Proofs Verified on the public explorer

Everything tested. Everything verifiable.

This page lists what LOPW has tested and proven, on Stellar testnet and, once deployed, on Stellar mainnet: the contracts, the warranty payouts for every predicate, the stake lifecycle, the safety controls and the automated test suites behind the code. Every contract address and transaction links to the public explorer so a reviewer can check it without trusting this page.

How to verify an entry. Open its transaction. The explorer shows the contract that was called, the events it emitted (ClaimPaid, ClaimRejected, deposits and withdrawals) and any USDC transfer that resulted. Contract addresses open on the same explorer, where storage, calls and events can be inspected.

Stellar testnet Code tests

8 contractsdeployed on Stellar testnet

14 transactionseach linked to the public explorer

7 claims paidfrom seller stake, by contract alone

130 automated tests3 suites, CI passing

01 Network

Stellar testnet.

Live8 contracts deployed and 14 transactions linked. Each link opens the public explorer for this network.

Contracts on **Stellar testnet**
Contract	Address
Bond Registry	CBNGZB5GL3FEZKIQK73BTJYCQAC76N7SZCLN34JRMTQCUWER4GB3WHPL ↗
Claims	CBUBZC2AHVKFKYTAO3DIF6CZFQVM4UYCNABYVTPQNUUJGLOIBSIWONSC ↗
Validator P1 Equivocation	CBEBETGU7AFDBYSP5VGUIKJ7FHLLDOG5LM56MHYWYWT4M4S7FZEZ7TU3 ↗
Validator P2 Terms mismatch	CCDRQUWK5JHLNJRAMT6P37K4RS4B3SNELLZPP6LMM64IZ357MSSGSDW4 ↗
Validator P3 Stale data	CDUIB7ZPIRXMUZLIXRTALEFLXMAYLLIBJ6TDN5HWDR77CPLLPIG44DVJ ↗
Validator P4 Bad status	CA5FBH3RUW65UXIHU4YP2GSTQNUXHXTB4NIEVICPHHV7ISXY2VB6A2LV ↗
Validator P5 Size limit	CDJGYTFQOGMY3UX7CPYLJPNZF2SPFEHJRJGY3VOOHVVIPLNS4NWL5BEE ↗
Validator P6 Oracle deviation	CDPLC6G732LTARGLAKNA5TRR4DAERXKMWGWI4TS4XQ6WLHRSPHQNEWGV ↗

Warranty payouts after real x402 payments
What was tested	Result	Transaction
P1 Equivocation: seller signed two different receipts for one payment	Claim paid 5 USDC from stake	c2857bcf… ↗
P2 Terms mismatch: receipt cited different terms than the offer	Claim paid 5 USDC	a3b8824e… ↗
P3 Stale data: data an hour old against a 10-minute promise	Claim paid 5 USDC	b0a9882d… ↗
P4 Bad status: charged for HTTP 203 when only 200 was chargeable	Claim paid 1 USDC	c0d29757… ↗
P5 Size limit: response larger than the 4 KiB promised	Claim paid 1 USDC	72afb00b… ↗
P6 Oracle deviation: EUR/USD quoted 10% away from Reflector; validator read the oracle on-chain	Claim paid 5 USDC	5d75c3a0… ↗
Honest response	Receipt verified, warranty kept, no claim	—
Tampered receipt signature	Flagged untrusted by the buyer SDK; no claim possible, no penalty	—
Payout took stake below the minimum	Service suspended automatically; agents stopped paying it	39dafbca… ↗

Mainnet engineering, proven on testnet
What was tested	Result	Transaction
Protocol fees: 1 USDC registration fee on each reference service	Fees reached the treasury account	f53799e3… ↗
Annual stake fee (1%/year) accrued per second and collected on demand	collect_fee moved the accrued amount to the treasury; FeeCollected event indexed	—
Payment settled by LOPW's own self-hosted x402 facilitator, then a P6 claim	Claim paid 5 USDC; facilitator paid 0.0046 XLM in fees for two settlements	b394a774… ↗
Storage keeper extended the registry, claims and every service entry	4 transactions, 0 failures	—
Property test: random deposits, slashes, fees, unbonding and withdrawals	Contract USDC balance equalled the sum of stakes after every step in 64 random sequences	—

Stake lifecycle
What was tested	Result	Transaction
Deposit 150 USDC activates a Pending service	State Active	88b3fc64… ↗
Partial unbonding keeps the service Active	Pending withdrawal recorded with unlock time	28062bcd… ↗
Withdraw before the unlock time	Rejected: StillLocked	—
Cancel unbonding	Pending withdrawal cleared	0302d702… ↗
Registration below the 100 USDC floor	Rejected: StakeBelowFloor	—

Governance and safety
What was tested	Result	Transaction
Admin proposed a replacement Claims contract	Time-locked 26 hours; monitor raised a critical alert within seconds; proposal cancelled	—
Oracle read charges	A contract-to-contract Reflector read carried no fee beyond the normal transaction fee	678d5670… ↗
Honest claim against an honest quote	Recorded as rejected, NotProven, no payout	ff7ed65b… ↗

02 Network

Stellar mainnet.

Not deployedNo mainnet deployment exists yet. Mainnet proofs are added here as they are run, with the same explorer links.

03 Code tests

Tested in code, before the chain.

130 automated tests across 3 suites, run in continuous integration on every push.

Test suites
Suite	Tests	Covers
Soroban contracts (Rust)	97	Every registry state transition, slash rate limit, key retirement, admin time locks, launch limits, pause, allowlist, fees, a stake-accounting property test, all six validators, end-to-end claims with real signatures and a test USDC token
Protocol, buyer SDK, seller middleware (TypeScript)	22	Byte-for-byte test vectors shared with Rust, local predicate evaluation, policy refusals, receipt verification, durable receipt store, live testnet reads
Indexer, API, monitor (Go)	11	Event decoding, API pagination, errors, ETags, rate limits, OpenAPI coverage, alert rules including launch-configuration alerts
Total	130

PassingContinuous integration: Build and test on every push: Rust (fmt, clippy, tests, wasm build), TypeScript (build, type check, tests), Go (gofmt, vet, tests with a PostgreSQL service).

Live Scenario runs

Run on a schedule, judged every time.

Scenarios run on a schedule against the live services with real payments; every run is judged against the outcome the protocol must produce. Each scenario below shows its latest runs, with the payment and claim transactions linked to the explorer.

The scenario runs are read live from the LOPW API. What each scenario checks, why it matters and how a run is judged is described in Proofs and scenarios in the documentation.

Run How to reproduce

Run the tests. Run the agent.

The suites above run from a clone of the repository with Rust, Node and Go installed. The on-chain proofs are produced by the demo agent against the reference sellers, each of which can be asked to misbehave in one specific way.

TerminalSoroban contracts

# Rust: registry transitions, slash limit,
# key retirement, time locks, validators, claims
cd contracts && cargo test

TerminalProtocol, SDK, middleware

# TypeScript: shared test vectors, predicates,
# policy refusals, receipts, live testnet reads
pnpm install && pnpm -r test

TerminalIndexer, API, monitor

# Go: one module per service (API: PostgreSQL)
(cd services/indexer && go test ./...)
(cd services/api     && go test ./...)
(cd services/monitor && go test ./...)

Terminaldemo-agent

# One real purchase, one real claim.
# FAULT asks the seller to misbehave.
AGENT_SECRET=... SERVICE_URL=https://fx.lopw.com FAULT=BAD_PRICE \
  pnpm --filter @lopw/demo-agent start

# Ledger data API instead (P4 and P5):
RESOURCE=/v1/... REQUIRE=4,5 FAULT=BAD_STATUS \
  pnpm --filter @lopw/demo-agent start

AGENT_SECRET is the agent's Stellar secret key; the account needs USDC on the same network as the contracts. The agent sends FAULT as the x-lopw-fault header, which a reference seller honours only when started with LOPW_ALLOW_FAULT_HEADER=1. Each mode produces one of the outcomes in the tables above:

BAD_PRICEFX quote 10% off the oracle → P6, claim paid
STALE_DATAData an hour old → P3, claim paid
WRONG_TERMSReceipt cites other terms → P2, claim paid
DUPLICATE_RECEIPTSecond receipt for one payment → P1, claim paid
BAD_STATUSCharges for HTTP 203 (ledger data API) → P4, claim paid
OVERSIZEResponse over the size limit (ledger data API) → P5, claim paid
BAD_SIGNATURETampered receipt → flagged untrusted, no claim
NORMALHonest response → warranty kept, nothing to claim

Networks named here. Stellar testnet is where every linked transaction above was run. Stellar mainnet is listed so that mainnet proofs, when they exist, appear in the same format with the same kind of explorer links.