Cardano Modular Restaking

Evidence-gated delivery, not document-driven completion.

The source-bound local model suite passes 130 tests across 21 files with 1,087,740 assertions. It retains seven accepted vault/operator actions, a zero-capability D-029 catalogue model, and 3,000,000 reconciled scale-model attempts; all remain modeled only. The direct repository suite passes 298 tests across 35 files with 1,089,034 assertions. The latest added source-bound test and five assertions bind only the exact EigenPod constructor source/type/callsite incompatibility across two Middleware consumers; no modeled protocol action was added. Spending schema v25 passes 348 CEK evaluations: twenty internal admissions, 327 internal rejections through PCX-030, and one terminal rejection. The spending and policy generators additionally export two source-bound terminal V3 development artifacts with zero positive acceptance; neither has production or ledger parameters, a ledger script hash, a blueprint, release eligibility, or a deployment claim. The untrusted typed source layer now covers eleven strategy/vault-bootstrap/operator-registration/existing-position/delegation/queue/completion requests, emits forty-five datum and twenty-nine spending/policy redeemer CBOR items, then returns no transaction at D-032. Bootstrap derives exact root names, zeroed state, mint/redeemer, and Preview facts while keeping its supplied target policy ID unverified and production policy parameters/shared-validator hash unavailable. Registration derives seed/reference/signer/identity/mint/zero-state facts but consumes, authorizes, signs, and constructs nothing. D-033 rejects new-position and owner-absence inputs. Allocation adds 28 neutral exact-rational helpers; claim loss adds 25 exact upper-bound/conservation helpers; cumulative reward claim adds 28 exact checkpoint/funding-conservation helpers with six admissions, twenty-two rejections, and RCA-001–RCA-008. Migration conservation adds 28 exact sequence, asset, accounting, and tail helpers with six admissions, twenty-two rejections, and MCA-001–MCA-008. Claim/slash readiness applies 21 profiles to 104 action/profile pairs and rejects 208 calls before any evidence, challenge, authority, timing, cap, reservation, loss, destination, or terminal rule executes. Reward readiness applies 21 profiles to 120 pairs and rejects 240 calls before any asset, funding, distribution, proof, authority, timing, payout, accounting, replacement, recovery, or terminal rule executes. The governance dispatcher applies 21 profiles to 227 pairs and rejects 454 calls before any governance rule executes. Controlled staking applies 21 profiles to 164 pairs and rejects 328 calls before any certificate, withdrawal, authority, accounting, or retirement rule executes. Middleware/key/task/checkpoint readiness applies 21 profiles to 217 pairs and rejects 434 calls before any key, signature, threshold, task, certificate, remote-finality, value-import, or migration rule executes. All five dispatchers preserve byte-identical pre-state and accept zero domain transition. The reward helper derives no asset, distribution, proof, authority, action, transaction, or value movement; the migration helper derives no identity, enumeration, manifest, authority, action, transition, transaction, or value movement. First deposit, active allocation, every claim/reward/governance/controlled-staking/middleware action, positive child-policy authorization, complete non-vault output rules, and public-validator acceptance remain fail closed. The widened corpus contains 678 protocol helpers and 784 total evaluator runs including 106 preserved non-protocol probes. No protocol transaction has been constructed, Blaze-emulated, or testnet-executed; NOT_RELEASED remains the only truthful decision.

The middleware corpus closes the reachable Solidity graph from 78 source files, 97 test files, and two scripts at 310 files and 1,402 import edges with zero unresolved, while recording 121 normalized source declarations, 618 named source functions, 116 test families, and 800 named tests. Its 921 exact review records still accept zero Cardano behavior. Hash-pinned Foundry v1.3.6 and Solidity 0.8.27 compile all 310 files into 508 byte-stable contract artifacts with digest 520ba265…a61598; one raw Foundry build-info file remains recorded separately because its generated filename/source-ID map varies across otherwise identical clean builds. A fixed-seed non-fork EVM run records 839 passing and six skipped. A deterministic overlay reproduces the upstream assertion mismatch and confirms the transparent proxy's expected admin rejection before the call reaches Allowlist. The 43-path semantic triage resolves 29 paths as source-compatible at the reviewed source level, classifies six as source-incompatible, and queues eight for manual review. The latest bounded EigenPod finding covers only exact IntegrationDeployer.t.sol and CoreDeployLib.sol constructor surfaces: project core removes SemVerMixin and the third version-string constructor argument, while both importers retain three-argument calls and neither has a two-argument call. It establishes no implementation, initializer, beacon, proxy, or deployment equivalence. The earlier EigenPodManager, IStrategy, IStrategyFactory, ArrayLib, core AllocationManagerMock, StrategyBaseTVLLimits, removed-semver, SlashingLib, EigenStrategy-constructor, strategy-hook, queue-slash, and allocation/slasher findings retain their exact source/type/callsite limits. The exact source-bound reviews are hash-bound but unexecuted by those reviews and establish no storage-layout proof, bytecode equivalence, whole-core compatibility, Cardano translation, or approved divergence. This is partial upstream EVM evidence, not Cardano compatibility or execution.

The unanimous evidence source is 28ea9a3 under evidence controller 4240932. All eighteen source-bound reports agree, and the rebuild contract passes twenty-one self-comparisons, forty-nine projection checks, and ten fixture checks. The current same-host replay at 4240932/28ea9a3 passes all twenty commands, twenty-one projections, and three controller fixtures in 527,994 ms; report SHA-256 is 487f3483…e565f. Hosted run 31348903499 completed successfully at historical published commit 122d228 and predates this source. The currently imported hosted Ubuntu run 31300338815 at 6c7b59f/f79ca94 remains an immutable passing historical result with the same bounded command/projection counts, 2,870,569 ms, and SHA-256 949387c4…bf8f6. The allocation, claim, reward, and migration arithmetic corpora all match their exact oracles without creating a public action or transition. Blaze builds eleven scoped packages, passes 63 emulator tests, and replays one generic non-protocol transfer. The current immutable Middleware report binds the 29/6/8 triage at source 28ea9a3, including the exact bounded EigenPod constructor incompatibility while retaining the prior EigenPodManager, SlashingLib, and EigenStrategy findings; overall compatibility remains false, and accepted Cardano behavior remains zero. The exact WASM profiles remain Linux/X64 964,313 bytes/929ed7ee…e816a and Darwin/ARM64 964,605 bytes/e4c8a702…9871a; unknown profiles fail closed. PPA-08, PPA-09, and PPA-10 pass in the current strict report, ten gates fail, and the decision remains NOT_RELEASED. Publication and a fresh hosted replay are required. D-032 and D-033, active allocation/reward decisions, positive public validators/policies, protocol construction, Blaze lifecycle execution, official V4 support, complete independent release reproduction, and testnet evidence remain open. Current same-host report ↗ · Historical hosted report ↗ · Migration helper report ↗ · Migration boundary ↗ · Reward helper report ↗ · Reward boundary ↗ · Claim helper report ↗ · Rebuild contract ↗

Claims stop exactly where the evidence stops.

The project uses a deliberately strict vocabulary so pure models, transaction construction, evaluator execution, emulator acceptance, public-ledger inclusion, formal proofs, and release decisions cannot be conflated.