Verifex
Verifex is a small Solana program that checks one on-chain fact about an agent and, if the check passes, issues a seven-day credential through Referee, so a DvP trade can only settle for parties the chain has vouched for.
What it checks
Each Verifex instruction runs one check, then calls Referee's issue_credential, signing as Verifex's own program-derived address. Today there are two instructions, so two checks.
verify_and_issue
The agent's program must have no upgrade authority, so its code can no longer be changed.
Otherwise it refuses with AgentNotImmutable (6002).
verify_outcome_and_issue (“Verifex Core”)
A commitment on TrustRail Core must be Passed and verified, and its executor must be the credential's subject.
Otherwise it refuses: BadCommitment (6003), CommitmentNotPassed (6004) or SubjectNotExecutor (6005).
Why it exists
DvP's CreateDvp needs only the payer to sign. The two parties and the settlement authority do not, so something has to decide who may settle. On devnet, that is Referee: its program-derived address is the settlement authority, and its settle step needs a valid credential for both parties. Verifex is the program that issues those credentials. If a credential is missing or expired, the trade never settles, and the parties can walk away through DvP's own Reject or Reclaim.
4GTqnRnN4ZDTzHf2EeqQW98RhDAtCkwG7vTgaPapR4Qs
RefereeEeviRiwTbsLcnYCkagwppFD9aRmN6fVeax9WN3tuTZEe
Verifex issuer PDA72PiHwHvMASwKLJoc76VkheqLyxaUDeRV69DM9graiGz
DvP (unmodified)dvp34bdbcEm4f4FCUjGV4mDAkDshaQR4LkK8fdcsyZq
Receipts: Verifex issues the credentials
11 transactions on Solana devnet. Each signature opens in Solana Explorer.
| Verifex program deployed (96,328 bytes) | 4M81UFX89uPW… |
Fifth in-place upgrade adds set_issuer (233,056 bytes, sha256 0ca7e752be598b4ff3f38f6ad93f5fe7c4d7436f9c93a281e3dcbb38708f1a5b) | 2Py1tTyR3mUw… |
| Referee's issuer set to the Verifex PDA | 3YWaV5rUSKny… |
Agent B presents the Token-2022 program (upgradeable): Verifex refuses, AgentNotImmutable (6002) | 5KCURHKamfaw… |
| Agent A presents the classic Token program (immutable): Verifex issues party C's credential | 5TgLoDP6d5AF… |
| DvP trade 3001 between C and D: create | 5YUZRrJmFxF4… |
| Trade 3001: fund | 5v9JzRV6bUNg… |
| Trade 3001: register | 2MgTjEeubwGc… |
Settle while D has no credential: refused, AccountNotInitialized (3012) | 5EJTsD5kN7Za… |
| D presents the immutable Token program: Verifex issues D's credential | 4yKndKZkXWR6… |
| Settle with two Verifex-issued credentials, rent returned (trade 3001) | 3vHKabVU8sB3… |
Receipts: an outcome gates the credential
14 transactions on Solana devnet, using TrustRail Core.
| TrustRail Core deployed (268,368 bytes) | LVGzKA4TxJ2E… |
| Mock swap deployed (114,280 bytes) | 263FHbihhzQc… |
Verifex upgraded in place to add verify_outcome_and_issue (106,136 bytes, sha256 1ce32cc8ee76e5b0cf2bb78041840749441d9418af30ac57dedf2a8843ab7992) | 3JZTS9pmnKmm… |
Commitment created on TrustRail Core: 1,000,000 in, 500,000 minimum out, executor EkA7LiSKxc9pqxkByWR7BrPAZjmqto7naJK8C3oTBqtw | 5bHp6V9WNg1s… |
| Mock pool initialised | 5HjLXJLPBbai… |
| Escrow moved to the swap staging account | 3TQdpXREkpAu… |
| Mock swap executed (1:1 stand-in) | 67WL4EHDupJo… |
Executor submits the proof: commitment Passed | 3vFdVvmomA7s… |
Verifex Core refuses a credential for another subject, SubjectNotExecutor (6005) | 2np47g3b2mqM… |
| Verifex Core issues the executor's credential | 5axvsbgGs37d… |
| DvP trade 4001 between the executor and D: create | 5TCpA3o7V8Dy… |
| Trade 4001: fund | 2sMbrJoRaQSB… |
| Trade 4001: register | 2YvHeySD5Upn… |
| Settle with the Verifex Core credential and D's credential, rent returned (trade 4001) | 3cLGQQMQdVMF… |
TrustRail Core
TrustRail Core: barebones, devnet only devnet only
TrustRail Core is a devnet-only fork of my separate TrustRail project. I made it for the Referee capstone so that Verifex has a real outcome to check. It is barebones: the swap behind it is a 1:1 stand-in, and its pass check compares an output balance with a minimum, so a plain donation could satisfy it. Treat it as proof the wiring works, not as a security guarantee. The program (58t4gi88MNSURkwN6GuGugmXWPFqAT6s9pB56Srx4Bez) is upgradeable by my wallet. TrustRail itself is unchanged.
Limits
- This is a demonstration of the path from check to credential to settlement. It is not a security guarantee, and it is not KYC.
- Devnet only. Unaudited.
- Both Verifex and Referee are upgradeable by my wallet, which is a trust assumption.
- The first check shows only that a program can no longer be upgraded. It says nothing about what the program does.
- The second check trusts TrustRail Core's
Passedstatus, which is a weak gate.
Plans
Stronger proofs of what an agent actually ran. Plans only, no dates promised.