Discovery and reuse

This is a gate, not a guideline. It runs before creating or modifying any /p/ or /r/ code, and again before deployment.

It exists because it was once skipped: vault and bounties were built against a curated genesis set and skill references rather than a full chain enumeration. The retroactive review found a RELATED fee-calculation package that could have been imported. Nothing was broken by the miss — but nothing guaranteed that either.

The mandatory gate

1. Search Cosmic Bull's own catalog — catalog/.
2. Search all existing Cosmic Bull /p/ and /r/ sources — the working trees in this repository, not just the catalog summaries.
3. Search on-chain Gno — enumerate the target chain's packages (/p/ and /r/), then inspect the plausible candidates. Enumeration is cheap; guessing is not.
4. Search the public Gno / GitHub ecosystem — the pinned examples tree and public repositories, where relevant.
5. Classify every hit.
6. Reuse where appropriate — prefer composition over new infrastructure.
7. Document the evidence in a committed DISCOVERY.md.
8. Repeat before deployment — the chain moves between the start of an application and its deploy.

Classification

Every hit gets exactly one label:

A RELATED hit that is not reused must carry a concrete reason. Acceptable: "takes creator/hunter as string parameters — a designation-forgery shape"; "accounting-only, shows no real-coin custody"; "marked v0 Unaudited". Not acceptable: "different approach", "cleaner to write our own".

Language discipline

Never claim ecosystem-wide uniqueness from a finite search.

Use exactly this phrase:

"No relevant existing implementation was found in the searched sources."

Not "nobody has built this". Not "this is the first". The search is finite, keyword- and path-based, and the chain moves. The phrasing has to carry that.

Every DISCOVERY.md must also state its search-confidence limits — what was enumerated exhaustively, what was sampled, and what was not searched at all.

DISCOVERY.md — required contents

A discovery record is committed alongside the application source. It must record:

• Search date
• Target chain enumeration / reference — what was enumerated, and how many packages
• Cosmic Bull catalog searched
• Cosmic Bull /p/ and /r/ sources searched
• Public Gno / GitHub sources searched
• Relevant implementations found — each one named and located
• Classification of each
• Reuse decisions and reasons — including concrete reasons for not reusing a RELATED hit
• The cautious novelty statement, verbatim
• Search-confidence limits

service_registry was the first application to ship one — 12 related implementations found and individually classified. It is the model for subsequent applications.

Reuse outcomes in this portfolio

Reused:

• p/nt/avl/v0 — ordered iteration, under feeledger
• p/nt/markdown/sanitize/v0 — adopted by bounty_panel, duebook_demo, grants, market, permbook_demo, service_market, service_registry and subscriptions. In service_registry this was a security fix (Y5): it replaced a hand-rolled sanitizer that permitted markdown link/image phishing.
• feeledger — reused by bounties, bounty_panel, coindemo, grants, market, service_market, subscriptions, vault
• coinio — reused by bounty_panel, coindemo, grants, market, service_market, subscriptions — the deployed bounties and vault v1s predate coinio; only their undeployed local vNext trees import it

(All three lists reconciled 2026-09-23 to the chain-computed consumed_by in catalog/portfolio.json, which C7 re-proves against the chain's own declared imports on every verifier run — replacing a 2026-09-22 hand-grep whose coinio membership had wrongly included the deployed bounties and vault.)

Built new, with recorded reasoning: feeledger, coinio, duebook, permbook. See catalog/primitives.md.

Found and deliberately not reused, with reasons recorded:

Known limits of the search

Stated so that no reader over-reads the results:

• Search is keyword- and path-based. A package solving the same problem under an unrelated name can be missed.
• Chain enumeration is exhaustive at the moment it runs — the chain grows (190 /p/ + 434 /r/ at one audit, up from an 85-package genesis; 626 packages at the fee_split gate). Re-enumerate per build.
• GitHub-wide sweeps are best-effort, not exhaustive.
• The pinned examples/ tree is a snapshot; packages added or removed upstream since the pin are not reflected, and the live testnet may not carry a listed package at all.

Verify every intended import against the target chain, not just against upstream master.