# Evidence Lab

[Run the lab](https://sergrdz.pages.dev/labs/evidence/) · [Event trust investigation](https://sergrdz.pages.dev/case-studies/event-trust.html) · [Execution gap investigation](https://sergrdz.pages.dev/case-studies/execution-gaps.html)

Three reduced, offline reproductions of defects in an original research recorder and evaluator. No network, account, wallet, or transaction support is present in the Python reproducer. The browser loads only the local fixture file.

| Case | Counterexample | Previous model | Corrected model |
|---|---|---|---|
| Boolean serialization | Byte 0x02 at offset 56 | Coerces to BUY | Rejects noncanonical boolean |
| Event provenance | Valid-looking data emitted by a foreign CPI | Counts the event | Rejects foreign attribution |
| Opening gap | Entry 100, stop 95, next open 85 | −1R at the stop | −3R at the opening quote |

These are defects in our consumers of data. They are not claimed vulnerabilities in Pump, Solana, MetaTrader, or a deployed third-party contract. The reproductions do not establish trading profitability.

## Run independently

Download `reproduce.py` and run with Python 3.9 or later:

```sh
python reproduce.py
python reproduce.py --fixtures
```

The six test methods exercise canonical/malformed booleans, direct and nested emitters, failed ancestors, incomplete stacks, synthetic runtime-marker spoofing, and gap arithmetic. `fixtures.json` contains 22 shared vectors: five boolean, twelve attribution, and five opening-price cases.

From this repository, verify the browser model:

```sh
node scripts/check-evidence.mjs
node scripts/check-release.mjs
```

The published vectors were also compared with the actual reviewed recorder and fill functions using the offline test loaders. All 22 agreed. The standalone file is a smaller explanation, not a copy of the full recorder or its full regression suite.

## Model boundaries

- The hexdump is a synthetic 113-byte consumed prefix. All ordinary fields are zero-filled; only the discriminator and selected boolean have nonzero values.
- `PUMP` and `OTHER` are symbolic labels. `TRADE:1` stands for a valid event prefix. The actual recorder accepts anchored base58 runtime program IDs and validates binary event data.
- Frame buffering attributes an event only under the intended program and after successful completion of its ancestors. It assumes complete, trustworthy runtime logs. It does not authenticate the RPC provider or establish chain finality.
- The reduced log model rejects unknown line forms; the recorder also handles ordinary runtime compute/return messages. Agreement on these fixtures is not exhaustive equivalence.
- The legacy comparison retains the earlier stream's rejection of a known transaction error. The attribution correction addresses provenance and invocation outcomes beyond that existing check.
- Gap arithmetic is a zero-spread long fixture. When the opening price is at or above 95, a later stop touch is assumed. The source evaluator also has spread and conservative intrabar-ordering logic.

The JSON export records the selected input and computed results, marked synthetic. It is not a log from a live system.

## Primary references

- [Borsh specification](https://borsh.io/): canonical boolean representation and field order.
- [Solana logsSubscribe](https://solana.com/docs/rpc/websocket/logssubscribe): transaction-level mentions filter and notification format.
- [Pump public IDL](https://github.com/pump-fun/pump-public-docs/blob/9c82f61cb711b044a17f770ab8ce9f9bdf78f333/idl/pump.json): reviewed event prefix layout.

Review date: September 10, 2026. All examples and labels are synthetic.