# Proofs and scenarios

> What LOPW has demonstrated on a live network: every predicate's payout after a real x402 payment, the stake lifecycle, governance safety and the automated test suites, with links to the demo and proofs pages.

*LOPW documentation · Deep dive.* Canonical page: https://lopw.com/docs/deep-dive/proofs-and-scenarios.html · This Markdown twin: https://lopw.com/docs/deep-dive/proofs-and-scenarios.md · Index of all pages: https://lopw.com/llms.txt · Everything in one file: https://lopw.com/llms-full.txt

Everything below has been run for real on the Stellar test network, with real x402 payments and real claims. The [proofs page](https://lopw.com/proofs/) links each item to its transaction on a public explorer; the [demo](https://lopw.com/demo/) replays one claim step by step with its console output.

## Warranty payouts after real payments

| Demonstrated | Result |
| --- | --- |
| P1 Equivocation: the seller signed two different receipts for one payment | Claim paid 5 USDC from stake |
| P2 Terms mismatch: the receipt cited different terms than the offer | Claim paid 5 USDC |
| P3 Stale data: data an hour old against a 10-minute promise | Claim paid 5 USDC |
| P4 Bad status: charged for HTTP 203 when only 200 was chargeable | Claim paid 1 USDC |
| P5 Size limit: response larger than the 4 KiB promised | Claim paid 1 USDC |
| P6 Oracle deviation: EUR/USD quoted 10% away from the oracle; the validator read the oracle on-chain | Claim paid 5 USDC |
| Honest response | Receipt verified, warranty kept, no claim |
| Tampered receipt signature | Flagged untrusted by the buyer SDK; no claim possible, no penalty |
| Payout took stake below the minimum | Service suspended automatically; agents stopped paying it |

## Stake lifecycle

| Demonstrated | Result |
| --- | --- |
| Deposit 150 USDC activates a Pending service | State Active |
| Partial unbonding keeps the service Active | Pending withdrawal recorded with unlock time |
| Withdraw before the unlock time | Rejected: `StillLocked` |
| Cancel unbonding | Pending withdrawal cleared |
| Registration below the 100 USDC floor | Rejected: `StakeBelowFloor` |

## Governance and safety

| Demonstrated | Result |
| --- | --- |
| Admin proposed a replacement Claims contract | Time-locked 26 hours; the monitor raised a critical alert within seconds; proposal cancelled |
| Oracle read charges | A contract-to-contract oracle read carried no fee beyond the normal transaction fee |
| Honest claim against an honest quote | Recorded as rejected, NotProven, no payout |
| Protocol fees: 1 USDC registration fee on each reference service | Fees reached the treasury account |
| Annual stake fee (1% a year) accrued per second and collected on demand | `collect_fee` moved the accrued amount to the treasury; `FeeCollected` indexed |
| Payment settled by a self-hosted x402 facilitator, then a P6 claim | Claim paid 5 USDC |
| Storage keeper extended the registry, claims and every service entry | All transactions succeeded |
| Property test: random deposits, slashes, fees, unbonding and withdrawals | The contract’s USDC balance equalled the sum of stakes after every step in 64 random sequences |

## Automated test suites

| Suite | Tests | Covers |
| --- | --- | --- |
| Soroban contracts (Rust) | 97 | Every registry state transition, slash rate limit, key retirement, admin time locks, launch limits, pause, allowlist, fees, a stake-accounting property test, all six validators, end-to-end claims with real signatures and a test USDC token |
| Protocol, buyer SDK, seller middleware (TypeScript) | 22 | Byte-for-byte test vectors shared with Rust, local predicate evaluation, policy refusals, receipt verification, durable receipt store, live test-network reads |
| Indexer, API, monitor (Go) | 11 | Event decoding, API pagination, errors, ETags, rate limits, OpenAPI coverage, alert rules including launch-configuration alerts |

Every push builds and tests all three: Rust (format, lint, tests, wasm build), TypeScript (build, type check, tests) and Go (format, vet, tests). Counts are those recorded on the [proofs page](https://lopw.com/proofs/).

## The scheduled scenarios

Eleven named scenarios run on a schedule against the live reference services and are judged automatically: honest quote, each predicate’s breach, tampered signature, replay blocked, honest claim rejected and policy refusal. Each is written in plain language with why it matters:

| Scenario | Why it matters |
| --- | --- |
| Honest FX quote: warranty kept | The normal path must stay cheap and simple: one x402 payment, one receipt, no escrow, no extra transaction when the seller behaves. |
| Quote 10% off the oracle: P6 claim paid | The only predicate checked against evidence the seller does not control. A seller cannot lie about market data without paying for it. |
| Data older than promised: P3 claim paid | Freshness guarantees are enforceable without any oracle: the seller’s signed receipt is the evidence. |
| Receipt cites different terms: P2 claim paid | A seller cannot quietly swap the promise after payment: the receipt must name the exact terms the buyer paid under. |
| Two different receipts for one payment: P1 claim paid | Equivocation is the clearest proof of dishonesty, and the second receipt is all the evidence needed. |
| Broken receipt signature: untrusted, no claim, no penalty | An invalid signature proves nothing about the seller (anyone could forge one), so it is never slashable; the protocol must say so rather than guess. |
| Charged for an unpromised HTTP status: P4 claim paid | Sellers cannot bill for responses they promised not to bill for; the status is in the signed receipt. |
| Response larger than promised: P5 claim paid | Size limits protect agents from paying for padded or runaway responses. |
| Same claim filed twice: second one rejected | One payment can be compensated once. Replay protection is on-chain, keyed by service and payment. |
| Claim against an honest receipt: rejected, nothing paid | Anyone may submit a claim, so the protocol must produce no false positives: an honest seller is never slashed. |
| Agent policy refuses an under-staked seller: no payment made | The bond is readable before payment, so an agent can decline a seller it does not trust at zero cost. |

Run them yourself: [Run the scenarios](https://lopw.com/docs/guides/run-scenarios.html). Read the recorded runs: `GET /v1/{network}/scenarios` in the [API](https://lopw.com/docs/protocol/api.html).

## Production network

No production-network deployment exists yet. When one does, its proofs are added to the proofs page under that network with the same explorer links, and the Stellar binding’s `STELLAR_MAINNET` entry receives its contract addresses.