docs(plan): define hashless recovery

[kapustazh]

Summary

Finalize Privy + Arc + The Graph as the OneShot product architecture. Define a
concrete lost-response demo: The Graph discovers hashless transfer candidates,
Arc verifies exact receipt/log evidence, and PostgreSQL alone owns the durable
decision. Remove alternative settlement-rail analysis from the roadmap.

Scope and acceptance criteria

• The change is limited to the product roadmap, architecture, milestone contracts, and supporting agent guidance.
• Privy, Arc, and The Graph have explicit, non-overlapping product roles.
• The Graph prize target and live-data requirement are explicit.
• Lost-hash recovery, degraded evidence, and Arc mainnet readiness are specified.
• Alternative settlement rails are outside this roadmap.

Product and security invariants

• One Business Intent produces at most one committed settlement.
• UNKNOWN never causes a blind retry.
• Privy authorization remains mandatory for the normal settlement path.
• The Graph proposes candidates and never grants payment authority.
• Arc receipt and ERC-20 Transfer verification remain authoritative chain evidence.
• No secret, token, production identifier, or personal data is committed.

Invariant notes: PostgreSQL remains the source of durable state. Arc Memo
correlation is used only if the Privy policy spike proves the forwarded call
can be constrained; otherwise strict authorization and The Graph tuple/window
candidate discovery remain.

Validation

git diff --check: PASS
local Markdown links: PASS (45 files)
milestone packets: PASS (18 files)
Mermaid CLI 11.17.0: PASS (12 diagrams)
removed settlement alternatives scan: PASS
secret-pattern scan: PASS

Independent review evidence

Gate A and Gate B were skipped by explicit user instruction for this follow-up
planning change. Human review remains required before merge.

Risk and rollback

• Residual risk: live Graph value and Arc Memo/Privy policy compatibility still require B01/C01 evidence.
• Rollback: revert commits 12603dd9504b29ad023e765e5ad87ee77cb1eef4 and 8b55623.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	oneshot	8b55623	Sep 06 2026, 09:57 PM