# Matlock — Machine Authentication & Cryptographic Provisioning (`auth.md`)

Matlock is a **Deterministic Verification Harness & Polyglot Toolset** across 15+ polyglot language & CI ecosystems requiring **`0` user accounts, `0` OAuth flows, `0` bearer API keys, `0` cookies, and `0` cloud source uploads**. Local and ephemeral cloud-container verification (**Cloudflare `ContainerHarness` / `Codex` `cloudflare/debian-trixie`**, Docker, E2B, Firecracker) runs over `stdio` (`matlock-mcp --stdio --headless --no-coverage`, `npx -y @dutchp2p/matlock-mcp`, `uvx matlock-mcp`, or 2-line `agent-install.sh` + `matlock-mcp init . --mcp-json --json`) with `readOnlyHint: true` auto-approval annotations, progressive `mode: "tool_bag"` (`matlock-mcp toolbag`), `dedup_by_rule` (`sibling_coordinates`), `< 2ms` `if_none_match` short-circuits, flat JSON Schema primitives, `resources/list`, and `prompts/list`; paid coordinate unlocking uses offline-verifiable `Ed25519` (`MATLOCK-V2`) cryptographic grants.

## 1. Mode 0 — Unauthenticated `Index 0` Cold-Start Value Proof (`$0.00`, `0` Credentials)
- **Command**: `matlock_run_scan(target_path)` (`Index 0` primary entry tool; `matlock_describe_project(mode: "tool_bag")` optional at `0` credits in `~350–550` tokens).
- **Auth Required**: None (`0` tokens, `0` network calls, `readOnlyHint: true` zero-popup IDE auto-approval).
- **Output (`< 50ms`)**: Un-truncated `HTTP 402` value proof in `structuredContent` and `content[0].text` (`0.0–100.0` Health Score, `findings_commitment_sha256`, severity counts, violated `MITRE CWE` & `MITRE ATT&CK` (`T*`) codes, `merkle_test_seal`, live workspace AST token-savings math; `0` file names, `0` line/col coordinates, `0` diff patches).

## 2. Mode 1 — Per-Transaction `x402` V2 Settlement (`product: "matlock_agent"`, `$0.01–$4.99` — Headless `matlock-mcp` & Ephemeral Cloud VMs Only; Does Not Unlock Desktop GUI)
- **Supported Assets (`6` Decimals, `10000`–`4990000` Micro-Units)**:
  - **Solana `USDC` (`solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`)**: Mint `EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v` · Recipient ATA `E5qmxhdZTmSvKEmGRYtquF1Nh4rYSx3ko8m25WG5Cqfs` (Owner `FD8yYPXMYrUpVhzYNT3w9EqD8XvpcUhzeqTs72SerXxb`)
  - **Solana `PYUSD` Token-2022 (`solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`)**: Mint `2b1kV6DkPAnxd5ixfnxCpjxmKwqjjaYmCZfHsFu24GXo` · Recipient ATA `G6zg9GqwVUX3dfA95WQkYawKw3qFYmtSt1j5Bu8wb46W`
  - **Base `USDC` (`eip155:8453`, `chainId = 8453`)**: `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` -> Treasury `0xdcccb2740e9199e79e3fe4f814486bd586074ad2`
  - **Polygon `USDC` (`eip155:137`, `chainId = 137`)**: `0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359` -> Treasury `0xdcccb2740e9199e79e3fe4f814486bd586074ad2`
- **1-Call Settle + Unmask & Same-Workspace Micro-Repair Window**:
  1. Transfer directly (`0` quote calls), execute a 1-tx `ExactOut` DEX swap (Jupiter `ExactOut` on Solana to `E5qmxhdZTmSvKEmGRYtquF1Nh4rYSx3ko8m25WG5Cqfs`, or Uniswap v3 / Aerodrome `exactOutputSingle` on Base `8453` / Polygon `137` to `0xdcccb2740e9199e79e3fe4f814486bd586074ad2`), OR call `POST https://matlock.dutchp2p.com/pay/agent/quote` (`account`: Solana Base58 pubkey or `0x...` EVM address).
  2. Call `matlock_run_scan(target_path, transaction_signature: "<sig>")` or `matlock_purchase_license(transaction_signature: "<sig>", target_path: "<dir>")` (`< 800ms` Solana `confirmed` finality + automatic `HTTP 425` retry).
  3. Edge verifies on-chain net treasury balance delta, prevents replay (`HTTP 409`), and returns an `Ed25519`-signed `MATLOCK-V2` cumulative grant sealed locally (`0600` POSIX / Win32 DPAPI; zero PII). After a paid `1`-credit debit on workspace `W`, up to **`3` `changed_only: true` delta micro-rechecks within `10` minutes on `W`** run at `0` extra credit burn (`0` free cold-start runs). Read-only status: `GET https://matlock.dutchp2p.com/pay/agent/status?lid=MLK-XXXXXXXX` or `matlock-mcp status --json`.

## 3. Mode 2 — Unlimited Workstation Pro Offline `Ed25519` License Key (`product: "matlock"`, `$24.99 USD/yr`, `MATLOCK_LICENSE_KEY`, `2,500`-Run Break-Even)
- **Acquisition**: Developer purchases at `https://matlock.dutchp2p.com/en/pricing` (Markdown sheet: `https://matlock.dutchp2p.com/en/pricing.md` or `Accept: text/markdown`) or via agent handoff `https://matlock.dutchp2p.com/relay?lid=<LID>` (`24`-character Base62 order code; breaks even at `2,500` runs/yr vs `$0.01/run` Gas Tank and unlocks both Native Desktop GUI and unlimited headless/cloud-VM runs).
- **Headless / Container Claim (`1` Call -> `$0.00/run` Unlimited)**:
  - Environment secret: `MATLOCK_LICENSE_KEY="<24_CHAR_KEY>"` (or `MATLOCK-V2` certificate)
  - MCP tool: `matlock_purchase_license(license_key: "<24_CHAR_KEY>", target_path: "<dir>")`
  - One-shot CLI: `matlock-mcp activate <24_CHAR_KEY>` (`--move` transfers hardware binding)
- **Strict GUI-vs-Headless Partition & Swarm Isolation**: Native Desktop GUI and `matlock-mcp --headless` never run concurrently on the same workspace (`gui_workspace_active` halt; `"Sync with Headless"` bridges standing orders), while `agent_id` / `MATLOCK_AGENT_ID` isolates concurrent headless swarm lanes.

## 4. Credential, SARIF, Loop-Handoff & Provenance Guarantees
- **Outbound-Only TLS 1.2/1.3 SMTP Alerts (`matlock_list_alerts` / `matlock_trigger_alert` / `matlock-mcp send-alert`)**: SMTP/script secrets stay encrypted in the OS keychain or Argon2id + ChaCha20-Poly1305 headless container vault (`MATLOCK_VAULT_PASSPHRASE`) and render as `***REDACTED***` to agents.
- **Sealed Scripts, Single-File `file:` Qualification, 2-Tier Loop Breaker, SARIF 2.1.0 & Badge**: `matlock_register_sealed_script` and `matlock_qualify_test(file: "<path>")` seal scripts and unit tests in OS storage (`0600` / DPAPI); 2-Tier Loop Breaker writes `< 200`-token `session_handoff.json` work orders on stalled coordinates; provisioned `matlock-mcp scan . --format=sarif` emits OASIS `SARIF 2.1.0`; boundary verification (`matlock_run_sequence(id: "seq_matlock", cold_box: true)`) returns `pr_verification_badge` (`https://matlock.dutchp2p.com/badge/verified.svg`).
- **Discovery**: `https://matlock.dutchp2p.com/agents.md` · `https://matlock.dutchp2p.com/en/pricing.md` · `https://matlock.dutchp2p.com/.well-known/api-catalog` · `https://matlock.dutchp2p.com/.well-known/agent-skills/index.json` · `https://matlock.dutchp2p.com/.well-known/mcp/server-card.json` · `https://matlock.dutchp2p.com/en/eula`