Live on testnet
Verified against: F-003 (2026-11-09), F-030 (2026-11-09), F-040 (2026-11-09), F-060 (2026-11-10), F-063 (2026-11-10), F-070, F-073, F-075, F-076, F-078 (2026-11-09), F-167, F-168, F-173, F-177, F-178, F-179, F-036, F-184 (2026-11-09), F-328, F-329, F-338, F-352, F-369 (2026-11-10), C-007 (open), C-012 (open), D-016, D-018, D-019, D-025, D-026 (2026-11-10), D-027 (2026-11-11) · docs/EVIDENCE.md G2b re-run (2026-11-10T16:52Z, 91db9ea), G7 v7 (2026-11-10T16:52Z, 91db9ea), G14 (2026-11-10T16:52Z), G11 re-run (2026-11-10T16:12Z, 53f1e63), G2 (2026-11-09T20:55Z, 5f27f44), G4 + addendum (2026-11-09T22:10Z / 22:51Z), G6 (2026-11-09T22:58Z), G8 re-run (2026-11-09T23:56Z) · §v7 module runs (2026-11-10T17:20Z, 2bf99e1) · G3b re-run (2026-11-10T17:48Z, 0ed567f), G12 + G13 (2026-11-10T18:05Z, 7bface5) · rollout logs evidence/rollout/ (2026-11-11) · re-runs after D-027: G2b, G7, G13, G14 (2026-11-11T08:25Z, recorded in b8784c1), G11, G3b (2026-11-11T08:20Z / 08:24Z, recorded in 5083d30) · G9 run 3 (2026-11-11T15:30Z–15:38Z, tested 3107a1a, recorded in 837cd12) and re-run (2026-11-11T08:57Z–09:00Z, tested 0af5cdd, recorded in 89f83ee) · G3b re-run 2 after WO-49 (PASS, 2026-11-11T17:26Z–17:44Z, tested fd6592d, recorded in 5770fa7) · G14 402 → 200 verifier run and G1 gas rows on 2.2.1 (2026-11-11T13:52Z–14:18Z, tested 45ed1f3, recorded in 2e16f9b) · G14 on HEAD and the G1 2.2.1 gas-row re-check (2026-11-11T15:01Z–15:25Z, tested 48b5c5a, recorded in a677689) · docs/work/review-2-findings.md (2026-11-11), tests in apps/web/lib/copilot/verify.test.ts, apps/web/lib/api/api.test.ts, services/x402/test/borrow-guard.test.ts
Status on 2026-11-11: P0 gates G1–G3 PASS. G4 (OutLayer quoter) PASS, G6 (1Click depth) PASS. G5 (oracle): FALLBACK (disclosed), the owner oracle is in use. G8 (copilot) PASS on a fixture. v7: G1 (v7) PASS, G10 PASS (open items), G12 (Base toolchain) PASS on a local fork of Base Sepolia, not Base Sepolia (D-026). On 2026-11-11 a security fix wave was deployed (D-027): nectar-core-v2 2.2.1-v7, Solana vault v2, a redeployed EVM vault on the fork. The verifier then re-ran on that stack: G11 PASS, G2b (nectar-core-v2 deploy) PASS, G7 (Solana + signer round trip) PASS, G14 (x402) PASS for the chain claims and, in a later verifier run (recorded in 2e16f9b), for the HTTP 402 → 200 step, then on HEAD with the demo agent that checks the MCP call (recorded in a677689), G3b (web) PASS, G13 (Base round trip) PASS on the local fork. The per-method gas-row check on 2.2.1 passed on re-check (67 of 67 change methods, max 78.60 Tgas per tx, recorded in a677689); its first run (2e16f9b) had failed on one owner setter without a row, since covered by a new test (no contract change). G9 (fresh-clone rehearsal) PASS: run 3 after review 2 (docs/EVIDENCE.md §G9, 2026-11-11, tested 3107a1a, recorded in 837cd12); the first run (commit c5f6349) failed on a docs wording issue on the Evidence page, since removed. G3b web re-run 2 after review 2 and WO-49 (tested fd6592d, recorded in 5770fa7) PASS: e2e 404 passed / 0 failed, screens.spec 76/76, Lighthouse 28/28 = 100; re-run 1 had failed on screenshot tests only, fixed in WO-49. Source: docs/EVIDENCE.md (re-runs recorded in b8784c1, 5083d30, 89f83ee, 837cd12 and 5770fa7). See Audits for what was fixed and what remains.
The account ids come from packages/config/config.yaml. The current contract is nectar-core-v2.nectar.testnet, deployed beside v1 (D-018). NearBlocks returned HTTP 403 and Solana Explorer HTTP 429 to the verifier, so every chain claim was re-derived from public RPC; a human browser check of the links below is still open.
| Component | Account / id | Kind | Status |
|---|---|---|---|
| nectar-core-v2 | nectar-core-v2.nectar.testnet | contract 2.2.1-v7, code_hash 3mv4LRm6mNtyDLkR8fmaiTQmpHc12KGdfd2BLsjovFvk; upgrade txs 7J1DsrKP… (2.1.0 → 2.2.0) and EfTCTQbX… (2.2.0 → 2.2.1) | live (testnet). G2b re-run on 2.2.1-v7: PASS (EVIDENCE §G2b, recorded in b8784c1). The 2.2.1-v7 wasm rebuilt from a fresh clone with cargo near build non-reproducible-wasm matched the deployed code hash (3mv4LRm6…) on the verifier's machine; it is not the Docker reproducible build. Recovery methods: resign_remote_settlement, claim_owed_collateral (see Remote collateral on Solana). pnpm demo:testnet reads this account |
| keeper-v2 | keeper-v2.nectar.testnet | one function-call key for 5 methods, no full-access key (D-019) | key verified (G2b); the daemon is run locally, not continuously. Its relay reports are advisory: nectar-core does not verify the remote tx (Trust model). See Run a keeper |
| mock USDC | usdc-mock.nectar.testnet | mock NEP-141, 6 decimals | live (testnet). Code-only upgrade for v7 (raw-key multiplier()); code_hash 55hvEq… in G2b; upgraded again 2026-11-11 (SR-27: registration is charged) |
| mock NVDAx | nvdax-mock.nectar.testnet | mock collateral, 6 decimals, same code as mock USDC | live (testnet) |
| owner | nectar.testnet | deployer; sets params and the owner price | live (testnet) |
| Aggregate limit + Weekend Oracle Guard | get_exit_capacity, get_session_calendar on v2 | contract checks | live on testnet (EVIDENCE §G2b). Total debt, shared capacity and headroom are returned; 287 NYSE windows are loaded. The closed-window refusal is tested in the sandbox only. See Aggregate borrowing limit, Weekend Oracle Guard |
| OutLayer TEE quoter (v2) | version_key 5f9bb287…581bc062 pinned since 2026-11-11 (the G7 evidence ran on 5d90edb8…0f891fc9) | TEE program (F-040) | live (testnet), EVIDENCE §G7. Trigger tx HrpQsuMW…: request 16453 completed, quoter_result filled quotes at 250, 300 and 400 bps. Demo inputs; the TDX quote is not verified on-chain. See Quoter (TEE) |
| OutLayer-attested deposits | same version (vault_read job) | TEE read of the Solana vault | live (testnet), EVIDENCE §G7. Confirm txs 8XXvnBVN…, 8hNqxAdC…: remote_deposit_confirmed {source: outlayer}. The keeper attestation path is the labelled testnet fallback and was not used |
| Remote collateral on Solana | nectar_vault ENZaNF…pubW (devnet) + v1.signer-prod.testnet (F-030, F-184) | Anchor program + MPC signer; one derived Ed25519 key per position (F-338) | live (devnet + testnet), G7 PASS on vault v2 + 2.2.1-v7 (2026-11-11) and earlier on the v1 vault layout. Upgraded in place to vault v2 on 2026-11-11: depositor-bound slots, nonces per slot and authority, pull payouts (withdraw by the depositor, claim by a buyer whose token account cannot receive). G7 re-run on v2 (EVIDENCE §G7, recorded in b8784c1): positions 8 (loan refused by the aggregate limit, released), 9 (released) and 10 (settled, +2.386856 NVDAx to the buyer), each followed by the depositor's withdraw. Earlier G7 PASS evidence (v1 layout): release 5fTihnbJ… (position #2) and settle 3cdcQru2… (position #3): ix0 Ed25519 verify of the NEAR-signed message, ix1 the vault instruction, both finalized with no error. See Remote collateral on Solana |
| x402 paid Feed export | x402-relayer.nectar.testnet, agent1.nectar.testnet | delegated payment in mock USDC (F-328, F-329) | live (testnet), G14 PASS. Relay tx 5VL1P4kg… pays 0.01 mock USDC from agent1 to nectar.testnet; agent borrow tx GcHF75nW… opened position #4 with a 30 bps origination fee. Re-run on 2.2.1-v7: borrow tx HvFX6YRa… (position #13) and relay tx BemztvL9… verified on chain (EVIDENCE §G14 re-run, recorded in b8784c1). The verifier then ran the HTTP leg itself from a fresh clone (EVIDENCE §G14, 2026-11-11T13:54Z–13:55Z, recorded in 2e16f9b): unpaid GET → 402 with the route terms, borrow tx 7UFpexpd… (position #14), relay tx EskZKj9s…, paid GET → 200 with the CSV (110 rows). The demo agent now checks the MCP call before signing; the verifier re-ran G14 with it on HEAD (EVIDENCE §G14, 2026-11-11T15:02Z, recorded in a677689): borrow_verified logged before signing, borrow tx E2suM2LC… (position #15), relay tx 4vW2tPF5…, paid GET → 200 with 123 CSV rows. See Agent skill and x402 |
| Base spoke (EVM vault) | vault 0xC64b733424C8d25fB574F275007ED8756e261226, MockB20 0x634F88DAEf0a1f77645c523C3FA351Fe37aaf81d | EVM vault + EIP-712 signatures from Chain Signatures (domain 0) | local fork of Base Sepolia (anvil, chain id 84532), not Base Sepolia (D-026). G12 + G13 PASS on the fork with the earlier vault 0xC4f4…3d09. Redeployed 2026-11-11 (slot-scoped nonces, depositor-keyed slots); G13 re-run PASS on the fork (EVIDENCE §G13, recorded in b8784c1): position 11 released, 12 settled, replays revert with NonceUsed. Deposits use the labelled keeper attestation. No public explorer |
| Position Notes | NEP-171 tokens on v2 | contract feature | live on testnet (EVIDENCE §G2b, §G14). See Position Notes |
| Shields, Profit-Lock, Nectar Reserve | nectar-core-v2 | contract features | ran on testnet 2026-11-10 (evidence/v7-modules/summary.md); resulting state checked in EVIDENCE §v7 module runs (2bf99e1); the Profit-Lock self_settled event is not chain-confirmed. See Shields, Profit-Lock, Nectar Reserve |
| oracle | owner oracle (update_owner_price) | owner oracle (disclosed), badge shown in UI | in use for NVDAx. The Pyth path is built and sandbox-tested but has no NVDA price on testnet (C-007, handoff H13; C-012). G5: FALLBACK (disclosed). Current value: run pnpm demo:testnet. See Oracle policy |
| settlement discount fallback | quote's max_discount_bps | fallback | used when the quoter fails or is denied (request 15145, G4 addendum run C; G4 run A) |
| 1Click depth | dry: true quotes only (F-002, F-060) | read-only, signed quotes, mainnet API | G6 PASS. NVDAx has no route (F-063), so D_c = 0. See 1Click depth |
| Feed REST / MCP + agent skill tools | local only | read-only, no keys | built; runs locally, no public host. get_note and build_self_settle still return not_available. No gate has run the MCP server with an agent client. See Feed MCP |
| NEAR AI copilot | web app panel, NEAR AI Cloud cloud-api.near.ai (F-070) | P2; prose only, never a contract input | built; no live NEAR AI answer has been verified yet. Live mode needs key H7, and NEAR AI Cloud returned 500 on 2026-11-09 (F-078). The panel shows an answer only when it is signed by an attested NEAR AI TEE (signature and attestation checks pass). That shows where the text came from, not that it is right, and it is not advice. The answer is bound to the question you typed and the announced model: the browser rebuilds the request from the notes it sent and requires the signed request and model id to match (checks request_matches_input and model_id). /api/copilot accepts same-origin JSON requests only (8 KB cap) and is rate-limited: 5 live calls a minute per client, 30 overall. Tests run on a fixture (Phala dcap-qvl sample TDX quote plus a chat signed by a throwaway key), not a NEAR AI recording. Intel DCAP verification runs on the server (F-073); EIP-191 recovery and report_data/nonce checks run in the browser (F-075, F-076). G8: PASS (fixture) |
| web app on v2 | pnpm --filter web dev | UI | Latest G3b re-run (re-run 2, after the review 2 web fixes and WO-49; EVIDENCE §G3b, recorded in 5770fa7): PASS, e2e 404 passed / 0 failed / 88 skipped (desktop 229/0/17, phone 175/0/71), e2e/screens.spec.ts 76/76, Lighthouse 28/28 = 100, security headers present, pnpm verify green; re-run 1 had failed on screenshot tests only, fixed in WO-49. Earlier G3b re-run after D-027 and the design port: PASS (EVIDENCE §G3b, recorded in 5083d30): e2e 392 passed / 0 failed / 82 skipped, accessibility ≥ 90 on all 22 route/theme pairs. The vault v2 screens (withdraw, claim, Re-sign settlement, claim owed collateral) passed their mocked E2E tests in that run on desktop and phone (e2e/remote.spec.ts, "Solana remote borrow (mocked)"). Only screenshot capture was not run (REMOTE_SCREENS and NOTES_SCREENS unset) |
Earlier deployment: v1 (kept as evidence)
| Component | Account / id | Status |
|---|---|---|
| nectar-core (v1) | nectar-core.nectar.testnet, code_hash CFTfzY4APx3fBsebqQ8SqcfLVVcShKe4TdD48Sapgi5t | on testnet; code unchanged since the P2 upgrade at 2026-11-09T23:40Z (see Upgrades). G1–G3, G4, G6 and the first G7 run were recorded against it |
| keeper (v1) | keeper.nectar.testnet | one function-call key for 2 methods, no full-access key (D-012) |
| OutLayer quoter (v1) | project nectar.testnet/nectar-quoter, version_key 3ce17749…6cc2 | G4 PASS: request 15148 returned 159 bps against a 400 bps cap (attestation JSON, F-168, F-179) |
| Chain Signatures, NEAR side (v1) | trigger tx FCtApD2L…MHhe, position #6 | signer side verified 2026-11-09T23:57Z (G7 v6 PARTIAL, superseded by G7 v7). Placeholder program id; position #6 stays Settling by design |
Not on testnet yet
| Module | Status | Page |
|---|---|---|
| Corporate-action multiplier | built and tested in the sandbox; product flag off; no testnet run; OutLayer multiplier job has no recorded testnet execution; xStocks mechanism unverified (F-352) | Corporate-action multiplier |
pay_to and registered referrers | built and tested in the sandbox; product flags off; no testnet run (the 30 bps origination fee itself is live, G14) | Fee stack and referrals |
| Base spoke on Base Sepolia itself | built; runs only on a local fork until the deployer is funded (H15) | — |
What "mock", "fallback" and "PROD-only" mean here
- Mock: a stand-in we deployed ourselves with no value. The tokens are mocks, and so is the owner-set price.
- Fallback: a permanent code path used when the better source is not available. If the OutLayer quoter fails or is denied, settlement prices at the quote's
max_discount_bps(D-004). The oracle is owner-set until a live Pyth price exists (D-005, D-013). Remote deposits can be confirmed by a keeper attestation if the OutLayer read is unavailable; the Feed labels it. All are disclosed in the UI. - PROD-only: designed but not built here. This covers mainnet, real xStocks, keeper bonds and slashing, and a DAO owner with a timelock. See Roadmap.
Demo state
Snapshot on v2 at 2026-11-10T16:52Z (EVIDENCE §G2b re-run): pool $36,500 available, $13,500 utilised; quotes #0 $5,000 at 400 bps, #1 $10,000 at 250 bps, #2 $629.56 at 300 bps; positions #0 and #1 open, #2 and #3 closed by the G7 round trip. Since then position #4 was opened by the G14 agent borrow, and the module runs (evidence/v7-modules/summary.md) self-settled position #0, added quote #3 ($5,000 at 450 bps), Shield position #5 and Reserve Note r-NVDAx-0. Live state (price, Q_c, open positions) is not hard-coded on this page; current value: run pnpm demo:testnet. Demo accounts: buyer1.nectar.testnet, buyer2.nectar.testnet, borrower1.nectar.testnet.
Explorers: NEAR https://testnet.nearblocks.io/address/<id>, OutLayer attestations https://testnet-api.outlayer.ai/attestations/by-request/<id> (API JSON, F-168; dashboard https://app.outlayer.ai/executions, F-169), Solana https://explorer.solana.com/?cluster=devnet.