Human-operated testnet gate deployment

Reviewed Solana V2 artifact

The reference gate artifact abraxas_eligibility_gate_v2_institutional_r2 was deployed to Solana devnet at 4hf3cY57ciPakr4omyTSbksAfW672iGrdo6fiDVQAD4K. Its on-chain ELF matches reviewed keccak 0x6adcb3850f269710bd815bde0cc518cf6d02e167a01398776d8d78df9f566991 and SHA-256 0x37f7310ee6ceab81619964165a8d570a1af3502bf52bc8bf52e46d6d1515cdd8. This is binary proof only: GateConfig has not been initialized, no partner gate is registered, and no authorization is issuable from this deployment. Independent operators must still follow solana/abraxas-eligibility-gate/REPRODUCIBLE_RELEASE.md and verify their own deployment.

Boundary

This kit deploys partner-owned eligibility gates only. It does not transfer tokens, mint, approve spending, settle USDC, call Circle, or custody funds.

No wallet private key, RPC URL, raw transaction, or account data is stored in the repo, Vercel, browser, logs, Studio, or these docs. Environment names only.

CLI

npx tsx scripts/abraxas-gate.ts plan solana
npx tsx scripts/abraxas-gate.ts plan evm
npx tsx scripts/abraxas-gate.ts deploy solana-devnet
npx tsx scripts/abraxas-gate.ts deploy evm-testnet
npx tsx scripts/abraxas-gate.ts verify <deployment-manifest>
npx tsx scripts/abraxas-gate.ts register <deployment-manifest>
npx tsx scripts/abraxas-gate.ts plan institutional-evm-sepolia
npx tsx scripts/abraxas-gate.ts plan institutional-solana-devnet
npx tsx scripts/abraxas-gate.ts validate-plan <plan-file>
npx tsx scripts/abraxas-gate.ts deploy institutional-evm-sepolia --confirm
npx tsx scripts/abraxas-gate.ts deploy institutional-solana-devnet --confirm
npx tsx scripts/abraxas-gate.ts verify <registry-manifest>
npx tsx scripts/abraxas-gate.ts register <registry-manifest>

Plan is a planning envelope only. Use validate-plan before a human deploy. Deploy requires --confirm and never broadcasts. The operator deploys with a local Solana toolchain, then verify/register a post-deploy registry manifest against chain observation. A reusable institutional gate is not bound to one organization or actor.

Approved networks

Solana devnet and EVM Sepolia (published chain ID 11155111). Arc/Circle testnet stays unselected until the reviewed registry publishes a chain ID. Arc/Circle Mainnet remains disabled. Production/Mainnet networks are rejected.

Environment names

ABRAXAS_GATE_PARTNER_ID · ABRAXAS_GATE_APPLICATION_ID · ABRAXAS_GATE_POLICY_ID · ABRAXAS_GATE_POLICY_VERSION · ABRAXAS_GATE_SIGNER_KEY_ID · ABRAXAS_GATE_EVM_RPC_URL · ABRAXAS_GATE_EVM_PRIVATE_KEY · ABRAXAS_EVM_GATE_VERIFY_RPC_URL · ABRAXAS_GATE_SOLANA_RPC_URL · ABRAXAS_GATE_SOLANA_KEYPAIR · ABRAXAS_SOLANA_GATE_VERIFY_RPC_URL · ABRAXAS_GATE_PUBLIC_VERIFIER · ABRAXAS_GATE_HANDOFF_PATH

Solana human test plan

1. Build the reviewed V2 eligibility-gate ELF and confirm its keccak digest matches the approved registry artifact before verify/register.
2. Complete Hosted Partner Flow for the sandbox policy.
3. Re-fetch GET /api/receipts/{id}/public and require currently_valid.
4. Issue a chain attestation bound to the verified deployment_ref.
5. Place Ed25519 verify immediately before authorize, then activate_protocol_access.
6. Replay the same nonce; expect replay rejection.
7. Wait until valid_until; expect assert_protocol_access inactive.

Expected: authorization PDA consumed once; protocol access valid_until copied from expires_at; no SOL transfer, mint, or token CPI.

Institutional V2 testnet

Institutional V2 testnet kit. A reusable gate requires V2 institutional attestations. Organization, actor, result-category, subject, and expiry are attestation-only — never deployment-static. Plan, validate-plan, then the operator deploys with a local Solana toolchain. --confirm never broadcasts. Verify and register need a post-deploy registry manifest plus chain observation. No browser deploy button. Not Utila, live KYB, Arc, or Mainnet.

1. Institutional policy review required
2. Create V2 testnet deployment plan
3. Human deploys gate
4. Verify exact deployed configuration
5. Register verified sandbox deployment
6. Request a fresh institutional presentation and chain attestation

EVM human test plan

1. Complete Hosted Partner Flow for the sandbox policy.
2. Re-fetch GET /api/receipts/{id}/public and require currently_valid.
3. Issue an EIP-712 attestation bound to the verified deployment_ref.
4. Call consumeEligibility then activateProtocolAccess on the partner-owned contracts.
5. Replay the nonce; expect replay rejection.
6. Advance past expiresAt; expect hasAccess false.

Expected: gate nonce consumed once; validUntil copied from attestation expiresAt; no ETH/token transfer, mint, or approval.

Related

Verified deployments · Protocol access · Signer lifecycle