@finchip.ai/foga 0.0.0-stage → 0.6.0-alpha.4

package/dist/world/deploy.js

@@ -0,0 +1,277 @@
+import { Contract, ContractFactory, NonceManager, Wallet, formatEther, getAddress, isAddress } from "ethers";
+import { PinnedProvider } from "../kernel/provider.js";
+import { join, relative } from "node:path";
+import { loadBundle, getContract } from "../bundle/load.js";
+import { linkBytecode } from "../util/bytecode.js";
+import { exists, readJson, repoRoot, writeJson } from "../util/fs.js";
+import { log } from "../util/log.js";
+import { DEPLOY_PLAN, WIRE_PLAN } from "./plan.js";
+import { envMnemonic, mnemonicKeys } from "../genesis/roles.js";
+import { feeFloor, quotePriceOf } from "../genesis/funding.js";
+/**
+ * Gas the deployer is asked to hold per contract it still has to deploy, as a budget priced at the chain's quote
+ * (at least the fee floor, FOGA_FEE_FLOOR_GWEI): the 15 reference contracts `foga world deploy` added on Sepolia on
+ * 2026-11-01 took 111 M gas in all, 1.6 M to 14.6 M each (code deposit costs about 1,500 gas per byte there), so a
+ * contract is budgeted at the average with a margin of one half. Checked before anything is sent, so an unfunded
+ * deployer is told what it needs instead of failing on the first transaction.
+ */
+export const DEPLOY_GAS_PER_STEP = 11000000n;
+export function loadWorldConfig(path) {
+    const cfg = readJson(path);
+    if (cfg.schema !== "foga.world-config/1")
+        throw new Error(`unsupported world config schema in ${path}`);
+    return cfg;
+}
+function newWorldFile(cfg, bundle, mode, deployer) {
+    const batch = new Date().toISOString();
+    const compact = batch.replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+    return {
+        schema: "foga.world/1",
+        worldId: `${cfg.network}-${cfg.chainId}-${compact}`,
+        name: cfg.name,
+        network: cfg.network,
+        chainId: cfg.chainId,
+        mode,
+        bundleHash: bundle?.hash ?? null,
+        batch,
+        forkSourceBlock: null,
+        deployer,
+        identity8004: { mode: cfg.identity8004.mode === "stub" ? "stub" : "address", address: "0x0000000000000000000000000000000000000000", note: cfg.identity8004.note },
+        params: cfg.params,
+        contracts: {},
+        wiring: {},
+        steps: [],
+        notes: [...(cfg.notes ?? [])],
+    };
+}
+/** Pure transform for public chains: author the address book from the config, no transactions. */
+export function attachWorld(cfg, bundle) {
+    if (cfg.mode !== "attach")
+        throw new Error(`world ${cfg.name} is not an attach-mode config`);
+    if (cfg.identity8004.mode !== "address")
+        throw new Error("attach-mode worlds must name the ERC-8004 Identity Registry address");
+    const world = newWorldFile(cfg, bundle, "attached", null);
+    world.identity8004 = { mode: "official", address: cfg.identity8004.address, note: cfg.identity8004.note };
+    for (const [id, c] of Object.entries(cfg.contracts ?? {})) {
+        world.contracts[id] = { ...c, address: normalizeAddress(c.address, id) };
+        world.steps.push({ id, status: "attached", note: c.note });
+    }
+    world.contracts["identity8004"] = { address: normalizeAddress(cfg.identity8004.address, "identity8004"), note: cfg.identity8004.note ?? "official ERC-8004 Identity Registry" };
+    world.identity8004.address = world.contracts["identity8004"].address;
+    if (cfg.expectations) {
+        world.wiring.expectations = Object.fromEntries(Object.entries(cfg.expectations).map(([k, v]) => [k, /^0x[0-9a-fA-F]{40}$/.test(v) ? normalizeAddress(v, k) : v]));
+    }
+    const kinds = bundle?.extras?.["ard-onchain-framework"]?.kindIds?.kinds;
+    if (kinds)
+        world.wiring["8444/kindIds"] = kinds;
+    return world;
+}
+/** Accept any casing (upstream records are not all EIP-55) and return the checksummed form. */
+export function normalizeAddress(address, label) {
+    const lower = address.toLowerCase();
+    if (!isAddress(lower))
+        throw new Error(`${label}: bad address ${address}`);
+    return getAddress(lower);
+}
+/** Expand ${ENV_VAR} references in an RPC URL. */
+export function resolveRpc(rpc) {
+    return rpc.replace(/\$\{([A-Z0-9_]+)\}/g, (_m, name) => {
+        const v = process.env[name];
+        if (!v)
+            throw new Error(`RPC URL references ${name}, which is not set`);
+        return v;
+    });
+}
+export async function deployWorld(opts) {
+    const root = repoRoot();
+    const cfg = loadWorldConfig(opts.worldConfigPath);
+    const bundle = loadBundle(opts.bundlePath);
+    const outPath = opts.outPath ?? join(root, "deployments", `${cfg.name}.json`);
+    // An attach-mode config lists what exists upstream. Plan steps it does not list are deployed from the bundle by
+    // the deployer (W): a reference instance upstream never deployed, or one deployed at another revision than the
+    // locked source. A config that lists everything needs no RPC and no key.
+    const toDeploy = cfg.mode === "attach" ? missingPlanSteps(cfg) : [];
+    if (cfg.mode === "attach" && toDeploy.length === 0) {
+        const world = attachWorld(cfg, bundle);
+        writeJson(outPath, world);
+        log.info(`attached world ${world.worldId}: ${Object.keys(world.contracts).length} contracts -> ${relative(root, outPath)}`);
+        return { world, path: outPath };
+    }
+    const rpc = opts.rpc ?? resolveRpc(cfg.rpc);
+    const provider = new PinnedProvider(rpc, undefined, { staticNetwork: true, cacheTimeout: -1 });
+    provider.pollingInterval = cfg.network === "anvil" ? 250 : 4_000;
+    const net = await provider.getNetwork();
+    await provider.getBlockNumber(); // seeds the read pin at the head (kernel/provider.ts)
+    if (Number(net.chainId) !== cfg.chainId) {
+        const msg = `chain id mismatch: rpc reports ${net.chainId}, world config says ${cfg.chainId}`;
+        if (!opts.allowChainMismatch)
+            throw new Error(msg + " (pass --allow-chain-mismatch for forks)");
+        log.warn(msg);
+    }
+    const pk = deployerKey(cfg);
+    if (!pk)
+        throw new Error(`no deployer key: set ${cfg.deployer?.privateKeyEnv ?? "FOGA_DEPLOYER_PK"}, or FOGA_MNEMONIC / FOGA_MNEMONIC_FILE (the deployer is then W, the phrase's first account)`);
+    // NonceManager keeps nonces strictly sequential even when a node mines instantly.
+    const wallet = new NonceManager(new Wallet(pk, provider));
+    const deployer = await wallet.getAddress();
+    const balance = await provider.getBalance(deployer);
+    log.info(`world ${cfg.name} on chain ${net.chainId} via ${rpc}; deployer ${deployer} (balance ${Number(balance) / 1e18} ETH)`);
+    let world;
+    if (opts.resume && exists(outPath)) {
+        world = readJson(outPath);
+        if (world.chainId !== Number(net.chainId) && !opts.allowChainMismatch)
+            throw new Error(`cannot resume ${outPath}: it belongs to chain ${world.chainId}`);
+        log.info(`resuming world ${world.worldId} from ${relative(root, outPath)}`);
+    }
+    else if (cfg.mode === "attach") {
+        world = attachWorld(cfg, bundle);
+        world.notes.push(`${toDeploy.length} reference contracts the upstream records do not provide at the locked revision are deployed from the bundle by ${deployer}: ${toDeploy.join(", ")}`);
+    }
+    else {
+        world = newWorldFile(cfg, bundle, "deployed", deployer);
+    }
+    world.deployer = deployer;
+    world.bundleHash = bundle.hash;
+    if (cfg.mode === "attach")
+        log.info(`attach-mode world: ${Object.keys(cfg.contracts ?? {}).length} contracts attached; deploying ${toDeploy.length} from the bundle (${toDeploy.join(", ")})`);
+    // What the deployer must hold for the contracts not yet in the world file, before the first one is sent.
+    const remaining = DEPLOY_PLAN.filter((s) => !world.contracts[s.id] && !(s.id === "identity8004" && cfg.identity8004.mode === "address")).length;
+    if (remaining > 0) {
+        const price = await quotePriceOf(provider);
+        const need = BigInt(remaining) * DEPLOY_GAS_PER_STEP * price;
+        const priced = `${remaining} contracts x ${Number(DEPLOY_GAS_PER_STEP) / 1e6} M gas at ${Number(price) / 1e9} gwei (${price === feeFloor() ? "the fee floor FOGA_FEE_FLOOR_GWEI; the chain quotes less" : "the chain's quote"}) = ${formatEther(need)} ETH`;
+        if (balance < need)
+            throw new Error(`deployer ${deployer} holds ${formatEther(balance)} ETH, the deployment is budgeted at ${priced}. Fund it and run again${world.steps.some((s) => s.status === "deployed") ? " with --resume" : ""}.`);
+        log.info(`deployment budget: ${priced}; the deployer holds ${formatEther(balance)} ETH`);
+    }
+    const stepById = new Map(DEPLOY_PLAN.map((s) => [s.id, s]));
+    const ctx = {
+        config: cfg,
+        bundle,
+        world,
+        deployer,
+        addr: (id) => {
+            const c = world.contracts[id];
+            if (!c)
+                throw new Error(`step ${id} has no address yet (plan order?)`);
+            return c.address;
+        },
+    };
+    const gasMultiplier = opts.gasMultiplier ?? 1;
+    for (const step of DEPLOY_PLAN) {
+        const existing = world.contracts[step.id];
+        if (existing && cfg.mode === "attach" && cfg.contracts?.[step.id]) {
+            log.step(`${step.id}: attached at ${existing.address}`);
+            continue;
+        }
+        if (existing && (await provider.getCode(existing.address)) !== "0x") {
+            log.step(`${step.id}: already at ${existing.address}`);
+            continue;
+        }
+        const skip = step.skip?.(ctx);
+        if (skip) {
+            if (step.id === "identity8004" && cfg.identity8004.mode === "address") {
+                world.contracts[step.id] = { address: cfg.identity8004.address, note: cfg.identity8004.note ?? "existing ERC-8004 Identity Registry" };
+                world.identity8004 = { mode: "address", address: cfg.identity8004.address, note: cfg.identity8004.note };
+            }
+            world.steps.push({ id: step.id, status: "skipped", note: skip });
+            writeJson(outPath, world);
+            log.step(`${step.id}: skipped (${skip})`);
+            continue;
+        }
+        const art = getContract(bundle, step.bundleKey);
+        if (!art.deployable)
+            throw new Error(`${step.bundleKey} is not deployable (kind ${art.kind}, abstract ${art.abstract})`);
+        const libraries = {};
+        const linked = linkBytecode(art.bytecode, art.linkReferences, (_src, lib) => {
+            const libStep = DEPLOY_PLAN.find((s) => s.bundleKey === `${art.repo}:${lib}`);
+            if (!libStep)
+                return undefined;
+            const a = world.contracts[libStep.id]?.address;
+            if (a)
+                libraries[lib] = a;
+            return a;
+        });
+        const args = step.args(ctx);
+        const factory = new ContractFactory(art.abi, linked, wallet);
+        const txReq = await factory.getDeployTransaction(...args);
+        const estimate = await provider.estimateGas({ ...txReq, from: deployer });
+        const gasLimit = BigInt(Math.ceil(Number(estimate) * gasMultiplier));
+        const contract = await factory.deploy(...args, { gasLimit });
+        const deployTx = contract.deploymentTransaction();
+        const receipt = await deployTx.wait();
+        const address = await contract.getAddress();
+        const rec = {
+            address,
+            bundleKey: step.bundleKey,
+            txHash: receipt?.hash,
+            block: receipt?.blockNumber,
+            args: args.map((a) => (typeof a === "bigint" ? a.toString() : a)),
+            libraries: Object.keys(libraries).length ? libraries : undefined,
+            note: cfg.mode === "attach" ? `deployed by FOGA from the bundle (not provided upstream at the locked revision)${step.note ? "; " + step.note : ""}` : step.note,
+        };
+        world.contracts[step.id] = rec;
+        if (step.id === "identity8004")
+            world.identity8004 = { mode: "stub", address, note: cfg.identity8004.note ?? "local stand-in, not the reference registry" };
+        world.steps.push({ id: step.id, status: "deployed", txHash: receipt?.hash });
+        writeJson(outPath, world);
+        log.step(`${step.id}: ${address} (gas ${receipt?.gasUsed}, block ${receipt?.blockNumber})`);
+    }
+    for (const wire of WIRE_PLAN) {
+        if (world.steps.some((s) => s.id === wire.id && s.status === "wired")) {
+            log.step(`${wire.id}: already wired`);
+            continue;
+        }
+        const skip = wire.skip?.(ctx);
+        if (skip) {
+            world.steps.push({ id: wire.id, status: "skipped", note: skip });
+            continue;
+        }
+        const hashes = [];
+        for (const call of wire.calls(ctx)) {
+            const target = world.contracts[call.stepId];
+            const step = stepById.get(call.stepId);
+            if (!target || !step)
+                throw new Error(`wiring ${wire.id}: unknown step ${call.stepId}`);
+            const art = getContract(bundle, step.bundleKey);
+            const c = new Contract(target.address, art.abi, wallet);
+            const tx = await c.getFunction(call.fn)(...call.args);
+            const receipt = await tx.wait();
+            hashes.push(receipt.hash);
+            log.step(`${wire.id}: ${call.fn}(${call.note ?? ""}) in ${receipt.hash}`);
+        }
+        world.wiring[wire.id] = { txHashes: hashes };
+        world.steps.push({ id: wire.id, status: "wired", txHash: hashes[hashes.length - 1] });
+        writeJson(outPath, world);
+    }
+    const kinds = bundle.extras["ard-onchain-framework"]?.kindIds?.kinds;
+    if (kinds)
+        world.wiring["8444/kindIds"] = kinds;
+    writeJson(outPath, world);
+    log.info(`world ${world.worldId}: ${Object.keys(world.contracts).length} contracts -> ${relative(root, outPath)}`);
+    return { world, path: outPath };
+}
+/**
+ * The deployer's key: the configured variable (FOGA_DEPLOYER_PK), else W as the genesis will see it (FOGA_KEY_W, or
+ * account 0 of the phrase in the environment), else the config's default. The genesis binds the escrow this deploys
+ * as W, so the deployer is W unless the variable says otherwise.
+ */
+export function deployerKey(cfg) {
+    const fromEnv = cfg.deployer?.privateKeyEnv ? process.env[cfg.deployer.privateKeyEnv] : process.env.FOGA_DEPLOYER_PK;
+    if (fromEnv)
+        return fromEnv;
+    if (cfg.network !== "anvil") {
+        // on anvil the genesis derives W from anvil's phrase, so a phrase in the environment must not move the deployer
+        if (process.env.FOGA_KEY_W)
+            return process.env.FOGA_KEY_W;
+        const phrase = envMnemonic();
+        if (phrase)
+            return mnemonicKeys(phrase).W;
+    }
+    return cfg.deployer?.defaultPrivateKey;
+}
+/** Plan steps an attach-mode config does not list and does not skip: what `foga world deploy` adds from the bundle. */
+export function missingPlanSteps(cfg) {
+    const listed = cfg.contracts ?? {};
+    return DEPLOY_PLAN.filter((s) => !listed[s.id] && !(s.id === "identity8004" && cfg.identity8004.mode === "address")).map((s) => s.id);
+}

package/dist/world/plan.js

@@ -0,0 +1,93 @@
+export const DEPLOY_PLAN = [
+    {
+        id: "identity8004",
+        bundleKey: "foga:Identity8004Stub",
+        args: () => [],
+        skip: (ctx) => (ctx.config.identity8004.mode === "address" ? "attached to an existing ERC-8004 Identity Registry" : null),
+        note: "LOCAL stand-in for the ERC-8004 Identity Registry; public worlds attach the official registry instead",
+    },
+    { id: "8338/SkillToken", bundleKey: "skill-token-standard:SkillToken", args: (c) => [c.config.params.skillToken.name, c.config.params.skillToken.symbol] },
+    { id: "8414/TaskToken", bundleKey: "task-token-standard:TaskToken", args: (c) => [c.config.params.taskToken.name, c.config.params.taskToken.symbol] },
+    { id: "8414/HashlockVerifier", bundleKey: "task-token-standard:HashlockVerifier", args: () => [] },
+    { id: "8419/KYASchemeRegistry", bundleKey: "kya-standard:KYASchemeRegistry", args: () => [] },
+    { id: "8419/KYARegistry", bundleKey: "kya-standard:KYARegistry", args: (c) => [c.addr("8419/KYASchemeRegistry")] },
+    { id: "8419/KYAPolicyRegistry", bundleKey: "kya-standard:KYAPolicyRegistry", args: (c) => [c.addr("8419/KYARegistry")] },
+    { id: "8419/ValidationRegistry8004", bundleKey: "kya-standard:ValidationRegistry8004", args: (c) => [c.addr("identity8004")], note: "spec-conforming ERC-8004 Validation Registry companion from kya-standard, bound to the world's identity registry" },
+    { id: "8419/KYABridge8004", bundleKey: "kya-standard:KYABridge8004", args: (c) => [c.addr("8419/KYARegistry"), c.addr("8419/ValidationRegistry8004"), c.deployer] },
+    { id: "8419/Groth16Verifier", bundleKey: "kya-standard:Groth16Verifier", args: () => [], note: "credential-pattern ZK-KYA verifier (kya_public_v1 circuit)" },
+    { id: "8419/Groth16KYAVerifierAdapter", bundleKey: "kya-standard:Groth16KYAVerifierAdapter", args: (c) => [c.addr("8419/Groth16Verifier"), c.config.params.kya.issuerSetRoot, c.config.params.kya.epochLength, c.config.params.kya.epochGrace] },
+    { id: "8434/AIDRegistry", bundleKey: "aid-standard:AIDRegistry", args: (c) => [c.config.params.aid.defaultLivenessWindow, c.config.params.aid.maxLivenessWindow] },
+    { id: "8436/ACDFPolicyRegistry", bundleKey: "acd-framework:ACDFPolicyRegistry", args: () => [] },
+    { id: "8436/ACDFRegistry", bundleKey: "acd-framework:ACDFRegistry", args: (c) => [c.addr("8436/ACDFPolicyRegistry")] },
+    { id: "8444/ARDOnchainRegistry", bundleKey: "ard-onchain-framework:ARDOnchainRegistry", args: () => [], note: "owner = deployer; the four kinds are registered by the wiring step" },
+    { id: "8444/SkillAdapter", bundleKey: "ard-onchain-framework:SkillAdapter", args: () => [] },
+    { id: "8444/TaskAdapter", bundleKey: "ard-onchain-framework:TaskAdapter", args: () => [] },
+    { id: "8444/AgentAdapter", bundleKey: "ard-onchain-framework:AgentAdapter", args: (c) => [c.addr("8434/AIDRegistry")], note: "bound to the world's ERC-8434 AIDRegistry (on Sepolia the upstream instance is bound to ARD's own fixture registry — see worlds/sepolia.json)" },
+    { id: "8444/RegistryAdapter", bundleKey: "ard-onchain-framework:RegistryAdapter", args: () => [] },
+    { id: "8447/SpecValidator", bundleKey: "swarm-ai-framework:SpecValidator", args: () => [], note: "external library" },
+    { id: "8447/LifecycleLib", bundleKey: "swarm-ai-framework:LifecycleLib", args: () => [], note: "external library, links SpecValidator" },
+    { id: "8447/MembershipLib", bundleKey: "swarm-ai-framework:MembershipLib", args: () => [], note: "external library" },
+    { id: "8447/ResourceLib", bundleKey: "swarm-ai-framework:ResourceLib", args: () => [], note: "external library" },
+    { id: "8447/SwarmRegistry", bundleKey: "swarm-ai-framework:SwarmRegistry", args: () => [[], []], note: "constructed with no resource kinds, as upstream did on Sepolia" },
+    { id: "8447/AllowlistEligibility", bundleKey: "swarm-ai-framework:AllowlistEligibility", args: (c) => [c.deployer] },
+    { id: "8447/ERC8004Eligibility", bundleKey: "swarm-ai-framework:ERC8004Eligibility", args: (c) => [c.addr("identity8004")] },
+    { id: "8447/IdentityStateEligibility", bundleKey: "swarm-ai-framework:IdentityStateEligibility", args: (c) => [c.addr("8434/AIDRegistry")] },
+    { id: "8447/SwarmTenderAdapter", bundleKey: "swarm-ai-framework:SwarmTenderAdapter", args: (c) => [c.addr("8447/SwarmRegistry"), c.addr("8414/TaskToken")] },
+    { id: "8454/AUFUnitRegistry", bundleKey: "aifi-unit-framework:AUFUnitRegistry", args: () => [] },
+    { id: "8454/AUFAssertionRegistry", bundleKey: "aifi-unit-framework:AUFAssertionRegistry", args: (c) => [c.addr("8454/AUFUnitRegistry")] },
+    { id: "8468/ASFEvaluation", bundleKey: "agent-safety-framework:ASFEvaluation", args: () => [], note: "external library" },
+    { id: "8468/ASFLifecycle", bundleKey: "agent-safety-framework:ASFLifecycle", args: () => [], note: "external library, links ASFEvaluation" },
+    { id: "8468/ASFSpecificationRegistry", bundleKey: "agent-safety-framework:ASFSpecificationRegistry", args: () => [] },
+    { id: "8468/ASFBindingRegistry", bundleKey: "agent-safety-framework:ASFBindingRegistry", args: () => [], note: "links ASFEvaluation and ASFLifecycle" },
+    { id: "8471/ADRFPolicyRegistry", bundleKey: "ai-dispute-resolution:ADRFPolicyRegistry", args: () => [] },
+    { id: "8471/ADRFBindingModule", bundleKey: "ai-dispute-resolution:ADRFBindingModule", args: (c) => [c.addr("8471/ADRFPolicyRegistry")] },
+    { id: "8471/ADRFFilingModule", bundleKey: "ai-dispute-resolution:ADRFFilingModule", args: (c) => [c.addr("8471/ADRFPolicyRegistry")] },
+    { id: "8471/ADRFResolutionModule", bundleKey: "ai-dispute-resolution:ADRFResolutionModule", args: (c) => [c.addr("8471/ADRFPolicyRegistry")] },
+    { id: "8471/ADRFDecisionModule", bundleKey: "ai-dispute-resolution:ADRFDecisionModule", args: (c) => [c.addr("8471/ADRFPolicyRegistry")] },
+    { id: "8471/ADRFRecordModule", bundleKey: "ai-dispute-resolution:ADRFRecordModule", args: (c) => [c.addr("8471/ADRFPolicyRegistry")] },
+    { id: "8471/ADRFOutcomeModule", bundleKey: "ai-dispute-resolution:ADRFOutcomeModule", args: (c) => [c.addr("8471/ADRFPolicyRegistry")] },
+    {
+        id: "8471/ADRFDisputeRegistry",
+        bundleKey: "ai-dispute-resolution:ADRFDisputeRegistry",
+        args: (c) => [
+            c.addr("8471/ADRFPolicyRegistry"),
+            c.addr("8471/ADRFBindingModule"),
+            c.addr("8471/ADRFFilingModule"),
+            c.addr("8471/ADRFResolutionModule"),
+            c.addr("8471/ADRFDecisionModule"),
+            c.addr("8471/ADRFRecordModule"),
+            c.addr("8471/ADRFOutcomeModule"),
+        ],
+        note: "router over six delegatecall modules (each unit fits Sepolia's per-transaction gas cap)",
+    },
+    { id: "8471/DuplicateSettlementVerifier", bundleKey: "ai-dispute-resolution:DuplicateSettlementVerifier", args: () => [] },
+    { id: "8471/DeclaredVersionVerifier", bundleKey: "ai-dispute-resolution:DeclaredVersionVerifier", args: () => [] },
+    { id: "8471/AttestorQuorumRule", bundleKey: "ai-dispute-resolution:AttestorQuorumRule", args: () => [] },
+    { id: "8471/ADRFACDFBridge", bundleKey: "ai-dispute-resolution:ADRFACDFBridge", args: (c) => [c.addr("8471/ADRFDisputeRegistry"), c.addr("8436/ACDFRegistry")] },
+    { id: "8471/ADRFServiceEscrow", bundleKey: "ai-dispute-resolution:ADRFServiceEscrow", args: (c) => [c.addr("8471/ADRFDisputeRegistry")], note: "service escrow example (obligation source + executor); bound to a policy by the genesis runner" },
+];
+export const WIRE_PLAN = [
+    {
+        id: "8444/registerKinds",
+        // An attached registry was wired upstream (its owner key registered the kinds); only a registry this run deployed is wired here.
+        skip: (c) => (c.world.steps.some((s) => s.id === "8444/ARDOnchainRegistry" && s.status === "attached") ? "ARD registry attached: the kinds were registered upstream" : null),
+        calls: (c) => {
+            const kinds = c.bundle.extras["ard-onchain-framework"]?.kindIds?.kinds;
+            if (!kinds)
+                throw new Error("bundle extras lack ARD kind ids (ard-onchain-framework/kindIds)");
+            const uris = c.config.params.ard.kindURIs;
+            const adapters = {
+                skill: "8444/SkillAdapter",
+                task: "8444/TaskAdapter",
+                agent: "8444/AgentAdapter",
+                registry: "8444/RegistryAdapter",
+            };
+            return Object.entries(adapters).map(([kind, step]) => ({
+                stepId: "8444/ARDOnchainRegistry",
+                fn: "registerKind",
+                args: [kinds[kind], c.addr(step), uris[kind] ?? ""],
+                note: `kind ${kind} -> ${step}`,
+            }));
+        },
+    },
+];

package/dist/world/types.js

@@ -0,0 +1 @@
+export {};

package/docs/build.md

@@ -0,0 +1,45 @@
+# Build: from ten repositories to one bundle
+
+`foga build` turns the ten locked reference implementations (plus FOGA's local contracts) into `artifacts/bundle.json`, a single machine-independent file that every other command reads. Nothing else in FOGA needs the Solidity sources.
+
+## Inputs
+
+- `vendor/LOCK.json` — repository URL and commit per ERC.
+- `vendor/<repo>/` — materialized by `foga vendor sync` (a one-commit fetch of exactly the locked commit; the directory is replaced if it is at any other commit).
+- `build/profiles.json` — how each repository is compiled:
+  - `native`: `forge build --ast --no-cache --skip test --skip script --out <foga out dir>` runs inside the vendored repository with its own `foundry.toml`, so optimizer, runs, via-IR, EVM version, metadata and remappings are exactly upstream's.
+  - `staged` (kya-standard, aid-standard, whose upstream toolchain is solc-js): the contract tree is copied into `.foga-build/stage/<repo>/` with a generated `foundry.toml` that mirrors the upstream compile script (`solc 0.8.28`, optimizer on, 200 runs, EVM `cancun`, `bytecode_hash = ipfs`). Source names inside the staged project equal the upstream script's source names.
+  - `local`: `contracts/` (FOGA's own stand-ins), built with `contracts/foundry.toml`.
+- `build/known-interface-ids.json` — the ids 8338 and 8414 publish in their READMEs (those two repositories have no vectors file).
+
+## Compiler binaries
+
+The Foundry release binaries are glibc builds that need GLIBC 2.35 or newer; on an older Linux (Amazon Linux 2/2023, CentOS 7, Debian 11) `scripts/install-foundry.sh` installs the statically linked ("alpine", musl) build of the pinned release into a directory of its own, and `FOGA_FOUNDRY_DIR` tells `foga demo` where its anvil is.
+
+Foundry downloads solc from the Solidity binary mirror on demand. On a machine that cannot reach the mirror, run `scripts/install-solc.sh` (which fetches the three static Linux binaries from the Solidity GitHub releases) and export `FOGA_SOLC_DIR`; `foga build` then passes `--use <dir>/solc-<version>` to forge. The compiler commits used for the committed bundle are `0.8.24+commit.e11b9ed9`, `0.8.28+commit.7893614a` and `0.8.30+commit.73712a01` — the same commits recorded in the upstream Sepolia deployments.
+
+## What goes into the bundle
+
+For every compilation target under a profile's `contractsRoot` (tests, scripts, `lib/` and vendored test fixtures are excluded):
+
+| Field | Source |
+|---|---|
+| `abi`, `methodIdentifiers`, `bytecode`, `deployedBytecode` | forge artifact |
+| `linkReferences`, `deployedLinkReferences`, `immutableReferences` | forge artifact; used for linking at deploy time and for masking at verification time |
+| `kind` (contract / library / interface), `abstract`, `baseContracts` | AST |
+| `interfaceId` | XOR of the selectors of the interface's own functions (AST `functionSelector`), the same rule as `type(I).interfaceId` |
+| `compiler`, `settings` (optimizer, runs, viaIR, evmVersion, bytecodeHash, remappings), `sourceKeccak` | artifact metadata |
+| `runtimeIdentity` | keccak256 of the runtime code after stripping the CBOR metadata trailer and zeroing link and immutable slots |
+| `role` | heuristic from path and kind (registry, kernel, adapter, module, library, verifier, bridge, example, companion, mock, interface, local-stub) |
+
+`interfaceIds` records, per repository, the computed id, the upstream-published id when there is one, and whether they match. `extras` carries small upstream vectors the world needs (ARD kind ids, SAI term ids, AUF identifiers).
+
+## The bundle hash
+
+`hash` is the sha256 of a canonical JSON (sorted keys, no whitespace) of every contract's `abi`, `bytecode`, `deployedBytecode`, link and immutable references, `compiler`, `settings`, `sourceKeccak` and `upstreamPath`, plus the locked commits. It excludes timestamps and machine paths. `foga build --verify` rebuilds everything into `.foga-build/bundle.verify.json` and compares hashes; CI runs this on every push, so the committed bundle is always reproducible from the lock.
+
+## Determinism notes
+
+- forge writes repository-relative source paths into the metadata, so builds are independent of the checkout location.
+- The same solc commit produces the same bytecode; a different forge version does not change bytecode but may change the artifact JSON layout, which the extractor tolerates.
+- `--no-cache` is passed so stale caches in a vendored tree cannot leak into the bundle.

package/docs/cell-account.md

@@ -0,0 +1,58 @@
+# FogaCellAccount
+
+`contracts/src/FogaCellAccount.sol` is the body of a cell: one contract account that is, at the same time, the cell's ERC-8434 anchor, its ERC-8004 owner, the holder of its assets and tokens, the fulfiller of record on ERC-8414 tenders, the adopter of its ERC-8468 binding, the KYA subject (`account` type), and the controller of its ARD records and AUF units. Everything the cell does on chain is a call made by this address; a call made by the operator key directly is the operator's own act, not the cell's (design memo, section 8.2).
+
+The account carries the execution-gate semantics of the ERC-8468 reference's `ASFGuardedAccount` — a requirement fixed at deployment, bindings presented by the owner, a de-risk allow-list that stays open under a derisk-only suspension — and adds what a cell needs on top. It is compiled with via-IR (solc 0.8.30, cancun) and shipped in the bundle as `foga:FogaCellAccount`. `ACCOUNT_VERSION` is 2 since 0.6.0: revision 2 closes the operator's scope to an allow-list (below). The cells of the 0.5.0 Sepolia run are revision-1 accounts; a revision-1 account cannot be upgraded in place, so a cell that is to run as a public node moves to a revision-2 account the way T9 moves A to A-prime (docs/design-memo.md, Phase 3).
+
+## Roles
+
+| Role | Held by | Powers |
+|---|---|---|
+| `owner` | the cold principal (on the Finch OG Agent: the author's key; on anvil: a derived account) | set operator, guardian, recovery and AID registry; adopt and present bindings; set selector classes; transfer ownership; `execute`; `sweep` |
+| `operator` | the node's hot signer | `execute`, within scope: only (target, selector) pairs the owner allow-listed (`operatorAllowed`), never an asset-moving selector, optional expiry (`operatorValidUntil`), a per-day cap on native value sent (`operatorDailyValueCap`); ERC-1271 signatures only when the owner enabled them (`operatorMaySign`) |
+| `guardian` | the intervener named in the cell's safety binding | nothing on the account itself: the guardian acts on the ERC-8468 Binding Registry (`suspend`, `resume`), and the gate reads the result |
+| `recovery` | defaults to the owner | `sweep` to the owner, at any time |
+
+## The operator's scope (revision 2)
+
+The operator key is the one key a running node holds, so what it can do through the account is what an attacker holding it can do. Revision 1 bounded that by expiry and a daily value cap only: any target, any selector. Revision 2 adds an allow-list and a signing switch, both owner-administered:
+
+- `operatorAllowed[target][selector]` — `setOperatorAllowed(target, selector, allowed)` and `setOperatorAllowedBatch(targets, selectors, allowed)` (`OperatorAllowedSet` per entry). A call by the operator whose (target, selector) is not on the list reverts with `OperatorNotAllowed(target, selector)` before the gate is consulted. A fresh account allows nothing: the owner opens the scope after `setOperator`, and the genesis does it in T1 (`T1.<X>.scope`) from the groups in `src/genesis/operator-scope.ts` — identity, standing, skills-provider, labour, demander, organization-member, organization-coordinator, service-provider, service-client — so a cell's allow-list reads as the roles it plays, and opens two more entries for B in T4 when the swarm's decision adapter and account exist (`T4.B.scope.*`). The selector is the first four bytes of `data`; a call with less than four bytes of data has selector `0x00000000` and must be allow-listed as such.
+- Asset-moving selectors are closed to the operator by construction, allow-listed or not: `transfer`, `transferFrom`, both ERC-721 `safeTransferFrom`s, the ERC-1155 `safeTransferFrom` and `safeBatchTransferFrom`, `approve`, `setApprovalForAll`, `increaseAllowance`, `permit`. Allow-listing one reverts with `OperatorAssetSelector`, and so does an operator call carrying one. Moving the cell's assets — the ERC-8004 identity and the skill tokens A hands to A-prime in T9, for instance — is the owner's act (`execute` by the owner, which is never scope-checked, or `sweep`).
+- `operatorMaySign` (`setOperatorMaySign`, `OperatorSigningSet`) — off by default. While off, an operator signature is not the account's signature (ERC-1271 below), so a relayed, signed path (`bindWithSig`, `joinBySig`, `assertStatementBySig`, signed ballots) is not open to a key that only holds `execute` rights.
+
+The order of checks for an operator call is: expiry, asset selector, allow-list, daily value cap, then the gate below. The owner's calls pass none of the operator checks and all of the gate.
+
+## The gate
+
+`execute(target, value, data)` is the only way to act as the cell. Every call passes `_gate`:
+
+1. The presented bindings must be as many as the requirement has clauses; before the first `adoptBinding` nothing executes (`BindingsNotPresented`). There is no privileged path around this, the owner included.
+2. `safety.check(requirement, presentedBindings)` must return `Satisfied`. `NotSatisfied` passes only when every failing clause is a suspension (own, inherited, or a standing stop by a named intervener) whose response set keeps de-risking open and is not a full stop, **and** the selector is on the owner's de-risk allow-list for that target. `Unknown` (the specification registry unreachable) never passes.
+3. A selector the owner marked as commitment-class (`setCommitmentClass`) additionally requires `aid.state(address(this)) == ACTIVE` in the configured ERC-8434 registry — "no delivery while not ACTIVE" is enforced, not promised. De-risk calls skip this clause by construction.
+
+The genesis marks `TaskToken.submitFulfillment`, `SwarmRegistry.join`, `SwarmRegistry.applyToJoin`, `AUFAssertionRegistry.assertStatement` and `ACDFRegistry.castBallot` as commitment-class, and `TaskToken.withdrawCredit`, `TaskToken.reclaimEscrow`, `SwarmRegistry.leave` and `ADRFServiceEscrow.withdrawBalance` as de-risk actions. T7 of the genesis exercises the gate on chain: a transaction sent around the kernel fails with `BindingNotSatisfied` under a suspension, the allow-listed withdrawal passes, a fresh binding does not escape the intervener's standing stop, and a STALE anchor stops commitment-class calls until the next heartbeat (docs/genesis.md).
+
+## Adopting the binding
+
+Adoption is the bootstrap and it is owner-level: `adoptBinding(input, clauseIndex)` calls `adopt` on the Binding Registry with the account as `msg.sender` (so the registry records the account as adopter) and presents the returned id for the given clause. The operator cannot swap bindings; re-adoption after a termination overwrites the slot. `presentBindings` remains for re-pointing an existing set.
+
+Because the requirement names the account as adopter and subject, the deploying kernel predicts the account's address from the deployer's nonce (`getCreateAddress`) and checks the receipt against it.
+
+## Signatures and receivers
+
+`isValidSignature` accepts a 65-byte ECDSA signature by the owner always, and one by the operator only when `operatorMaySign` is on, the operator has not expired and the safety gate is satisfied at that moment (bindings presented and the registry's verdict `Satisfied`): a suspension that stops `execute` stops the signed path too, where revision 1 checked the expiry alone. That makes `bindWithSig` (ERC-8434), `joinBySig` (ERC-8447), `assertStatementBySig` (ERC-8454) and signed ballots (ERC-8436) available to a cell whose owner opens them. The account implements the ERC-721 and ERC-1155 receiver hooks and ERC-165 for 1271 and both receivers.
+
+## Sweep
+
+`sweep(token, amount)` moves native value or an ERC-20 balance to the owner. It is open to the owner and the recovery address and is not gated: it can only reduce the account's exposure, which is what `RESTRICT_DERISK_ONLY` is meant to keep open.
+
+## Errors
+
+`NotOwner`, `NotOperatorOrOwner`, `NotOwnerOrRecovery`, `OperatorExpired(validUntil)`, `OperatorNotAllowed(target, selector)`, `OperatorAssetSelector(target, selector)`, `LengthMismatch` (a batch whose arrays differ in length), `DailyValueCapExceeded(cap, spent, requested)`, `BindingsNotPresented(presented, required)`, `ClauseIndexOutOfRange(index, clauses)`, `BindingNotSatisfied(verdict, reasons)`, `AnchorNotActive(state)`, `CallFailed(data)` (the inner revert data of the target call), `ZeroAddress`. The kernel's revert decoder unwraps `CallFailed` so a refused call reports the real cause (`CallFailed(Error("TaskToken: verification failed"))`).
+
+## Tests
+
+`contracts/test/FogaCellAccount.t.sol` (17 tests, `forge test`): constructor fixes requirement and roles; nothing executes before bindings are presented; `adoptBinding` is owner-only, presents the binding and makes the account the adopter; operator executes when satisfied; owner executes, strangers cannot; the gate blocks `NotSatisfied` for operator and owner alike; de-risk allow-list under a derisk-only suspension, full stop blocks even allow-listed calls; `Unknown` blocks; commitment class requires an ACTIVE anchor (DORMANT and STALE refused); operator expiry and the daily cap, reset on the next day; target reverts bubble; the allow-list is the operator's only door (a fresh account refuses with `OperatorNotAllowed` before the gate, the batch opens and closes entries, the owner is not scope-checked); asset selectors are closed to the operator and cannot be allow-listed; ERC-1271 for the owner always and for the operator only when enabled, in scope and satisfied; sweep by owner or recovery only, open under a full stop; receivers and ERC-165; owner-only administration.
+
+Timestamps in the tests are absolute: with via-IR the compiler may cache `block.timestamp` within a call, so `block.timestamp + x` after a `vm.warp` can still read the pre-warp value.

package/docs/compatibility-matrix.md

@@ -0,0 +1,38 @@
+# Compatibility matrix
+
+Compatibility is declared per ERC in three parts: the specification version FOGA follows, the role FOGA takes, and the run evidence that proves it. An interface that merely exists is never counted as a pass. Verdicts use the doctor's vocabulary: Pass / Fail / Unknown / Not tested / Not applicable.
+
+Status key for the evidence column: **L1–L4** = doctor layers 1–4 pass on a locally deployed world (`deployments/local.doctor.example.json`); **L5** = semantic validation through the genesis scenario (`deployments/local.genesis.example.json`, T0–T9; `foga doctor --genesis` attributes its checks per standard, all eleven Pass in `deployments/local.doctor.example.json`). The same run on an attach-mode world (`deployments/local-attach.example.json`: the address book attached, the ERC-8471 stack and two eligibility modules added by `foga world deploy`, a second ERC-8434 registry as the ARD backing registry) is the rehearsal of the public-chain path, all eleven Pass in `deployments/local-attach.doctor.example.json`. **Sepolia (2026-11-01)**: the same scenario against the upstream reference deployments, completed from the bundle (`deployments/sepolia.example.json`, world `sepolia-11155111-20261101T043153Z`): 203 operations, the evidence in `deployments/sepolia.genesis.example.json` (the final replay of the completed run: 114 checks remade against the chain, 47 recorded as skipped because the run itself changed that state later, 0 failed) and the doctor in `deployments/sepolia.doctor.example.json` — L1–L4 Pass for the 51 contracts but the one known layer-3 Fail of the ARD fixture registry, L5 Pass for all eleven standards (docs/genesis.md, "The Sepolia run"). One thing the local run exercises was not exercised there: the predicate-pattern proof of ERC-8419 (the proving material was not built on the machine that ran it; recorded as skipped). Everything else was, against the real instances: the ERC-8004 checks against the official Identity Registry, the ERC-8434 checks against two registries (the reference instance and ARD's fixture as backing registry), the ERC-8471 checks against FOGA's revision-4 instance.
+
+| ERC | Specification followed | FOGA role(s) | Minimum run acceptance (Phase 2 target) | Evidence today |
+|---|---|---|---|---|
+| 8338 Token-Bound Executable Skills | repository commit `359ad64` (Draft, PR #1879) | holder, executor, publisher of skill tokens | reads the on-chain commitment, verifies the full package before executing; a tampered file is rejected; publishing v2 does not move an existing v1 commitment | L1–L4 Pass; L5: T2 mint ×2 by the account, package verified against `skillOf` before T3's run, tampered package detected; T6 v2 published (`updateSkill`, prev = v1) while a call stays committed to v1; T9 the token transferred to the successor and its ARD record adopted again |
+| 8414 Token-Bound Task Tenders | commit `b3da62e` (Draft, PR #2005) | fulfiller; demander | creates and funds a real tender; submits; one machine settlement; repeated requests do not pay twice; a judged tender and the NoDecision default path | L1–L4 Pass; L5: T3 mint/fund/commit by B, submit/settle by A, paid once, second settlement and further submission refused, crash-and-resume does not resubmit; T4/T5 judged tenders accepted through the council's adapter and, on silence, by `claimUnjudged` — the NoDecision default path; T7 a two-completion tender: the operator key's direct submission is accepted by the chain but attributed to the key, the account's own is accepted and paid |
+| 8419 KYA Framework | commit `f204f2e` (Draft, PR #2012) | subject; prover; issuer (world operator) | attested and two proved paths (credential-pattern, predicate-pattern) run; expiry, revocation, wrong binding and replay are rejected | L1–L4 Pass; L5: T0 schemes S_att and S_cred registered, T1 attested level 2 for three account subjects, `check` true; T1 credential-pattern proof for A through FOGA's Groth16 adapter (`attestWithProof`, `check` level 4 true); replayed, re-targeted and stale-epoch proofs refused; T4 revocation suspends a swarm seat on challenge; T3 predicate-pattern proof over A's first accepted completion through FOGA's circuit and adapter (level 1, anchor = source-set root), a false predicate (K above the count) refused, a flipped result bit refused by the verifier, replay, subject, scheme and stale epoch refused; T9 standing is not inherited by the successor |
+| 8434 Agent Identity | commit `1ff7215` (Draft, PR #2044) | anchor | ERC-8004 binding; ACTIVE / STALE / RETIRED transitions; document keeps provenance, validity and proof class; histories are not merged | L1–L4 Pass; L5: T1 bind/heartbeat/document by three accounts (ACTIVE), T2 document update with a skills facet; T7 the anchor shortens its own liveness window, STALE once it passes stops commitment-class calls at the account's gate, heartbeat restores ACTIVE and the default window is restored; where a world names a backing registry (Sepolia's ARD fixture instance) the cells bind, heartbeat, take over and retire there too; T9 transfer of the agent turns A STALE, the successor's takeover bind, A RETIRED with successor, a retired anchor cannot heartbeat; histories not merged |
+| 8436 ACDF | commit `f8204fb` (Draft, merged 2026-10-14) | consumer (through adapters); judges | a real 2-of-3 Final; enactment only after authorization check; NoDecision as a distinct outcome | L1–L4 Pass; L5: T0 FOGA-Council registered; T5 a real 2-of-3 Final (Provisional, appeal window, finalize) enacted through the tender adapter after its own authorization check; a NoDecision case left to the kernel's clock; the workers' 2-of-2 decision through the swarm decision adapter; wrong-round, non-judge and premature execution refused; T6 the council as judgment tier of an ADRF case through the bridge (Final Decided No imported with provenance) |
+| 8444 ARD Onchain | commit `2641685` (Draft, merged 2026-10-15) | controller; discoverer | an external node finds a resource and checks descriptor and anchor; controller change and stale descriptors are detectable; adoption after transfer | L1–L4 Pass (four kinds registered and verified); L5: T1 agent records, T2 skill records, T3 task record, all `backed`; A discovers T3's task through its record; T9 a new agent record for the successor (the retired anchor's record is no longer backed), the skill record's controller follows the token, adoption by recommitting the same descriptor |
+| 8447 Swarm AI | commit `de5bc29` (Draft, PR #2081) | member; coordinator; SwarmAccount operator | distinct identities accept one charter; roles take effect; a cooperative tender is completed; leave and inactivity handling | L1–L4 Pass; L5: T4 three identities accept one charter under a composite eligibility (8004 agent, AID ACTIVE, KYA level), roles take effect (REPRESENT by the coordinator role only), the swarm account fulfils and is paid, the swarm concludes ACHIEVED from the tender's record; challenge suspends and reinstates; T9 the seat stays with the account that joined; leave and inactivity Not tested |
+| 8454 AUF | commit `1be1da6` (Draft, PR #2095) | definition controller; evaluator | cell and swarm units defined; income, gas and missing items recorded; realized net cash flow measured, never presented as value; no double counting | L1–L4 Pass; L5: T1 cell units ×3 and T2 skill units ×2 registered by the accounts; T4 the swarm unit containing the member units at pinned versions; T8 the realized-net-cash-flow method registered by E, observation receipts for cell A (T3–T7) and the swarm (T4–T5) asserted by E and recomputed by the resolver; a receipt counting the swarm's tender for A fails the boundary and once rules; an unregistered method is refused; no receipt states a value |
+| 8468 ASF | commit `a76071c` (Draft, PR #2113) | adopter; guardian; execution gate | out-of-scope actions rejected at the execution gate; suspension blocks; a second binding cannot bypass an effective stop | L1–L4 Pass; L5: T0 specification, T1 adoption by three accounts with G as intervener, `status()` Satisfied, gate exercised on every act; T7 the guardian's suspension enforced on chain at the gate against a transaction sent around the kernel, the de-risk allow-list open under it, a fresh binding refused by the standing stop, the adopter unable to lift the intervener's suspension, resume; T9 the successor adopts its own binding |
+| 8471 ADRF | commit `cd5a3e0` (Draft, PR #2123) | party; obligation source (escrow); executor | file, evidence, judgment, ruling, enactment with report; repeated enactment rejected; a conforming delivery yields no breach | L1–L4 Pass (on Sepolia the stack is FOGA's revision-4 instance deployed from the bundle, the upstream deployment being revision 3 — docs/version-lock.md seam 3); L5: T0 FOGA-Service-v1 registered and the world's escrow bound to it; T6 a service call committed to v1 delivered as v2, filed by the client (stranger, self-filing and duplicates refused), formal finding by the declared-version verifier, judged finding by FOGA-Council through the bridge, Final Sustained with the refund allowed, enacted once by the escrow and reported, a second enactment refused; a conforming call released to the provider |
+| 8004 Trustless Agents | official registries (Draft) | registrant | register, agentURI, transfer; local stub and public instance always labeled apart | L1–L4 Pass against the local stub; L5: T1 `register(agentURI)` by three accounts against the stub; T9 `transferFrom` through the account moves the agent to the successor (the stub clears the wallet as the official registry does). On Sepolia the same against the official registry `0x8004A818…`: agents 11255–11257 registered by the cells' accounts in T1, agent 11255 transferred to A-prime in T9 (layer 2 Pass for its ERC-165 and ERC-721 declarations; layer 3 Not applicable, not built by FOGA) |
+
+## Interface identifiers
+
+Computed from each interface's own function selectors in the compiled AST and compared with the identifiers the upstream repositories publish in their vectors (or README for 8338/8414). At the locked commits every published identifier matches the computed one; `artifacts/bundle.json` → `interfaceIds` holds the full table, including interfaces upstream publishes no id for (shims and helpers).
+
+| ERC | Interface | Id |
+|---|---|---|
+| 8338 | ISkillToken / IOnchainSkillDocument | `0x734553a6` / `0x7050dd2c` |
+| 8414 | ITaskToken / ITaskTender / ITaskVerifier / IOnchainTaskDocument | `0xcdaeb26d` / `0xc319d532` / `0x9977db15` / `0xeb078d05` |
+| 8419 | IKYASchemeRegistry / IKYARegistry / IKYAPolicyRegistry / IKYAPolicyEvaluator / IKYAVerifier | `0xe6dbd933` / `0x5d1bec61` / `0x1cf9e558` / `0x173ff2b6` / `0xfc2b4271` |
+| 8434 | IAIDRegistry | `0x72750a54` |
+| 8436 | IACDFPolicyRegistry / IACDFRegistry | `0xb362eb4e` / `0xd31aae30` |
+| 8444 | IARDOnchainRegistry / IARDKindAdapter | `0x881908a5` / `0x67bde273` |
+| 8447 | ISwarmRegistry / IEligibility / ISwarmAccount / IResourceAdapter | `0x085203a4` / `0xd0ede3d8` / `0x25e98353` / `0x8e20b298` |
+| 8454 | IAUFUnitRegistry / IAUFAssertionRegistry | `0x7128ef29` / `0x46ae6e24` |
+| 8468 | IASFSpecificationRegistry / IASFBindingRegistry | `0x9bddde77` / `0xcff7f826` |
+| 8471 | IADRFPolicyRegistry / IADRFDisputeRegistry / IADRFObligationSource / IADRFVerifier / IADRFEvidenceRule / IADRFJudgmentMethod | `0x4413df85` / `0xedc59c17` / `0xa52f2870` / `0xdfed0fe7` / `0x7ff3f359` / `0xc29a559d` |
+
+Note that 8454 and 8468 derive ids without `supportsInterface`, while 8447 and 8471 include it; the computed values follow each repository's own declaration, which is what `type(I).interfaceId` yields.