a2255fe was tested on
17 October 2026. These tests executed the actual SDK and relayer, beyond the earlier isolated
feasibility spikes. All records were synthetic; all writes used a throwaway Tiramisu wallet.
This is test evidence for an experimental implementation. The upgrade was not published or
deployed by the integration work, and no independent security audit was performed.
Integrated results
Times include proof generation, RPC, transaction waits and readback; they are not pure proving
benchmarks. Browser artifacts were self-hosted with matching pinned SHA-256 digests. The browser
used a recovery-backed WorkerVault, not a physical passkey or mobile device. Versions were Arkiv
0.8.1, viem 2.57.4, Semaphore 4.14.4, Vite 8.3.4 and Playwright 1.64.1.
Boundaries exercised
- Empty-group creation, minimum-size enforcement, enrollment and historical snapshots after appending.
- Normal SDK encrypted writes, one-time ownership transfer, readonly creation and ownership challenges.
- Recovery from an injected failed acknowledgement after confirmation, without resending.
- Real browser-worker proof generation, submission and decrypted record discovery.
- Invalid proof, missing proof, owner substitution, malformed JSON and replay rejection.
- Independent proof/content verification and chronological selection of a same-nullifier winner.
- Deletion and actual expiry preserving spent state without promoting a later duplicate.
- An actual process exit after durable reservation, corrupt/stale-locked journals and fail-closed recovery.
- Uncertain sends without batch splitting/retries, known hash retention and final anonymity checks.
- Typed verification unavailability rather than silently returning an empty feed.
Remaining work
Node tests also emitted a
MaxListenersExceededWarning about 15 socket unpipe listeners. Its
source was not diagnosed. Proving workers kept an early Node test process alive after assertions;
the test runner uses an explicit force-exit after tests and the integration driver exits after
cleanup. Vite warned about existing __dirname and browser-externalized crypto imports; the
build and actual worker flow passed. These observations are not silently treated as resolved.
See security, operating Semaphore and the
module reference.