> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/implementation-ledger/ns-446-hyperliquid-validation-evidence-verifier.md).

# NS-446 · Hyperliquid validation evidence verifier

Status: implemented locally; no venue campaign has been claimed or performed.

## Goal

Turn the Hyperliquid go-live checklist into one strict, redacted, mechanically verifiable campaign record. Repository tests prove code paths; this record proves the separately executed venue lifecycle, database projections, recovery drills and final safe state.

## Delivered

* `pnpm hyperliquid:evidence -- template` writes an intentionally incomplete exact-schema testnet or mainnet checklist to a private regular file outside the repository.
* `create` accepts only a completed checklist and writes canonical digest-bound evidence atomically.
* `verify` revalidates a completed evidence file offline and returns only a fixed, redacted summary.
* Testnet evidence requires exactly:
  * resting GTC placement and exact cancellation finality;
  * IOC fill, fee and PnL projection;
  * reduce-only close without position flip;
  * grouped stop-loss lifecycle;
  * take-profit/stop-loss sibling finality;
  * ambiguous outcome converted to reconcile-only;
  * venue dead-man scheduled-cancel proof;
  * signer restart recovery;
  * cold signer-store backup and isolated restore.
* Every required mutation has its own action ID, intent fingerprint, parameters digest, authorization-reference digest, expected/result code and reconciliation time. Authorization must precede the attempt by no more than five minutes.
* Readiness must be green before the first mutation, after every testnet case and at final closure. It independently proves database/account-digest state, all execution gates, exact network, symbol-scope digest, $12 canary cap, 1x leverage cap, zero open orders, revoked operator session and zero readiness-command capital mutation.
* Mainnet evidence additionally binds prior testnet evidence, funding receipt, entry and exit projections, cumulative realized loss, customer-database reconciliation, account flatness, all-DEX zero-open-order proof, kill-switch restoration, dead-man disarm only after zero orders, stopped signer and final backup.
* A passing final decision requires no unresolved mutation or incident, customer-database reconciliation, flat account, zero open orders, active kill switch, stopped signer and verified backup.
* Account/API-wallet/builder/store identity stays limited to short redacted fingerprints. Release, policy, migration, readiness, authorization and lifecycle evidence use SHA-256 digests. Raw addresses, CLOIDs, signatures, keys, cookies, tokens, URLs, database strings and provider payloads are rejected.

## Policy envelope

* exactly one redacted symbol scope;
* maximum $12 per order and $12 gross exposure;
* exactly 1x leverage and one concurrent exposure;
* maximum 30 bps slippage;
* 30-second dead-man deadline and 15-second heartbeat freshness;
* maximum $100 testnet allocation;
* maximum $50 mainnet allocation and $2 realized-loss stop.

Tighter reviewed values remain valid. Broader values fail verification.

## Authority boundary

The tooling performs no network or venue request. It cannot register or revoke an API wallet, approve a builder, fund an account, claim testnet funds, change leverage, place or cancel an order, arm or disarm a dead-man switch, sign, retry or reconcile with Hyperliquid. Every such mutation still requires fresh exact action-time user authorization and the operational services/credentials remain outside the repository.

The canonical evidence digest detects modification only while its approved value is retained independently. It is not a signature and does not prove reviewer identity against a malicious replacement of both file and digest.

## Verification

```powershell
node --test scripts/hyperliquid-validation-evidence.test.mjs
pnpm hyperliquid:evidence -- verify --evidence C:\secure\nightshift\campaign-evidence.json
```

The second command is an operational gate and cannot pass until a real, separately authorized campaign supplies the private evidence.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/implementation-ledger/ns-446-hyperliquid-validation-evidence-verifier.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.