Live Testnet Proof Harness

The committed live proof runner is scripts/proof-live-testnet.mjs. It is a separate, opt-in executable for kaspa:testnet-10 only and never requires a hosted facilitator.

The runner validates configuration, calls an operator-provided adapter module, checks that all required evidence is present, and writes an ignored operational report. It does not contain wallet, RPC, signing, broadcast, or per-transaction recovery logic. Those responsibilities belong to the adapter used for a live run. The public summary in docs/live-testnet-report.md is the sanitized committed report.

Current Required Flow

The runner requires live evidence for:

1. exact payment and replay rejection; 2. batch deposit-voucher settlement; 3. batch voucher-only settlement; 4. batch claim construction and broadcast; 5. replay rejection across exact and batch-settlement; 6. batch refund construction and broadcast after timeout.

The live result must state transaction ids, transaction versions, version evidence source, finality for every broadcast transaction, final rejection for the replay attempt, outpoints, charged amounts, top-level settlement amounts, Kaspa extension charged amounts, cumulative charge before/after values, replay outcomes, and refund/claim evidence where applicable. Claim evidence must reconcile the funding input, previous claimed cumulative amount, active charged amount, claim amount, server output, fee, and continuation amount. Refund evidence must reconcile the continuation input, refund amount, and fee. Batch voucher-only evidence must prove it continues the same channel and active outpoint opened by the deposit-voucher flow.

Report And Recovery Files

With --write-report, the runner writes:

• .kaspa-x402-live/report.json for successful or blocked check output;
• .kaspa-x402-live/recovery.json for blocked or failed runner state.

These files are ignored by git because they can contain operational metadata. The committed sanitized summary is docs/live-testnet-report.md.

The runner's recovery file is not a resumable transaction journal. A production or release-candidate live adapter should maintain its own pre-submit recovery record with:

• network;
• template id;
• client public key;
• server public key;
• refund timeout DAA score;
• escrow address;
• active outpoint;
• active script public key;
• funding amount in sompi;
• latest signed cumulative voucher amount in sompi;
• latest voucher signature;
• submitted transaction ids;
• whether the replay attempt was rejected.

Safety Gates

• Refuse to run any network other than kaspa:testnet-10.
• Refuse --live unless the operator supplies the required RPC, funding, adapter, network, and confirmation environment variables.
• Refuse to accept a live result that omits required flow evidence.
• Refuse to accept missing or inconsistent transaction-version evidence.
• Refuse to accept missing accepted-or-confirmed finality for funding, settlement, claim, or refund transactions.
• Refuse to claim more than the latest voucher amount.
• Refuse to claim when the continuation output would be below inputAmount - voucherAmount.
• Refuse to accept a claim or refund report whose input/output/fee accounting does not reconcile with the active charged amount and continuation amount.
• Refuse to publish if the script public key differs from the fixture-derived value.
• Adapter implementations should refuse to run if their own recovery journal exists and the operator has not chosen resume or reset.

Source: /spec/live-covenant-proof-harness.md