Direct-link checks: bounded financial counterparty comparison

The standard and nested signature components together cover 383 counterparty order appearances in 95 trade transactions (98 condition financial transactions including three merges). There are 382 distinct counterparty order digests and 172 recovered authorizing keys. These ordinary market counterparties are not alleged Car associates or attackers. No exact match to the retained target or role-aware discovery lists was found.

From the extracted ZIP root, run:
  python3 root/check_july_counterparty_links.py nested-signatures root root/ATTACKER-COMPARISON-TARGETS.json --check
  python3 nested-signatures/verify_nested_signatures_offline.py --check
  python3 root/combine_july_links.py . --check
  python3 root/check_standard_controls.py nested-signatures
  python3 attacker-origin/verify_origin_bundle.py

The package places the previously public financial RPCs, headers and crypto helper under nested-signatures once. It also places the old JULY3-FINANCIAL-PUBLIC-VERIFIED.json there as a source-selection/Car-order cross-check. All four hashes are bound by the standard replay output. No network or signing is needed for these commands.

The standard replay verifies exchange domain/order digest, the actual positive OrderFilled event, maker and filled fields, receipt/header bindings and public signature recovery. It retains every counterpart's claimed signer separately from recovered authorizing keys. The nested replay additionally verifies ERC7739 framing and the historical execution-block owner and ERC1271 responses. Those calls are end-of-block state, not an independent signing-time observation.

The combined script joins the verified component outputs; it does not replace their cryptographic replays. The selected 26-address comparison is a bounded subset. The 117-address inventory also contains public services and unproved leads; it is not a complete financial network or human-control list. The 18 unique attacker-side inputs likewise preserve actual flow, computed-only and potentially independent payer roles.

The positive control temporarily adds one known ordinary counterparty key to test detection. It is not an attacker label. Altered actual signature parity is rejected as verified even though recovery under a different key is mathematically possible. Sources and target lists remain unchanged after the controls.

Source consistency, public key recovery and successful historical calls do not independently authenticate chain consensus, a person's identity, consent, intent, private sessions or an exploit relationship. No new Car–drainer connection is established by this bounded comparison.
