# BACKSTOP Implementation Matrix

**Evidence snapshot:** 2 November 2026. This matrix classifies code in the current repository, not roadmap assertions.

| Capability | Status | Evidence | Not established |
|---|---|---|---|
| Local protocol payment/reservation/dispute/refund | LOCALLY TESTED | `src/protocol.js`, `node --test`, `node src/demo.js` | Real payment or provider settlement |
| SQLite double-entry ledger and v1–v4 migrations | LOCALLY TESTED | `src/ledger.js`, `src/durable-events.js`, migration tests | Cryptographic tamper resistance; cross-chain truth |
| Durable domain events and transactional outbox | LOCALLY TESTED | Outbox tests | Exactly-once delivery; persistent external-chain relay |
| Read-only reconciliation and CLI | LOCALLY TESTED | `src/reconciliation.js`, `scripts/reconcile.js`, reconciliation tests | Verification of external chain custody |
| Local API authentication, authorization, idempotency | SANDBOX ONLY | `src/api/`, `api/openapi.json`, `GET /v1/me/balance`, `GET /v1/reconciliation`, API tests | External identity verification or production operations |
| Mock provider and signed/deduplicated webhook | SANDBOX ONLY | `src/mock-provider.js`, provider tests | Production keys, actual exchange/payment provider |
| Solidity Protection Vault and Mock-USDC | LOCALLY TESTED | Contract, Hardhat tests, local E2E demo | Testnet deployment, independent audit, real token |
| Git/CI engineering baseline | IMPLEMENTED | Local Git `main`, baseline commit `689aa69d65edcbe32526823259f71c0c107b3ca7`, `.gitignore`, `.gitattributes`, `.github/workflows/verify.yml`, `npm run verify` | Hosted CI awaits an approved remote and actual run |
| Base Sepolia deployment | NOT AVAILABLE | Guarded deployment script only | Contract address, transaction receipt, explorer/source verification |
| Chain adapter and durable transaction/event journal | LOCALLY TESTED | `src/blockchain/vault-adapter.js`, `src/blockchain/transaction-journal.js`, journal and Hardhat tests | External RPC/testnet evidence and production governance remain pending |
| Opt-in local API/outbox-to-vault protection lifecycle | LOCALLY TESTED | `npm run relay:demo`, lifecycle/relay/recovery integration tests; [Gate C report](BACKSTOP-GATE-C-ACCEPTANCE.md) | Chain 31337, mock tokens and test signers; no browser wallet, testnet or production custody |
| Signed local operator recovery | LOCALLY TESTED | Snapshot/receipt-bound administrator and provider approvals, immutable audit, `solidity-test/LocalVaultRecovery.cjs` | Unresolved divergence stays halted; production operations require Gate E |
| Optional persistent local sandbox | LOCALLY TESTED | `SANDBOX_DB_PATH`, stable local fixture keys, `test/persistence.test.js` | Production key custody, public identities or chain-backed browser payments |
| Read-only browser wallet connection | IMPLEMENTED / LOCALLY TESTED | `web/wallet-client.js`, EIP-6963 discovery, explicit Base Sepolia switch and wallet tests | No wallet signing, token approval, deployed testnet contracts or chain-backed browser payments |
| Backstop browser sandbox: buyer payment, merchant balance/transfer, provider pool, dispute/review and reconciliation | LOCALLY TESTED | `web/app.html`, `web/app.js`, same-origin API server from `npm run sandbox`, `test/sandbox-app.test.js` | Fixed local personas; no public authentication, wallet, real funds or chain transaction |
| Repository marketing website and local docs portal | IMPLEMENTED | `web/index.html`, `web/docs.html`, and explicit routes in both local servers | Local delivery only; responsive/accessibility/browser acceptance is tracked by Gate B3 |
| Gate B3 local UI/docs acceptance | LOCALLY TESTED | `scripts/verify-browser.js`, nine Chromium acceptance groups and complete local verifier; [audit](BACKSTOP-B3-UI-UX-AUDIT.md) | CSS viewport emulation and measured accessibility subset; no screen-reader certification, public deployment or SQLite/EVM integration |
| Investor browser simulation | SANDBOX ONLY | Shared preview; labeled investor/reference simulation | Repository backend or blockchain integration |
| API documentation | IMPLEMENTED | `api/openapi.json`, `/v1/openapi.json`, `docs/api-reference.md` | No public API hosting, external credentials or generated SDK |
| SDK documentation / TypeScript SDK | PLANNED | No SDK package found | External developer integration |
| Repository-maintained developer docs | IMPLEMENTED | `/docs`, OpenAPI route and source-linked guides under `docs/` | Not an externally hosted portal or public production integration surface |
| Economics/risk demos | SANDBOX ONLY | `src/economics.js`, `src/admission.js` | Validated real loss, capital, or partner assumptions |
| Independent audit / production security approval | NOT AVAILABLE | No independent report present | Audit, certification, or production approval |

Status definitions: **IMPLEMENTED** means repository code exists; **LOCALLY TESTED** means the named local test/build runs; **SANDBOX ONLY** means mock/demo behavior; **TESTNET VERIFIED** requires chain/address/receipt evidence; **PLANNED** means not implemented; **NOT AVAILABLE** means no evidence or implementation was found. Statuses do not imply audit or real-funds safety.