Every security vendor makes your code safe to ship. Almost none make other people's code safe to touch.

Five cases that end the argument.

Each one is a real failure mode where the code was fine and the person was not protected. That gap is the whole product.

The nearest real competitor — and the line

The auditors are not the competition. The closest players are the on-chain monitoring and alerting tools; they exist, they are useful, and the line between them and a gate is drawn above rather than blurred.

Every wallet tool waits for the signature request. This evaluates the site before the connection exists.

On Solana most token scams live for minutes — far shorter than any blocklist's update cycle. The attack is not the contract; it is the connection. A hijacked social account posts a lookalike site, and the wallet connects before anything has evaluated the site at all. Verdicts are verified, unknown, suspicious and blocked.

Proof, not promises: every assurance claim is tested against history.

The baseline corpus is built from four complementary oracles, and every incident becomes a regression test the system has to keep passing.

Incidents with both a Rekt corpus row and a DeFiHackLabs reproduction become gold-standard tests — pre-state code hash plus a working exploit. The claim stops being “we think we would have caught this” and becomes “here is the test that catches it.”

The evidence base, counted

“Tested against history” is a claim, so here are the counts behind it — including the row that is a gap rather than a win.

The corpus is about 10 MB, and that is the point. Each incident is stored as a pinned pointer — chain, address, pre-state block number, and the keccak-256 hash of the runtime bytecode at that block — and the state itself is re-fetched on demand from archive RPC endpoints, the Etherscan V2 API and Sourcify. The evidence is the hash and the block number, not a copy, which is what makes a result reproducible by a third party rather than dependent on a snapshot only a3e9 holds. Multi-gigabyte build directories exist on disk; they are compiler output and are excluded from every count above.

a3e9 “Safe to Touch” positioning brief v2, reviewed 2026-09-09. Counts as of 2026-09-08.

A detector written after reading the post-mortem will always pass.

That is the failure mode any backtest has to defend against, and the defences are structural rather than promised.

The fifth is the one worth dwelling on. It would have been easy to leave that run out. Keeping it is what makes the other four worth reading — a corpus that only ever reports success has stopped being a measurement.

If we had been on this, would it have mattered?

For ten incidents the answer is not an opinion — a detection exists, it is armed in CI, and it runs against the contract as it stood at the block before the exploit. Here is the whole list, with nothing left off.

$286,635,000 of recorded loss sits behind detections that are armed today and run against pre-incident state. Beanstalk is in the list and contributes nothing to that total, because the corpus holds no loss figure for it — the widely-reported number is not in the evidence, so it is not in the arithmetic. Nine incidents carry the whole sum. That is the difference between a total and a headline.

Incident list, losses, families and controls from a3e9-tinl-assurance-test out/coverage_manifest.json and out/incident_catalogue.csv. Loss figures carry a loss_basis in the source; the total sums only rows that carry one.

One historical exploit is never one test. It is a family.

Beanstalk was not a Beanstalk bug — it was a governance-capture pattern: flash-loan voting power, pass a malicious proposal, drain the treasury, repay the loan. A zero-day is unknown to everyone. A 1-day is disclosed and patched, and still works everywhere the patch did not reach. An n-day is the state this industry actually lives in. So the defensive question is deliberately not “has this contract been patched?” It is:

Which safety invariant failed, where else does the same invariant exist, and can the exploit be reconstructed through another function, asset, market, deployment, chain, signer, or administrative path?

Every incident in the corpus is reduced to that invariant, then re-aimed along eight variant axes. This is the mechanism that turns a one-off into coverage: one historical exploit is never one test, it is a family, and the family is what gets run against the contracts a desk is about to touch.

How a “bypass” claim is graded before anyone repeats it

“A patched protocol got hit again” is four different claims wearing one sentence. Each incident carries an explicit evidence grade, so a fork inheriting a known class is never reported as a novel defence bypass.

Narrow patches are now an attack surface

a3e9 distinguishes a true defense bypass from a known class left unpropagated, and from governance whose timer worked while its security purpose failed.

The historical transaction is the first test, not the last. a3e9 names the failed invariant, mutates equivalent paths, and monitors the conditions that make the exploit family viable again.

a3e9 forked-exploit and narrow-patch risk analysis, 2026-09-04. SCONE-bench figures as published by Anthropic; that study was confined to simulators and did not touch live assets.

a3e9 uses models heavily and trusts them with nothing.

Seven roles are pinned across five providers, each with a written constraint, and the constraints are the product: a model can read, search, propose, translate and argue. It cannot admit evidence, approve a control, change a policy, or move value.

Frontier models are demonstrably capable of generating working exploits for this class of target: in Anthropic's controlled SCONE-bench study over 405 contracts with real-world exploits, several frontier models produced profitable simulated exploits against post-cutoff cases — and in a separate simulation over 2,849 recently deployed contracts with no known vulnerabilities, two novel exploitable cases were found. Two out of 2,849 is a small number and an honest one. It is also the number that decides the question: the capability is real, it is cheap, and it is available to whoever wants it. SCONE-bench figures are as published by Anthropic; that study was confined to simulators and did not touch live assets.

The verifier is never the generator. Whoever proposed a conclusion cannot be the one that checks it. A run is rejected outright if the verifier shares an independence group with the generator — the same origin-counting rule applied to models. Final verification runs with search disabled, on frozen evidence: a checker that can go find fresh support for the thing it is checking is not a checker.

Do not invoke a reasoning model when an unchanged deterministic poll returns no new object. It is a cost rule and a security rule at once: 15-minute advisory checks and per-block chain reads run as plain deterministic jobs, and model work begins only when there is a new or changed object, a meaningful correlation, a scheduled threat-hunting cycle, or a specific analyst request. A regression test asserts it directly.

Release requirements are explicit: different generator and verifier providers, frozen evidence handed to the verifier, verifier search disabled, no automatic training on raw updates, and no model override of policy. The gateway rejects a run for an unpinned or unexpected returned model, a silent provider fallback during high-assurance work, a tool inventory that differs from the manifest, a verifier sharing an independence group with the generator, or final verification with search left on.

a3e9 model routing manifest v1.3, as of 2026-09-07. Model identifiers are configuration and are re-validated against the provider catalog at runtime.

A multisig proves a threshold of keys signed particular bytes. It does not prove independent humans understood the same operation.

• —No unrestricted administrative EOA. Material ownership, upgrades, treasury, minting, oracle, bridge and role administration terminate in constrained multisig or threshold authority.
• —Timelock before critical authority. The upgrade Safe proposes; a separate group cancels; a pause-only guardian reduces risk but cannot transfer, upgrade, mint, unpause or change owners.
• —Every signature is independently intelligible. The manifest includes chain, Safe, nonce, target, value, operation, calldata, nested calls, state changes, implementation hashes, source commit, simulation block, expiry and safeTxHash.
• —Dedicated signer devices. No email, chat, development tools, recruiter tests, package installation, remote support or personal trading.
• —AI never becomes an authority source. Generated summaries assist review but never replace deterministic decoding. Seeds, keys, recovery material, sessions and production payloads stay out of prompts and copilots.

A timelock creates time. It is only useful if someone can act inside the window.

A timelock is useful only when the exact payload remains stable, detection is fast, cancellation remains independent, and responders can act inside the window. Governance Sentry watches pre-proposal state through destination-chain execution.

Objectives are explicit. Concentration and queue events within one finalized block; decoded authority impact within two; human acknowledgement under five minutes; independent simulation under fifteen; defensive finality before half of the usable timelock expires.

Monitoring integrated into the control model

Active AI-driven signer attack: the response path

The runbook assumes the primary chat, identity account, workstation, Safe interface, RPC or transaction service may be hostile. Identity containment and on-chain containment run in parallel.

Everything above depends on inputs — the part most security products never show you.

The Oracle Governor owns them: what a source is allowed to establish, how fresh it has to be, how many genuinely independent origins a claim needs, and what happens when a source goes dark. The advisory layer is not scraped news but a fixed set of registered public feeds, polled on a signed schedule with conditional requests, durable cursors, overlap windows and an explicit health event for every miss.

How a feed becomes evidence

a3e9 oracle feed manifest v1.1 (as of 2026-09-08) and the evidence intake contract. Endpoints were verified by the specification author on 2026-09-08 and are re-checked for transport, media type, schema, ownership and terms at runtime onboarding.

Eighteen oracle classes, each with its own failure rule

A source is not trusted in general; it is trusted for a specific job. Every input is declared into one of eighteen classes, and the class fixes four things in advance: what the source may establish, how many independent origins a material claim needs, how stale it may be, and what happens when it stops answering.

Seven classes fail closed. None of the eighteen fails open, because the governing rule is written into the manifest as policy rather than left to a runbook: loss of a critical oracle never becomes permission. An outage is a reason to stop, never a reason to proceed.

external_threat_discovery is always required, and discovery-only. The Governor is obliged to watch the outside world and forbidden to let what it finds approve anything. Every source in the feed table sits in that class. It can raise a state, open an investigation and page a human. It cannot clear a transaction.

Health is evaluated in a fixed order, worst first: quarantined → untrusted → unavailable → stale → degraded → healthy. Integrity is checked before freshness on purpose — evaluating freshness first would let a well-timed forgery read as healthy. Sources have a lifecycle too: proposed → vetting → shadow → active → degraded → suspended → retired. Nothing leaves quarantine by waiting, and nothing returns from suspended on its own.

Independence is declared, never inferred

“Two independent sources agreed” is the most-abused sentence in security tooling. Two API keys at the same provider agree. A provider and its reseller agree. Three news sites repeating one press release agree. Counting interfaces manufactures confidence that was never there.

Two endpoints operated by the same provider are one administrative origin — however many URLs are configured. Every source declares its independence group, and the policy engine counts administratively independent origins, never endpoints. The FBI's IC3 PSA and CSA feeds are registered to a single operator precisely so they collapse to one. Two search tools that both surface the same underlying article are one evidence lineage, not two.

This is enforced in code rather than asserted in a policy document. The counting function cannot return a bare number: it returns what it counted and what it refused to count, with the reason — not registered, same operator as an already-counted group, or empty. Three negative controls in CI fail the build if an unregistered group ever counts, if two same-operator sources ever fail to collapse, or if an empty group is ever scored. The property the tests pin is blunt: adding duplicate endpoints from one independence group must not increase confidence.

Sources are graded — and a grade never opens a gate

Every source carries a rolling 30-day reliability grade across eight weighted dimensions. It is a record of how a feed has behaved, published so that a source's history is visible rather than assumed.

The rules around the number matter more than the number. Never round upward across a grade boundary. A grade change never expands allowed uses. A good grade never overrides a current hard failure. No model-generated confidence value contributes to a grade. And a discovery-only source can earn a perfect score and still be unable to approve a single piece of evidence — reliability and authority are different axes, deliberately.

Bands are A 90–100, B 80–89.99, C 70–79.99, D 50–69.99, F below 50, plus Q for hard-gate quarantine and N for insufficient history. Scores are computed in integer basis points — 10,000 bp = 100.00 points — with integer division throughout and no floating point anywhere, so a grade is reproducible byte-for-byte by anyone re-running it. A zero denominator contributes zero, not full marks: a source with no observations does not get credit for a clean record it never earned.

a3e9 Oracle Governor grading model (ADR-0003) and the governor-core implementation.

Early warning: the alert pipeline

Research-quality sources are slow by design — they publish after verification. The alert pipeline watches the fastest primary sources instead, and feeds the ledger as provisional records that verified sources later supersede.

News-derived records can trigger watch states — never verdicts. The model categorizes; Pathfinder decides. When the verified record lands it supersedes the provisional one, and the ledger keeps both: the detection-latency delta is itself evidence.

The default watchlist is fixed, versioned, and pinned by numeric account ID rather than handle — a handle can be renamed or sold, and a renamed handle must never silently repoint a feed at someone else's account. Polling is budgeted: a since_id cursor, dedup across accounts reporting the same incident, and a hold until the rate-limit reset on a 429 rather than a retry storm.

A chain a3e9 can observe is not a chain it can assess, and neither implies it can construct and sign.

Two questions get asked together and answered as one, which is how vendors end up overstating both. They are separate. “Release 1” is a capability boundary, not a chain list — and “supported” means something different on each of the three planes a3e9 operates.

Ethereum, Base and BNB Smart Chain are hunted for verdicts today, with Solana running as a separate process. Ethereum, Base, Arbitrum One, BNB and OP Mainnet have built execution-path assessment. Signing adapters cover EVM, Solana, Stellar, Bitcoin and Litecoin. And every armed detection listed above runs on Ethereum — coverage follows the chain the evidence is deepest on, not the chain list that markets best.

Naming a chain is not implementing a desk. That sentence is a comment in a3e9's own source, above the function that maps chain IDs to names, and it is the rule this table follows. Several chains are named in code — Arbitrum, Optimism, Polygon, Avalanche, Mantle, Blast — while the hunting allowlist refuses them at startup. Two of them have no execution-simulation endpoint available at all, so they get identity and price-impact analysis and nothing deeper.

The Pathfinder chain allowlist, the TINL chain registry and README, the chain-router status table and release checklist, and the nine-chain scale analysis.

One artifact a protocol can display and anyone can verify.

Not a static badge: a signed, evidence-anchored attestation that expires, downgrades and revokes automatically when the underlying state changes.

Why the mark is non-transferable

The mark is issued as a soul-bound token on Solana. That single property is what makes the system enforceable.

A static badge says “we were once looked at.” A soul-bound, revocable mark says “we are being watched right now, and here is the proof.” That is the difference between marketing and assurance.

Where this stands

The engine behind the mark is built and running: TINL evaluates transaction intent and connection trust; Pathfinder evaluates execution paths and exploit variants; Governance Sentry watches voting, timelocks, Safe authority and administrative state; and the a3e9-ledger stores the append-only evidence chain. The Rekt baseline corpus — 266 incidents with pre-state code hashes — is wired in as the regression test set. Badge issuance, expiry, downgrade and revocation run on the same evidence-backed stack.

The lineage is honest: this concept began as a self-attested badge submitted to a Solana hackathon in 2025 — a badge with no engine behind it, and the judges saw that. The badge was right; the engine did not exist yet. Now it does. The mark is the output; the service is what stands behind it.

The limits, in the same place as the pitch.

a3e9 “Safe to Touch” positioning brief v2, reviewed 2026-09-09. Counts as of 2026-09-08.