Measured 2026-08-16: a 42-byte contract that merely STORES the constant 0x0AE1 and
never calls anything still scores GREEN, with the reference marked medium
confidence. So the headline colour does not separate a resolved call from a bare
constant, and a client who tests that in five minutes would find it before we
admitted it.
The scan text now says, per address, whether a CALL to each verifier resolved from
the bytecode or whether only the address is present, and says plainly that a
present address can also be plain data. The colour stays what the scanner
computes; the sentence next to it carries what it means.
Zero dependencies, no account, no API. Every command takes --rpc, so it runs
against a node you operate and never needs ours. That is the point: an exposure
measurement you cannot re-run is an opinion with a logo on it.
Ships with two self-checks meant to be run by you, not just by us. The second,
proba-vocabular.mjs, exists because of a real defect found on 2026-08-16: the
scanner emits RED / YELLOW / GREEN, two downstream files each wrote their own
copy of that list, and both wrote AMBER, so a hybrid contract, exactly a client
who has already started migrating, was reported as unmeasurable. Both sides were
self-consistent, so nothing we had could see it. The vocabulary now has one
exported source, and the test walks the whole path with a negative control that
makes it able to fail.
The same scanner returns RED about our own contracts. See VERIFY-US.md.
