Policy client · Newton Explorer

POLICY ID

0x6f303450…ccc2

REVISION

19 of 19

POLICIES

1 of 8

DISTINCT

RESPONSE EXPIRY

300 blocks

CHAIN

Sepolia

TASKS · 24H

ALLOW RATE

—

Every policy must allowFail-closed, and no short-circuit: every policy is evaluated even after one has denied, and a single denial denies the intent. The response expires 300 blocks after its reference block — the shortest expireAfter in the set, on slot 0.

Policies — 1

one Rego + WASM pair per slot

0
0xb019e3e7ec715b0e353454722e51b7b7b288bc41 0xb019…bc41not in factory registry300 blocksbounds set expiry
wasmnone — pure Regorego
— rules— denyno WASMspecHash 0x3b3b430e…
listnot in schema0x3f21e39EC62Cc2b201883CFFc18852B5203bDeCb
swap_selectornot in schema0x9d555cf7
threshold_hexnot in schema0000000000000000000000000000000000000000000000000000000000000000
deposit_selectornot in schema0xf08a814e
policyParams — 197 bytes on chain
0x7b22737761705f73656c6563746f72223a2230783964353535636637222c226465706f7369745f73656c6563746f72223a2230786630386138313465222c227468726573686f6c645f686578223a2230303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030222c226c697374223a22307833663231653339454336324363326232303138383343464663313838353242353230336244654362227d

Each module is evaluated against its own input — {"params": <this slot’s policyParams>, "wasm": <this slot’s WASM output>}. There is no shared data.wasm object and no cross-slot namespace, so slot 1 cannot read slot 0’s WASM output and a policy cannot be written to depend on its neighbours.

SET IDENTITY

policyId0x6f3034508b1fd3ceedb54ac707c2881665002fb63e56d27041253045635cccc2

POLICY_SET_DOMAINkeccak256("newton.policy.set")

chainId11155111

policyClient0x5f75377870f4e477bf5ad149cfc9549af1ba6880

revision19

policies0xb019…bc41@300

Task managerreads getPolicies() at task creation, then never again

policyId = keccak256(abi.encode(POLICY_SET_DOMAIN, chainId, client, revision, policies)), where policies is the complete ordered array with each entry’s parameters and expiry. Order is part of it, so a reorder alone is a new id.

WHAT A TASK FREEZES

A task carries this exact ordered set as its own snapshot, plus one WASM input per slot. Response validation reads that snapshot and never re-reads the client, so reconfiguring mid-flight cannot change what an in-flight task means — and replay proves it by recomputing the policyId over the snapshot and comparing against the task’s own.

The bound is MAX_POLICIES = 8, enforced on chain and mirrored in the operator, the enclave and the proof guest. An oversize set is rejected, never truncated, and an empty one is rejected too — there is no vacuous allow.

Configuration history

19 writes · newest first

Rev	Policy set	Change	Policies	Configured by	Block
19 · current	0x6f303450…ccc2	identical re-apply	0xb019e3e7ec715b0e353454722e51b7b7b288bc41	—	11,828,8270x410a…02fc
18	0x3151ae47…dddc	identical re-apply	0xde67d83ab3bca76474c2bbb1c2291de9c622cb07	—	11,816,4420x3fcb…90b1
17	0x18238e54…bf75	identical re-apply	0xb23f2b42910aa3e5100d83bd98c0580f258655ae	—	11,816,3450x2e12…aebb
16	0x17c4a105…4356	identical re-apply	0xa1ac0aef68ff48a383fe6ab17590a63a0b0ff08e	—	11,815,7830x08cc…34be
15	0xba029d2b…eb3d	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0xa1ac0aef68ff48a383fe6ab17590a63a0b0ff08e	—	11,815,6430x6070…9592
14	0x7a76ff36…b4c5	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,1730x3775…df93
13	0x7fafabee…3dd8	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,1720x5cb3…6975
12	0xef3e1f4f…b1c5	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,1670xc034…403f
11	0x8bf2894f…2d6e	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,1420x2086…48be
10	0xfcfd064e…7007	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,0950x78fe…403a
9	0x49c8a51b…71b9	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,0910x2ebd…df06
8	0x453d2d61…abb5	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,0570x94e8…56d3
7	0x015fac19…41cf	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,0520x13c8…ce54
6	0x6054457a…2369	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,815,0510xe6c8…4196
5	0x11378eb0…dad0	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,814,9240xb232…56e7
4	0xa99a39eb…b680	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x6f0215c1af5b08be8fee0be0b1b8bb342552e36e	—	11,808,2520x8c93…ff0c
3	0xdbbc42ba…f065	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7 · 0x87027320a301e34fff346836cba0964301eaa515	—	11,803,0340x0588…6974
2	0xbbc32111…21db	identical re-apply	0xcc3957c06472f9e599ed2eeba754d5854f23321b · 0x9cc8f6d9352f559422da29184d510a78b006c2f7	—	11,801,5600xd891…e54e
1	0xee3adddb…2535	first set	0xcc3957c06472f9e599ed2eeba754d5854f23321b	—	11,800,5280x7986…888b

Every write mints a new policyId and revokes every attestation bound to the previous one, because the id commits the client, the chain, the revision counter and the exact ordered list — keccak256(POLICY_SET_DOMAIN, chainId, client, revision, policies). Revision 19 is the only one whose attestations are still spendable. One write here re-applied a byte-identical list. PoliciesUpdated fires anyway and the revision advances anyway, so that write changed nothing about the policies and still killed every outstanding authorization.

Task history — every revision

no tasksExport CSV JSON

No tasks match this scope yet.

The export carries one row per task with the frozen policy set in slot order, and it is the complete filtered history rather than this page. It has no per-policy verdict column: TaskResponse.allowed is a single boolean for the whole set, so which policy denied a task is in no record.

0x5f75…6880revision 19 · current

Policies — 1

Configuration history

Task history — every revision