PASS: git diff --check -- full-v3/solana.
PASS: protected v3-src worktree/index unchanged and tree hash exact.
PASS (compile-only before artifact gate): program-test lifecycle target compiled with the explicit loader-interface dependencies and no deprecated-loader warning after correction.
EXPECTED BLOCK: scripts/check-deployment-safety.sh rejects the entire untracked Solana candidate plus untracked canonical manifest paths. This proves the untracked-path regression is active; ignored target caches are allowed by regression test.

Current non-ELF hashes
- IDL: 1ce771b588c39614423eba762870af70529d6292fd861360b083faf86eb84afc (180,617 bytes)
- Cargo.lock: 9e6f3dd3f9e38be5d8db1c62206f3c697660f9d55d209e82ef3ef2650701b040
- rust-toolchain.toml: 92d22712000a7d8c1a6c236f19967550b431b6c3ec8d89d798b214da15dd3c7f
- Anchor.toml: f1ed500ab30d0727e686d1153390090ef24046038247b2dbe764d0e498c14c5e
- SOURCE_SHA256SUMS.txt: 3fdc18b3c1ecec53b942ffccc4146495dcc66221343d119be388ee2ddb7eb6c2
- artifact-status manifest: 6411e6920fcee92546e132694cc36b7a471052ac39264098f09394ee6d599eba

Artifact and real-proof blockers
- FINAL ELF HASH: NONE. The filesystem reached 100% during validation, so no final-source SBF build completed and no two-build byte comparison was possible.
- The retained pre-remediation ELF remains physically present only as historical evidence. Its old hash 20139d4e... is explicitly NOT a final hash and must not be reused. manifests/artifact-status.json and evidence/REMEDIATION_BLOCKED_20260831.txt mark this gate blocked.
- Real-SBF lifecycle execution was not run because doing so against the stale ELF would be invalid. It must run only after two identical final-source SBF builds replace the retained evidence artifact.
- Real SP1 Groth16 success remains blocked by the intentionally all-zero program vkey; no guest ELF, final program vkey, real proof, or proof-chain success claim was produced. The host atomic state/replay helper proves failure leaves both unchanged and simulated verified success consumes exactly once; the lifecycle source adds stale/retired/downgraded/substituted/revoked scope and proof-failure rollback cases, but those await the final SBF build.
- Deployment safety remains blocked until the candidate and canonical manifest paths are tracked and clean.
- A full feature-matrix script/documentation reconciliation and full pre-existing implementation-report rewrite were not completed in this bounded pass; supported default, program-test compile, and idl-build paths were exercised separately.

Files changed/created in this remediation
- Cargo.lock
- SOURCE_SHA256SUMS.txt
- evidence/REMEDIATION_BLOCKED_20260831.txt
- evidence/REMEDIATION_FINDINGS_20260831.txt
- idl/vaultfire_v3_successor.json
- manifests/artifact-status.json
- manifests/bootstrap-binding.json
- manifests/deployment.template.json
- manifests/idl-interface-spec.json
- programs/vaultfire_v3_successor/Cargo.toml
- programs/vaultfire_v3_successor/src/errors.rs
- programs/vaultfire_v3_successor/src/lib.rs
- programs/vaultfire_v3_successor/src/mldsa_sp1.rs
- programs/vaultfire_v3_successor/src/state.rs
- programs/vaultfire_v3_successor/tests/adversarial.rs
- programs/vaultfire_v3_successor/tests/program_lifecycle.rs
- scripts/check-deployment-safety.sh
- scripts/check-release-tree-clean.py
- scripts/generate-idl.sh
- scripts/validate-idl.py
- tests/adversarial.rs
- tests/fixtures/release-status/clean.txt
- tests/fixtures/release-status/modified.txt
- tests/fixtures/release-status/staged.txt
- tests/fixtures/release-status/untracked.txt
- tests/test_idl_validation.py
- tests/test_release_safety.py
