Saidur-droid · Oct 7, 2026 · Oct 7, 2026 · Oct 7, 2026 · Oct 7, 2026 · Oct 7, 2026
diff --git a/.env.example b/.env.example
@@ -10,6 +10,8 @@ CANTON_MAINTAINER_TOKEN=
 CANTON_CONTRIBUTOR_TOKEN=
 CANTON_VERIFIER_TOKEN=
 CANTON_USER_ID=
+# Label copied into proof artifacts. Use authenticated-devnet only after connecting to real DevNet.
+CANTON_ENVIRONMENT_LABEL=
 # Explicit local sandbox only. Never enable for a remote/production service.
 CANTON_INSECURE_LOCAL=false
 COMMITLEDGER_ISSUE_URL=https://github.com/Saidur-droid/CommitLedger/issues/5

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,7 +1,7 @@
 name: Verified Delivery
 on:
   push:
-    branches: [main, 'fix/**']
+    branches: [main, 'fix/**', 'season4/**']
   pull_request:
   workflow_dispatch:
 permissions:
@@ -71,6 +71,10 @@ jobs:
           test -f docs/EVIDENCE_MANIFEST.md
           test -f docs/DEMO_SCRIPT.md
           test -f docs/SUBMISSION_DRAFT.md
+          test -f docs/SEASON4_RULES_SNAPSHOT.md
+          test -f docs/SEASON4_LOCKED_PLAN.md
+          test -f docs/DEVNET_PROOF_RUNBOOK.md
+          test -f docs/VALIDATION_SPRINT.md
           test -f daml/daml/CommitLedger.daml
           ! grep -RniE 'vercel|supabase' package.json src web scripts daml
           ! git ls-files | grep -E '(^|/)\.env(\.local)?$'
diff --git a/README.md b/README.md
@@ -1,117 +1,97 @@
 # CommitLedger
 
-**Canton-native settlement infrastructure for verified open-source work.**
+**Verified work. Authorized settlement. Replay-safe receipt.**
 
-CommitLedger binds canonical contribution evidence to role-separated authorization and an auditable settlement receipt.
+CommitLedger is a Canton-native business workflow that turns canonical GitHub contribution evidence into a role-authorized settlement state and an auditable `SettlementReceipt`.
 
-## Active competition targets — 7 October 2026
+## HackCanton Season 4 target
 
-This sprint has exactly two active submission targets:
+**Primary track:** Real-World Asset (RWA) & Business Workflows
 
-1. **HackCanton Season 3**
-   - Submission deadline: **9 Oct 2026, 23:59 UTC**
-   - Bangladesh time: **10 Oct 2026, 05:59**
-2. **Crypto World's Fair — Colosseum**
-   - Contest/submission cutoff: **12 Oct 2026, 23:59 PT**
-   - Bangladesh time: **13 Oct 2026, 12:59**
+Business story:
 
-The 1 October plan that retired HackCanton is superseded by the owner's 7 October instruction to submit CommitLedger to both programs.
+> A foundation pays contributors only after independently verified work, with no duplicate settlement and a permanent audit receipt.
 
-See [Competition Targets](docs/COMPETITION_TARGETS.md), [Submission Status](docs/SUBMISSION_STATUS_20261007.md), [Final Checklist](docs/FINAL_CHECKLIST.md), and [Submission Draft](docs/SUBMISSION_DRAFT.md).
+Core flow:
 
-## Product thesis
+`GitHub Issue -> Bounty -> Claim -> Pull Request -> Verify -> Settle -> SettlementReceipt`
 
-`GitHub Issue -> Bounty -> Claim -> Pull Request -> Merge Evidence -> Canton Settlement -> SettlementReceipt`
+### Why Canton is essential
 
-Canton/Daml is the authorization and workflow-state layer, not a cosmetic integration. GitHub remains the canonical external work-evidence source.
+GitHub proves the work event. Canton/Daml controls what each party is allowed to do next.
 
-## Core guarantees
+- Maintainer creates, accepts and settles.
+- Contributor claims work and submits the PR.
+- Verifier attests canonical merge evidence.
+- Wrong evidence is rejected.
+- Unauthorized settlement is rejected.
+- Duplicate settlement is rejected because the verified contract is consumed.
+- Settlement creates an inspectable receipt.
 
-- **Maintainer** creates the bounty, accepts the claim and settles verified work.
-- **Contributor** claims work and submits the exact PR.
-- **Verifier** attests canonical merge evidence.
-- Merge evidence is bound to the exact issue and PR metadata.
-- Wrong evidence, unauthorized actions and replay/duplicate settlement are rejected.
-- Settlement consumes the verified contract and creates an auditable `SettlementReceipt`.
-- `DEMO_CREDIT` is explicitly non-production test value.
+## Season 4 judge experience
 
-## Frozen technical proof
+The Season 4 branch adds only judge-facing upgrades around the proven core:
 
-The last fully executed, source-bound technical proof is:
+- **60-second Judge Mode**
+- **Evidence Passport**
+- **same-run replay/duplicate rejection spotlight**
+- **business-first workflow framing**
+- **authenticated DevNet-ready proof path**
+- **real validation sprint kit**
+
+The Daml authorization model, GitHub verifier, six-step lifecycle and settlement semantics are intentionally not rewritten.
+
+## Proven technical baseline
+
+Last fully executed frozen proof before Season 4 polish:
 
 `26bd992787401f6458f6685d2ab76aacd05eab4e`
 
-Verified at that exact code commit:
+Verified there:
 
-- Node tests: **86/86 PASS**
-- DPM **3.5.12** PASS
+- Node tests: 86/86 PASS
+- DPM 3.5.12 PASS
 - Daml build PASS
 - Daml Script tests PASS
 - fresh Canton sandbox PASS
 - six ledger transitions PASS
-- `SettlementReceipt` generated
+- SettlementReceipt generated
 - wrong-evidence rejection captured
 - unauthorized-settlement rejection captured
 - duplicate/replay rejection captured
 
-External GitHub evidence fixture:
+Current Season 4 branch must pass the same proof pipeline before being called technically complete.
+
+## Real evidence fixture
 
 - Repository: `Saidur-droid/MergeEarn`
 - Open issue: `#69`
 - Merged PR: `#73`
 
-**MergeEarn is only the external proof fixture. CommitLedger is the product being submitted.**
+MergeEarn is only the external GitHub evidence fixture. CommitLedger is the product.
 
-Canonical proof service:
+## Public proof service
 
 https://commitledger-proof-final.onrender.com
 
 Proof JSON:
 
 https://commitledger-proof-final.onrender.com/api/proof
 
-Planning/documentation commits after the frozen proof do not become runtime-proven automatically. If executable code changes, rerun the complete proof on the exact new commit.
-
-## Run locally
-
-Requires Node.js 22+.
-
-```bash
-npm test
-npm start
-```
-
-Open `http://127.0.0.1:4173`.
-
-## Run the full Canton proof
-
-Configure the documented Canton environment values, then run:
-
-```bash
-bash scripts/run-local-proof.sh
-```
-
-The proof path reruns tests, builds/tests Daml, starts a fresh Canton sandbox, captures each ledger transition, executes negative authorization/replay checks, validates one coherent evidence bundle, and finishes at `SettlementReceipt`.
+The existing public service reflects the previously frozen proven build until the Season 4 branch is redeployed.
 
-## Submission assets
+## Season 4 control docs
 
-- [Rules recheck — 7 Oct](docs/RULES_RECHECK_20261007.md)
-- [Submission status — 7 Oct](docs/SUBMISSION_STATUS_20261007.md)
-- [Competition targets](docs/COMPETITION_TARGETS.md)
+- [Rules snapshot](docs/SEASON4_RULES_SNAPSHOT.md)
+- [Locked winning plan](docs/SEASON4_LOCKED_PLAN.md)
+- [DevNet proof runbook](docs/DEVNET_PROOF_RUNBOOK.md)
+- [Validation sprint](docs/VALIDATION_SPRINT.md)
 - [Final checklist](docs/FINAL_CHECKLIST.md)
-- [Submission master draft](docs/SUBMISSION_DRAFT.md)
-- [HackCanton pitch](docs/PITCH.md)
-- [HackCanton demo script](docs/DEMO_SCRIPT.md)
-- [Colosseum pitch script](docs/COLOSSEUM_PITCH_SCRIPT.md)
-- [Colosseum demo script](docs/COLOSSEUM_DEMO_SCRIPT.md)
-- [Hackathon work disclosure](docs/HACKATHON_WORK_DISCLOSURE.md)
-- [AI assistance disclosure](docs/AI_DISCLOSURE.md)
-- [Delivery status](docs/DELIVERY_STATUS.md)
 
 ## Integrity
 
-CommitLedger does not claim Canton Coin transfer, fiat settlement, external adoption, MainNet usage, revenue, paying customers, or production custody without evidence.
+Do not claim DevNet, MainNet, real-money settlement, customers, revenue, traction or production custody without executed evidence.
 
-`DEMO_CREDIT` is test value only.
+`DEMO_CREDIT` is non-production test value.
 
-Canton is a registered trademark of Digital Asset (Switzerland) GmbH. CommitLedger is an independent project and is not sponsored or endorsed by Digital Asset.
+Canton is a registered trademark of Digital Asset (Switzerland) GmbH. CommitLedger is independent and is not sponsored or endorsed by Digital Asset.
diff --git a/docs/BUILD_STATUS.md b/docs/BUILD_STATUS.md
@@ -1,7 +1,46 @@
-# Build Status
+# Build Status — HackCanton Season 4
 
-Last reviewed: 2026-09-29.
+_Last updated: 7 October 2026._
 
-See [Delivery status](DELIVERY_STATUS.md) for the current evidence-based status, [Automated runbook](AUTOMATED_RUNBOOK.md) for execution, and [Final checklist](FINAL_CHECKLIST.md) for release/submission gates.
+## Current branch
 
-Original Node suite: 16 passed. Expanded delivery Node suite: 65 passed. Daml build/tests, real Canton lifecycle evidence, full browser QA, final video, and official portal recheck remain unverified. CI configuration is not CI success. Do not claim 100% or submission-ready before those gates pass.
+`season4/jaw-drop-upgrade`
+
+## Technical baseline
+
+The proven pre-Season-4 baseline is commit:
+
+`26bd992787401f6458f6685d2ab76aacd05eab4e`
+
+It passed:
+- Node 86/86;
+- DPM 3.5.12;
+- Daml build/tests;
+- fresh Canton sandbox;
+- six real ledger transitions;
+- SettlementReceipt;
+- wrong-evidence rejection;
+- unauthorized-settlement rejection;
+- duplicate/replay rejection.
+
+## Season 4 delta
+
+Implemented:
+- Judge Mode;
+- Evidence Passport;
+- replay rejection spotlight;
+- business-first Season 4 copy;
+- DevNet-ready environment labeling/runbook;
+- validation sprint kit;
+- Season 4 CI coverage.
+
+Current gate:
+- the Season 4 branch must pass the full CI/proof pipeline on its exact source commit.
+
+External/manual gates are separate:
+- Season 4 registration;
+- authenticated DevNet access/run;
+- real validation interviews;
+- final video and portal submission.
+
+Do not call those external gates complete until they actually happen.
diff --git a/docs/DELIVERY_STATUS.md b/docs/DELIVERY_STATUS.md
@@ -1,79 +1,50 @@
-# Delivery Status — 7 October 2026
+# Delivery Status — HackCanton Season 4
 
-Delivery branch: `fix/verified-delivery-20260929`.
+_Last updated: 7 October 2026._
 
-## Product / technical status
+## Product status
 
-**Technical delivery is GREEN.**
+**Core product: complete.**
 
-Frozen fully executed proof commit:
-
-`26bd992787401f6458f6685d2ab76aacd05eab4e`
-
-Canonical Render proof service:
-
-`commitledger-proof-final`
-
-Live page:
-https://commitledger-proof-final.onrender.com
-
-Proof endpoint:
-https://commitledger-proof-final.onrender.com/api/proof
-
-Successful proven deploy recorded in project history:
-`dep-daujs4m0tbcc73dn0c80`
-
-Verified on the frozen code state:
-- Node 86/86 PASS;
-- DPM 3.5.12 PASS;
-- Daml build PASS;
-- Daml Script tests PASS;
-- Java 21 runtime;
-- fresh Canton sandbox;
-- DAR/package identity extraction;
-- three distinct demo parties;
-- external GitHub fixture `Saidur-droid/MergeEarn#69 -> PR #73`;
-- six real Canton transitions;
+CommitLedger already has:
+- Canton/Daml role authorization;
+- canonical GitHub issue/PR verification;
+- six-step lifecycle;
 - SettlementReceipt;
 - wrong-evidence rejection;
 - unauthorized-settlement rejection;
-- duplicate/replay rejection;
-- source-commit binding.
+- duplicate/replay rejection.
 
-## Active competition direction
+## Season 4 judge polish
 
-The current sprint has exactly two active targets:
+**Implemented on `season4/jaw-drop-upgrade`:**
+- 60-second Judge Mode;
+- Evidence Passport;
+- visible duplicate-settlement rejection moment;
+- RWA / Business Workflows positioning;
+- DevNet-ready proof path;
+- validation sprint package.
 
-1. **HackCanton Season 3**
-2. **Crypto World's Fair — Colosseum**
+## Proof status
 
-The 1 October retirement of HackCanton is superseded by the owner's 7 October instruction.
+Frozen previously proven commit:
+`26bd992787401f6458f6685d2ab76aacd05eab4e`
 
-## Submission readiness
+Current Season 4 branch:
+**CI / exact-commit proof must be green before merge/deploy.**
 
-### HackCanton
-- technical product: DONE;
-- evidence/security proof: DONE;
-- written pitch/demo plan: DONE;
-- rules deadline recheck: DONE;
-- logged-in AppsFactory eligibility/profile state: **PENDING MANUAL CHECK**;
-- recorded final video: PENDING;
-- repo/publication gate: PENDING;
-- final portal submission/receipt: PENDING.
+## External status
 
-### Colosseum
-- technical product: DONE;
-- official rules recheck: DONE;
-- pre-existing-work approach: DONE;
-- submission copy: DRAFTED;
-- presentation/demo scripts: DONE;
-- portal registration/join state: **PENDING MANUAL CHECK**;
-- real demand validation: PENDING if available;
-- final videos: PENDING;
-- final portal submission/receipt: PENDING.
+Still user/organizer dependent:
+- Season 4 registration confirmation;
+- logged-in portal requirements;
+- authenticated DevNet credentials/environment;
+- 3–5 real validation conversations;
+- final demo video;
+- final submission.
 
-## Engineering state
+## Release rule
 
-Do not reopen product engineering unless a verified rule requires it or a real defect appears.
+Technical product may be called **100% technically ready** only after the current Season 4 exact commit passes the full Node + Daml + real local Canton proof pipeline.
 
-Documentation-only commits may advance the branch without changing the frozen technical proof claim. If executable code changes, rerun the full proof on the exact new commit.
+Competition submission may be called **100% ready** only after the external/manual gates above are also complete.