You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Sub Rosa is a protocol and integration stack, not only a hosted application:
13
22
14
-
- a Soroban round contract with on-chain Drand BLS12-381 verification;
23
+
- a Soroban sealed-round contract with on-chain Drand BLS12-381 verification;
15
24
- a public TypeScript SDK with high-level partner templates;
16
-
- a tlock package for deterministic sealed payloads;
25
+
- a tlock package for deterministic time-locked payloads;
17
26
- a permissionless keeper for reveal and settlement;
18
-
- a hosted pilot UI and public receipts.
27
+
- a hosted pilot UI with public lifecycle receipts.
19
28
20
-
The primary economic use case is an **asset-backed sealed auction**. A second
21
-
`ReceiptOnly` template supports partners that need confidential proposals and a
22
-
verifiable simultaneous reveal without putting funds in escrow.
29
+
The project is licensed under [MIT](./LICENSE).
23
30
24
-
Licensed under [MIT](./LICENSE).
31
+
## Status at a glance
32
+
33
+
| Surface | Current status |
34
+
| --- | --- |
35
+
| Core v2 testnet | Active, with settled `ReceiptOnly` and atomic auction proofs |
36
+
| Core v2 mainnet | Official deployment active at the contract linked above |
37
+
| Public SDK |`@sub-rosa/sdk`, named `testnet` and `mainnet` presets |
38
+
| Hosted pilot | Standalone The Signal-style OTC and loan deal flow |
39
+
| Production boundary | Independent funds-handling review still required before uncapped value |
40
+
41
+
Core v2 uses the same versioned payload envelope, Drand reveal gate,
42
+
permissionless lifecycle, public read surface, and deterministic receipt model
43
+
on both Stellar networks. An integrator chooses the network and signs for the
44
+
matching contract; a testnet deployment is never silently used for mainnet.
45
+
The hosted demo may be configured to testnet for safe pilots; its active network
46
+
is shown in the UI. Mainnet support is available through the explicit SDK and
47
+
deployment configuration documented below.
48
+
49
+
## Why Sub Rosa
50
+
51
+
Many applications need a fair private decision before they can safely execute
52
+
an on-chain action. A public mempool exposes quotes too early; a trusted
53
+
operator can change the outcome; a normal database cannot prove that every
54
+
participant saw the same reveal boundary.
55
+
56
+
Sub Rosa provides the confidential competition primitive while leaving the rest
57
+
of the workflow with the integrating application. It is designed to sit inside
58
+
existing Stellar products rather than replace their discovery, identity,
59
+
selection, payment, or escrow systems.
25
60
26
61
## Core v2 modes
27
62
28
-
| Mode |Intended use | Settlement|
63
+
| Mode |Use it for | What the contract does|
29
64
| --- | --- | --- |
30
-
|`Auction`| High-value assets, collectibles, access rights, or other Stellar-native lots | Winner payment to seller and lot to winner in one settlement |
31
-
|`ReceiptOnly`| Confidential proposal collection and design-partner pilots | No asset movement; canonical reveal receipt only |
65
+
|`Auction`| Asset sales, grants, bounties, RFPs, access rights, and other lots that must settle on-chain | Holds the lot, enforces identical bidder escrow, verifies reveals, refunds losers, and atomically transfers the winning payment and lot |
66
+
|`ReceiptOnly`| Confidential provider proposals, design-partner pilots, OTC quotes, and loan terms | Seals and reveals the proposal set, records a verifiable receipt, and moves no assets |
67
+
68
+
Both modes support open rounds or contract-enforced participant allowlists.
69
+
`Auction` rounds require one identical public escrow amount for every bidder so
70
+
the escrow cannot reveal relative bid sizes before the reveal gate. New partner
71
+
workflows should be typed templates over these reviewed modes instead of custom
72
+
settlement callbacks.
73
+
74
+
## How it fits into an application
75
+
76
+
```text
77
+
Partner application
78
+
|
79
+
v
80
+
Create a sealed round (Auction or ReceiptOnly)
81
+
|
82
+
v
83
+
Participants submit encrypted payloads
84
+
|
85
+
v
86
+
Drand round reaches the reveal boundary
87
+
|
88
+
v
89
+
Permissionless open -> reveal -> clear
90
+
|
91
+
+--> Auction: contract settles the winning exchange
92
+
|
93
+
+--> ReceiptOnly: application compares the verified receipt and selects
94
+
```
95
+
96
+
The operator cannot decrypt a payload before the configured Drand round. After
97
+
the boundary, any account can advance the lifecycle. If reveal cannot complete,
98
+
the contract exposes a grace-period void path that returns held assets.
32
99
33
-
Both modes use the same versioned payload envelope, Drand reveal gate,
34
-
permissionless lifecycle, public read surface, and deterministic receipt model.
35
-
Partner rounds can be open or contract-enforced allowlist rounds. Auctions also
36
-
enforce one identical escrow amount for every bidder, so differing public
37
-
escrow values do not leak relative bid sizes before reveal.
38
-
New partner workflows should be expressed as typed templates over these reviewed
39
-
modes rather than custom settlement callbacks.
100
+
## Hosted deal-flow pilot
101
+
102
+
[Open the standalone pilot](https://sub-rosa-web.vercel.app/#/pilot/the-signal)
103
+
104
+
The hosted pilot is a The Signal-style validation surface built entirely on the
105
+
Sub Rosa side. It demonstrates the deal flow without requiring a The Signal
106
+
database, production-code change, or escrow integration:
107
+
108
+
1. An organizer creates an OTC or loan deal room.
109
+
2. Providers submit private `ReceiptOnly` offers.
110
+
3. The organizer chooses a deadline of `2 min`, `5 min`, `1 day`, or `15 days`.
111
+
4. Offers remain sealed until the shared reveal boundary.
112
+
5. The revealed receipt lets the organizer compare terms and choose a winner
113
+
manually.
114
+
115
+
This is a named early-pilot and validation workflow, not a claim of production
116
+
integration with The Signal. It is intentionally useful as a linkable demo
117
+
while leaving settlement and business selection to the partner application.
118
+
119
+
## Ecosystem validation
120
+
121
+
-**Build on Stellar Istanbul 2026:** first place in the Hack Privacy track.
122
+
-**Stellar ecosystem programs:** SCF and Instawards materials are backed by
123
+
public Core v2 contracts, SDK integration, receipts, and a runnable pilot.
124
+
-**The Signal:** early pilot and validation partner for the standalone
125
+
confidential OTC and loan deal-flow pilot above.
126
+
-**Open x402 / Ithaca Labs:** integration work is being explored around sealed
127
+
provider bidding between MCP discovery and x402 payment.
128
+
129
+
These statements describe the current validation scope. They do not imply that
130
+
partner production codebases, private databases, or payment rails have been
131
+
modified by this repository.
40
132
41
133
## Public SDK
42
134
43
135
```bash
44
136
npm install @sub-rosa/sdk
45
137
```
46
138
47
-
The SDK includes the tlock and generated contract packages as versioned runtime
48
-
dependencies. Integrators normally need only the SDK:
139
+
The SDK includes the tlock and generated contract packages as version-matched
140
+
runtime dependencies. Integrators normally need only the SDK:
0 commit comments