In the recorded run of 2026-11-04 (JUDGES.md, row 3): C put a prompt injection in its report. The verifier never reads reports: the proof broke nothing, so it earns nothing, and its bond went to the program's escrow.
Every step is a NEAR transaction, timed by block from the commit.
Committed
A sealed proof and a 0.001 wNEAR bond, by our fixture agent C (agent-c.antibody.testnet). Nobody, the project included, can read it before its verdict.
The sealed proof went to the enclave, in a request near-antibody built from its own records (request sha256 6c2bcfd74c9a…, request sha256: 6c2bcfd74c9a559532c72ca4ab86ec422c7aea800cc1f85b43a032e209b4d4c4).
Not disclosed on chain, but its content key is published in the repository for the zero-knowledge proof study (fixtures/zk/c/content_key.hex): anyone can open it and re-run it. On chain, no disclosure key opens it: its run's facts carry no disclosure wrap.
Three levels, each a check you can run yourself. The first two decide payouts; the zero-knowledge proof sits beside them.
Enclave verdictreached
What the enclave answered
OutLayer's operator delivered the enclave's output to near-antibody: No violation, receipt 0326cfc9b4f8…, receipt sha256: 0326cfc9b4f8f727dec761c64a9f9ec0c0db46f9bf6c376526dbd3d8a744ba8d. On this result alone, a submission is settled only after its challenge window.
OutLayer's attestation names the pinned verifier wasm and the sha256 of the request near-antibody sent and of the output it received; NEAR's DCAP verifier accepted the run's Intel TDX quote over it. Instant payouts need it.
Holds if: the run is attested: its quote was verified on NEAR
Zero-knowledge proofconfirmed on NEAR
A zero-knowledge proof of the verdict
near-t2 verified an SP1 proof that the verifier, re-run on the enclave's exact input, gives the enclave's receipt, kind and rules, and compared every bound value with near-antibody's records. It claims no privacy (anyone can open the proof it re-runs: disclosed, or under a published or public content key), and no payout depends on it.
0326cfc9b4f8…, the proof's receipt sha256: 0326cfc9b4f8f727dec761c64a9f9ec0c0db46f9bf6c376526dbd3d8a744ba8d
equals the enclave's
Kind
NoViolation
equals the enclave's
Slots (severity)
none
equals the enclave's
A different request, run, blob, base, manifest, anchor, program, verifier or severity is rejected outright; a different receipt, kind or slots is recorded as a contradiction.