proxmox/docs/03-deployment/DBIS_ENGINE_X_RECIPIENT_PROOF_RUNBOOK.md

DBIS Engine X Recipient Proof Runbook

Status: executed on Ethereum Mainnet, final evidence recorded Scope: Chain 138 cUSDC -> Ethereum Mainnet cWUSDC funding, Engine X maintained accounting rail, exact-output recipient deposits, ISO 20022-style evidence, and on-chain hash anchoring.

Purpose

This runbook is the durable operator path for the DBIS Engine X proof package where 5,000,000,000 cWUSDC is delivered to each configured recipient wallet.

The final 2026-05-07 execution delivered exactly 5,000,000,000.000000 cWUSDC to the Meta wallet and exactly 5,000,000,000.000000 cWUSDC to the master wallet. The final execution report is reports/status/dbis-engine-x-final-recipient-proof-execution-20260507.md.

The current implementation proves the Engine X internal maintained rail, not public DEX market depth. A public cWUSDC/USDC peg still requires separate public liquidity and quote evidence.

Public LP compliance boundary: if the proof standard requires a public, Etherscan-indexable cWUSDC/USDC swap against official Mainnet USDC, Engine X evidence alone fails that standard. The proof must use an actual public LP surface, preserve before/after reserves plus swap transaction hashes, and avoid labeling virtual internal netting as public DEX volume. See reports/status/mainnet-cwusdc-cross-protocol-public-lp-proof-plan-20260507.md and reports/status/mainnet-engine-x-indexed-liquidity-upgrade-plan-20260507.md.

Proof Boundaries

Claim	Status	Evidence
Exact recipient output	Implemented	DBISEngineXVirtualBatchVault.runVirtualProofExactOutTo(...) and recipient planner
Engine X internal cWUSDC ~= USDC peg throughout batch	Implemented	Virtual batch requires equal maintained reserves before execution and leaves reserves unchanged
ISO 20022-style transfer evidence	Implemented	head.001.001.03 application header + pacs.008.001.13 credit transfer XML with DBIS supplementary proof data
Online proof package	Complete for 2026-05-07 execution	Timestamped plan, ISO XML, peg proof, audit envelope, and proof hashes under reports/status/
On-chain proof anchor	Complete for 2026-05-07 execution	VirtualProofAuditEvidence emitted ISO/audit/peg hashes per recipient proof
Legal/regulatory approval	Not claimed	Requires external legal, compliance, AML/KYC, sanctions, and auditor evidence
Public DEX peg repair	Not claimed	Requires separate public cWUSDC/USDC liquidity, quote, and reserve evidence
Public indexed LP compliance	Blocked	Actual public LP is quote-starved; cross-protocol routes are allowed only when official-USDC unwind quotes repay all borrowed capital and fees

Official ISO references used by this package:

• ISO 20022 standard: https://www.iso20022.org/iso-20022-standard
• ISO 20022 message definitions: https://www.iso20022.org/iso-20022-message-definitions
• ISO 20022 FAQ/certification note: https://www.iso20022.org/frequently-asked-questions

Implemented Components

Component	Path
Virtual batch proof vault	smom-dbis-138/contracts/flash/DBISEngineXVirtualBatchVault.sol
Virtual batch tests	smom-dbis-138/test/flash/DBISEngineXVirtualBatchVault.t.sol
Indexed public LP proof vault	smom-dbis-138/contracts/flash/DBISEngineXIndexedLiquidityVault.sol
Engine X ERC-3156 proof borrower	smom-dbis-138/contracts/flash/DBISEngineXFlashProofBorrower.sol
XAUt-backed USDC borrow vault	smom-dbis-138/contracts/flash/DBISEngineXXautUsdcBorrowVault.sol
XAUt-backed USDC borrow vault tests	smom-dbis-138/test/flash/DBISEngineXXautUsdcBorrowVault.t.sol
Recipient deposit planner	scripts/verify/plan-dbis-engine-x-recipient-deposits.py
Planner wrapper	scripts/verify/plan-dbis-engine-x-recipient-deposits.sh
ISO/audit proof generator	scripts/verify/generate-dbis-engine-x-iso20022-proofs.py
Proof package wrapper	scripts/verify/build-dbis-engine-x-proof-package.sh
Canary preflight and canary hash generator	scripts/verify/preflight-dbis-engine-x-virtual-batch-canary.py
Engine X v2 deploy dry-run	scripts/deployment/deploy-engine-x-v2-mainnet.sh
XAUt-backed USDC borrow vault deploy dry-run	scripts/deployment/deploy-engine-x-xaut-usdc-borrow-vault-mainnet.sh
Indexed proof vault deploy dry-run	scripts/deployment/deploy-engine-x-indexed-liquidity-vault-mainnet.sh
Public UniV3 indexed-liquidity migration dry-run	scripts/deployment/migrate-engine-x-vault-to-mainnet-cwusdc-usdc-univ3.sh
Legacy vault retirement dry-run	scripts/deployment/retire-engine-x-legacy-vault.sh
Engine X small loop proof dry-run	scripts/deployment/run-engine-x-loop-proof.sh
UniV3 public swap proof dry-run	scripts/deployment/run-engine-x-univ3-public-swap-proof.sh
Indexed proof recorder dry-run	scripts/deployment/record-engine-x-indexed-liquidity-proof.sh
Public indexed readiness report	scripts/verify/check-engine-x-public-indexed-readiness.sh
Audit manifest builder	scripts/verify/build-engine-x-audit-manifest.sh
Main status report	reports/status/dbis-engine-x-5b-cwusdc-ladder-recalc-20260506.md
Final execution report	reports/status/dbis-engine-x-final-recipient-proof-execution-20260507.md

Executed Mainnet Run

Item	Value
Final execution date	2026-05-07
Virtual batch vault	0x9a22a3e272A364D64240dE6bda796FcA421cA7E9
Chain 138 bridge tx	0x4a6c323f69d50b866eaf4e8ec62e19fcde34f8fab9d2e388834e6284a46ccc84
Meta proof tx	0xb84b06d7ac32997b14f0a23b5157d2d3f8f7972ed52151ea1d830d89df3099f2
Master proof tx	0xbfb3a7a46fba827de8cedab004cd71effbca5409a21322ff81eca9b95b777182
Meta proof ID	0x46b2bb7dd3c8e797976a1858c890326f7606584b6af7b7a6d311571192fbfbab
Master proof ID	0x2905249dc5f6301b4997d57a4f0c491230d43bb920d824824dd6005103e178b7
ISO hash	0x452ec3bd52dd5291de3bbc64325119a8e8047283f267612d90abc249364214a2
Audit hash	0x11ef49d5c522ba5960dd2bba77203a032cb6cc1aecf46028cde403aee4ff5e93
Peg hash	0x0ad30c7472668e3ecac8d00620b4b1d3bc27219a036148c500ffa124bddfb446
Final Meta cWUSDC	5,000,000,000.000000
Final master cWUSDC	5,000,000,000.000000
New vault accounting pool	85.763529 cWUSDC / 85.763529 USDC
Old vault actual cWUSDC / USDC	0 / 0

Durable evidence files:

• reports/status/dbis-engine-x-vault-promotion-execution-20260507.json
• reports/status/dbis-engine-x-bridge-execution-20260507.json
• reports/status/dbis-engine-x-final-approval-execution-20260507.json
• reports/status/dbis-engine-x-final-recipient-execution-20260507.json
• reports/status/dbis-engine-x-final-readback-20260507.json
• reports/status/dbis-engine-x-final-gas-summary-20260507.tsv
• reports/status/dbis-engine-x-recipient-deposit-plan-20260507-final.json
• reports/status/dbis-engine-x-recipient-deposit-iso20022-20260507-final.xml
• reports/status/dbis-engine-x-recipient-deposit-peg-proof-20260507-final.json
• reports/status/dbis-engine-x-recipient-deposit-audit-envelope-20260507-final.json
• reports/status/dbis-engine-x-recipient-deposit-proof-hashes-20260507-final.json

Build The Proof Package

pnpm engine-x:proof-package --per-recipient 5000000000

Optional reproducible run:

DBIS_ENGINE_X_SNAPSHOT_TAG=20260507 \
DBIS_ENGINE_X_GENERATED_AT=2026-05-07T00:00:00+00:00 \
pnpm engine-x:proof-package --per-recipient 5000000000

The wrapper emits:

• reports/status/dbis-engine-x-recipient-deposit-plan-<tag>.json
• reports/status/dbis-engine-x-recipient-deposit-plan-<tag>.md
• reports/status/dbis-engine-x-recipient-deposit-iso20022-<tag>.xml
• reports/status/dbis-engine-x-recipient-deposit-peg-proof-<tag>.json
• reports/status/dbis-engine-x-recipient-deposit-audit-envelope-<tag>.json
• reports/status/dbis-engine-x-recipient-deposit-proof-hashes-<tag>.json

On-Chain Anchor Flow

The 2026-05-07 Mainnet run is complete. Use this section for future reruns, not for replaying the already-used proof IDs.

Do not broadcast a future run from this runbook until the deployment wallet, surplus receiver, rounding receiver, bridge tranche, and fresh proof IDs are explicitly confirmed.

1. Run the canary preflight:

pnpm engine-x:canary-preflight

2. Deploy and verify DBISEngineXVirtualBatchVault.
3. Seed the virtual batch vault with the canary cWUSDC/USDC rail and fund the canary lender bucket.
4. Run runVirtualProofExactOutTo(...) for the canary using the canary ISO/audit/peg hashes.
5. Save the canary deploy, seed, fund, proof, and final reserve evidence.
6. Bridge the required Chain 138 cUSDC to the deployer on Mainnet, not directly to recipients.
7. Confirm the Mainnet cWUSDC mint and deployer balances.
8. Export the 5B proof hashes from reports/status/dbis-engine-x-recipient-deposit-proof-hashes-<tag>.json.
9. Approve cWUSDC and XAUt to the virtual batch vault.
10. Run runVirtualProofExactOutTo(...) for each recipient.
11. Save the bridge transaction hash, Mainnet mint event, proof transaction hashes, emitted proof IDs, and final recipient balances.

If the deployer wallet has no official Mainnet USDC, the canary preflight will recommend a tiny XAUt -> USDC prep swap. Do not reuse the 5B recipient proof hashes for this canary; use the canary hashes generated by pnpm engine-x:canary-preflight.

Peg Maintenance Rule

Engine X proof execution must satisfy all of these conditions:

• poolCwusdcReserve == poolUsdcReserve before proof execution.
• The virtual proof preview passes the configured maximum round-trip loss.
• The recipient exact output is less than or equal to the preview output.
• The proof event emits nonzero ISO 20022, audit envelope, and peg proof hashes.
• The vault leaves poolCwusdcReserve == poolUsdcReserve after execution.

This proves the maintained Engine X internal accounting rail. It does not prove public market price discovery or public DEX volume.

Public LP And Flash-Loan Boundary

Cross-protocol routing can be used for a public proof, but the roles must stay explicit:

• UniV2 cWUSDC/USDC is the public indexed proof surface.
• UniV3 cWUSDC/USDC can also be used as the public indexed proof surface once created and funded with actual cWUSDC plus official Mainnet USDC.
• Aave USDC flash liquidity is same-block working capital, not permanent LP funding.
• The upgraded Engine X vault can provide ERC-3156 flash loans from its accounted USDC lender bucket only; it cannot lend pool USDC and it keeps flash fees in lender accounting.
• DODO or cW mesh pools may be unwind legs only when live min-out quotes repay Aave principal plus premium in official USDC.
• XAUt cannot currently expand Aave USDC debt capacity because live Aave XAUt LTV is 0.

With current balances, the only honest public LP path is a tiny wallet-funded UniV2 canary. Larger policy-floor or listing-quality depth still needs external official Mainnet USDC.

XAUt-Backed USDC Borrow Vault

Engine X now has a dedicated repo-side borrowing component for the banking model where XAUt represents XAU collateral and USDC represents USD debt:

pnpm engine-x:borrow-vault-deploy

The command is dry-run by default and deploys DBISEngineXXautUsdcBorrowVault only when EXECUTE=1 is set. The vault:

• accepts XAUt collateral deposits;
• lends only pre-funded official Mainnet USDC;
• enforces configurable LTV, liquidation threshold, minimum health factor, liquidation bonus, and global borrow cap;
• allows standard USDC repay, third-party USDC repay, and USDC repay with attached cWUSDC public-swap proof hashes;
• records cWUSDC-sourced repayment proof hashes without accepting cWUSDC as debt payment;
• exposes owner price/risk updates, pause/unpause, lender withdrawal, liquidation, and surplus-token rescue controls.

The borrow vault does not solve quote-side capital by itself. It is a controlled accounting surface for XAU-backed USD borrowing once the vault is funded with real USDC. If the vault has no USDC lender bucket, no borrower can draw USDC regardless of XAUt collateral value.

Indexed Liquidity Upgrade Path

The current Engine X virtual batch vault contains a tiny balanced proof pool: 85.763529 cWUSDC / 85.763529 USDC, plus a 5 USDC lender bucket. That balance can be migrated into an official Mainnet Uniswap v3 cWUSDC/USDC position for public, indexable 1:1 proof evidence:

pnpm engine-x:indexed-lp-migration

The command is dry-run by default. It reads the live vault state, checks the official Uniswap v3 factory, simulates pool creation at exact 1:1 sqrtPriceX96, and prints the withdrawal, pool initialization, approval, and mint commands. It also detects whether the configured vault exposes the upgraded accounting-aware APIs.

The repo-side next version of DBISEngineXVirtualBatchVault adds:

• withdrawPoolLiquidity(...), which decrements pool reserves and rejects withdrawals that break the maintained 1:1 pool invariant.
• withdrawLenderUsdc(...), which decrements the lender bucket.
• ERC-3156 maxFlashLoan, flashFee, and flashLoan, limited to lenderUsdcAvailable.
• A safer generic withdraw(...), now restricted to unaccounted surplus/rescue tokens.
• Emergency pause() / unpause() gates for proof execution, seeding, and flash loans.
• Flash borrower allowlist controls and optional max flash amount cap.

The already-deployed 2026-05-07 vault does not retroactively gain those APIs. Redeploy or replace the vault before broadcasting an accounting-aware migration.

The indexed LP upgrade creates public proof surface only. It does not meet the 2,500 / 2,500 policy floor or the preferred 10,000 / 10,000 target without additional official Mainnet USDC.

2026-05-07 live attempt: the legacy vault balances were swept and used to create/fund the official UniV3 cWUSDC/USDC pool at 0x1Cf2e685682C7F7beF508F0Af15Dfb5CDda01ee3. External swaps immediately moved the pool out of range; current active liquidity is 0 and deployer USDC is 0. See reports/status/engine-x-univ3-public-lp-migration-attempt-20260507.md.

Engine X V2 Public Proof Sequence

All commands are dry-run by default:

pnpm engine-x:public-readiness
pnpm engine-x:v2-deploy
pnpm engine-x:borrow-vault-deploy
pnpm engine-x:indexed-lp-migration
pnpm engine-x:indexed-vault-deploy
pnpm engine-x:loop-proof
pnpm engine-x:univ3-swap-proof
pnpm engine-x:indexed-proof-record
pnpm engine-x:audit-manifest

Recommended order:

1. Run pnpm engine-x:public-readiness and confirm the blockers.
2. Deploy the upgraded accounting-aware Engine X v2 vault with pnpm engine-x:v2-deploy.
3. Optionally deploy the XAUt-backed USDC borrow vault with pnpm engine-x:borrow-vault-deploy; fund it only with real official USDC.
4. Seed the upgraded vault with actual cWUSDC/USDC and a bounded USDC lender bucket.
5. Create/fund the official UniV3 cWUSDC/USDC public LP from the upgraded vault using pnpm engine-x:indexed-lp-migration.
6. Deploy DBISEngineXIndexedLiquidityVault with pnpm engine-x:indexed-vault-deploy.
7. For internal Engine X loop evidence, dry-run the exact 0.01 cWUSDC loop proof with pnpm engine-x:loop-proof.
8. Run a tiny actual UniV3 public swap proof with pnpm engine-x:univ3-swap-proof.
9. Record the indexed proof with real swap/liquidity/proof hashes using pnpm engine-x:indexed-proof-record.
10. Build the ABI/proof audit manifest with pnpm engine-x:audit-manifest.
11. Retire the legacy vault only after v2 proof state is live and externally reviewed with pnpm engine-x:legacy-retirement.

The indexed proof vault enforces the public proof gates: nonzero public swap hash, nonzero liquidity tx hash, tick drift limit, minimum liquidity, optional pool token-balance floors, optional max proof amount, pause, and operator allowlist.

Remaining External Gates

• Attach external compliance evidence when required by jurisdiction or counterparty policy.
• Maintain public-DEX proof separation: this run does not repair or prove listing-quality public cWUSDC/USDC market depth.
• Attach AML/KYC, sanctions screening, legal, tax, accounting, and external auditor materials separately when required.
• For any rerun, regenerate the proof package and use fresh proof IDs; the 2026-05-07 Meta and master proof IDs are already consumed.