The protocol, without the pitch.

Dissent is an evidence-backed adversarial audit protocol for AI trading agents. A client submits a thesis and machine-testable failure conditions, commits their canonical hashes on NEAR, funds a fixed audit quote, and receives eight isolated attack analyses followed by evidence review, sycophancy review, reproducibility checks and a deterministic verdict.

It is not a trading venue, broker, custodian, wallet or investment adviser. A failed, incomplete or unverifiable audit never becomes a positive result.

Thesis and condition preimages are normalized, serialized with versioned RFC 8785 canonical JSON and hashed with SHA-256. The client signs commit_audit on NEAR. The backend verifies the contract, method, predecessor, audit ID, hashes and finality before the preimage is revealed to attackers.

A fixed fee quote is issued only after commitment. The client funds the exact quote; attacker dispatch happens only after both commitment and funding are verified. A committed audit is immutable. Changing conditions requires a new audit.

A01–A08 cover liquidity, asset safety, logic, correlation, inversion, provenance, timing and base rates. Each run has a separate context, a pinned provider/model and a typed evidence grant. Attackers see the committed thesis and conditions; they never see sibling outputs, adjudicator state or prior verdicts.

Every output contains an assessment for every committed condition exactly once, plus a justified Section B search beyond the conditions. Section B cannot be omitted without a recorded reason.

The evidence re-fetch and sycophancy review happen before deterministic adjudication. Missing coverage, a material invalid test or unresolved conflict produces ABSTAIN, never NOT_HIT. A verified critical failure produces REFUSE. TRADE requires every positive gate to pass.

The policy version and hash are part of the certificate. A later policy change cannot rewrite an earlier verdict.

Re-fetch uses a stored typed locator, never a model-supplied URL. Unavailable sources are UNVERIFIABLE; a changed live value is not automatically a contradiction of an older observation. The Evidence Auditor and Sycophancy Auditor records are append-only.

The certificate is canonical JSON containing the verdict, policy version, coverage matrix, accepted and minority findings, evidence outcomes and the decision trace. Its SHA-256 hash is registered on the NEAR registry. The public verifier recomputes the hash and compares it with the chain record; it never exposes the thesis preimage, positions or private evidence.

The proprietary arm runs the same eight-attacker pipeline. A `TRADE` certificate can reach a capped NEP-141 vault only when execution is explicitly enabled. The vault holds wNEAR, enforces per-transaction and daily caps, and can transfer only to an owner-approved venue quote address with a certificate-bound memo.

The primary adapter is NEAR Intents 1Click on mainnet. The agent holds a Function Call Key scoped to the vault; the full-access owner key is not in the execution runtime. `EXECUTION_ENABLED` and `PROPRIETARY_LOOP_ENABLED` default to `false`.

Authorization is enforced server-side for every object read and write. Secrets stay server-side; API keys are hashed at rest. External data and model output are treated as untrusted. There is no arbitrary URL fetch tool, no shell/filesystem access and no wallet signing inside an attacker run.

The model-family, vendor and open-weight gates remain enforced. See docs/SECURITY_SPEC.md.

Connect → sign a server-issued nonce → verify the access key through NEAR RPC → set an HttpOnly SameSite=Lax session cookie. Nonces are single-use and expire in five minutes. The operator allowlist is checked server-side; a client-supplied wallet address is never trusted.

Client agents use Authorization: Bearer ds_... keys with the scopes audit:create, audit:read:own, audit:commit, audit:fund and certificate:read:own. A key is displayed once at issuance and stored only as a salted hash. Rotation and revocation are supported.

Keys cannot list clients, read another workspace or sign a wallet transaction. Authorization is enforced server-side for every object read and write.

Reputation events are append-only and keyed by attacker, audit, event type and finding. They are written once from finalized accepted or rejected findings. Replaying finalization cannot double-count, and unfinished runs never enter the ledger.

The hosted service runs as a Render web service with a Neon PostgreSQL database. The service has no separate background worker; pg-boss runs in-process. Production deployment requires operator-owned mainnet registry, vault and payout accounts plus explicit release authorization.

Build: pnpm install && pnpm build
Start: pnpm start
Health: /healthz
Readiness: /readyz

See docs/DEPLOYMENT.md for the exact environment configuration and release boundary.