de9a79298c
Zero dependencies, no account, no API. Every command takes --rpc, so it runs against a node you operate and never needs ours. That is the point: an exposure measurement you cannot re-run is an opinion with a logo on it. Ships with two self-checks meant to be run by you, not just by us. The second, proba-vocabular.mjs, exists because of a real defect found on 2026-08-16: the scanner emits RED / YELLOW / GREEN, two downstream files each wrote their own copy of that list, and both wrote AMBER, so a hybrid contract, exactly a client who has already started migrating, was reported as unmeasurable. Both sides were self-consistent, so nothing we had could see it. The vocabulary now has one exported source, and the test walks the whole path with a negative control that makes it able to fail. The same scanner returns RED about our own contracts. See VERIFY-US.md.
26 lines
1.6 KiB
JSON
26 lines
1.6 KiB
JSON
{
|
|
"note": "Real deployed runtime bytecode extracted from this repo's compiled Hardhat artifacts (aerenew/contracts/artifacts/contracts/pqc/*). Used by the scanner's offline path and by selftest.js. Extracted 2026-07-19.",
|
|
"fixtures": {
|
|
"AerePQCAttestation": {
|
|
"source": "contracts/artifacts/contracts/pqc/AerePQCAttestation.sol/AerePQCAttestation.json",
|
|
"expectedReadiness": "GREEN",
|
|
"why": "Directly staticcalls the live native PQC precompiles 0x0AE1..0x0AE4."
|
|
},
|
|
"AerePQCTxAccount": {
|
|
"source": "contracts/artifacts/contracts/pqc/AerePQCTxAccount.sol/AerePQCTxAccount.json",
|
|
"expectedReadiness": "GREEN",
|
|
"why": "ERC-4337 sender auth via a direct staticcall to 0x0AE1..0x0AE4."
|
|
},
|
|
"AereHybridAuth": {
|
|
"source": "contracts/artifacts/contracts/pqc/AereHybridAuth.sol/AereHybridAuth.json",
|
|
"expectedReadiness": "RED",
|
|
"why": "Semantically ECDSA + Falcon hybrid, BUT verifies Falcon via the SOLIDITY AereFalcon512Verifier contract (0x4E8e...D8fFC), not the native precompile band, so bytecode scanning cannot see the PQC leg. This is the scanner's documented scope limit, kept as a fixture so it cannot silently regress."
|
|
},
|
|
"AereFalcon512Verifier": {
|
|
"source": "contracts/artifacts/contracts/pqc/AereFalcon512Verifier.sol/AereFalcon512Verifier.json",
|
|
"expectedReadiness": "RED",
|
|
"why": "The heavy in-EVM Falcon verifier. Its 0x0100 PUSH2 constants are lattice-math literals (the number 256), not P-256 precompile calls, so the call-proximity gate correctly does not flag P-256."
|
|
}
|
|
}
|
|
}
|