Deployment status

Trust Stack targets Supra MoveVM Testnet, chain ID 6. The deployment manifest—not a feature page or source directory—is authoritative for live package identity.

Active revision-6 deployment#

The active runtime registry selects the core package:

0x0afbe7d92996d30632c228665bac163478ae2a04922fdfc8cb3c69a51fba9230

It was published at block 148375016 in transaction 0x78e118451269ca05f5fa19e34a2fa4bf61dd937c44a41c08c445df07478d8dc2 from source commit 608ab9a80d32812b084c4fbac442b230d43babb0, initialized, and frozen with immutable upgrade policy 2. Its 12 modules keep the revision-5 entry-function ABI and add the read-only views token_factory::total_minted and asset_policy::council_epoch.

The revision-6 manifest records the public publish receipt, fee and asset-policy initialization, freeze, the rejected post-freeze upgrade attempt, source and toolchain pins, 12/12 matching deployed bytecode hashes, and fresh test evidence: 439 passing Move tests and 96.73% aggregate coverage. The revision-6 acceptance record covers 113 transactions on chain ID 6: 50 successful and 63 expected failures that aborted on chain with the exact expected error. It exercises every core product module, the Dexlyn adapter, and the governance timelocks. Neither record replaces an independent audit.

Revision 6 changes these on-chain rules:

• timelocked governance proposals (fee schedule, fee governor, treasury administrator, collector, renunciation, asset admission, and council rotation) must execute within a 14-day acceptance window after their effective time, after which they expire and may be replaced;
• governance delays below 172,800 seconds (48 hours) are rejected outside the allow-listed test chains (6 and 4);
• the fee collector must hold a registered SUPRA coin store;
• maximum supply caps every unit ever minted, and total_minted does not decrease on burn;
• a council rotation invalidates pending admissions of the previous council;
• accepting a new fee governor cancels the outgoing governor's pending fee schedule;
• the token metadata object is untransferable;
• a staking withdraw always returns principal; an unbacked settled reward is forfeited instead of aborting the withdrawal; and
• a later Merkle airdrop reclaim sweeps assets deposited after the first reclaim to the creator and aborts with EALREADY_RECLAIMED only when the vault is empty.

Retained claim-only deployments#

Earlier immutable cores are claimOnly: their existing positions keep claim, proof, and position pages, but the applications create no new positions on them.

Revision 5 remains registered as core:

0xc4dcb9a8a6dcabac0ae695fe95df5a7cb793f3f5766746ced70c1159705ec74b

It was published at block 137913840 from source commit 251320132139e73cda960909efc111203ad21d7a with 60-second testnet governance delays (shortened for testing). The revision-5 manifest records 12 of 12 matching bytecode hashes, 312 passing Move tests, and 95.48% coverage. Its acceptance section is a revision-5 publication-time partial snapshot, not a release-wide acceptance conclusion; later revision-5 lifecycle receipts are recorded separately.

Revision 4 remains registered as coreV4:

0x993701927cc7da8c48a556af86a46128b42ee23044fc736d5eb9302cf58f5617

The earlier immutable revision-3 and revision-2 cores also remain registered for existing positions:

0x3218c2357c3dfad0edbfb620e7cb8c3e81f6ef0a3bd06c4f8cd129e87417a43f

0xa254b92f4a87c4cb48f84e42fd585a04f4f1cf2426496f0d66659e17d0e09005

Public proof URLs retain the originating package so each position is read and managed with the package that created it. The current separately published Dexlyn adapter is:

0x7ce836f84a15d1ba576da4a18703f67aba3ba71c67b22fac27dddcc11c7735ad

Revision 6 reuses this adapter unchanged: its source has not changed since publication and it does not depend on the core package. Its fresh source and bytecode are recorded in the Dexlyn revision-2 manifest. It retains compatible upgrade policy under 3-of-5 owners: Supra rejects an immutable freeze while the external Dexlyn router and LP dependencies remain upgradeable. The earlier adapter at 0x899b43319d957a345b65667db7166e2e843c80433f55e1c79e427d2dbea203ba remains registered as dexlynAdapterV1 for existing locks. New locks use revision 2; management selects the originating adapter, and the indexer retains both histories.

The machine-readable deployments/runtime-registry.json file is the authority consumed by the SDK, dApp, API, and indexer. The dated immutable revision-6 manifest is the deployment-evidence record for the active core. A copied address in documentation must never override either file.

Separately gated work#

Release evidence checklist#

Before presenting a module as live:

1. run the pinned Move compile, tests, and instruction coverage;
2. perform focused manual security review;
3. publish a fresh release from the exact reviewed commit when the contract version changes; require immutable core policy and explicitly record any adapter upgrade authority and external dependencies;
4. read exact bytecode and ABI back from chain;
5. compare local and on-chain hashes;
6. complete one real positive and required negative lifecycle;
7. archive transaction links, object/resource reads, events, and source commit;
8. update the shared runtime registry and evidence manifest in one reviewed release; and
9. confirm every consumer resolves the same chain ID, package, module set, and start height.

The revision-6 fee governor, treasury administrator, collector, and asset-policy council are single-key testnet wallets held by one operator. The retained revision-5 package uses three distinct 3-of-5 multisig wallets with 15 unique owners, but one operator currently controls the encrypted local testnet profiles for all owners. Both are testnet operational separation, not independent signer custody.