# transient-digest-to-ledger

> Terminal ledger data is constructed using an upgrade-unstable transient hash or commitment.

Canonical: https://nightshade.dicksonwu.xyz/rules/transient-digest-to-ledger.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `transient-digest-to-ledger` |
| Severity | low |
| Confidence | low |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Privacy and cryptographic derivations |
| Engine facts used | transient-data-origins, state-writes, completed-entries |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors transient-digest-to-ledger
./.nightshade/node_modules/.bin/nightshade detector show transient-digest-to-ledger
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.

| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
| ---: | ---: | ---: | ---: | ---: |
| 1/1 | 1/1 | 1/1 | 0/0 | 0 |

No deviations were recorded for this rule.

These are behavior checks on synthetic fixtures, not a precision or recall estimate. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/transient-digest-to-ledger.md at v0.1.1.

Availability: **opt-in**, no policy required. Severity/confidence: **low/high**.
Select with `--detectors transient-digest-to-ledger`.

The standard library documents that `transientHash` and `transientCommit` lack
upgrade stability and should not derive state data. This rule reports a terminal
modeled ledger operand constructed using either authenticated native primitive.
It groups each primitive source site and entry, listing affected writes and
invocations. It does not establish an actual upgrade failure, secrecy requirement,
concrete feasibility or vulnerability.

```compact
export ledger fingerprint: Field;
export circuit register(value: Field): [] {
  fingerprint = disclose(transientHash<Field>(value));
}
```

A fingerprint that must be recomputed after a compiler/protocol upgrade needs
a stable derivation. Use `persistentHash` or `persistentCommit` over stable inputs
when that is the required lifecycle. Changing an existing representation requires
an explicit migration. A persistent hash around a transient result still depends
on the transient algorithm. Intentional version-bound state, ephemeral caches and
compiler disclosure tests can match, so this compatibility review remains opt-in.

The origin annotation describes syntactic data derivation, independently of
private inputs. It survives modeled arithmetic, casts, helpers, snapshots and
aggregate construction; projecting another aggregate member does not inherit an
unrelated origin. Ambient control guards and arbitrary witness callback arguments
do not establish data derivation. Consistency-only assertions, return/event-only
outputs, namesake user functions, persistent-only derivations and definite final
overwrites stay quiet. Origins do not establish value equality or live storage.

Exact bounded observations are isolated from baseline analysis. Native hashes
and commitments, ordinary storage operands and Map keys/values are supported.
The observer disables compressed folds/hash choices and retains the original
40,000-step/256-path/50,000-value limits. Origins are limited to128 source sites;
the consumer shares200,000 applicability/lifetime/grouping checks. May-value
origins, wildcard/may-alias or partial overwrites, unsupported List/Merkle payload
lifetimes and exhaustion produce explicit rule/entry-scoped incomplete diagnostics.
Set removal after a transient-derived insertion is unavailable: whole-Set writes
do not expose enough element lifetime evidence. A final exact reset can discharge
an earlier uncertain operand. Other rules and baseline completion remain separate.
This does not track arbitrary TypeScript witness code or cross-entry upgrades.

Compiler acceptance and analyzer behavior are validated separately. The rule
does not establish application recall or an upstream defect.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line transient-digest-to-ledger -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/transient-digest-to-ledger.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#privacy-and-cryptographic-derivations)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)