Registry
The certificate store — publish, attest, verify.
CBM2UAVZFUI2QGZIS35VB6P3W5FYC3HW3KV3E2AF6KFQDUMFIZPPAJWV
The Registry is the certificate itself: it stores what is claimed, moves the status through its lifecycle, and answers the one read every counterparty makes.
Functions
| Function | Auth | Purpose |
|---|---|---|
initialize(challenge_manager, auditor_staking) | once | Wire dependencies |
publish(operator, agent, bound, reserve_amount, expires_at, reserve_vault, auditor_staking) -> cert_id | operator | Create a Pending certificate |
attest(auditor, cert_id) | auditor | Verify registered → Verified; calls AuditorStaking.lock(auditor, expires_at) |
verify(agent) -> VerifyResult | view | {valid, status, bound, reserve, auditor_stake, auditor, expires_at} |
get_cert_reserve(cert_id) -> i128 | view | The claimed reserve — read by the ChallengeManager |
get_cert_auditor(cert_id) -> Address | view | Who vouched — read by the ChallengeManager |
invalidate(cert_id) | ChallengeManager only | Mark Invalid |
Status
Pending → Verified → Invalid.
- Pending — published by the operator, nobody has vouched.
verify().validis false. - Verified — an auditor attested, and their stake is locked to this certificate.
- Invalid — a challenge succeeded. Terminal.
verify().valid is true only when status == Verified && now <= expires_at. An expired
certificate is not invalid; it is simply no longer a claim about the present.
The one call that matters
attest is where the security model is created, not publish. Publishing is a claim.
Attesting locks an independent party's money behind that claim, in the same transaction,
via the Registry's call into AuditorStaking.lock. The lock extends an existing lock
and never shortens one, so an auditor vouching for several certificates stays bound
until the last of them expires.
Claimed, not actual
get_cert_reserve returns what the certificate says is locked. The vault's
get_balance returns what is locked. Keeping those two numbers in separate
contracts is what makes fraud provable by arithmetic — see
ChallengeManager.