This table maps major project claims to the part of the repository that actually enforces or supports them. Its purpose is to keep doctrine, documentation, and runtime behavior from drifting apart.
Unresolved economic and trust-model choices are tracked in OPEN_DESIGN_DECISIONS.md; current runtime behavior should not be mistaken for final policy.
Coverage levels:
- Contract-enforced: enforced directly by Solidity code.
- Script-enforced: checked or generated by local tooling.
- Dashboard-supported: represented in the UI, but not a source of authority.
- Docs-only: policy or design intent without executable enforcement yet.
- Not implemented: named direction with no current mechanism.
| Claim | Current Coverage | Evidence | Gap / Next Step |
|---|---|---|---|
| Rebate deposits are recorded on-chain | Contract-enforced | contracts/PBMRebateTreasury.sol stores rebateDeposits and exposes deposit getters |
Add deployment-specific indexing/export docs |
| Pharmacy payouts use Merkle proofs | Contract-enforced + script-supported | claim, flagClaim, tools/merkle/allocations.js, and scripts/verify-export.js |
Add chain/RPC event reconciliation for exported claims |
| Patient fund receives 10% of gross claims | Contract-enforced | PBMRebateTreasury.claim routes patient share |
Add dashboard visibility for patient-fund inflows |
| Unclaimed epoch funds can be recalled to patient fund | Contract-enforced | recallUnclaimed |
Add release/demo scenario showing recall lifecycle |
| Patient-fund tokens routed directly to participatory budgeting become matching liquidity | Contract-enforced + tested | PatientFundParticipatoryBudgeting.startRound, ExternalPatientFundsApplied, and PB Sink Model tests |
Deployment must choose and document whether patientFund is a Safe/intermediate treasury or the budgeting contract itself |
| Daily/hard volume caps reduce treasury blast radius | Contract-enforced | dailyVolumeCap, hardAbsoluteVolumeCap, reduceHardCap, updateDailyCap |
Add operator-facing simulator before root confirmation |
| Epoch finalization supports payout tokens with different decimals | Contract-enforced + tested | Constructor-configured minimumEpochVolume and six-decimal token regression test |
Deployment must express thresholds in token base units |
| Disputed dismissed claims do not poison caps or lock recalled funds | Contract-enforced + tested | resolveClaim and security tests |
Keep as regression test in CI |
| Root-exclusion payouts cannot bypass single-party governance or epoch caps | Contract-enforced + tested | approveExclusionClaim, resolveClaim, and security tests |
Add evidence-hash provenance for off-chain review packets |
| Exclusion remediation cannot consume ordinary distribution liquidity | Contract-enforced + tested | fundExclusionRemediation, exclusionRemediationReserve, and security tests |
Define an operational reserve-funding target before deployment |
| Exclusion payouts cannot distort root-unclaimed reporting | Contract-enforced + tested | epochRootClaimedTotal, epochExclusionPaidTotal, epochAccounting, and security tests |
Surface the provenance-aware fields in any future dashboard |
| Issued vouchers reserve mutual-credit capacity until redemption or expiry cleanup | Contract-enforced + tested | reservedVoucherCredit, releaseExpiredVoucher, transfer and limit-update checks |
Expired capacity is not auto-released; add operational monitoring for expired reservations awaiting cleanup |
| Flagged normal disputes reserve cap volume until resolved | Contract-enforced + tested | resolveClaim resets volume, security tests |
Covered by cap-reservation regression tests |
| Flagged disputes can be retracted by the claimant pharmacy after a 30-day timeout | Contract-enforced + tested | retractClaimDispute, ClaimDisputeRetracted, and dispute-timeout tests |
Handles both recalled (sent to patientFund) and unrecalled (returned to escrow) states; re-flagging after retract is fully supported |
| Stale unrooted epochs can be bypassed by the timelock executor after 180 days | Contract-enforced + tested | skipStaleUnrootedEpoch, StaleUnrootedEpochSkipped, and stale recovery tests |
Advances currentEpoch and deletes expired proposals to prevent permanent deadlock |
| Voucher IDs cannot be stolen and redeemed by another participant | Contract-enforced + tested | Recipient stored in Voucher; redeemVoucher requires the intended recipient |
Add cancellation and reissuance only if real workflows require it |
| Claim | Current Coverage | Evidence | Gap / Next Step |
|---|---|---|---|
| Root publication has durable proposal and approval trust roots | Contract-enforced + tested | COUNCIL_ROLE proposes; ROOT_CONFIRMER_ROLE confirms; mutual exclusion is enforced during role grants; confirmer rotation is timelocked |
Rehearse Safe and timelock rotation before deployment |
| Council controls operational governance | Contract-enforced | COUNCIL_ROLE gates recall, sanctions, unpause, and root proposals |
Document real Safe setup before deployment |
| Executor/timelock controls cap and reserve changes | Contract-enforced | EXECUTOR_ROLE gates cap and reserve functions |
Add deploy verification checklist for executor address |
| Guardian can pause but not unpause | Contract-enforced | guardian/council role split | Add emergency runbook |
| Dizzy is an arbitration/judgment layer | Docs-only | GOVERNANCE.md |
Reframe as advisory unless evidence packet, versioned prompt, appeal path, and council ratification exist |
| Relayer verifier enables voter self-registration | Contract-enforced with centralized trust root | relayerVerifier, registerVoterWithSignature; EOA and ERC-1271 verifier signatures accepted |
Set public prototype verifier to a governed multisig or equivalent contract wallet, plus rotation/runbook and eligibility policy |
| Trusted credential issuer signatures authorize voter self-registration | Contract-enforced + tested | trustedCredentialIssuers, registerVoterWithCredential, credential policy tests |
Current issuer-signature path uses ECDSA recovery; do not claim ERC-1271 issuer support unless implemented and tested |
| Relayer authorizations cannot be replayed after use or council revocation | Contract-enforced + tested | chain-bound registration nonce in PatientFundParticipatoryBudgeting |
Add operator tooling to query nonce automatically from the target chain |
| Experimental cooperative/reflexive governance drafts are quarantined from production runtime | Draft/test-only prototype | contracts/CooperativeParticipatoryBudgeting.sol, contracts/ReflexiveFiduciaryManifold.sol, and test/DraftGovernanceModules.test.js |
Keep out of deployment scripts and production docs until threat model, economic spec, formal audit, and release governance exist |
| Local mutual-credit federation autonomy | Not implemented | PharmacyMutualCredit.sol uses global COUNCIL_ROLE for registration, credit limits, and voucher issuer status |
Add scoped local roles or separate per-federation ledgers before semi-autonomous federation use |
| Mutual-credit default and bad-debt resolution | Not implemented | PharmacyMutualCredit.sol enforces balances, credit limits, and capacity accounting only |
Define bad-debt, write-off, freeze, and local federation solvency rules before claiming default governance |
| Ratification requires multi-class constituency thresholds | Docs-only (Proposed) | RATIFICATION_PROCEDURE.md |
Freeze eligibility lists and voting thresholds |
| Evidence commitments use off-chain metadata schema | Docs-only (Proposed) | EVIDENCE_METADATA.md |
Define custodian, availability, and retention policies |
| Voter and claim privacy via scoped nullifiers | Docs-only (Proposed) | IDENTITY_NULLIFIER_DESIGN.md |
Mitigate PBM profiling risk with ZK nullifiers |
| Shielded participant safety tiers | Docs-only (Proposed) | RETALIATION_AND_PRIVACY_THREAT_MODEL.md |
Tier 1 shielded claims/votes require future ZK nullifier implementation |
| Credential revocation appeal legitimacy | Docs-only (Proposed) | RATIFICATION_PROCEDURE.md |
Add governed revocation appeal process and emergency continuity status |
| Claim | Current Coverage | Evidence | Gap / Next Step |
|---|---|---|---|
| Auditable value flow is not the same as reliable care | Docs-only | CARE_CONTINUITY.md |
Define measurable care-continuity workflows and responsible operators |
| Mutual credit can support emergency fills | Contract-enforced accounting + docs-only operations | PharmacyMutualCredit.sol, CARE_CONTINUITY.md |
Contract clears credit, but does not track inventory, formularies, or SKU availability |
| Non-digital workflows protect access during infrastructure degradation | Script-supported draft artifacts only | tools/resilience/continuity-engine.mjs and test/ContinuityAndAdversarialTools.test.js generate and verify local paper-voucher/relay-intake artifacts with fail-closed MAC checks |
Still Node.js-dependent and not a standalone air-gapped kit; no SMS, live proxy relay, redemption authority, or production offline-clearing workflow exists |
| Scarcity allocation has legitimate triage rules | Docs-only (Proposed) | SCARCITY_GOVERNANCE.md |
Ratify privacy-preserving, appealable scarcity governance before public use |
| Claim | Current Coverage | Evidence | Gap / Next Step |
|---|---|---|---|
| Dashboard is local/test only | Dashboard-supported + locked | chainId and contract-code verification checks in dashboard/web3_integration.js |
Switch to environment-specific deploy scripts |
| Dashboard does not imply audit readiness | Dashboard-supported + docs | README warning, persistent warning banners, and badge logic | Add shared audit-status config so all surfaces stay aligned |
| Ledger of Omissions is factual, not accusatory | Docs-only | OMISSION_LEDGER.md legal guardrails |
Add language linter for dashboard/docs risky phrases |
| ADA/WCAG readiness matters | Dashboard-supported + self-audited pass | Emojis wrapped in aria-hidden, focus-visible outlines, accessibility-compliant contrast, and aria-live announcements in dashboard/index.html |
Maintain accessibility guidelines during future layouts |
| Claim | Current Coverage | Evidence | Gap / Next Step |
|---|---|---|---|
| Participant data can be exported as JSON | Script-enforced | scripts/export-portability.js |
Add full chain/RPC event reconciliation |
| Exported Merkle proof material can be checked locally | Script-enforced + tested | scripts/verify-export.js |
Include chain ID, contract addresses, block range, and root event references |
| Exported clinical placeholders are not represented as real records | Script-enforced + tested | metadataProvenance: "synthetic-placeholder" |
Extend schema to separate on-chain and off-chain fields |
| Voter credentials are bound to a trusted issuer, wallet, type, active status, expiry, and revocation registry | Script-enforced + tested | shared credential-policy.mjs, voter relayer, and credential policy tests |
Replace static pin and local revocation file with a governed DID/key registry |
| Private key material is kept out of Git | Git hygiene + script-supported | .gitignore, 0o600 private-key writes |
Add secret scanning in CI |
| Claim | Current Coverage | Evidence | Gap / Next Step |
|---|---|---|---|
| Tests run locally | Tested | npm.cmd test currently passes 166 tests |
Keep CI green |
| Tests run on GitHub | CI-configured | .github/workflows/test.yml |
Confirm first workflow run after push |
| Dependencies are monitored | GitHub-configured | .github/dependabot.yml |
Review Dependabot PRs before merging |
| Production frontend build exists | Not implemented | checklist only | Add bundler/minifier, no public source maps, no unsafe CDN dependency |
| Database/RLS exists | Not implemented | checklist only | Do not claim DB security until DB/API surface exists |
| API rate limiting exists | Not implemented | checklist only | Add when backend/API endpoints exist |
| Error tracking exists | Not implemented | checklist only | Add when hosted dashboard/API exists |
-
Dizzy arbitration is stronger in doctrine than in mechanism.
- Fix: make Dizzy advisory in governance docs unless a ratified evidence-packet workflow exists.
-
Wellbeing metrics describe automated triggers that are not yet executable.
- Fix: add a
tools/wellbeing/audit.mjsscript that emits machine-readable pass/fail results.
- Fix: add a
-
Omission pressure is politically clear but legally sensitive.
- Fix: enforce neutral registry language in dashboard and docs.
-
Dashboard is visually real but still prototype infrastructure.
- Resolved: Implemented chainId-based environment locks, local Ethers.js bundling, and WCAG accessibility pass.
- Next: Add production bundler/minifier build pipelines.
-
Portability exports now verify local proof consistency, but not full chain event reconciliation yet.
- Fix: extend the verifier with chain ID, contract addresses, block range, and root event references.
A reviewer should be able to pick any major claim in README.md, GOVERNANCE.md, PORTABILITY.md, OMISSION_LEDGER.md, or WELLBEING_METRICS.md and classify it as contract-enforced, script-enforced, dashboard-supported, docs-only, or not implemented within five minutes.