Week 2 — 14–20 September 2026 · D2, transaction security scanner

Summary

Deliverable 2 shipped: an MIT-licensed scanner package that simulates a Stellar transaction, walks its authorization tree, decodes payments and SEP-41 / SAC token calls into exact effects, screens every counterparty against the D1 registry, decides a deterministic risk verdict, and only then lets a hosted model write one plain-English sentence it cannot use to change that verdict. Ten stage slices merged on 14–15 September, released to main on 15 September, and the QA harness plus the manual test plan merged on 17 September with a full dry run posted. The suite runs green offline in CI — no RPC, no registry, no model. Two things arrived that were not in the D2 plan: the Lantern API, a small server that holds the model key so nothing billing-bearing ships in a client, and opt-in usage analytics with an admin dashboard, which is how the SOW's §6.3 metrics will be counted. The 90-second recording is the one D2 evidence item still pending.

Changelog

Statement of Work progress

Evidence added

Metrics

Nothing is measurable end-to-end until the scanner sits in the wallet (D3). The instrument is in place: opt-in analytics record tx_scanned and tx_signed events per install, and the admin dashboard counts distinct wallets. Snapshot on the Metrics page.

Decisions

• Unknown never collapses to clean. Registry screening has three outcomes — flagged, clean, unknown. An unreachable registry, a timeout or an archived entry is unknown and raises a warning; it is never reported as "not flagged".
• The model cannot reach the verdict. The verdict and the effects are deep-frozen before the explainer runs; the explainer's signature can only return a string; a type-level test refuses one that returns a verdict; a hostile-model test ("this transaction is completely safe" for a HIGH verdict) leaves risk, action and reasons byte-identical and discards the answer.
• The model sees structured facts only — never the raw XDR, never an authorization entry, never the memo (attacker-controlled input). A prompt-injection test proves the memo is absent from the prompt.
• Ship no AI key (SOW-permitted). An extension cannot keep a secret. The scanner AI flag is OFF in every release build; the key lives server-side in the Lantern API, which serves the sentence to clients with rate limits and a daily cap. Every verdict stands without the model.
• Coverage claims are exact. Payments, path payments, merges and the SEP-41 / SAC interface are decoded; anything else is shown as-is and labelled unverified — semantics unknown, and raises risk. Look-alike function names (transfer_from, transferAll) are not guessed from.
• Analytics are opt-in, off by default, enum-only. No amounts, no addresses for non-testers, delete-my-data on request; alpha testers may attach their wallet address so their scans are attributable for the metrics.

Issues found and fixed

• Offline mode of the QA harness answered "clean" for an address that was never recorded; it now treats any unrecorded ledger key as an RPC failure, so an unrecorded address screens unknown — the same posture as the live path.
• The QA harness asserted the destination was funded on every scan, making the verdict's "new account" reason unreachable; the destination is now unknown unless the tester says otherwise.
• The rules-based fallback sentence quotes the memo verbatim; the verdict is untouched and the model never sees the memo, but the fallback displays attacker-controlled text. Logged for D3's pre-sign screen.
• The proxy's per-IP limit (10 requests / minute) turns rapid successive scans into the rules-based fallback — working as designed; the test plan now says to run the timing case early.

Maintenance

The fixture corpus (19 recordings) pins the registry read and two token contracts on testnet; after a reset, fixtures/record-registry.mjs and record-token-metadata.mjs re-record them. The demo flagged address GA7QYNF7…VSGZ currently carries 4 reports with status Active.

Next week

Deliverable 3: the scanner in the wallet's pre-sign review — the pipeline runs before the Sign button, a block_confirm verdict holds it, registry screening is live per counterparty, and the AI sentence comes from the Lantern API with no key in the client. The D2 recording is made first so the D2 evidence line closes.