surface
program id · instructions · intents
what can be called at all
derive plan (per account)
seed recipe · dependency order
role · writable · signer
origin —
extracted
recovered
flagged
the artifact declared it → theirs. It was silent → ours.
They disagree → neither.
chain (the lifecycle)
steps · links · basis · refuted by
every edge argues for itself and names its own counterexample
receipt (before it counts)
status · compute units · revert class
binding — the exact bytes, hashed
expires with its blockhash, ~1 minute
the real answer, from the live surface
// find_start("buy water at the bar") → the start it chose
"program": "let_me_buy",
"instruction": "make_purchase",
"why": ["buy", "storefront"],
"chain": { "name": "sell_and_deliver",
"verdict": "NOT_EVALUATED",
// the plan is reported, never claimed executable
"links": [{
"account": "receipts", "kind": "produces",
"provenance": "extracted",
"basis": "…account 0 of BOTH instructions,
so the two calls address one account…",
"refuted_by": "a mark_as_delivered that
settles a receipt_id no make_purchase wrote"
}] },
"derive_plan": [
{ "account": "receipts",
"provenance": "extracted" },
{ "account": "sender_token_account", … },
// …7 more, dependency-ordered
],
"gaps": [] // flagged honestly when they exist
NOT_EVALUATED is the interesting field. Nothing here
pretends the chain was verified against landed transactions — because it was not.
A graph that only ever says yes tells you nothing about when to trust it.