Policy client · Newton Explorer

POLICY ID

0xa7de3a35…83e0

REVISION

1 of 1

POLICIES

1 of 8

DISTINCT

RESPONSE EXPIRY

25 blocks

CHAIN

Sepolia

TASKS · 24H

ALLOW RATE

53.3%

Every policy must allowFail-closed, and no short-circuit: every policy is evaluated even after one has denied, and a single denial denies the intent. The response expires 25 blocks after its reference block — the shortest expireAfter in the set, on slot 0.

Policies — 1

one Rego + WASM pair per slot

0
0xbefefe1984934e823218f5285412c77b0c519eab 0xbefe…9eabnot in factory registry25 blocksbounds set expiry
wasmnone — pure Regorego
— rules— denyno WASMspecHash 0x7c1aa403…
calc_versionnot in schemasuperearn-recon/v1
bybit_base_urlnot in schemahttps://newton-ui-demos-web-git-demo-superearn-newtonlabs.vercel.app/api/superearn/bybit
account_currencynot in schemaUST
ust_usd_rate_ppmnot in schema999800
tolerance_rel_bpsnot in schema1
max_source_skew_msnot in schema120000
max_snapshot_age_msnot in schema900000
tolerance_abs_centsnot in schema2500
policyParams — 302 bytes on chain
0x7b2263616c635f76657273696f6e223a2273757065726561726e2d7265636f6e2f7631222c2262796269745f626173655f75726c223a2268747470733a2f2f6e6577746f6e2d75692d64656d6f732d7765622d6769742d64656d6f2d73757065726561726e2d6e6577746f6e6c6162732e76657263656c2e6170702f6170692f73757065726561726e2f6279626974222c226163636f756e745f63757272656e6379223a22555354222c227573745f7573645f726174655f70706d223a3939393830302c22746f6c6572616e63655f6162735f63656e7473223a323530302c22746f6c6572616e63655f72656c5f627073223a312c226d61785f736e617073686f745f6167655f6d73223a3930303030302c226d61785f736f757263655f736b65775f6d73223a3132303030307d

Each module is evaluated against its own input — {"params": <this slot’s policyParams>, "wasm": <this slot’s WASM output>}. There is no shared data.wasm object and no cross-slot namespace, so slot 1 cannot read slot 0’s WASM output and a policy cannot be written to depend on its neighbours.

SET IDENTITY

policyId0xa7de3a354138c07898fcc40b2f0bd4dd6b8b1acdc18102a01f116796a89383e0

POLICY_SET_DOMAINkeccak256("newton.policy.set")

chainId11155111

policyClient0x9bf25344ab70180fe532191d09c27bf12ad3d07d

revision1

policies0xbefe…9eab@25

Task managerreads getPolicies() at task creation, then never again

policyId = keccak256(abi.encode(POLICY_SET_DOMAIN, chainId, client, revision, policies)), where policies is the complete ordered array with each entry’s parameters and expiry. Order is part of it, so a reorder alone is a new id.

WHAT A TASK FREEZES

A task carries this exact ordered set as its own snapshot, plus one WASM input per slot. Response validation reads that snapshot and never re-reads the client, so reconfiguring mid-flight cannot change what an in-flight task means — and replay proves it by recomputing the policyId over the snapshot and comparing against the task’s own.

The bound is MAX_POLICIES = 8, enforced on chain and mirrored in the operator, the enclave and the proof guest. An oversize set is rejected, never truncated, and an empty one is rejected too — there is no vacuous allow.

Configuration history

1 write · newest first

Rev	Policy set	Change	Policies	Configured by	Block	Tasks
1 · current	0xa7de3a35…83e0	first set	0xbefefe1984934e823218f5285412c77b0c519eab	—	11,946,8800xc863…8228	15

Every write mints a new policyId and revokes every attestation bound to the previous one, because the id commits the client, the chain, the revision counter and the exact ordered list — keccak256(POLICY_SET_DOMAIN, chainId, client, revision, policies). Revision 1 is the only one whose attestations are still spendable.

Task history — every revision

15 of 15 matchingExport CSV JSON

Task	Sender	Policy	Function	Signers	Result	Age
0xef02cc92…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	6h 23m
0xe33f224a…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	NON-COMPLIANT	6h 23m
0x529287d0…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	NON-COMPLIANT	6h 23m
0x1c393a05…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	NON-COMPLIANT	6h 23m
0xe48fdc6c…	0xd232…df1a	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	9h 26m
0x069e641e…	0xd232…df1a	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	9h 27m
0xb78d131e…	0xd232…df1a	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	9h 27m
0xc5980457…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	18h 01m
0x7e258c3c…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	NON-COMPLIANT	23h 24m
0x6954fae7…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	NON-COMPLIANT	23h 24m
0x4f46ffc3…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	23h 24m
0xba9ed2e6…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	23h 25m
0x2021b102…	0x863d…9d0d	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	NON-COMPLIANT	23h 25m
0x2ce0210a…	0xd232…df1a	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	NON-COMPLIANT	1d 11h
0x5101471e…	0xd232…df1a	0xbefefe1984934e823218f5285412c77b0c519eab	function attestReserve(uint256 equityUsdCents, uint256 snapshotTimeMs, string calcVersion)	2	COMPLIANT	1d 11h

The export carries one row per task with the frozen policy set in slot order, and it is the complete filtered history rather than this page. It has no per-policy verdict column: TaskResponse.allowed is a single boolean for the whole set, so which policy denied a task is in no record.

0x9bf2…d07drevision 1 · current

Policies — 1

Configuration history

Task history — every revision