Status
Functional alpha. Testnet verified. Unaudited.
Gauge reads real Horizon data and produces real findings. It is also early: seven of sixteen rules are live, there is no tagged release, and every observation below comes from testnet. This page records what was run, when, and what it does not prove.
Implementation matrix
| Component | State | What that means |
|---|---|---|
| strict policy loader | Shipped | Unknown keys, duplicate accounts, bad values and secret seeds are rejected with exit 2. |
| Horizon source | Shipped | Timeouts, a 1 MiB cap, retries, bounded concurrency, no redirects and a passphrase check before any account read. |
| check and audit | Shipped | Text and JSON output, a stable exit code, and the limits footer on every report. |
| rules | 7 of 16 | The account, flag and identity families work. Signer and threshold rules are specified but not registered. |
| role severities | Not shipped | Every live rule uses its baseline severity. Task 3.4. |
| SEP-1 identity checks | Shipped | The home domain an account publishes is fetched through a dial-time address guard, and an identity Gauge could not verify is a warning rather than a pass. Never run against a live domain. |
| tagged release | None | No version is tagged and no artifact is signed. Build from source. |
| this documentation site | Live | Static pages deployed from the repository by GitHub Actions. Task 5.9. |
"Shipped" means the code is merged and covered by tests, not that it has been audited or used on mainnet.
Fail-closed behavior
A run either produces a report it trusts or refuses to produce one. These cases are exercised by the CLI tests, including gate G3.
| Condition | Exit | Report |
|---|---|---|
| Endpoint unreachable | 3 | No report. The source failed. |
| Oversized response | 3 | No report. The body cap was hit. |
| Malformed JSON | 3 | No report. Strict decode failed. |
| Wrong network passphrase | 1 | Report with acct-network-mismatch. No account was read. |
| Account absent (404) | 1 | Report with acct-missing for that account. |
| Unknown policy key | 2 | No report. The policy is rejected before any request. |
| Secret seed in the policy or arguments | 2 | No report, and the seed is never echoed. |
| Missing policy file | 2 | No report. |
| Rule panic | 3 | Report with src-rule-panic; the account's result is incomplete. |
| Identity fetcher will not build | 3 | No report. The stage never started. |
| Home domain resolves to a blocked address | 0, or 1 under --fail-on warn | Report with id-toml-unreachable. Nothing was dialed, and the document is not quoted. |
A non-zero exit is the expected behavior for the first three rows. Treating exit 3 as a flaky pass is the failure mode this design tries to prevent.
Testnet evidence
These runs were made against https://horizon-testnet.stellar.org on 2026-10-30 and again on 2026-11-02. Ledger numbers are the endpoint's latest ledger at read time. Testnet resets, so a later run may not find the same accounts.
| Account or request | Ledger | Result |
|---|---|---|
| GBK4NFJ7…UKE7M3 | 5467515 | Exit 0. Facts printed, limits footer present. |
| GC2HHIM6…43LO2II (unfunded) | 5467749 | Exit 1. acct-missing. |
| Mainnet requested from the testnet endpoint | 5467749 | Exit 1. acct-network-mismatch; no account read. |
GDSX2WUF…UVBEVG, --fail-on warn |
5467759 | Exit 1. flag-undeclared-clawback. |
GDSX2WUF…UVBEVG again on 2026-11-02, --fail-on warn |
5517199 | Exit 1. Same finding; this run is the report excerpt on the overview page. |
What this does not prove. Mainnet was not probed, per the project's testnet-only verification decision. A mainnet account can have a different population of flags or signer shapes than the fixtures here. The committed Horizon fixtures are testnet captures and are marked perishable for the same reason.
Roadmap position
46 of 77 tasks across Phases 0 to 6 are done.
G3, fail-closed tests, is green. The rest are open.
Account, flag and identity rules. Role severities are open.
No tag, no signed artifact, no attestation yet.
Phase 3 is 3 of 7. The signer and threshold rules are blocked by task 0.7, which needs a transaction submission that Gauge forbids itself to make. The guarded SEP-1 fetcher and its three identity rules landed on 2026-11-03. Read the full roadmap.
Security and project hygiene
- OpenSSF Scorecard runs on every push to main and weekly; the README badge reports its current score.
- Dependabot watches the Go module and the pinned GitHub Actions.
govulncheck,staticcheckandgo vetrun in CI.- No secret is accepted, stored or echoed. A seed found anywhere in a policy is a hard failure.
- The repository has a security policy and a private reporting route. Read SECURITY.md before reporting.
Passing checks are not an audit. No third party has reviewed this code, and the project says so in every banner and release note.
The boundary
Gauge reads public ledger state only. It cannot see who holds a key, whether signers are separate people, or off-chain controls. Report limits footer
A clean report is a posture result, not proof that the account cannot be compromised. A failing report is evidence of a disagreement, not necessarily an incident. Read both with the policy file open beside them.