The Pit's claim is narrow and checkable: every pick was sealed on-chain before its deadline, and no revealed pick differs from what was sealed. The broadcast is decoration; the registry is the product. Here is the whole audit, no credentials required:
It talks to a public devnet RPC, enumerates every Strategy and Commitment account on the registry program, decodes the raw bytes, and prints a PASS/FAIL table. No API keys, no env vars, under three minutes.
commit_signalrejects any commitment whose clock is at or past its event deadline. The main event's picks were sealed roughly twenty hours before kickoff — the account's committed_atis set by the chain's clock, not ours.reveal_signal recomputes keccak256 of the submitted payload on-chain and rejects a mismatch. There is no instruction to edit or delete a commitment. Hiding a bad call is impossible; it just stays sealed and unrevealed, which the cadence meter counts against you.The program cannot check how a pick was computed — the engines run off-chain (TEE attestation is the honest roadmap answer, not a claim we make today). It cannot stop someone registering many strategies and promoting the lucky one — but registration is public, cadence promises are public, and an abandoned sibling strategy is visible forever. Replay rounds are labelled REPLAY: their commitments were sealed after the matches ended, as their on-chain timestamps plainly show. Only the main event was sealed before its own kickoff.
Registry program: 8GcrsgwxH4p4DzdBimyApwMex1DRwve8j3XiMWN9WbaD
pit/steamer/v1|lookbackH=6|pickBy=max-prob-delta|totals=steam-side|late=goals-lambda+steam — keccak of this exact string is the on-chain params_hash; the verifier recomputes it.pit/quant/v1|model=poisson|supremacy=ah-even-line|total=primary-ou|pickBy=max-model-edge|late=lambda*19/94*1.25 — keccak of this exact string is the on-chain params_hash; the verifier recomputes it.pit/heel/v1|lookbackH=6|pickBy=min-prob-delta|totals=fade-steam|late=fade-crowd — keccak of this exact string is the on-chain params_hash; the verifier recomputes it.All evidence links are account links (devnet purges transaction history in days; accounts persist). Raw transaction JSON is archived in evidence/tx/ in the repo.
This registry wasn't deployed for tonight. Two earlier strategies have been committing odds-dislocation signals to the same program since early July — the verifier lists them as hash-only entries (their payloads live in the older repo). The mechanics you're auditing tonight have a month of history.