TRUST GROUNDING — Complete Citation Map

Every fact the app uses is listed here with its source, confidence, where it enters the code, and what breaks if it's wrong. If a fact is not in this document, the app must not assert it.

Live classification frame: PROMPT_VERSION=trust-v8 — cited facts + privacy / authorization / composability invariants. High-level: GROUNDING.md.

How to read this document

Each entry follows the same structure:

FACT: what the app treats as true
SOURCE: primary URL
AS_OF: date verified
CONFIDENCE: verified | self-reported | live-at-scan | inferred | unverifiable
ENTERS CODE AT: where in the codebase this fact is used
IF WRONG: what breaks

Confidence levels:
- verified — confirmed against a primary source (official announcement, GitHub repo, CIP text)
- self-reported — claimed by the entity itself with no independent confirmation
- live-at-scan — pulled from API at runtime; accurate at scan time, may change
- inferred — derived from public patterns (e.g., -da handle suffix); reasonable but not confirmed
- unverifiable — cannot be confirmed or denied from public sources

A. Corporate & funding

FACT: DA raised $355M Series F on Jun 11 2026, led by a16z crypto, ~$2B valuation
SOURCE: https://www.prnewswire.com/news-releases/digital-asset-series-f-2026 
        (also: https://a16zcrypto.com/posts/article/investing-in-digital-asset/)
AS_OF: 2026-06-11
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (context for investor-customer mapping)
IF WRONG: investor-customer pipeline analysis loses its anchor

FACT: DA reports profitability
SOURCE: https://rareevo.io (citing ChainCatcher, Jun 2026)
AS_OF: 2026-06
CONFIDENCE: self-reported — no revenue figures, no P&L disclosed
ENTERS CODE AT: grounding.py (context only — not used in classification)
IF WRONG: low impact — never asserted as verified on dashboard

FACT: Oversubscribed against ~$300M target; final close at $355M
SOURCE: https://ftpartners.com (FT Partners transaction profile)
AS_OF: 2026-06-11
CONFIDENCE: verified
ENTERS CODE AT: grounding.py
IF WRONG: minor — framing detail only

B. Leadership

FACT: CEO Yuval Rooz (co-founder)
SOURCE: https://www.digitalasset.com/about
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (context)
IF WRONG: low impact

FACT: CPO Bernhard Elsner — CIP-0112 co-author
SOURCE: https://www.digitalasset.com/about (title)
        https://github.com/canton-foundation/cips/blob/main/cip-0112/cip-0112.md (authorship)
AS_OF: 2026-07-22
CONFIDENCE: verified (both sources)
ENTERS CODE AT: grounding.py (used in discrepancy detection — proposals touching V2 are flagged for CPO relevance)
IF WRONG: high impact — V2 analysis misdirected

FACT: CTO Ratko Veprek
SOURCE: https://www.digitalasset.com/about
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (context)
IF WRONG: low impact

FACT: CBDO Kelly Mathieson (26 yrs JPMorgan, 3 yrs Goldman)
SOURCE: https://www.digitalasset.com/about
        https://www.sifma.org/people/kellymathieson (Goldman confirmed)
AS_OF: 2026-07-22
CONFIDENCE: verified (two independent sources)
ENTERS CODE AT: grounding.py (context — turf note on engagement model)
IF WRONG: low impact

FACT: Head of Network Strategy Eric Saraniecki (co-founder)
SOURCE: https://www.digitalasset.com/about
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (context — governance CIP authorship)
IF WRONG: medium — misattributes governance strategy

C. GitHub handle attributions

FACT: meiersi-da = DA employee (Simon Meier)
SOURCE: https://github.com/meiersi-da (profile); -da suffix pattern; CIP-0112 authorship
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (is_da_author), grounding.py
IF WRONG: DA-voice metric false positive

FACT: bame-da = DA employee
SOURCE: https://github.com/bame-da (profile); -da suffix; PR #238 (CIP-0104 FA weights, merged)
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (is_da_author)
IF WRONG: DA-voice metric false positive

FACT: moritzkiefer-da = DA employee (Moritz Kiefer)
SOURCE: https://github.com/moritzkiefer-da (profile); -da suffix; PR #218
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (is_da_author)
IF WRONG: DA-voice metric false positive

FACT: Stephan-da = DA employee
SOURCE: https://github.com/Stephan-da (profile); -da suffix; Wallet Gateway PR #109
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (is_da_author)
IF WRONG: DA-voice metric false positive

FACT: waynecollier-da = DA employee (Wayne Collier)
SOURCE: Contributor graph (7 commits to dev-fund main); -da suffix
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (is_da_author) — MUST BE ADDED (missing in current code)
IF WRONG: DA ops presence undercounted

FACT: hrischuk-da = DA employee
SOURCE: Contributor graph (3 commits to dev-fund main); -da suffix
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (is_da_author) — MUST BE ADDED
IF WRONG: DA ops presence undercounted

FACT: davidrichards-da = DA employee
SOURCE: Contributor graph (2 commits to dev-fund main); -da suffix
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (is_da_author) — MUST BE ADDED
IF WRONG: DA ops presence undercounted

FACT: hythloda = Amanda L Martin, Canton Foundation staff (NOT DA)
SOURCE: https://github.com/hythloda (profile: Organization = Canton Foundation)
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: scanner.py (classify_author → "foundation", NOT "da")
IF WRONG: DA-voice metric false positive; governance distinction erased

FACT: pedrodneves = Foundation ops/admin role
SOURCE: Contributor graph (14 commits, batch normalization PR #461)
AS_OF: 2026-07-22
CONFIDENCE: inferred — no profile org; role inferred from commit pattern
ENTERS CODE AT: scanner.py (classify_author → "foundation")
IF WRONG: low impact — commit pattern is clear but org unconfirmed

FACT: bstolman1 = anonymous, no verifiable affiliation
SOURCE: https://github.com/bstolman1 (no name, no org, no bio)
AS_OF: 2026-07-22
CONFIDENCE: unverifiable — earlier claim "= Eric Saraniecki" is WRONG and withdrawn
ENTERS CODE AT: NOT in any handle list — classified as "external"
IF WRONG: n/a — no assertion made

D. Standards & CIPs

FACT: CIP-0056 (Token Standard V1) — status: Final — authors: Meier, Limberto, Kiefer
SOURCE: https://github.com/canton-foundation/cips (registry README, CIP-0056 row)
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (standard spec authority)
IF WRONG: high — misattributes spec ownership (earlier drafts incorrectly said "likely Elsner/Meier")
NOTE: Elsner co-authored V2 (CIP-0112), NOT V1

FACT: CIP-0112 (Token Standard V2) — status: Approved — authors: Bernhard Elsner, Simon Meier
SOURCE: https://github.com/canton-foundation/cips/blob/main/cip-0112/cip-0112.md
        https://ccpedia.xyz/cips/0112 (confirmed Approved since 2026-06-12)
AS_OF: 2026-06-12
CONFIDENCE: verified (both registries now agree)
ENTERS CODE AT: grounding.py (discrepancy detection — proposals claiming V2 compliance checked against spec)
IF WRONG: high — V2 is the SDK PM's central standard
NOTE: earlier specs said "Approved/Draft conflict" — resolved; both show Approved

FACT: CIP-0117 (Logical Synchronizers) — status: Approved — min Splice 0.6.5
SOURCE: https://github.com/canton-foundation/cips/blob/main/cip-0117/cip-0117.md
AS_OF: 2026-06-05
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (upgrade-cost context)
IF WRONG: medium — upgrade timeline misstated

FACT: CIP-0086 — REST/gRPC ERC-20 middleware standard
SOURCE: https://github.com/canton-foundation/cips/blob/main/cip-0086/cip-0086.md
AS_OF: 2025-10-20
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (alignment risk detection)
IF WRONG: medium
NOTE: JSON-RPC facade and MetaMask compatibility are ChainSafe PRODUCT features (per blog.chainsafe.io), NOT part of the CIP text. Earlier specs conflated the two.

FACT: CIP-0100 — OSS Maintainers can block contributions through OSS governance processes, separate from dev fund governance
SOURCE: https://github.com/canton-foundation/cips/blob/main/cip-0100/cip-0100.md
AS_OF: 2026-01-14
CONFIDENCE: verified — direct quote from the CIP text
ENTERS CODE AT: grounding.py (the "hidden veto" — proposals requiring core repo changes vs standalone tools)
IF WRONG: critical — the entire alignment-leak thesis rests on this distinction

E. Network scale

FACT: 57 Super Validator nodes
SOURCE: https://canton.foundation/about-the-foundation/ (homepage: "57 Super Validator Nodes")
AS_OF: 2026-06-26
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (SV count for weight concentration analysis)
IF WRONG: medium — concentration ratio calculation uses this denominator
NOTE: earlier specs said "45+" — stale by ~12 nodes

FACT: Broadridge DLR: $7.5T monthly volume, $357B ADV
SOURCE: https://www.prnewswire.com (Broadridge DLR Jun 2026 release, published 2026-07-07)
        https://www.ledgerinsights.com (2026-06-11: "more than $7 trillion monthly")
AS_OF: 2026-07-07
CONFIDENCE: verified (two sources)
ENTERS CODE AT: grounding.py (network scale context)
IF WRONG: embarrassing — most-cited ecosystem metric; earlier spec said ">$1T/month" (7x stale)

FACT: DTCC first live production trades Jul 15 2026, 30+ firms (~38 named)
SOURCE: https://www.dtcc.com/digital-assets/tokenization/live-production-trades
AS_OF: 2026-07-15
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (production milestone)
IF WRONG: medium
NOTE: earlier specs said "40+ firms" — DTCC's own language is "more than 30"

FACT: DTCC settles across Besu AND Canton with Chainlink CCIP
SOURCE: https://www.dtcc.com/digital-assets/tokenization/live-production-trades
AS_OF: 2026-07-15
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (competitive context — Canton is a rail, not the rail)
IF WRONG: high — misframes Canton's competitive position

FACT: DTCC selected Stellar as public blockchain rail, targeting H1 2027
SOURCE: https://www.dtcc.com/news/2026/may/27/tokenization-service-to-connect-with-stellar-public-blockchain-as-dtc-advances-multi-chain-strategy
AS_OF: 2026-05-27
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (competitive context)
IF WRONG: medium — multichain framing

F. Foundation governance

FACT: Canton Foundation (formerly GSF) rebranded Sep 22, 2025
SOURCE: https://canton.foundation/the-gsf-is-now-canton-foundation/
AS_OF: 2025-09-22
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (timeline context)
IF WRONG: low — but shows stale research if wrong in an interview
NOTE: earlier specs said "Jan 2026" — wrong

FACT: DTCC co-chairs the Foundation alongside Euroclear
SOURCE: https://canton.foundation/about-the-foundation/
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (governance context)
IF WRONG: medium — misrepresents governance structure

FACT: Dev fund: 5% of CC emissions, per CIP-0082/CIP-0100
SOURCE: https://github.com/canton-foundation/cips/blob/main/cip-0082/cip-0082.md
        https://canton.foundation/canton-foundation-launches-protocol-development-fund/ (2026-02-19)
AS_OF: 2026-02-19
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (funding mechanism)
IF WRONG: high — entire dev-fund analysis depends on this

FACT: CC reward split: 62% Featured Apps, 20% SVs, 15% users, 5% dev fund
SOURCE: CIP-0104 (app rewards), CIP-0096 (liveness killed Apr 30 2026), CIP-0105 (SV locking)
        https://github.com/canton-foundation/cips/blob/main/cip-0104/cip-0104.md
AS_OF: 2026-04-30 (post CIP-0096)
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (incentive structure for CC-optimization detection)
IF WRONG: critical — entire "follow the money" analysis depends on these percentages

G. Governance automation (from .github/workflows/)

FACT: sig-label-check.yml enforces SIG label taxonomy in CI
SOURCE: https://github.com/canton-foundation/canton-dev-fund/tree/main/.github/workflows
AS_OF: 2026-05-27
CONFIDENCE: verified — executable code
ENTERS CODE AT: grounding.py (governance rules)
IF WRONG: n/a — it's code; either it runs or it doesn't

FACT: champion-check.yml enforces champion requirement in CI
SOURCE: same workflows directory
AS_OF: 2026-07-15
CONFIDENCE: verified — executable code
ENTERS CODE AT: grounding.py
IF WRONG: n/a

FACT: aipricheck.yml — Foundation runs its own AI PR classifier
SOURCE: same workflows directory
AS_OF: 2026-07-15
CONFIDENCE: verified — executable code
ENTERS CODE AT: grounding.py (positioning context — scanner complements, doesn't duplicate)
IF WRONG: n/a

H. Ecosystem actors

FACT: OpenZeppelin — 24-month Canton Contracts Library grant, PR #262 (merged 2026-05-14)
SOURCE: https://github.com/canton-foundation/canton-dev-fund/pull/262
AS_OF: 2026-05-14
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (spec↔implementation seam)
IF WRONG: medium — OZ relationship misframed
NOTE: earlier specs called this a "Year 2 proposal" — it's a single 24-month grant

FACT: Zenith — Tier-1 SV; EVM-on-Canton in controlled test environment; MainNet not live as of Jul 2026
SOURCE: https://www.theblock.co/post/394288 (2026-03-19)
AS_OF: 2026-03-19
CONFIDENCE: verified (test environment)
ENTERS CODE AT: grounding.py (polyglot context)
IF WRONG: medium — overstating readiness
NOTE: "100k+ transactions" and "400ms-1.5s latency" are from the test environment, not production. Earlier specs presented these as "live EVM atomic swaps."

FACT: Zenith multi-VM work is dev-fund funded
SOURCE: /proposals/2026-02-Zenith-...multi-VM-capable-Canton.md (in proposals directory)
AS_OF: 2026-02
CONFIDENCE: verified — proposal file exists in funded directory
ENTERS CODE AT: grounding.py (polyglot fragmentation is now funded, not hypothetical)
IF WRONG: low

FACT: Polyglot Canton whitepaper dated February 2025
SOURCE: https://www.canton.network/hubfs/Canton%20Network%20Files/whitepapers/Polyglot_Canton_Whitepaper_11_02_25.pdf
AS_OF: 2025-02
CONFIDENCE: verified — PDF date
ENTERS CODE AT: grounding.py (polyglot timeline)
IF WRONG: low — date confusion doesn't affect analysis
NOTE: filename `11_02_25` = Feb 11, 2025 (DD_MM_YY). Earlier specs said "Nov 2025" — wrong.

FACT: Rust SDK for Canton (#407) — merged, funded, by Nodejumper
SOURCE: dev-fund pulse (Jun-Jul 2026 period); PR #407
AS_OF: 2026-07
CONFIDENCE: verified
ENTERS CODE AT: grounding.py (polyglot fragmentation — now a funded third-party Rust SDK)
IF WRONG: medium — polyglot thesis loses a concrete anchor

I. DA self-funding through the Foundation

FACT: 13 of ~24 funded proposals are DA-prefixed (54%), including:
  DA-canton-oss-maintenance, DA-splice-oss-maintenance, DA-daml-open-source,
  DA-token-standard-v2, DA-Logical-Synchronizer-Upgrades, DA-ISS-based-BFT,
  DA-scalability_performance_robustness
SOURCE: https://github.com/canton-foundation/canton-dev-fund/tree/main/proposals (file listing)
AS_OF: 2026-07-22
CONFIDENCE: verified — deterministic from filename prefix
ENTERS CODE AT: dashboard (DA self-funding stat); grounding.py (nuances ownership map)
IF WRONG: high — changes the narrative about who funds what
NOTE: this means "DA solely maintains X" is true for code authority, but the Foundation PAYS for it. The dev fund is partially DA's operating budget routed through neutral governance.

J. Repo metrics (live-at-scan)

FACT: Dev-fund repo — 188 open PRs / 219 closed / 407 total
SOURCE: https://api.github.com/repos/canton-foundation/canton-dev-fund/pulls
AS_OF: 2026-07-22
CONFIDENCE: live-at-scan — changes with every PR
ENTERS CODE AT: scanner.py (scan scope); dashboard (stats strip)
IF WRONG: n/a — refreshed every run
NOTE: earlier specs assumed "~40-60 open" — wrong by 3x

FACT: Dev-fund repo — 127 open issues, 83 active in Jun-Jul period
SOURCE: GitHub pulse page (monthly view)
AS_OF: 2026-07-22
CONFIDENCE: live-at-scan
ENTERS CODE AT: deep_scan.py (issues layer) — MUST BE ADDED (currently missing)
IF WRONG: n/a — refreshed every run
NOTE: issues are 3x PR volume; milestone tracking lives here

FACT: Dev-fund repo — 266 forks
SOURCE: https://github.com/canton-foundation/canton-dev-fund (repo header)
AS_OF: 2026-07-22
CONFIDENCE: live-at-scan
ENTERS CODE AT: deep_scan.py (fork radar) — MUST BE ADDED
IF WRONG: n/a

FACT: Proposal lifecycle board = projects/3/views/1, NOT projects/5
SOURCE: https://github.com/canton-foundation/canton-dev-fund README ("Proposal Lifecycle Board" link)
AS_OF: 2026-07-22
CONFIDENCE: verified
ENTERS CODE AT: board_scan.py (GraphQL target)
IF WRONG: queries wrong board — pipeline state is garbage
NOTE: projects/5 = "Dev Fund Milestones" (delivery tracking, not intake)

Trust rules for the LLM

These rules go at the top of the system prompt, before any facts:

TRUST RULES:
1. You may ONLY assert facts listed in the grounding context below.
2. Every grounding fact has a [source] and [confidence] tag. Carry both into your response.
3. If confidence is "self-reported" or "inferred", state that in your classification.
4. If confidence is "unverifiable", do not use the fact in severity or action decisions.
5. Do NOT use your training knowledge about Canton, Digital Asset, or any institution.
6. If a question cannot be answered from the grounding context + the PR content provided, respond "insufficient data."
7. Never guess institutional affiliations. Only use verified_affiliations from GitHub profiles or -da handle suffix.
8. When citing a grounding fact in your response, include its source URL.

Live product versions (step 1): da_product_context.refresh_product_context() appends
CURRENT DA PRODUCT VERSIONS from GitHub (Canton releases, Daml/Splice tags). These are
ground truth / auto-refreshed, not hand-curated CITED_FACTS — they do not carry
confidence tags. They must never become classification cards.

Seam signals (step 2): regex on the last 3 Canton release bodies (0 extra API calls)
appends RECENT SEAM SIGNALS — new API, deprecations, breaking/migration, CIP refs,
min-version, protocol/Ledger API markers. Code only; not LLM.

Daml backlog health (step 3): 3 Search API count queries (open, help wanted,
older than 1yr). Rendered as the dashboard Reference strip and a short
grounding note. Canton/Splice backlogs are labeled not GitHub-visible. Never cards.

Upcoming Canton changes (step 4): fetch UNRELEASED.md (1 REST) + bounded LLM
summary (max 5 items affecting Ledger API / config / deprecations). Injected as
UPCOMING CANTON CHANGES. Skipped on dry-run. Never cards.

Cross-refs (step 5): string-match Foundation card text for digital-asset/daml|canton,
canton-network/splice, @daml/*, and CIP-#### ids that also appear in Canton
release notes. Annotates cards with da_cross_ref; grounding gets CROSS-REFS.
0 API calls.

Product lens (step 6): sdk | ledger | splice — reorders grounding sections and
shapes the Reference strip for each TPM. Classification targets unchanged.
Config product_lens · scanner.py --lens. Distinct from Approval-chains lens.

Architectural invariants (trust-v8): classification frame tests every proposal against
Elsner's three invariants — privacy, party-based authorization, composability
(PATCH_privacy_architecture_first.md).
violated → critical; at_risk → ≥ watch. sdk_impact and discrepancy types remain.
Pre-scan keyword flags (EVM/ZKP/ERC-20 language) inject into the per-PR prompt; LLM judges.

See ARCH_NOTE_da_repos_as_context.md.

How to maintain this document

After every scan run, grounding_check.py compares CITED_FACTS against:
- Live API responses (PR counts, fork counts, contributor lists)
- Any new CIP status changes
- CC price (for feasibility-gap correlation)

Flag any fact where the live value differs from the grounded value by >10%. Print the diff. Update this document. The grounding is only as trustworthy as its freshness.