A compliance-bound atomic delivery-versus-payment settled on the public Canton DevNet global synchronizer.

A two-leg settlement committed in a single transaction on the public Canton DevNet. Each leg opened its own rail and bound a cleared attestation to that leg's realized anchor, both nullifiers were recorded as consumed once by our read-back (see the addendum above), and every forged variant was refused at command interpretation. Every value below is copied from the run evidence, and that evidence is published rather than described: one archive, sha256 60651427…, carrying the records of all three runs, against which every gate, anchor, nullifier and verbatim refusal quoted on this page can be checked using sha256sum and jq alone. The verification key both 0.7.0 runs proved under, sha256 069d3c10…, is still in this repository and unchanged since they ran. What lies outside a reader's reach is named where it arises: re-fetching the transaction takes DevNet participant access (section 5), the curator-signed list roots stay in the curator's custody (section 8), and one artifact claim did not survive a later repoint (section 7). Canton DevNet

1. What ran, 2026-07-23 under 0.6.0

2. The settlement

Both legs settled atomically in one transaction through the SettleAtomicBound choice, creating two OpenAnchor contracts. Each leg is bound to its own realized anchor: the recipient's cleared attestation is accepted only when it belongs to that recipient, is cleared, and its boundOpenA equals that leg's OpenAnchor.openA. Both nullifiers were recorded as consumed once by our read-back (see the addendum above).

The settlement is all-or-nothing across the two legs. A failed bind on either leg, after both legs have opened in-transaction, aborts both opens and both consumes, so no anchor is created and neither nullifier is spent.

3. The refusals

Each forged variant below was submitted against the same bound choice and refused. The named assert text is quoted verbatim from the ledger error message field recorded for that control.

Each refusal rolled back the whole settlement: no OpenAnchor at the scenario's openA, both leg shards still active with consumed = [], and both sealed envelopes still active, verified from ledger state per scenario. The full verbatim ledger error payload for each control, including grpcCodeValue: 9 and AssertionFailed, is in dvp-run.json in the evidence pack.

4. Upgrade continuity

5. Verify it yourself

sha256sum evidence-pack.zip                 # expect the sha256 above
unzip evidence-pack.zip
sha256sum CLAIMS-DVP.md dvp-provision-checkpoint.json dvp-run.json update-verification.json
jq '{allGreen, gates}' dvp-run.json
jq '.positive | {exercisedChoice, boundOpenA, consumedOnce, anchorOpenA: [.anchors[].openA]}' dvp-run.json
jq -r '.negativeControls | to_entries[] | [.key, .value.rejection.expectedAssert, .value.rejection.provenance] | @tsv' dvp-run.json
# re-verify the positive update id against a live DevNet participant:
export ZV_JSON_API=<participant JSON Ledger API base>
export ZV_PACKAGE_ID=395e49e4b8bdd3c9873a955a56502674648627101f5b8cfc2d1fee39c883d973
export ZV_USER_ID=ledger-api-user
UPDATE_ID=$(jq -r '.update.Transaction.value.updateId' update-verification.json)
curl -s -X POST "$ZV_JSON_API/v2/updates/update-by-id" -H 'Content-Type: application/json' \
  -d "{\"updateId\":\"$UPDATE_ID\",\"updateFormat\":{\"includeTransactions\":{\"eventFormat\":{\"filtersByParty\":{\"zvCanton::122062d7ab2a3a33bb08d45ae557e61e379e3d9dfbb7291b691eda59063c9e9be800\":{\"cumulative\":[{\"identifierFilter\":{\"WildcardFilter\":{\"value\":{\"includeCreatedEventBlob\":false}}}}]}},\"verbose\":true},\"transactionShape\":\"TRANSACTION_SHAPE_ACS_DELTA\"}}}" \
  | jq '.update.Transaction.value | {updateId, commandId, effectiveAt}'

6. Scope and limitations

7. The 0.7.0 runs, 2026-07-30 and 2026-07-31

Two further two-leg settlements were recorded on 2026-07-30 and 2026-07-31 under package zerovault-canton-gate-accum 0.7.0. Both are the same scenario run twice, with freshly allocated parties each time; both recorded allGreen: true. Every value below is copied from each run’s own dvp-run.json.

Run 20260730T232137Z

For each leg the attestation’s boundOpenA equals that leg’s realized OpenAnchor.openA, and each rail nullifier appears exactly once in its shard’s consumed set (deliveryOnce and paymentOnce both true). All nine settlement gates are true:

twoAnchors, deliveryBound, paymentBound, exercisedChoiceIsBound, deliveryConsumedOnce, paymentConsumedOnce, legBoundDistinct, deliveryLegBound, paymentLegBound

The leg-swap refusal

A clearance valid for one leg, presented for the other, was refused at SettleAtomicBound with clearance is not for the buyer leg of this settlement (FAILED_PRECONDITION / DAML_FAILURE, interpretation-time refusal (rolled back, not sequenced)). Verbatim ledger payload:

[public-dvp] /v2/commands/submit-and-wait-for-transaction -> 400: {"code":"DAML_FAILURE","cause":"Interpretation error: Error: User failure: UNHANDLED_EXCEPTION/DA.Exception.AssertionFailed:AssertionFailed (error category 9): clearance is not for the buyer leg of this settlement","correlationId":"6a8571bd-eeac-471f-aeee-f1ca23cdb091","traceId":"934b7b5dd88dc0889f10b38b04a1688c","context":{"participant":"'participant'","error_id":"UNHANDLED_EXCEPTION/DA.Exception.AssertionFailed:AssertionFailed","exercise_trace":"    in choice da26b65d:AtomicDvP:DvPSettlement:SettleAtomicBound on contract 0053bf03f0 (#0)\n    in exercise command da26b65d:AtomicDvP:DvPSettlement:SettleAtomicBound on contract 0053bf03f0.\n","category":"9","tid":"934b7b5dd88dc0889f10b38b04a1688c","definite_answer":"false","commands":"{readAs: [], deduplicationPeriod: {duration: 'PT30S'}, submittedAt: '2026-07-30T23:24:18.779392Z', submissionId: '6a8571bd-eeac-471f-aeee-f1ca23cdb091', actAs: ['zvCanton::122062d7ab2a3a33bb08d45ae557e61e379e3d9dfbb7291b691eda59063c9e9be800'], commandId: 'dvp-20260730T232137Z-settle-WRONG-LEG', userId: 'ledger-api-user', workflowId: }"},"resources":[],"errorCategory":9,"grpcCodeValue":9,"retryInfo":null,"definiteAnswer":null}

The refusal rolled the whole settlement back, verified from ledger state: noAnchor, deliveryUnspent, paymentUnspent and envelopesActive are all true. Four further controls in this run (BIND-D, BIND-P, UNCLEARED, XLEG) were refused and rolled back the same way; their verbatim payloads are in dvp-run.json.

What each leg’s clearance asserted

The run recorded, per leg, the exact claim the clearance stands for. Quoted verbatim from f7Scope.delivery.claim and f7Scope.payment.claim:

delivery:
Under vk-govid-m4-05b9caa0, at epoch 1785368536, the holder of two government-ID credentials signed by issuer_root 0x232de6aec4bc575a988e62e94a69fb00e6849cf19318c9a30b6bb2a49c66ef37 proved non-membership of all three curator-signed sanctions lists under policy_commit 0x2eb3fa93b476bdeadbe18956e0dd48267fd11f78aedb8aa7013d5b7a4826bc36, bound to destination context 0x00d04d068aecf06f3230a387584d6ea59b6481497936b33cd23a3687388266b0, single-use under nullifier 0x1f9b42a9ff09e6fd8450de3a76c6c5e1be9890f795f3dddefeb83f4e5d607829. NO party identity is asserted: the M4 public vector binds no subject identifier.

payment:
Under vk-govid-m4-05b9caa0, at epoch 1785368536, the holder of two government-ID credentials signed by issuer_root 0x232de6aec4bc575a988e62e94a69fb00e6849cf19318c9a30b6bb2a49c66ef37 proved non-membership of all three curator-signed sanctions lists under policy_commit 0x2eb3fa93b476bdeadbe18956e0dd48267fd11f78aedb8aa7013d5b7a4826bc36, bound to destination context 0x0ddf71673ff21c4cb35e19c077bdee0bd123e8196ff0c1fec8654dda380ba8f5, single-use under nullifier 0x1374f62563b973720f8dcdae4bf1c59d999d9ba32e816469825c0edde529cf6b. NO party identity is asserted: the M4 public vector binds no subject identifier.

The two claims are identical except for the destination context and the nullifier, which is what makes the legs distinct and non-interchangeable (legBoundDistinct = true).

Run 20260731T001019Z

For each leg the attestation’s boundOpenA equals that leg’s realized OpenAnchor.openA, and each rail nullifier appears exactly once in its shard’s consumed set (deliveryOnce and paymentOnce both true). All nine settlement gates are true:

twoAnchors, deliveryBound, paymentBound, exercisedChoiceIsBound, deliveryConsumedOnce, paymentConsumedOnce, legBoundDistinct, deliveryLegBound, paymentLegBound

The leg-swap refusal

A clearance valid for one leg, presented for the other, was refused at SettleAtomicBound with clearance is not for the buyer leg of this settlement (FAILED_PRECONDITION / DAML_FAILURE, interpretation-time refusal (rolled back, not sequenced)). Verbatim ledger payload:

[public-dvp] /v2/commands/submit-and-wait-for-transaction -> 400: {"code":"DAML_FAILURE","cause":"Interpretation error: Error: User failure: UNHANDLED_EXCEPTION/DA.Exception.AssertionFailed:AssertionFailed (error category 9): clearance is not for the buyer leg of this settlement","correlationId":"20ad233e-e3b7-49e2-aa43-eed73824ea04","traceId":"e320c1ee853dd325cfd3030928449dfb","context":{"participant":"'participant'","error_id":"UNHANDLED_EXCEPTION/DA.Exception.AssertionFailed:AssertionFailed","exercise_trace":"    in choice da26b65d:AtomicDvP:DvPSettlement:SettleAtomicBound on contract 009772ef46 (#0)\n    in exercise command da26b65d:AtomicDvP:DvPSettlement:SettleAtomicBound on contract 009772ef46.\n","category":"9","tid":"e320c1ee853dd325cfd3030928449dfb","definite_answer":"false","commands":"{readAs: [], deduplicationPeriod: {duration: 'PT30S'}, submittedAt: '2026-07-31T00:14:37.056754Z', submissionId: '20ad233e-e3b7-49e2-aa43-eed73824ea04', actAs: ['zvCanton::122062d7ab2a3a33bb08d45ae557e61e379e3d9dfbb7291b691eda59063c9e9be800'], commandId: 'dvp-20260731T001019Z-settle-WRONG-LEG', userId: 'ledger-api-user', workflowId: }"},"resources":[],"errorCategory":9,"grpcCodeValue":9,"retryInfo":null,"definiteAnswer":null}

The refusal rolled the whole settlement back, verified from ledger state: noAnchor, deliveryUnspent, paymentUnspent and envelopesActive are all true. Four further controls in this run (BIND-D, BIND-P, UNCLEARED, XLEG) were refused and rolled back the same way; their verbatim payloads are in dvp-run.json.

What each leg’s clearance asserted

The run recorded, per leg, the exact claim the clearance stands for. Quoted verbatim from f7Scope.delivery.claim and f7Scope.payment.claim:

delivery:
Under vk-govid-m4-05b9caa0, at epoch 1785368536, the holder of two government-ID credentials signed by issuer_root 0x232de6aec4bc575a988e62e94a69fb00e6849cf19318c9a30b6bb2a49c66ef37 proved non-membership of all three curator-signed sanctions lists under policy_commit 0x2eb3fa93b476bdeadbe18956e0dd48267fd11f78aedb8aa7013d5b7a4826bc36, bound to destination context 0x00d04d068aecf06f3230a387584d6ea59b6481497936b33cd23a3687388266b0, single-use under nullifier 0x1f9b42a9ff09e6fd8450de3a76c6c5e1be9890f795f3dddefeb83f4e5d607829. NO party identity is asserted: the M4 public vector binds no subject identifier.

payment:
Under vk-govid-m4-05b9caa0, at epoch 1785368536, the holder of two government-ID credentials signed by issuer_root 0x232de6aec4bc575a988e62e94a69fb00e6849cf19318c9a30b6bb2a49c66ef37 proved non-membership of all three curator-signed sanctions lists under policy_commit 0x2eb3fa93b476bdeadbe18956e0dd48267fd11f78aedb8aa7013d5b7a4826bc36, bound to destination context 0x0ddf71673ff21c4cb35e19c077bdee0bd123e8196ff0c1fec8654dda380ba8f5, single-use under nullifier 0x1374f62563b973720f8dcdae4bf1c59d999d9ba32e816469825c0edde529cf6b. NO party identity is asserted: the M4 public vector binds no subject identifier.

The two claims are identical except for the destination context and the nullifier, which is what makes the legs distinct and non-interchangeable (legBoundDistinct = true).

Scope of these two runs

8. The curator-signed sanctions list roots

The check compares two identity document numbers against three curator-signed list roots; names and dates of birth are not screened. These are the roots themselves, read from the curator-signed root artifacts; they are not attributed to any one run’s public inputs on this page. Each root is signed over a canonical byte string committing to the root, the list id and the expiry, under a single curator key.

All three artifacts carry the same curator key hash. Their expiries differ, by seconds: each root was signed in its own second of the 2026-08-22 ceremony, and the window that binds is the intersection of the three, which closes at 1789964030. In each one the first 32 bytes of the signed canonical_bytes reproduce the bracket_root exactly, the next 8 encode the list id, and the last 8 encode the expiry, so the root, its list identity and its expiry are covered by one signature.

These artifacts live outside the repository, in the curator’s custody location. This page states what the signed roots are; it does not assert that any particular run on this page read these bytes.

Related