Skip to main content

​
Original-invoice recovery rollout — 21 September 2026

The recovery API and three corrected app UIs are deployed. Native Base and Solana original-payment recovery, one-time crediting and process-relaunch persistence passed. Algorand original-invoice history-only recovery also passed. This is not full funded native execution or a store-release claim.

​
What changed

  • iOS uses persistent WebKit stores isolated by app and normalized bridge origin. Seven native storage/route tests pass, including actual process relaunch and same-origin cross-app isolation. Android route tests: three pass.
  • Authenticated GET /apps/{app}/ai-credits/quotes lists all invoices belonging to that owner/app, including instance invoices. The instance equivalent is narrower. Both support /v1, 50-entry pages and a scoped before cursor. Expired originals remain available. Listing has no chain/provider I/O or credit mutation; private verifier configuration is not returned.
  • Recovered invoices are confirmation-only. issued with a null transaction ID never establishes nonpayment. Existing or corrupt local records are not replaced, and lost history on another agent blocks a fresh payment.
  • Signal Lab v0.1.4 and Northstar/Harbor v0.1.9 were deployed using the public CLI and their existing developer identities. WASM, chain contracts and signer policies did not change. Bigman remains v0.1.4. The catalogue still contains only Bigman, Northstar and Harbor; no other app/history was deleted.

​
Verification before rollout

All 133 bridge tests pass. The 67 focused invoice/store/route tests also pass on the VM with its actual installed dependencies. A query-only inspection validated all five existing invoice rows with zero database changes, including the three original native invoices. This was operator inspection, not a substitute for the public/native recovery journey. Signal Lab passes 77 tests and 17 built-browser fixture checks; an extracted source archive installs offline and builds byte-identical UI assets. Each bot passes 52 tests and its production build. Public downloads of Signal Lab’s index, JS and source archive match the reviewed bytes, and all five published UI files match in each bot. The narrow updater and checkpoint suites pass 82 tests each on Linux as the service user and as root (30 updater, 52 checkpoint). Independent review reproduced and fixed a stale-checkpoint admission bug before deployment. The updater now compares current committed schema and typed rows, including queue rowids, to all three saved databases. It retains read-only handles, binds main database inodes and checks DB/WAL fingerprints throughout replacement.

​
Installed source and recovery points

Only these two production source files changed in the guarded source update: Active source root: /home/gora-dev-user/gora-azure-build.tzbYSb/apps/gora-node. The paid-AI Rust binary, dependencies, keys, configuration and financial databases were not replaced. The exact node-data directory’s mode was tightened from 0775 to 0755; its owning service user retains write access. No child file permissions or contents were changed by that step. Fresh coordinated checkpoint: /home/gora-dev-user/gora-runtime-checkpoint-4590k0t4. It includes three SQLite databases, native Algorand donor journal, keys, configuration, six validators and their actual running executable images. The earlier checkpoint gora-runtime-checkpoint-b6w8evk9 was retained but the updater refused it after the 15-minute freshness limit. No guard was relaxed. Original source backup: /home/gora-dev-user/gora-invoice-recovery-backup-k4gg8ldv. The later catalogue update also retained catalog.original.json there. Its new SHA-256 is e4bb03a1abf6a8c8b5d537df28e02d9c723e597ca611d3e2ea8aa5db20238736. The reviewed helper/updater tree remains in /home/gora-dev-user/gora-invoice-recovery-build.ciVkmBF4. The installed older checkpoint helper was not overwritten; use the reviewed staged helper when the native donor journal must be included. Never restore the old free-AI binary or reset journals/allowances to retry. These checkpoints precede subsequent original-payment confirmations and app publications; they are not permission to roll financial history backward.

​
Availability and remaining checks

The maintenance interruption was longer than intended: node/bridge stopped at 10:41:45 UTC, settlement at 10:41:47, and all three resumed at 11:01:10. Manager and validator processes stayed running. This 19-minute interruption means the earlier successful 20-minute freshness observation must not be read as uninterrupted availability across this rollout. At 11:02:43, both on-chain marks were about 27 seconds old. The separate post-update observation passed from 11:04:21.002 to 11:24:35.943 UTC: 1,214.941 continuous healthy seconds, 82 samples, zero failed samples/resets, maximum observed mark age 47.960 seconds and maximum observed update gap 45.174 seconds. The final summary records complete: true and continuous_healthy_window_observed. Evidence: /home/gora-dev-user/gora-post-recovery-monitor.q87Z3tG1/gora-market-freshness-i07r4ifc/summary.json. Unit: gora-recovery-freshness-20260921.service. This measures sampled on-chain timestamps, not independent source-exchange truth or a never-stale guarantee.

​
Final recovered-credit checkpoint and restart limitation

Final private checkpoint: /home/gora-dev-user/gora-runtime-checkpoint-dejc804e. The contiguous maintenance command verified the reviewed helper/source hashes, stopped the three financial writers, created the checkpoint, then resumed them. Node/bridge were stopped 11:25:02–11:25:10 UTC; settlement 11:25:06–11:25:10. Manager/validator processes were not stopped. No source, dependency, key or financial-history rollback occurred. The complete stopped-writer checkpoint includes three databases, 505 retained files, 11 runtime artifacts, the reviewed catalogue, six validators and seven running process images. Independent verification checked 511 file digests, all three SQLite integrity checks and both original payment acknowledgements: one ledger credit each, available 1/reserved 0, zero native provider attempts. This is a local private checkpoint, not an off-VM restore rehearsal. The short service pause nevertheless caused a longer price-delivery gap. Stopping the node before settlement had fully exited caused in-flight worker calls to fail. Persisted 120-second processing leases and per-instance FIFO ordering held the original mark heads until automatic reconciliation. Both marks were observed 131 seconds old at 11:26:41. Four old mark requests were then rejected for exceeding their committed execution-age limit; no expired callback was replaced to force a pass. By 11:28:16 both marks were 44 seconds old, and at 11:29:00 both were 27 seconds old. No leases, signed bytes or queue rows were cleared or manually resubmitted. Thus the successful 20-minute window above does not span this checkpoint. Planned maintenance needs a verified worker-drain/handoff procedure while the node remains available; a process restart alone is not a fresh-price guarantee. At 11:29 the operational monitor still reported the same 321 manual-review flags and about 3,010 pending settlements, with six manager-reported Running validators. Those historical queues/flags remain visible. The final read-only check at 11:32 UTC found both marks advancing: the public chain sample at 11:32:18 measured 43.654-second-old marks, and the subsequent operations check measured newly updated marks at 21 seconds old. Node, bridge, settlement and manager were all active with unchanged PIDs and zero restart counts. The manager reported six Running validators; that status read is not a fresh independent child-PID verification. The operations checker continued to alert on 321 manual-review flags, with 296 failed and 2,991 pending settlements; spendable operator funds were 308.489921 test ALGO. No further restart, checkpoint, financial action or provider attempt was performed. Read-only shutdown review confirms that settlement awaits active jobs on SIGTERM, but those jobs still need the node API to save progress. The proposed maintenance order is to stop and drain settlement while the node remains available, verify completion, then stop the node. The current 30-second worker shutdown allowance does not guarantee that drain. This recommendation is not an implemented or tested coordinated handoff; leases must not be cleared to shorten recovery.

​
Live original-payment recovery

The real published Signal Lab UI recovered each original Base/Solana invoice, accepted only its original transaction for confirmation, then showed exactly one available credit. Complete invoice/transaction/receipt records survived actual native process termination and relaunch unchanged. Each chain’s native test passed once; no new payment, agent funding or provider attempt occurred. The root reviewer independently compared both complete public quote hashes and pre/post-relaunch records, rechecked the original chain transfers and inclusion windows, and compared the payment DB receipts to the node ledger. Each has exactly one ledger row, total/available 1, reserved 0 and zero provider attempts at this checkpoint. The query-only inspection made zero database changes. The first Base run failed at a test-only long-label selector before restoration or confirmation. Its failed bundle is retained; the corrected exact-label selector run passed. This was not a payment retry. Northstar’s native history-only run recovered original quote b72ef15772af7590aef86ad21d1cc04cf8ee932ec007369394bacfb880a450cd, with its original owner, instance, token, amount and timestamps. It remains uncertain/confirmation-only, with no transaction or receipt, and the instance remains paused. No replacement quote, payment, vault or trading was enabled. Server issued/null or expiry alone must not be treated as proof of nonpayment. Detailed native bundles/attachments and original transaction IDs are in apps/gora-node/dev-bridge/FUNDED_NATIVE_ACCEPTANCE_2026-09-21.md. The independent-origin browser run also passed ten checks with the preserved Solana CLI owner. Actual UI/client app-wide and instance invoice reads returned the original credited record; anonymous, foreign-app and foreign-owner reads returned 401. Root inspected its report and screenshot. Across an initial harness failure and the approved retry, two login-message signatures and zero financial/provider calls occurred. See browser evidence.

​
Remaining launch gates

The privacy link is configured as https://gora.io/privacy, but still returns 404 after redirect. Explicit AI-sharing consent, physical-device/store checks, dependency-advisory work and live isolated liquidation acceptance remain open. Offline liquidation hardening now passes 39 JS, six Rust and four AVM tests, including actual AVM inner transactions checked by the independent JavaScript verifier. The separate handoff still requires a real isolated market, bound artifact/deployment and live acceptance. This does not prove a live liquidation. No store upload or mainnet action occurred. Dormant native fund/analyze drivers now require exact original identity, artifact, policy, quote, payment and recent independently reviewed preflight, plus a retained one-shot marker before wallet/provider action. Four synthetic latch tests passed. They remain held; the final checkpoint above retains the newly acknowledged credits. The pre-update checkpoint is historical financial state and must not be restored over later acknowledgements.