| Filename | Latest commit message | Latest commit date |
|---|---|---|
db65d20be0
`cargo audit` over all 47 workspace lockfiles reported 142 vulnerability instances. The dangerous ones were not exotic: the S2 executor was pinned to wasmtime 43.0.2, which carries eight advisories including RUSTSEC-2026-0379 (9.9), -0327 (9.3) and -0269 (8.8). That crate is the one component whose whole job is to execute untrusted guest code, so a sandbox-escape class defect there is not a dependency hygiene matter — it is the confinement claim itself. wasmtime moves 43.0.2 -> 49.0.4, the single version every one of the eight advisories names as patched (50.0.0 exists but no advisory lists it as fixed, so it is not yet the safe choice). WASMTIME_VERSION is updated with it: the constant is attested into the mechanism commitment under SPEC §7.9, so leaving it stale would attest confinement to a runtime that did not run. The crate's own `wasmtime_version_matches_the_lockfile` test enforces that pairing. The rest are semver-compatible bumps carrying no API change: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots/webpki-root-certs 1.0.10, quinn-proto 0.11.18 (RUSTSEC-2026-0340/-0343, both 7.5), tokio 1.54.1, crossbeam-epoch 0.9.20, rtrb 0.3.5. Not fixed here, and deliberately so rather than silently: zip (>=9.0.0), hpke-rs (>=0.6.0), quick-xml (>=0.41.0) and libcrux-kem (>=0.0.10) are all semver-major moves, three of them transitive, so each needs its dependent assessed on its own. rsa RUSTSEC-2023-0071 has no fixed version at all. Co-Authored-By: Claude Opus 5 <[email protected]> |
||
| .. | ||
| conformance | ||
| smart-byte-rs | ||
| spec | ||
| vocab | ||
| LICENSE | ||
| README.md | ||
| SECURITY.md | ||
| THREE_FACES.md | ||
Smart Byte
A carrier for value. Settlement-agnostic, energy-attributed, no off switch.
The smart byte is not money — it is a vesicle (the cellular-biology sense): a content-addressed, signed envelope carrying exactly five things — identity (the blake3 hash of its origin attestation), provenance (the issuer's signed birth certificate), an ownership chain (signature-bound transitions), cargo (whatever value it represents — USD, joules, compute-hours, votes, attestations, claims; the substrate is agnostic), and a two-part joule cost (measured + estimated, cumulative over its life). Consensus is lockstep deterministic simulation with BFT supermajority commit; the substrate scales by federating many bounded clusters, not by growing one. It is TCP/IP for value: an open, application-agnostic carrier that any matching, clearing, or trust-signaling layer can build on.
The substrate is intentionally ownerless: no protocol-level token, permissive licensing on the spec text and reference code, conformance test vectors so any implementer can verify canonicity without a trust relationship with the authors. The protocol's identity lives in its conformance vectors and content-addressing, not in any brand. Transaction Science is one steward — it publishes the spec, ships a reference implementation, and operates commercial services around the substrate — not its proprietor.
Contents
spec/treatise_v1_parts_I_II_III_combined.md— Smart Byte Substrate: A Treatise (Parts I–III: the foundation, the substrate architecture, the security engineering; Parts IV–VII previewed)strategic_context.docx— The Strategic Context: Why the Substrate Makes Sense in 2026SECURITY.md— the working security-engineering summary: it's a digital system on the internet, secured the way digital systems on the internet are secured (conservative cryptography, encrypted transports, reproducible multiply-reviewed builds, standard layer-2 key custody, standard availability engineering, textbook BFT consensus) plus a handful of new compositions of those proven parts. Plus the vulnerability-reporting process.
Status
Treatise v1.0 (May 2026). The conformance specification (byte-level wire formats) and the reference implementation referenced in the treatise as "v0.3" are to be brought into this repository.
Licence
Specification text: CC-BY-4.0 (see LICENSE).
Reference implementation in smart-byte-rs/: Apache-2.0 (see smart-byte-rs/LICENSE).
Related
- EOC (
../eoc/) — the energy-optimized AI compute substrate; the smart byte's energy attribution depends on an honest joules-per-task substrate. - Settlement (
settlement.science) — the flagship regulated financial institution running on the substrate as an issuer and consumer of smart bytes.