Verify

Every claim, next tothe code that proves it.

Each claim from the landing page with the contract method that implements it, the test that proves it, and what this page read from chain on this request. Where a live network has not run a path yet, the page says so.

Network: mainnet
Registry: incorpr.near
Signer: v1.signer
Tests in source: 77 sandbox, 24 unit
Evidence: 75 transactions, 1 company, updated 2026-11-06 17:59 UTC

01Live checks

Read from chain on this request.

JSON-RPC calls made while this page rendered: view_account, view_access_key_list and view_code on each account, plus the signer's derived keys for each vault.

Network

checked 2026-11-10T13:08:13.491Z

NEAR mainnet RPCmainnet, protocol 88, block 223,920,228 via https://rpc.mainnet.fastnear.com

Pass

External contracts the app calls, checked with view_account
Role	Account	Network	view_account	Code hash
Chain Signatures signer	v1.signer	mainnet	PassContract deployed, 1,164,178 bytes of storage	CpGX8ywXJw…fc3APERJ
NEAR Intents verifier	intents.near	mainnet	PassContract deployed, 13,538,562,387 bytes of storage	BtA1BEFNS6…n7xNothk
USDC token	17208628f84f5d6ad3…11e36133a1	mainnet	PassContract deployed, 66,454,277 bytes of storage	DVJx7F3dHE…cY5oNX8q

Registry and vaults

incorpr.near

Registry contract deployedContract deployed, 835,962 bytes of storage

Pass

Registry code hash equals contracts/res/incorpr_registry.wasmOn chain BD1oUGVmyi17bVyxB1NzuAda1LgULoTfvuQ4mfQhWgYA, repo BD1oUGVmyi17bVyxB1NzuAda1LgULoTfvuQ4mfQhWgYA

Pass

Registry code hash equals the evidence log (deploy, or its latest upgrade)Evidence log: BD1oUGVmyi17bVyxB1NzuAda1LgULoTfvuQ4mfQhWgYA, upgraded in place from EZ4ZuzRAMP…ptTHEnqK by tx Azkez5n9kU…fdXWFBfx

Pass

Full access keys on the registry account1. Whoever holds it can redeploy registry code. Vault code and keys are not affected.

Note

Vault code is embedded in the registry's deployed codeThe vault code (view_code) appears byte for byte in the registry's deployed code (view_code). Vault sha256 f86d3778e50fbb7d7ca31d70d8e72d14d7afa4d5cd2de2756c958ad7b9e15c4c

Pass

Vaults (1)

#1 Ledgerline Auditc-1.incorpr.near

FREE

Zero access keysview_access_key_list returned no keys

Pass

Code hashHikhecrHTSDFybvrHrKaKa2reCo1hjfFzsJ4tcvJhpP5. Equals the hash of contracts/res/company_vault.wasm

Pass

Treasury addressesStored epoch 1 addresses equal an off-chain derivation from v1.signerbtcbc1qvdpl…9hxsutevm0x1aa8c3…c41dcfsol7rjTVFMS…x1X9jK

Pass

Charter media_hashsha256 of the on-chain SVG equals media_hash

Pass

Raw signatures this epoch0. Above zero blocks listing and pledging.

Pass

Read from the contract source on this request

The registry compiles the vault wasm into its own codecontracts/incorpr-registry/src/lib.rs:30

Passconst VAULT_WASM: &[u8] = include_bytes!("../../res/company_vault.wasm");

Each company account is created, funded and given exactly that codecontracts/incorpr-registry/src/lib.rs:477

Pass.deploy_contract(VAULT_WASM.to_vec())

The creation batch adds no access keycontracts/incorpr-registry/src/lib.rs:474

Pass

Promise::new(vault) .create_account() .transfer(NearToken::from_yoctonear(funding)) .deploy_contract(VAULT_WASM.to_vec()) .function_call("new", init.to_string().into_bytes(), NO_DEPOSIT, GAS_VAULT_NEW)

The vault source never adds a key, deploys code or deletes its accountcontracts/company-vault/src/lib.rs, contracts/company-vault/src/chain.rs

Pass

No public vault method upgrades code or manages keyscontracts/res/company_vault_abi.json lists 30 public methods. None is named for an upgrade, a deploy or a key change.

Pass

contracts/res/company_vault.wasm340,329 bytes, sha256 f86d3778e50fbb7d7ca31d70d8e72d14d7afa4d5cd2de2756c958ad7b9e15c4c, NEAR code hash HikhecrHTSDFybvrHrKaKa2reCo1hjfFzsJ4tcvJhpP5

Note

02Claims

What the landing page says, and how to check it.

Test names are looked up in the contract sources on each request. Live evidence comes from docs/evidence/mainnet.json, which only scripts/deploy.mjs and scripts/demo.mjs write. Each entry links to the transaction on the explorer.

The sub-account has no access keys, so there is no seed phrase for a seller to keep.

Landing page: Hero

Contract method

incorporate_company

Proved by

test_incorporate_spawns_subaccount_and_mints_nep171sandbox test, contracts/integration-tests/tests/sandbox.rs:594

Live evidence

Live passchecked on this page load

1 of 1 vaults: view_access_key_list returned zero keys.

incorporate_companysuccess

incorporate "Ledgerline Audit": create keyless vault sub-account and mint the NFT

2xPK7TCGCM…Pg2oTJHX

Each vault runs the code the registry embeds, and has no upgrade method.

Landing page: Built on: NEAR sub-accounts

Contract method

incorporate_company

Proved by

test_incorporate_spawns_subaccount_and_mints_nep171sandbox test, contracts/integration-tests/tests/sandbox.rs:594

Live evidence

Live passchecked on this page load

1 of 1 vaults: code hash equals contracts/res/company_vault.wasm. Embedded in the registry's deployed code: yes.

incorporate_companysuccess

incorporate "Ledgerline Audit": create keyless vault sub-account and mint the NFT

2xPK7TCGCM…Pg2oTJHX

The NFT is minted only if the vault deploys. A failed deployment refunds the deposit.

Landing page: How it works: Incorporate

Contract method

incorporate_companyon_company_created

Proved by

test_incorporation_validation_and_failed_batch_refundsandbox test, contracts/integration-tests/tests/sandbox.rs:2426

test_sync_is_refused_on_an_encumbered_vault_and_mint_event_is_exactsandbox test, contracts/integration-tests/tests/sandbox.rs:4173

Live evidence

incorporate_companysuccess

incorporate "Ledgerline Audit": create keyless vault sub-account and mint the NFT

2xPK7TCGCM…Pg2oTJHX

Bitcoin, EVM and Solana addresses are derived on-chain from the MPC signer. The vault composes every derivation path.

Landing page: Built on: Chain Signatures

Contract method

refresh_treasury_keysrotate_treasury_epoch

Proved by

test_refresh_treasury_keys_matches_independent_derivationsandbox test, contracts/integration-tests/tests/sandbox.rs:2192

test_live_testnet_key_vector_with_independent_librariessandbox test, contracts/integration-tests/tests/sandbox.rs:2797

bip173_mainnet_and_testnet_vectorsunit test, contracts/company-vault/src/chain.rs:220

live_testnet_key_addressesunit test, contracts/company-vault/src/chain.rs:259

stale_key_derivation_after_rotation_is_ignoredunit test, contracts/company-vault/src/lib.rs:1662

Live evidence

Live passchecked on this page load

1 of 1 vaults: stored addresses equal an off-chain derivation from the signer.

refresh_treasury_keyssuccess

derive treasury addresses for token 1 on-chain

EMDJGJn41T…ZCaXjfcZ

da6679b0…4b6a8fda6679b0…4b6a8f

Revenue is booked from USDC transfers. No account can report revenue.

Landing page: The problem

Contract method

ft_on_transferreport_metrics

Proved by

test_revenue_split_refunds_and_related_partysandbox test, contracts/integration-tests/tests/sandbox.rs:1243

test_operator_cannot_credit_revenue_and_metrics_only_from_vaultsandbox test, contracts/integration-tests/tests/sandbox.rs:1349

test_vault_keeps_accepting_revenue_at_record_capacitysandbox test, contracts/integration-tests/tests/sandbox.rs:3856

test_registry_metrics_follow_deposits_and_are_datedsandbox test, contracts/integration-tests/tests/sandbox.rs:3945

Live evidence

ft_transfer_callsuccess

pay 0.050000 USDC for one call to Ledgerline Audit

HovPj1W2PK…2CrFXLfb

ft_transfer_callsuccess

pay 0.050000 USDC for one call to Ledgerline Audit

rNYr45nTYi…XhxixcQx

30-day revenue is not sybil-resistant: only the current shareholder's own payments are excluded.

The service route checks the on-chain payment before it runs inference.

Landing page: How it works: Earn

Contract method

get_paymentrecord_service_call

Proved by

test_operator_cannot_credit_revenue_and_metrics_only_from_vaultsandbox test, contracts/integration-tests/tests/sandbox.rs:1349

test_seller_operator_cannot_act_while_encumberedsandbox test, contracts/integration-tests/tests/sandbox.rs:3461

Live evidence

record_service_callsuccess

operator marks call 59947944cbbe served by TEE chat chatcmpl-3e29b917-c667-4191-b16c-f706743442a1

3iLE29jPqe…UCKroLbz

Qwen/Qwen3-VL-30B-A3B-Instruct

TEE chat chatcmpl-3e29b917-c667-4191-b16c-f706743442a1, call 59947944cb…73d0e14d, signed by 0x2665cce942fa427ef30d87f4b0bff67fb7645462

Raw L1 signing by the shareholder is frozen while the company is listed or pledged.

Landing page: Company state

Contract method

request_shareholder_signaturesign_legacy_epochrotate_treasury_epoch

Proved by

test_anti_rug_encumbrance_freezes_seller_mpc_signingsandbox test, contracts/integration-tests/tests/sandbox.rs:665

test_credit_offer_accept_repay_cyclesandbox test, contracts/integration-tests/tests/sandbox.rs:1615

test_transfer_call_gives_no_vault_rights_until_kept_and_revert_changes_nothingsandbox test, contracts/integration-tests/tests/sandbox.rs:3180

Live evidence

request_shareholder_signaturerejected as expected: ERR_ACCOUNT_ENCUMBERED_SIGNING_FROZEN

shareholder asks the MPC signer to sign a payload for the BTC treasury key while listed

DwLfeptiuL…2ZHVxEXG

Dividend claims are frozen while the company is listed or pledged.

Landing page: Company state

Contract method

claim_dividends

Proved by

test_dividends_bounded_frozen_and_restoredsandbox test, contracts/integration-tests/tests/sandbox.rs:1420

test_failed_bid_callback_refunds_gives_no_rights_and_can_be_recoveredsandbox test, contracts/integration-tests/tests/sandbox.rs:3570

Live evidence

claim_dividendsrejected as expected: ERR_ACCOUNT_ENCUMBERED_CLAIM_FROZEN

shareholder tries to pay itself retained earnings while Listed

2ZujvBZpKB…5P4kTqSx

claim_dividendsrejected as expected: ERR_ACCOUNT_ENCUMBERED_CLAIM_FROZEN

shareholder tries to pay itself retained earnings while Pledged

Du7yUNyxL9…oyMSSQbE

claim_dividendssuccess

shareholder claims 0.040000 USDC of retained earnings

5WW8cPNcN2…ky54nCgn

A direct NFT transfer is refused while the company is listed or pledged.

Landing page: Company state

Contract method

nft_transfernft_transfer_payout

Proved by

test_credit_offer_accept_repay_cyclesandbox test, contracts/integration-tests/tests/sandbox.rs:1615

test_nft_transfer_syncs_vault_and_approvals_clearsandbox test, contracts/integration-tests/tests/sandbox.rs:1961

test_nep199_payout_respects_royalty_and_encumbrancesandbox test, contracts/integration-tests/tests/sandbox.rs:2100

Live evidence

nft_transferrejected as expected: ERR_TOKEN_ENCUMBERED

owner tries to move the company NFT to another account while Listed

4tg5N6kTxw…mGcLUpXB

nft_transferrejected as expected: ERR_TOKEN_ENCUMBERED

owner tries to move the company NFT to another account while Pledged

CE7Yp11fZa…bVJwgGRe

Policy changes, operator changes and agent swaps are frozen while the company is listed or pledged.

Landing page: Company state

Contract method

set_policyset_operatoragent_swap_intentagent_withdraw_intent

Proved by

test_new_shareholder_gets_charter_policy_not_seller_policysandbox test, contracts/integration-tests/tests/sandbox.rs:1191

test_withdraw_intent_frozen_while_listed_and_pledgedsandbox test, contracts/integration-tests/tests/sandbox.rs:4125

test_pledge_obeys_the_same_freeze_rules_as_listingsandbox test, contracts/integration-tests/tests/sandbox.rs:2808

Live evidence

The demo script does not run this path on a live network. The tests above do, on a local sandbox.

A company that signed any raw payload this epoch cannot be listed or pledged until the shareholder rotates to new addresses.

Landing page: Security model: pre-signed transaction rule

Contract method

request_shareholder_signaturelist_companyaccept_offerrotate_treasury_epoch

Proved by

test_listing_requires_clean_epoch_and_rotation_changes_addressessandbox test, contracts/integration-tests/tests/sandbox.rs:743

test_signature_raced_before_freeze_fails_listing_and_leaves_no_locksandbox test, contracts/integration-tests/tests/sandbox.rs:821

test_sale_paths_refuse_dirty_keys_and_owner_transfer_rotatessandbox test, contracts/integration-tests/tests/sandbox.rs:3102

test_pledge_obeys_the_same_freeze_rules_as_listingsandbox test, contracts/integration-tests/tests/sandbox.rs:2808

Live evidence

request_shareholder_signaturesuccess

MPC signature for input 0 of a BTC spend from bc1q46d395d4m3s209vl7vpgmdenqynnhge8ccscs0

ENe31utHVK…QquEFQ1R

list_companyrejected as expected: ERR_SETTLEMENT_FAILED

owner holds an unbroadcast BTC transaction signed this epoch, then tries to list: refused

288ZLY6r1w…ur8CVWi1

rotate_treasury_epochsuccess

move the company to treasury epoch 1 after its epoch 0 BTC was moved across; resets raw_sigs_this_epoch

FFBtsc72iG…DizzyZz4

list_companysuccess

after rotation the same owner lists successfully

5T4tbMdjHZ…jCL734X6

1 more in docs/evidence/mainnet.json

On mainnet the vault refused the listing with ERR_RAW_SIGNATURES_THIS_EPOCH; the registry then reports ERR_VAULT_FREEZE_FAILED and ERR_SETTLEMENT_FAILED, which is the error the evidence log keeps.

An agent intent that has not reached its deadline blocks listing, pledging and every change of owner.

Landing page: Security model

Contract method

agent_swap_intentlist_companynft_transfer

Proved by

test_unexpired_agent_intent_blocks_encumbrance_until_deadlinesandbox test, contracts/integration-tests/tests/sandbox.rs:868

test_unexpired_intent_blocks_every_owner_changesandbox test, contracts/integration-tests/tests/sandbox.rs:3152

Live evidence

The demo script does not run this path on a live network. The tests above do, on a local sandbox.

On purchase, shareholder rights are suspended, the NFT and funds move, the founder royalty is paid, and only then does the buyer become shareholder. If the vault step fails, the buyer is refunded.

Landing page: How it works: Sell

Contract method

list_companyft_on_transfer {"action":"acquire"}begin_transitapply_encumbrance

Proved by

test_atomic_ma_acquisition_flips_shareholder_and_pays_royaltysandbox test, contracts/integration-tests/tests/sandbox.rs:698

test_acquire_is_bound_to_the_listing_the_buyer_readsandbox test, contracts/integration-tests/tests/sandbox.rs:3322

test_vault_failure_leaves_no_stuck_lock_and_refunds_via_resolvesandbox test, contracts/integration-tests/tests/sandbox.rs:1815

test_failed_bid_callback_refunds_gives_no_rights_and_can_be_recoveredsandbox test, contracts/integration-tests/tests/sandbox.rs:3570

Live evidence

list_companysuccess

list "Ledgerline Audit" for 1.000000 USDC

4au7synMju…4HTfAiKz

ft_transfer_callsuccess

buy token 1 for 1.000000 USDC at sync_nonce 1

4Tu3Xabccs…S8xCkcKZ

list_companysuccess

list "Ledgerline Audit" for 0.500000 USDC

648kaf3JKE…vo8jSzsA

ft_transfer_callsuccess

buy token 1 for 0.500000 USDC at sync_nonce 11

GYEdkNAoUo…Pa3YoKVi

6 more in docs/evidence/mainnet.json

When the owner accepts a loan, the vault freezes first and the principal is sent second. Repayment unfreezes it.

Landing page: How it works: Finance

Contract method

ft_on_transfer {"action":"fund_offer"}accept_offerft_on_transfer {"action":"repay"}

Proved by

test_credit_offer_accept_repay_cyclesandbox test, contracts/integration-tests/tests/sandbox.rs:1615

test_lender_terms_refuse_a_stripped_companysandbox test, contracts/integration-tests/tests/sandbox.rs:3369

test_offers_pay_their_own_storagesandbox test, contracts/integration-tests/tests/sandbox.rs:3696

Live evidence

storage_depositsuccess

lender prepays registry storage for one loan offer

HYn9vNApaA…NsqRPWgP

ft_transfer_callsuccess

offer 1.000000 USDC against token 1, repay 1.010000 USDC

7m656gNJoB…gLP5PWdR

accept_offersuccess

owner pledges token 1 and borrows 1.000000 USDC

3gA99cMdWi…XCvQB5fj

ft_transfer_callsuccess

repay 1.010000 USDC on token 1

69jjS9SsTg…eafeVMcY

6 more in docs/evidence/mainnet.json

After a default, a Dutch auction runs from 200% down to 50% of the debt. With no bid, the lender can claim the company.

Landing page: How it works: Finance

Contract method

start_auctionft_on_transfer {"action":"bid"}claim_defaulted_collateral

Proved by

test_default_dutch_auction_bid_pays_lender_royalty_borrowersandbox test, contracts/integration-tests/tests/sandbox.rs:1708

test_no_bid_lender_claims_collateralsandbox test, contracts/integration-tests/tests/sandbox.rs:1771

test_auction_vault_failure_refunds_bidder_and_keeps_loansandbox test, contracts/integration-tests/tests/sandbox.rs:2542

Live evidence

The demo script does not run this path on a live network. The tests above do, on a local sandbox.

The operator sends structured fields and never bytes to sign. A withdrawal can only go to the company's own addresses.

Landing page: Security model: agent firewall

Contract method

agent_withdraw_intentagent_swap_intent

Proved by

test_firewall_blocks_prompt_injected_agent_drainsandbox test, contracts/integration-tests/tests/sandbox.rs:648

test_firewall_tokens_and_epoch_capssandbox test, contracts/integration-tests/tests/sandbox.rs:975

test_price_floor_bounds_a_swap_even_with_a_valid_approvalsandbox test, contracts/integration-tests/tests/sandbox.rs:2970

Live evidence

agent_deposit_to_intentssuccess

move 0.500000 USDC of retained earnings to intents.near (ft_transfer_call, msg = vault)

856Sf7uijk…jVRatFCM

agent_swap_intentsuccess

swap 0.500000 USDC for 5545636 lamports (0.005545636 SOL) on intents.near (TEE chat chatcmpl-9925e457-37a6-4ed5-a159-88a88116f9cf)

4AmTFGH5Lb…uf9XAkvi

1Click dry quote1Click: No liquidity available

nep141:17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1 to nep141:btc.omft.near, 16000 in against a floor of 20

1Click dry quotequoted

nep141:17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1 to nep141:sol.omft.near, 12000 in, 131256 min out against a floor of 118949

One treasury swap ran on mainnet: 0.5 USDC to 0.005545636 SOL, settled by the solver relay (docs/evidence/rebalance-mainnet.json). The quotes below are dry 1Click quotes.

The vault recovers the TEE signer with ecrecover before it acts on an approval.

Landing page: Built on: NEAR AI Cloud

Contract method

agent_swap_intentagent_withdraw_intentswap_tee_request

Proved by

test_tee_proof_checks_and_onchain_ecrecoversandbox test, contracts/integration-tests/tests/sandbox.rs:891

test_tee_approval_is_bound_to_the_pinned_requestsandbox test, contracts/integration-tests/tests/sandbox.rs:2897

test_only_an_exact_approve_message_countssandbox test, contracts/integration-tests/tests/sandbox.rs:3017

test_approval_lifetime_binding_to_vault_epoch_and_ownersandbox test, contracts/integration-tests/tests/sandbox.rs:3054

Live evidence

agent_swap_intentsuccess

swap 0.500000 USDC for 5545636 lamports (0.005545636 SOL) on intents.near (TEE chat chatcmpl-9925e457-37a6-4ed5-a159-88a88116f9cf)

4AmTFGH5Lb…uf9XAkvi

tee_signers7 of 8 attestation checks passed at deploy

0x2665cc…645462

A compromised operator can resubmit until a nondeterministic model approves. The epoch cap and price floor bound the loss per window.

A listed or pledged company keeps taking payments and serving calls. Only the charter operator can serve calls or pay compute then.

Landing page: Company state

Contract method

ft_on_transferrecord_service_callpay_compute_bill

Proved by

test_seller_operator_cannot_act_while_encumberedsandbox test, contracts/integration-tests/tests/sandbox.rs:3461

test_compute_bill_only_from_reserve_to_payee_and_intents_depositsandbox test, contracts/integration-tests/tests/sandbox.rs:1470

Live evidence

The demo script does not run this path on a live network. The tests above do, on a local sandbox.

The registry updates the vault's owner and encumbrance. It cannot sign anything on the vault's behalf.

Landing page: Security model: who can do what

Contract method

sync_ownerbegin_transitapply_encumbrance

Proved by

test_role_separation_and_registry_only_syncsandbox test, contracts/integration-tests/tests/sandbox.rs:1063

test_sync_is_refused_on_an_encumbered_vault_and_mint_event_is_exactsandbox test, contracts/integration-tests/tests/sandbox.rs:4173

Live evidence

The demo script does not run this path on a live network. The tests above do, on a local sandbox.

The token media is an on-chain SVG charter, and media_hash is its sha256.

Landing page: Built on: NEP-177 on-chain SVG charter

Contract method

nft_token

Proved by

test_media_hash_is_the_hash_of_the_rendered_chartersandbox test, contracts/integration-tests/tests/sandbox.rs:3976

date_known_instantsunit test, contracts/incorpr-registry/src/charter.rs:290

Live evidence

Live passchecked on this page load

1 of 1 vaults: sha256 of the on-chain SVG equals media_hash.

A payout that is still in flight when the company is sold, pledged or moved cannot pay the seller twice or send the buyer's money to the seller. Each race runs both transactions in the same blocks and checks whichever order the chain produced.

Landing page: Security model: transfer threat model (docs/THREAT_MODEL.md, A8)

Contract method

claim_dividendson_dividends_paidnft_transfer_payoutlist_companyaccept_offerpay_compute_billagent_deposit_to_intentswithdraw_pending

Proved by

test_claim_in_flight_when_a_marketplace_sale_landssandbox test, contracts/integration-tests/tests/transfer_races.rs:588

test_failed_claim_restores_to_the_company_after_an_owner_transfersandbox test, contracts/integration-tests/tests/transfer_races.rs:681

test_listing_with_a_claim_in_flight_is_safe_for_the_buyersandbox test, contracts/integration-tests/tests/transfer_races.rs:756

test_pledge_with_a_claim_in_flight_honours_lender_termssandbox test, contracts/integration-tests/tests/transfer_races.rs:861

test_customer_payment_mid_sale_is_booked_to_the_company_for_the_buyersandbox test, contracts/integration-tests/tests/transfer_races.rs:933

test_failed_compute_bill_during_a_sale_restores_the_reservesandbox test, contracts/integration-tests/tests/transfer_races.rs:1013

test_intents_deposit_in_flight_when_an_owner_transfer_landssandbox test, contracts/integration-tests/tests/transfer_races.rs:1090

test_concurrent_acquires_settle_once_and_refund_the_restsandbox test, contracts/integration-tests/tests/transfer_races.rs:1173

test_failed_sale_payouts_stay_with_the_seller_through_a_resalesandbox test, contracts/integration-tests/tests/transfer_races.rs:1222

test_principal_and_repayment_payouts_through_a_repay_and_a_salesandbox test, contracts/integration-tests/tests/transfer_races.rs:1282

test_auction_proceeds_and_pledge_period_revenue_reach_the_right_accountssandbox test, contracts/integration-tests/tests/transfer_races.rs:1388

test_cancel_racing_accept_pays_the_principal_oncesandbox test, contracts/integration-tests/tests/transfer_races.rs:1452

test_repay_racing_a_bid_settles_oncesandbox test, contracts/integration-tests/tests/transfer_races.rs:1524

Live evidence

claim_dividendssuccess

shareholder claims 0.040000 USDC of retained earnings

5WW8cPNcN2…ky54nCgn

These tests live in contracts/integration-tests/tests/transfer_races.rs. A failed dividend transfer goes back to retained_earnings, which belongs to whoever is shareholder when the callback runs; a failed registry payout stays credited to its account. No failed payout has happened on mainnet.

The owner room at /company/<id>/owner opens only for the account nft_token names as owner. Access is checked against the chain on every request, so a sale moves it to the buyer.

Landing page: Company page: Owner room, holder only

Contract method

nft_token

Proved by

opens for the holder and refuses the same cookie once nft_token names someone elsenot found in the contract sources

ends the session once the key that signed in is deleted or downgraded, while the account still holds the tokennot found in the contract sources

answers 401 without a cookie, 403 after a sale, and passes the holdernot found in the contract sources

refuses a function-call access keynot found in the contract sources

refuses a signature for another recipientnot found in the contract sources

issues a challenge for the configured host when a relay sends X-Forwarded-Host: phish.examplenot found in the contract sources

Live evidence

The demo script does not run this path on a live network. The tests above do, on a local sandbox.

Vitest tests in web/tests/ownerAuth.test.ts, with real NEP-413 signatures and a mocked RPC; web/tests/ownerAuth.live.test.ts reads nft_token and view_access_key on mainnet. Sign-in needs a full access key. A real wallet sign-in by the mainnet holder has not been run yet. The settings the room groups are public through get_state.

Each company page lists what the NFT earned, what it paid out, what was refused, and who held it, rebuilt from contract event logs and reconciled with the vault's own counters.

Landing page: Company page: History

Contract method

ft_on_transferclaim_dividendsnft_transferget_state

Proved by

ignores ft_on_transfer called directly by an account that is not the USDC contract (constructed)not found in the contract sources

FastNEAR lists and returns every evidence transactionnot found in the contract sources

Live evidence

ft_transfer_callsuccess

pay 0.050000 USDC for one call to Ledgerline Audit

HovPj1W2PK…2CrFXLfb

ft_transfer_callsuccess

buy token 1 for 1.000000 USDC at sync_nonce 1

4Tu3Xabccs…S8xCkcKZ

claim_dividendssuccess

shareholder claims 0.040000 USDC of retained earnings

5WW8cPNcN2…ky54nCgn

ft_transfer_callsuccess

pay 0.050000 USDC for one call to Ledgerline Audit

rNYr45nTYi…XhxixcQx

4 more in docs/evidence/mainnet.json

Vitest tests in web/tests/history.parser.test.ts (real mainnet logs) and web/tests/history.live.test.ts (read-only mainnet). An event counts only when the contract that owns its standard logged it. Without FASTNEAR_API_KEY the route can fall back to NearBlocks and archival RPC, which miss intents.near settlements that name the vault only in a log.

The web server can sign as the operator with a function-call key that reaches one vault, five non-payable methods and a gas allowance. It cannot transfer NEAR, attach a deposit, add or delete keys, or call another contract.

Landing page: Security model: who holds which key (docs/OPERATOR_KEY.md)

Contract method

record_service_callsetup_intents_keyagent_deposit_to_intentsagent_swap_intentagent_withdraw_intent

Proved by

the chain refuses a NEAR transfer, AddKey, DeleteKey, another contract, a deposit and an unlisted methodnot found in the contract sources

allowance: only burnt gas is deducted, and a call is refused when the allowance cannot cover its prepaid gasnot found in the contract sources

--replace that stops before its transaction leaves the key files matching the chain, and a rerun still deletes the old keynot found in the contract sources

Live evidence

record_service_callsuccess

operator marks call 59947944cbbe served by TEE chat chatcmpl-3e29b917-c667-4191-b16c-f706743442a1

3iLE29jPqe…UCKroLbz

AddKey(FunctionCall)success

add a function-call key to operator.incorpr.near: receiver c-1.incorpr.near, methods record_service_call, setup_intents_key, agent_deposit_to_intents, agent_swap_intent, agent_withdraw_intent, allowance 0.25000 NEAR

Gk2U4VFtWS…eyR9YDFK

Vitest tests in web/tests/operatorKey.sandbox.e2e.test.ts, run against a local sandbox at protocols 87 and 88. On mainnet the key was added by scripts/operator-key.mjs, the chain refused the four forbidden probes before inclusion, and the web server now signs operator calls with it. The full access key stays off the server.

The contracts link on mainnet's runtime.

Landing page: Build status

Contract method

Build property, not a method

Proved by

test_mainnet_runtime_cannot_link_universal_state_init_importsandbox test, contracts/integration-tests/tests/sandbox.rs:4281

Live evidence

Notechecked on this page load

mainnet runs protocol 88. Read from the node status RPC on this page load.

The sandbox suite pins protocol 87. Mainnet moved to protocol 88 on 2026-11-06; the deploy and demo scripts were rehearsed on a protocol-88 sandbox, the cargo suite was not.

03Key holders

Who holds which key: can, and can never.

From docs/ARCHITECTURE.md section 1. Each can-never row is enforced in the vault or registry code and covered by the tests above. Where a holder's power rests on trust instead, the row says so.

Holder	Can	Can never
Owner (shareholder)nft_token(id).owner_id	claim_dividends, request_shareholder_signature and rotate_treasury_epoch while FREE set_operator, set_policy, set_tee_policy, set_price_floors while FREE list_company, accept_offer (borrow), nft_transfer	Sign, claim or change policy while LISTED, PLEDGED or in transit Add an access key to the vault or replace its code List or pledge with raw signatures taken this epoch
Operator (TEE agent relay)vault policy.operator	record_service_call for a payment that exists and is unserved pay_compute_bill from the reserve to compute_payee agent_swap_intent and agent_withdraw_intent inside policy, with a TEE approval	Supply bytes to sign or write the model prompt Choose a withdrawal destination other than the company's own addresses Report revenue, or use the agent methods while encumbered On mainnet operator.incorpr.near holds one full access key, which can also move the USDC it receives as compute_payee. scripts/operator-key.mjs adds a function-call key for the web server, limited to one vault and the operator methods; it is live on mainnet and the web server signs with it (docs/OPERATOR_KEY.md).
Registrythe registry contract	sync_owner, begin_transit and apply_encumbrance on its own vaults Hold the NFT, the listing book and the loan book	Sign anything on the vault's behalf Move vault USDC or call the shareholder methods The registry account itself keeps a full access key on the deployer machine. Until it is deleted, that key can redeploy the registry, call sync_owner or apply_encumbrance on any vault directly to name a new shareholder, and move USDC the registry holds (docs/THREAT_MODEL.md section 4.1). The never list above holds for the code, not for that key. The live check above counts its keys.
Buyerany account	Pay the ask with ft_transfer_call {"action":"acquire"} and receive the company	Hold shareholder rights before the payment settles Buy a listing that changed after it was read: refunded with ERR_LISTING_CHANGED
Lenderany account	fund_offer and cancel_offer start_auction after due_ms, claim_defaulted_collateral after a no-bid auction	Touch vault funds or request a signature Claim the company before the loan is due and the auction window has closed
MPC signerv1.signer / v1.signer-prod.testnet	Sign on paths incorpr-<id>-... when the vault itself calls sign, since the vault's account id is the derivation predecessor	Be asked by another account for the vault keys: a different caller derives different keys A threshold of colluding MPC nodes could sign anything. That is the trust assumption of Chain Signatures.

04Scope

What is real, and what is simulated.

Test doubles exist only in the sandbox tests. The app never shows sample companies, balances or hashes.

Component	Real	Simulated or not yet run	On mainnet now
Contracts	incorpr-registry and company-vault, built to wasm by scripts/build-contracts.sh. The tests run the same wasm files.	Tests run on a local nearcore sandbox. 77 sandbox and 24 unit tests are in the source.	PassRegistry live on mainnet
Chain Signatures	v1.signer derives keys and signs on mainnet.	The sandbox tests use mpc_signer_double from contracts/test-doubles, because a sandbox cannot reach the MPC network.	Passv1.signer: Contract deployed, 1,164,178 bytes of storage
USDC	Native USDC (Circle) on mainnet. Customers pay with ft_transfer_call.	Testnet uses Test USDC, which has no value. The sandbox uses test_usdc.	Passmainnet: 17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1
NEAR Intents	intents.near settles on mainnet. 1Click quotes are real API calls.	Sandbox tests use intents_double. Testnet has no intents deployment. One treasury swap settled on mainnet (docs/evidence/rebalance-mainnet.json). This hosted app only quotes rebalances unless INCORPR_ALLOW_MAINNET_REBALANCE is true.	Passintents.near: Contract deployed, 13,538,562,387 bytes of storage
NEAR AI Cloud	Inference runs on cloud-api.near.ai. The route checks the attestation and the response signature before it marks a call served.	Nothing. Without NEAR_AI_API_KEY the TEE routes answer HTTP 503 and the UI says so.	NoteAn API key is configured on this server. This page does not spend it on a test call.
Demo counterparties	Every sale, loan and payment in the evidence log is a real contract execution.	demo-buyer, demo-lender and demo-customer are controlled by the deployer, so they are not independent parties.	Note75 transactions recorded in docs/evidence/mainnet.json
Bitcoin spend	request_shareholder_signature returns a v1.signer signature over a BIP-143 sighash; scripts/demo.mjs broadcasts it to an Esplora node.	One mainnet spend so far: 9,523 sats from the epoch 0 address, signed and held (listing was then refused), then broadcast and confirmed. No EVM or Solana spend has been broadcast.	Pass2 Bitcoin entries recorded
L1 freshness check	/api/verify-l1 reads BTC UTXOs and SOL/EVM nonces.	Advisory. The desk runs it before List and Accept and blocks both when it is dirty, but the contract does not wait for it. The on-chain rule is ERR_RAW_SIGNATURES_THIS_EPOCH.	NoteDesk gate, not a contract gate

05Reproduce

Run the proofs yourself.

$ cd contracts && cargo test --workspace

Unit tests plus the sandbox suite on a local nearcore 2.14.0 node at protocol 87. The last recorded run: 78 passed.

$ node scripts/deploy.mjs --network mainnet --dry-run

Prices a mainnet deploy with read-only RPC, a live TEE attestation and live 1Click prices. Sends nothing.

$ node scripts/lib/sandbox.mjs start --fresh && node scripts/deploy.mjs --network sandbox && node scripts/demo.mjs --network sandbox --all --skip serve

The whole lifecycle on a local sandbox, including the refused rug attempts with their error codes.