Reclaim external-market SDK#

The maintained Reclaim path uses a standalone verifier program plus Seesaw V1 semantic instructions:

The former 0x38..0x3F, 0x4A..0x4C, and 0x4F bridge instructions are permanent tombstones. SDKs do not expose builders for them.

Proof submission#

Use @seesaw/reclaim to parse a raw-proof schema-V2 envelope and buildReclaimV1Plan from @seesaw/core to construct the deterministic staged plan. The plan:

1. creates a verifier-owned proof buffer committed to exact length and SHA-256;
2. writes contiguous bounded chunks;
3. finalizes the buffer, making it immutable; and
4. invokes one Seesaw V1 instruction that verifies and consumes the receipt through CPI before changing the market.

Do not add a secp256k1 or Ed25519 signature-precompile instruction. The verifier calls Solana's secp256k1_recover syscall internally. Do not pass the Instructions sysvar.

Every account owner, version, PDA, verifier program/config identity, active snapshot, proof hash, market policy, and receipt binding must be read and validated before signing a stage. Refresh finalized state after each submitted stage; local progress is not authoritative.

Verifier config initialization additionally requires the canonical read-only ProgramData PDA for the pinned verifier program. The writable initializer must be that ProgramData account's current upgrade authority; the onchain verifier rejects arbitrary first callers, wrong loader ownership or layout, and an immutable program before it creates the config PDA.

Semantic binding#

V1 supports only reviewed Kalshi V3 conditions. The market policy commits the exact descriptor and semantic-policy hashes. The signed context binds deployment, Seesaw program, market, purpose, source, source market ID, template hash, and version. Resolution derives YES, NO, or VOID from the exact matched terminal condition; callers never supply an outcome or fact hash.

Polymarket Gamma is not a supported settlement source. A future implementation must bind authoritative Polygon CTF/UMA state under a separately versioned policy.

Trust statement#

Applications must display the exact limitation:

Reclaim attestor signatures are verified onchain; Google TEE and underlying zkTLS verification remain offchain.

The initial epoch policy is threshold one. Runner and keeper services are untrusted proof-generation and relay conveniences; possession of valid proof bytes is sufficient for permissionless submission.

For service setup, see the self-hosted Reclaim runner.