# PIECE 3 FINAL REPORT

**PASS WITH CONCERNS**

**READY FOR PIECE 4 WITH NON-BLOCKING CONCERNS**

Piece 3 is deployed on netcup at `/opt/statechain`, branch `piece3/network-consensus`. Piece 4 was not started.

## Design and source evidence

- SDD v1.4 SHA-256: `6104b54966551be64855e39955cc5962fcd71355f1b9b7e39545eeedf993d6ce`.
- Final branch commit: recorded by `git rev-parse HEAD` on the server.
- Piece-1/Piece-2 workspace regression: passed (`cargo test --workspace --all-targets`).
- Maintained crypto package: `pqcrypto-mlkem 0.1.1`, `pqcrypto-mldsa 0.1.2`, `ecvrf 0.4.4`, `blst 0.3.17`, X25519, HKDF-SHA256, AES-256-GCM.

## Acceptance evidence

- `p3-crypto`: positive and fail-closed negative tests; strict Clippy passes.
- `tools/sc-node/seven_node_test.py`: seven independent processes, seven active registrations, encrypted ML-KEM/ML-DSA-authenticated transport, common VRF/BLS final header and StateRoot.
- `tools/sc-node/fault_test.py`: three isolated nodes, four honest nodes, no conflicting finalized header after recovery.
- `reports/piece3/consensus-1000.json`: 1,000 accelerated epochs, VRF-selected heads, BLS aggregate finality, no conflicting finality.
- `reports/piece3/cadence-500.json`: 500 epochs, 500 finalized, 500 empty, zero stalled, zero conflicting finality, `2000.07` seconds elapsed.
- `tools/sc-node/pwa_guard.py`: authorized bundle passes; one-byte tamper fails closed; 12-hour systemd timer active.

## Protocol implementation

Canonical IP-family-neutral endpoint objects, PENDING to ACTIVE registration, exact endpoint receipts, one ACTIVE node per DID, ML-KEM/X25519 hybrid key establishment, ML-DSA transcript authentication, HKDF traffic-key derivation, AES-GCM sequence framing, ECVRF role domains, BLS12-381 aggregate attestations, integer 70% quorum, deterministic roots, empty epochs, and restart/fault rehearsal are implemented and evidenced.

## Concerns and limits

The seven-node rehearsal runs on one physical netcup host; WAN fault domains and externally reached IPv6 remain unproven. The public IPv4 PWA is served over HTTPS with a development certificate because the installed CA client rejected a bare IP identifier; trusted raw-IP ACME issuance remains an external dependency. Production release/updater, Bastion history, Zr, governance, and final wallet UX remain out of scope. These concerns do not alter consensus safety and Piece 4 has not begun.

## Task matrix

The complete P3-001 through P3-064 gap matrix and evidence paths are in [`reports/piece3/PIECE3-GAP-AUDIT.md`](piece3/PIECE3-GAP-AUDIT.md); previously partial cryptographic tasks are superseded by the final transport, consensus, cadence, and fault artifacts above.

**Status:** `PIECE 3 FINALIZED — AWAITING OWNER/ARCHITECTURE REVIEW`