Identity + RMT — Deploy Plan

System State

Identity sprints done

S25 next · testnet after

RMT research score

0.9577

Phase 7b · best ever · sybil-ring 0% (Phase 8 fix)

Deployed contracts

Deploy script exists · ~2.5hrs to Base Sepolia

Backend routes

auth/bots/kyc/admin/payment/a2a/erc8004/trust-chain

Prisma models

User/Bot/KYC/TrustAnchor/Subscription/Payment/...

Multi-sig threshold

2/2

Both signers needed · ceremony required

Identity System — Trust Anchor Onboarding Flow (Deploy Status)

POST /auth/register + /auth/github + /auth/google · bcrypt 12r · JWT + CSRF

auth.service.ts oauth.service.ts

✓ DONE

Email Verification

SendGrid · 24h token · single-use · resend endpoint

email.service.ts

✓ DONE

Wallet Link (MetaMask sign-message)

No gas · EIP-191 sign · links wallet to user account · nonce replay protection

auth.routes.ts LinkedWallet model

✓ DONE

KYC Submission

Doc upload → S3 SSE-KMS · Prisma KYCSubmission model · status: PENDING/APPROVED/REJECTED

kyc.service.ts kyc.routes.ts

✓ DONE

Admin KYC Approval

Admin dashboard → review docs → approve/reject · configurable: manual/semi-auto/auto · email notify

admin-kyc.service.ts admin.routes.ts

✓ DONE

Trust Anchor Onboarding — onboardTrustAnchor()

Admin MetaMask TX · multi-sig 2/2 · return codes: 0=fail, 1=pending, 2=wrong status, 3=success · proposal UI in admin dashboard

multisig.service.ts TrustAnchorManager.sol

⚠ NOT DEPLOYED

Trust Anchor Verification — verifyTrustAnchor()

2nd admin signature · auto-executes when threshold=2 · EVT_verifyTrustAnchor emitted · dev status → "verified"

TrustAnchorManager.sol blockchain.service.ts

⚠ NOT DEPLOYED

Bot Registration — setAttestation()

Developer MetaMask TX · on-chain compressed JSON metadata · ERC-8004 discovery endpoint · A2A agent card · JWKS Ed25519

TrustAnchorStorage.sol bot.service.ts erc8004.routes.ts

⚠ NOT DEPLOYED

Stripe Subscription

FREE / $29 STANDARD / $99 PREMIUM · webhook lifecycle · Customer Portal · USDC/ETH on-chain payment also built

payment.service.ts Subscription model

✓ DONE

Reputation Score on Bot Card

Wire getCompositeScore() from RMT oracle → identity portal bot directory · needs RMT S30b + testnet oracle deployment

PageRankOracle.sol rmt-sdk

✗ NOT BUILT

Multi-Provider PoH Verification

Apple App Attest, Google Play Integrity, NFC Passport Chip — abstraction over platform verifiers · competitive vs Worldcoin

New module: verification/

✗ NOT BUILT

Hierarchical Agent Delegation

Extend MachineConsentHelper.sol — parent-child delegation trees, scoped permissions, revocable branches, rate-limited tokens

MachineConsentHelper.sol

✗ NOT BUILT

🚨 Testnet Deployment — The Single Unlock

Deploy script exists. All 5 contracts + admin + cross-links in one script. ~2.5 hours of execution. Steps 6–8 above immediately become real. This is the only thing separating "project" from "product."

Base Sepolia ETH in both admin wallets (faucet)

Multi-sig ceremony: promoteAdministrator() with 2nd signer

Live PostgreSQL instance (Railway/Supabase/self-hosted)

Domain + TLS cert for identity-portal

VITE_TRUST_ANCHOR_MANAGER_ADDRESS in .env.production

VITE_TRUST_ANCHOR_STORAGE_ADDRESS in .env.production

Run deploy script: all 5 contracts + admin + cross-links

Verify event indexer polling Base Sepolia successfully

⬡ Identity — Next Steps to Live System

S25 Sprint (2-3 days before testnet)

01Merge main → feature/identity-foundation (get Gemini dispatch helper + framework updates)HIGH
02Concurrent double-submit coverage gap — admin action race conditionMED
03Prisma error propagation coverage gapMED
04listUsers null edge cases in enrichment pathMED
05AuditTrailPage filter propagation + pagination controlsMED
06Vite production build verification added to CILOW

Post-testnet: Identity Research Sprint

🔬 Multi-Provider PoH Verification Module

Build the software-only proof-of-human abstraction. Three providers in priority order:
P1: Apple App Attest + Face ID — every iPhone, no hardware Orb, strong PoH
P1: Google Play Integrity — every Android, complementary to Apple
P2: NFC Passport Chip — government-grade, zero biometrics stored
Research needed: ZK proof layer over platform attestation, credential aggregation formula, regulatory mapping per jurisdiction. CLI deliverable: humanproof verify --provider apple

🔬 Hierarchical Agent Delegation (upgradeToVerified + Trees)

Extend MachineConsentHelper.sol to support parent→child delegation with scoped permissions. Flat delegation (Worldcoin: 1 agent/human) vs hierarchical trees (ours: unlimited depth, scoped, revocable). Dual-consent state machine for upgradeToVerified(): SELF_REGISTERED(500bp) → ANCHOR_VERIFIED → FULLY_VERIFIED(2000bp). Research: is 3-state necessary? What's the KYC confidence weight at each tier? 3-model convergence required (Claude+Codex+Grok) before coding.

🔬 Revocation Cascade — Critical Safety (Codex: #1 risk)

Compromised Trust Anchor = all child bots compromised. deregisterTrustAnchor() must walk the botToTrustAnchor mapping and cascade deregistration. This is NOT a nice-to-have — it's critical safety infrastructure. No identity system is trustworthy without revocation. Design: batch walk vs recursive vs event-driven? Gas cost analysis needed on Base.

Competitive Position vs Worldcoin

Dimension	Worldcoin	Us
Verification	Orb hardware (iris scan)	Software-only (Apple/Google/NFC)
Distribution	~300 Orb locations	Every iPhone/Android globally
Agent delegation	Flat (1 agent/human)	Hierarchical trees, scoped
Developer UX	React widget, web3-heavy	CLI-first, REST API, agent-native
Regulatory	Banned 7+ countries	No biometric collection
Protocol	OPRF MPC, multi-ZK complex	Simpler, auditable

Verification Provider Priority

Apple App Attest + Face ID

Strong PoH

Very Low risk

P1 · Build First

Google Play Integrity

Strong PoH

Very Low risk

P1 · Build First

NFC Passport Chip

Gov-grade

Med risk

BrightID Social Graph

Moderate

Very Low

World ID (as one option)

Maximum

High (7+ bans)

P3 · Optional

⬡ RMT — Compounding Prior Research

Phase 7b Locked Parameters (Do Not Change)

alpha0.614phase transition at ~0.72

reciprocalPenalty0.82real Ethereum data validated

reciprocalVerifiedDamping0.72stricter than default

clusterDensityThreshold0.18Optuna-optimized

carouselPenalty30.865Optuna-optimized

carouselPenalty4Plus0.039harsh 4+ ring penalty

starInDegreeThreshold8+0.027 biggest improvement

seedCapVerified2000bpD-4 locked 3-model

seedCapUnverified500bpD-4 locked 3-model

seedDecayShifts8D-1 bit-shift locked

Core Architectural Insight from Research

Layer 3 (Shyft Trust Channels / KYC identity) already provides sybil deterrence via identity cost. This means Layer 2 (RMT PageRank) should measure competence and behavioral trust — not fight sybils. The algorithmic sybil detection suite's job is evidence collection for the identity layer, not primary defense. This was confirmed by ablation: 22 of 33 parameters had zero impact. 3 parameters + trust channels = sufficient.

S30b Tasks (Next Sprint)

01Wire getCompositeScore() to rmt-dashboard consumers · IC-S29-4HIGH
02Fix IC-S28b-7: oracle=address(0) → registrationEpoch=0, re-registered bot inherits max decayHIGH
03Implement citation freshness weighting — unanimous P0, timestamp field exists in EAS, zero schema changesHIGH
04Update RMT_SOURCE_OF_TRUTH.md — stale since S28b, pre-dates S29+S30aMED
05Design S31 stablecoin fee migration (rmtToken.safeTransferFrom → USDT/USDC path)MED

RMT Research Sprint (After S30b)

🔬 Phase 8: Topology-Aware Alpha Selection

Auto-research running today (qwen3:8b) shows sybil-ring detection at 0% caught — structural not parametric. Root cause: α=0.614 is optimal for synthetic graphs but α=0.85 is optimal for real-world (Bitcoin Alpha/OTC, XBlock 2.97M, AUC 0.960). FP 17-22% at α=0.85 is structural. Fix: extract graph topology stats (density, reciprocityRatio, powerLawExponent) → classify synthetic-like vs real-like → select alpha dynamically. New detectors: coordinated low-rank exploitation, cross-alpha anomaly detection.

🔬 upgradeToVerified() + KYC Confidence Weights

2-state or 3-state? SELF_REGISTERED(500bp) → ANCHOR_VERIFIED(1500bp?) → FULLY_VERIFIED(2000bp). Dual-consent: proposeVerification() + acceptVerification(), 72h expiry. KYC confidence weight formula: how does attestation tier translate to score composition multiplier? Must converge before S31 coding begins. Models: Claude+Codex+Grok.

🔬 Fee Architecture (USDT/USDC Refactor)

RMT = score marker, NOT payment token (Grok CTO confirmed, 2018 whitepaper). Current ReputationEngine.sol uses rmtToken.safeTransferFrom — must refactor to stablecoin. 70/30 TA/protocol split. Registration bond sizing: ETH vs USDC? Logarithmic escalation at 1000s of bots cross-chain? Economic deterrence vs algorithmic detection — which is cheaper to build and harder to game? Models: Claude+Grok+Gemini (economics).

Attack Vector Status — What Remains

ID	Attack	Status	Next action
AV-2–6,8	Seed gaming, rings, carousel, cluster, staircase, cooldown	DONE	Monitor only
AV-1	Sybil flooding	PARTIAL	Fan-in AV-7 completes defense
AV-7	Fan-in / star topology (>8 citers, ≥70% low-score)	S30b	Threshold defined — implement in SybilDetector.ts
AV-9	Epoch freeze exploitation	PARTIAL	MAX_EPOCH_GAP in S29 — monitor in production
AV-10	Bootstrap bridge (cold start window)	RESEARCH	Phase 8 + citation velocity thresholds
AV-11	TA collusion (graduated staking)	RESEARCH	UR-7: 1/5/10 ETH staking tiers — new contract

RMT ↔ Identity Integration Points

Connection	Status	What's needed
Reputation score on bot cards	NOT BUILT	S30b getCompositeScore() → bot.service.ts API → frontend BotCard
Verified TA → 2000bp seed	CODE DONE · NOT DEPLOYED	SeedPopulator reads verifiedBots[bot] from ReputationEngine on testnet
Cherry-pick BotWizard for RMT track	PLANNED	Grok: cherry-pick only, don't merge full identity branch into RMT
Same-anchor citation dampening	RESEARCH	Cross-model confirmed: agents under same TA citing each other carry less weight
upgradeToVerified() ↔ KYC tier	RESEARCH	KYC approval event → trigger score seed upgrade on-chain

Deployment Roadmap — What Comes When

Phase A · Now · 1-2 weeks

Ship S25 + S30b

Identity S25 + RMT S30b in parallel

Merge main → identity branch
5 identity coverage gaps closed
getCompositeScore() wired to dashboard
Citation freshness in oracle (P0)
RMT SOURCE_OF_TRUTH updated

Phase B · Critical · 2-3 days

Base Sepolia Testnet

The unlock. Do this before anything else.

Multi-sig ceremony (2 admin wallets)
Deploy 5 contracts (~2.5hrs)
Live Postgres + TLS domain
Event indexer → real chain data
First developer becomes Trust Anchor

Phase C · Next · 1 week

Research Convergence

3-model: Claude+Codex+Grok+Gemini

upgradeToVerified() state machine
Fee architecture (USDT refactor)
Revocation cascade design
Phase 8 topology-aware alpha
PoH provider stack design

Phase D · Post-Testnet · Ongoing

Identity Live System

First real users · agent-human identity

S31: upgradeToVerified() on-chain
S26: Reputation scores in portal
Multi-provider PoH module (Apple/Google)
Hierarchical delegation trees
First external beta user (May target)

Research Queue — Before S31+ Dev Sprints

🔬 3-Model Convergence Required

upgradeToVerified() State Machine

2 vs 3 states. Dual-consent. KYC confidence weight. Models: Claude+Codex+Grok.

Fee Architecture (USDT/USDC)

Stablecoin refactor. Bond sizing. 70/30 split. Models: Claude+Grok+Gemini (economics).

Revocation Cascade Design

Codex: top risk. deregisterTrustAnchor() walks botToTrustAnchor. Gas cost on Base. Models: Claude+Codex.

PoH Provider Stack

Apple App Attest + Google Play Integrity first. ZK proof layer over platform attestation. Models: Claude+Grok+Gemini.

📐 Needs Design Doc

Citation Freshness (P0 — next sprint)

Timestamp → edge weight multiplier in oracle. Zero schema changes. Unanimous P0 cross-model.

Phase 8 Topology-Aware Alpha

Extract graph stats → classify topology → select alpha. Fixes sybil-ring 0% detection.

Same-Anchor Citation Dampening

Agents under same TA citing each other carry less weight. Cross-model confirmed. Medium effort.

Hierarchical Delegation Trees

Extend MachineConsentHelper.sol. Parent→child with scoped permissions. Revocable branches.

✓ Decided — Compounding

3 params sufficient for PageRank ✓

Ablation: 22 of 33 params → zero impact. alpha + citationDiversity + compositeWorstWeight.

L3 identity solves most sybil deterrence ✓

KYC cost IS the sybil bond. L2 measures competence. Detection = evidence collection, not primary defense.

RMT = score marker, NOT payment token ✓

Grok CTO confirmed. 2018 whitepaper intent. Fees: USDT/USDC.

Max composition + bit-shift decay ✓

D-1+D-2 locked. Seed = floor not boost. epoch-based decay, not time-based.

Admin keys NEVER in backend ✓

ADR-008: CRITICAL security. Frontend constructs all admin transactions independently.

⚡ Identity + RMT — Deploy Plan

🚨 Testnet Deployment — The Single Unlock