kapustazh · Sep 8, 2026 · Sep 8, 2026
diff --git a/.agent/context/20260908T221341Z-p4-verification-status.md b/.agent/context/20260908T221341Z-p4-verification-status.md
@@ -0,0 +1,83 @@
+# Session Context: P4 Verification Status
+
+## Date/time
+
+- UTC: 2026-09-08T22:13:41Z
+
+## User goal
+
+Fix unresolved issues from the previous development plan before starting future
+work, with external provider credentials available through approved secret
+stores.
+
+## Original prompt/request
+
+"let's fix current issues that we have from previous plans, after contining
+future work. all of api's i have in google cloud, privy, the graph and etc."
+
+## Assumptions
+
+- Repair the current plan/evidence inconsistency before enabling new live
+  integrations.
+- Provider credentials remain outside Git and outside review evidence.
+- Testnet remains the only authorized settlement network.
+
+## Plan
+
+1. Correct the Gate P4 manifest and checklist so scoped live evidence cannot be
+   mistaken for an overall gate pass.
+2. Validate the documentation change.
+3. Complete the required review loop before starting the separate live
+   Graph/MCP/model integration packet.
+
+## Key decisions
+
+- Preserve the verified Privy/Arc evidence while marking the missing live
+  Graph MCP/model proof `NOT_VERIFIED`.
+- Keep live adapter implementation separate from this status repair so each
+  candidate tree has one auditable purpose.
+
+## Files/components touched
+
+- `docs/GATE_P4_MANIFEST.md`: scoped statuses and missing live-proof criteria.
+- `docs/GATE_P4_CHECKLIST.md`: explicit incomplete live hashless-recovery step.
+- This context record.
+
+## Commands/checks
+
+- `git fetch origin develop` - base refreshed to
+  `48391e4968675764632627716e580988a271c13d`.
+- `git diff --check` - passed.
+- `npx markdownlint-cli2 docs/GATE_P4_MANIFEST.md docs/GATE_P4_CHECKLIST.md
+  .agent/context/20260908T221341Z-p4-verification-status.md` - passed with
+  zero issues.
+
+## External-doc findings
+
+- None required for this status-only correction; checked-in evidence and
+  canonical repository policy are authoritative.
+
+## Unresolved questions
+
+- The live Graph deployment identity, MCP endpoint, and model configuration
+  must be supplied through the approved runtime secret/configuration path for
+  the next packet; no secret values belong in this record.
+
+## Git and PR state
+
+- Branch: `fix/p4-verification-status`
+- Base: `origin/develop` at `48391e4968675764632627716e580988a271c13d`
+- Commit: uncommitted
+- PR: not created
+- CI: not started
+
+## Review gates
+
+- Gate A: NOT RUN
+- Gate B: NOT RUN
+
+## Handoff/next steps
+
+1. Run Markdown and repository validation.
+2. Stage the exact documentation tree and run Gate A.
+3. Commit, push, open a draft PR, await CI, and run Gate B.
diff --git a/docs/GATE_P4_CHECKLIST.md b/docs/GATE_P4_CHECKLIST.md
@@ -8,7 +8,10 @@ Gate P4 is the project convergence point where backend milestones across all thr
 - **Coder B**: B04 (Settlement adapter, Privy authorization, error taxonomy)
 - **Coder C**: C04 (Recovery matrix integration, Subgraph MCP engine)
 
-At Gate P4, checked simulators are replaced with real reviewed package versions, and integrated end-to-end proofs are executed before frontend milestones (A05/B05/C05) commence.
+At Gate P4, checked simulators are replaced with real reviewed package versions,
+the frontend contract is frozen, and the integrated live proofs required by the
+plan are executed. Composition and contract freeze are complete; the live
+Graph MCP/model lost-hash proof remains incomplete.
 
 ## Package Version Slots
 
@@ -20,7 +23,7 @@ At Gate P4, checked simulators are replaced with real reviewed package versions,
 | Settlement Worker | `@oneshot/worker@0.1.0` | Lane A | Composed & Converged |
 | Arc Settlement Adapter | `@oneshot/privy-adapter` (`ArcSettlementAdapter`) | Lane B | Integrated & Wired in Production Profile |
 | Privy Authorization Adapter | `@oneshot/privy-adapter` (`PrivyAuthorizationAdapter`) | Lane B | Integrated & Wired in Production Profile |
-| Subgraph MCP Recovery | `@oneshot/reconciliation` | Lane C | Integrated & Wired via `recovery-bridge` |
+| Subgraph MCP Recovery | `@oneshot/reconciliation` | Lane C | Boundary integrated via `recovery-bridge`; live MCP/model path `NOT_VERIFIED` |
 
 Both lane-B adapters ship from `@oneshot/privy-adapter` rather than from
 separate packages: settlement is a Privy wallet action carrying an Arc
@@ -55,6 +58,17 @@ readiness probing they build on. See
    - Published sanitized Gate P4 manifest in `docs/GATE_P4_MANIFEST.md`.
    - Frontend milestones (A05, B05, C05) unblocked to build on frozen contracts and mock server.
 
+5. **Prove live hashless recovery**: [INCOMPLETE]
+   - Pin a canonical immutable OneShot/Arc Subgraph deployment with an active
+     Indexer allocation.
+   - Query it through the live Subgraph MCP transport using
+     `execute_query_by_deployment_id`.
+   - Pass the sanitized candidate view to a structured-output model adapter.
+   - Record the bounded model action, referenced evidence, deterministic-core
+     disposition, Arc verification, and zero external replacement submissions.
+   - Keep `FALLBACK_DIRECT_RECOVERY`, The Graph `NOT_VERIFIED`, and the overall
+     Gate P4 status `INCOMPLETE` until every item is evidenced.
+
 ## Verification Commands
 
 The Arc, Privy, and settlement testkit packages are full members of the root

diff --git a/docs/GATE_P4_MANIFEST.md b/docs/GATE_P4_MANIFEST.md
@@ -6,6 +6,14 @@ Gate P4 represents the backend convergence boundary across all three coders (A04
 
 All checked simulators in production worker composition are replaced with real reviewed package entry points, and the OpenAPI v1 contract seam is frozen with additive sanitized fields, versioned mock server, and validated UI fixtures.
 
+| Scope | Status | Meaning |
+| --- | --- | --- |
+| Backend package composition | `COMPLETE` | Reviewed package entry points are wired into the production composition boundary. |
+| Frontend contract boundary | `FROZEN` | OpenAPI v1, fixtures, and mock-server semantics are published. |
+| Privy authorization and Arc settlement proof | `LIVE_VERIFIED` | The checked-in sanitized evidence proves the recorded Arc Testnet transaction and denial drills. |
+| Hashless Graph MCP and model recovery proof | `NOT_VERIFIED` | No admitted live MCP transport, immutable deployment with active Indexer allocation, or live model-to-core trace exists. |
+| Overall Gate P4 | `INCOMPLETE` | Composition is complete, but the plan's live lost-hash proof is still missing. |
+
 ## Package Version Slots
 
 | Slot | Planned Package | Owning Lane | Gate P4 State | Pinned Identifier / Digest |
@@ -16,7 +24,7 @@ All checked simulators in production worker composition are replaced with real r
 | Settlement Worker | `@oneshot/worker@0.1.0` | Lane A | Converged | Production profile wired with Lane B and C adapters |
 | Arc Settlement Adapter | `@oneshot/privy-adapter` (`ArcSettlementAdapter`) | Lane B | Integrated & Wired | Pinned Arc testnet `eip155:5042002` |
 | Privy Authorization Adapter | `@oneshot/privy-adapter` (`PrivyAuthorizationAdapter`) | Lane B | Integrated & Wired | Policy authorization `1.0.0` |
-| Subgraph MCP Recovery | `@oneshot/reconciliation` (`RecoveryService`) | Lane C | Integrated & Wired | Wired via `recovery-bridge` over durable `IntentLedger` |
+| Subgraph MCP Recovery | `@oneshot/reconciliation` (`RecoveryService`) | Lane C | Boundary Integrated; Live Path Not Verified | Wired via `recovery-bridge` over durable `IntentLedger`; production remains on `FALLBACK_DIRECT_RECOVERY` |
 | Recovery UI Components | `@oneshot/recovery-ui@0.1.0` | Lane C | Pinned | Mock Server `1.0.0` |
 
 ## Frozen Frontend Boundary (OpenAPI v1)
@@ -69,11 +77,11 @@ Published under `packages/contracts/fixtures/ui/v1/`:
 
 All fixtures are verified free of sensitive keys and conform to the published JSON Schema bundle via `pnpm validate:fixtures`.
 
-## Testnet Evidence Mode Verification Status
+## Privy and Arc Testnet Evidence Status
 
-Per `docs/plan.md` (procedure steps 8-13):
+Per `plan.md` (procedure steps 8-13):
 
-- **Verification Status**: `LIVE_VERIFIED`
+- **Verification Status**: `LIVE_VERIFIED` for Privy authorization and Arc settlement only. This is not an overall Gate P4 verdict.
 - **Human Provisioning (Step 8)**: Completed per `docs/settlement/PROVIDER_SETUP.md` with Privy app `cmtqbf5zo013w0cky3r0jqjca`, server execution wallet `0xfCC366c88A0c980e2FD5a7Cf7a36494E4457D943`, policy `balx3rtrpns3gnvhz3n32dml`, and funded Arc Testnet account.
 - **Live Settlement Drill (Step 9)**: Executed and confirmed on Arc Testnet (`eip155:5042002`).
   - Transaction Hash: `0x72ab1e93c95e5295b2dfa9b3abc8cc5130330f3bba07ad18af2c5b7784f57cf7`
@@ -95,3 +103,21 @@ Per `docs/plan.md` (procedure steps 8-13):
   - Live proof: `evidence/c06/sanitized-proof.json`
   - Settlement evidence log: `docs/settlement/LIVE_EVIDENCE.md`
   - Qualification report: `packages/reconciliation/docs/c06/QUALIFICATION_REPORT.md`
+
+## Remaining Gate P4 Live Proof
+
+- **Verification Status**: `NOT_VERIFIED`
+- Query a canonical immutable OneShot/Arc Subgraph deployment through the live
+  Subgraph MCP transport for a lost-hash case.
+- Record the deployment, query, variables digest, retrieval identity, `_meta`
+  health/freshness, and candidate count without credentials.
+- Feed the sanitized result to a structured-output model adapter and record its
+  bounded recommendation plus referenced evidence IDs.
+- Let the deterministic OneShot core validate the recommendation and verify any
+  candidate through authoritative Arc receipt and Transfer evidence.
+- Prove zero new settlement submissions throughout empty, delayed, malformed,
+  multiple-candidate, invalid-model-output, and successful-existing-result
+  cases.
+
+Until this evidence exists, automatic hashless recovery remains unavailable,
+The Graph remains `NOT VERIFIED`, and Gate P4 cannot receive a global pass.