Notice Trail

Notice Trail is a public-record comparison ledger that uses GenLayer validator consensus to compare a frozen pre-meeting notice with later minutes or a resolution and store the resulting factual-alignment verdict on-chain.

Resubmission revision status: the amended contract is deployed on the existing Studionet principal address with exact source parity, preserved state, canonical attachment-backed readback, and reassessment authorization evidence. Public commit 84dedb774f4c6718af52d5b4a6972868767ed6ec is deployed at the production alias and its OKX write path completed reassessment transaction 0x295e3067d8e628c6a0c9bd1fd3494132693ab1b0b03b47a35d3787780fe8ae06 with successful state advancement and authoritative readback. Final POST_GITHUB_VERCEL_FINAL review remains pending.

Candidate contract source SHA-256: 3aba609122bc8afa5e8676e9e9f0395edc4ffa490c977c5a3012aea668508a06.

Current verified Studionet evidence

• Studionet contract: 0xB6031E1b9F464E9D7982769A38010EE474554caA
• Deployment transaction: 0x2ffc1dcc…93ecb
• Current judge-remediation upgrade: 0xd71bb6c1…c530
• Current on-chain source SHA-256: 3aba609122bc8afa5e8676e9e9f0395edc4ffa490c977c5a3012aea668508a06
• Production app on candidate commit: https://notice-trail.vercel.app

Historical upgrade 0x13a459fe…b217e installed the previous 72f686… source and remains recovery history, not current-code evidence.

Trust problem

A notice publisher and a later record publisher may describe the same meeting item differently, while a submitter may selectively characterize either document. Readers should not have to trust the submitter's summary or a centralized backend's verdict. Notice Trail derives the public-body identity and meeting time independently from both Utah PMN records, requires authoritative PMN outcome attachments, and lets GenLayer validators inspect the bounded evidence.

Notice Trail is a non-legal factual-comparison attestation. It does not determine legal validity, open-meeting compliance, political correctness, misconduct, intent, or vote merits. URL hosts are claimed public-record sources, not independently verified institutional authority.

Why GenLayer is essential

The hard step is nondeterministic: interpreting whether two public documents refer to the same meeting and item and whether the recorded action matches, materially changes, omits, or cannot safely be compared with the notice. The contract performs that comparison through independent validator executions, validates a closed result schema, and accepts equivalence only across stable source and decision fields. Consensus writes one of five bounded verdicts to contract state:

• MATCHES_NOTICE
• MATERIAL_CHANGE
• NO_FINAL_ACTION
• SOURCES_NOT_COMPARABLE
• UNRESOLVED

The caller cannot submit the verdict, reason codes, fingerprints, or normalized action.

How it works

1. A user connects and signs with an EIP-1193 wallet on Studionet.
2. The user registers an agenda-item locator and two fixed-grammar Utah PMN URLs. The user does not choose the authoritative public-body or meeting identity.
3. Any wallet may trigger the first evaluation. Validators derive and cross-check the public-body ID/name and event time from both PMN pages, require the outcome page's PMN PDF attachment evidence, and compare item alignment and action outcome. The first accepted result reserves a canonical meeting-item binding, so a different URL pair cannot create a duplicate accepted claim for that meeting item.
4. After FINALIZED, successful execution, and authoritative readback, the UI displays the contract verdict and evidence fields.
5. Only the original submitter or registered upgrader may reassess an accepted record. Reassessment repeats the live comparison, preserves the prior accepted assessment in contract history, and rejects any drift in an already-complete canonical meeting/source binding before state mutation. A truly legacy accepted record may populate all previously absent binding fields once.

Architecture

• contracts/notice_trail.py: source of truth for registration, source constraints, validator consensus, verdicts, counters, history, and upgrades.
• src/: React/Vite interface for wallet selection, signing, transaction reconciliation, registration, evaluation, reassessment, and ledger readback.
• Studionet: authoritative transaction lifecycle and contract state.
• Browser state: presentation and pending-transaction coordination only; it never determines a verdict.

Notice Trail has no backend, relayer, cron job, custody, escrow, payout, or off-chain verdict database.

Intelligent Contract

The persistent layout is record_count, records, then key_to_id. The contract exposes four write methods:

• register_record: validates and freezes the two role-bound source URLs and caller item locator; legacy identity arguments are fixed placeholders for upgrade compatibility.
• evaluate_record: derives canonical PMN meeting metadata, requires bounded outcome attachments, and stores the first accepted assessment; later calls require submitter/upgrader authority.
• reassess_record: authorizes the submitter/upgrader, re-evaluates, and preserves the previous accepted assessment in history.
• upgrade: replaces Root Slot code only for a registered upgrader and rejects empty code.

The equivalence validator requires exact agreement on the verdict, match fields, record roles, source fingerprints, and all decision-bearing reason codes. Only the bounded auxiliary annotation PROMPT_INJECTION_IGNORED may be excluded from equivalence after each full result independently passes schema validation. The public stored evidence fingerprint still binds the complete accepted result and can therefore change when that auxiliary annotation changes.

There is no economic value model. Studionet GEN is used only for network transaction fees and is not presented as real-money settlement.

Transaction lifecycle

The frontend requires a fresh wallet signature after reload and after disconnect/reconnect. It treats a submitted hash as pending evidence, polls the existing transaction without blind resubmission, and reports success only after:

1. transaction status reaches FINALIZED;
2. consensus and execution indicate success; and
3. contract readback shows the exact expected counter, verdict, and history transition.

MAJORITY_DISAGREE, execution errors, timeouts, rejected signatures, unchanged state, and malformed readback remain recoverable error states. A retained hash is reconciled before any retry.

Run locally

Prerequisites: Node.js 20+ and npm.

npm ci
cp .env.example .env.local

Set VITE_CONTRACT_ADDRESS to the verified Studionet contract. The default RPC is https://studio.genlayer.com/api.

npm run dev

The local app is served by Vite, normally at http://localhost:3000.

Tests and verification

npm test
npm run lint
npm run typecheck
npm run build
py -3.13 -m pytest tests/direct -W error
py -3.13 -m pip check

Current verified results:

• GenVM lint: PASS, 3 checks
• DirectVM: 174 tests passed with warnings promoted to errors
• Frontend: 108 tests passed across five files
• ESLint: PASS
• TypeScript: PASS
• Production build: PASS
• npm audit: 0 vulnerabilities
• pip check: no broken requirements

See verification evidence for live transactions and source parity.

Current deployed contract

• Network: GenLayer Studionet
• Chain ID: 61999
• RPC: https://studio.genlayer.com/api
• Contract: 0xB6031E1b9F464E9D7982769A38010EE474554caA
• Policy: NOTICE_TRAIL_V1
• Current on-chain source SHA-256: 3aba609122bc8afa5e8676e9e9f0395edc4ffa490c977c5a3012aea668508a06
• Principal upgrade transaction: 0xd71bb6c1…c530
• Classification: UPGRADABLE
• External upgrader: 0x0d4B860B08b9fba6cf1D928c4A19863176eaD563

The recovery manifest documents the current principal upgrade, populated rehearsal, source parity, state preservation, canonical attachment-backed reassessment, and unauthorized-capacity rejection: Studionet deployment and recovery.

Security and trust boundaries

• Only exact HTTPS URLs on www.utah.gov matching the bounded Utah PMN notice grammar are accepted.
• Raw and normalized source sizes are capped; missing, malformed, conflicting, unavailable, or oversized evidence fails closed.
• Caller-provided public-body and meeting identity is ignored; both PMN pages must independently yield the same canonical public-body ID/name and event time.
• A canonical meeting-item index rejects a second accepted claim even when it uses a different URL pair.
• Outcome evidence must contain one to three strict Utah PMN PDF links inside the official Download Attachments table; non-200 and oversized attachment responses fail closed.
• GenLayer accepts at most two LLM images per call. A three-attachment claim remains supported when at least one PDF yields bounded text; three scan-only PDFs fail closed before the LLM call instead of exceeding that runtime limit.
• First evaluation remains permissionless, while accepted-record reassessment is restricted to the submitter or registered upgrader so unrelated wallets cannot exhaust the 50-assessment lifetime capacity.
• Verdicts and reasons use closed allowlists and a decision/reason consistency matrix.
• The frontend never advances state ahead of authoritative contract readback.
• Contract upgrade authority is concentrated in one external wallet. Loss or compromise of that key is a material recovery risk.
• The contract compares claimed public records but does not authenticate institutional ownership of the host.

Known limitations

• Production V1 supports only direct Utah PMN HTML notice pages and their bounded PMN PDF attachments on www.utah.gov.
• Source structure or availability can change after registration and affect later reassessments.
• A scanned PDF may require screenshot evidence when WebRender exposes no text layer; the PMN outcome-page transcript remains part of the comparison.
• At most two scan-only attachment screenshots are accepted per assessment.
• Fixed-host and fixed-path validation reduce caller choice but do not cryptographically certify institutional control of www.utah.gov.
• Public evidence_fingerprint values may vary across semantically equivalent reassessments when only the optional prompt-injection annotation varies; stable consensus fields remain exact.
• The production bundle currently emits a non-blocking approximately 746.56 kB chunk-size warning.
• Upgrader authority currently has single-key concentration risk.