# OpenYield State — state-v2
Generated: 2026-08-19
Milestone: v0.7 (Fraternal Groups Foundation) — COMPLETE
Tag: v0.6.6 (milestone release)
Ingested as: oy-state

> This is the **only** document the ciagent sends to the product owner (PO)
> to communicate current project state. The PO reads it before editing
> `oy-spec`. `oy-spec` and `oy-state` are the only two docs that cross the
> PO<->ciagent boundary; all other `.ciagent/oy/*.md` files are ciagent-internal
> working memory.
>
> Regeneration rule: the ciagent regenerates this file at every milestone ship
> AND at P0 of the next milestone if `oy-spec` changed since the last `oy-state`.
> `oy-state` is authoritative for "what exists"; PROJECT.md is internal working
> memory.

## 1. Current position
- Last shipped: v0.7 (Fraternal Groups Foundation) — COMPLETE — tag v0.6.6 (release_id 789)
- Next queued: none — awaiting `oy-spec` §7 v0.8 (Risk Mitigations + Infrastructure Economics, REQ-067..REQ-097)
- Release forge: Gitea (git.cloudinit.dev/oy/openyield), release_id 789
- Autonomy: full (decision_confidence_threshold 0.6, clarify_budget 10)
- Open `oy-spec` §8 questions answered by ciagent: 8 (D-074..D-081 — all PO recommendations accepted as binding; see §7)
- v0.7 shipped: P0 → v0.6.0; P1..P5 → v0.6.1..v0.6.5; P6 final → v0.6.6 (= v0.7 milestone release). No separate minor tag (D-008).
- v0.7 milestone type: feature (REQ-046..REQ-066 are feat-class primitives + a small number of test/docs adjuncts)
- v0.7 scope ruling (D-081): §7 is authoritative — v0.7 ships REQ-046..REQ-066 only; Cluster A–E + Infrastructure Economics (REQ-067..REQ-097) all defer to v0.8.
- v0.7 audit (2026-08-19): PASS with 2 fixes applied (config.json milestone v0.6→v0.7 + tag_base v0.5.x→v0.6.x; oy-state header IN PROGRESS→COMPLETE). Reconstruction test PASS. Branch hygiene PASS (all phase/milestone branches deleted; tags preserve history). Commit discipline PASS (128/139 commits have ---ci---; 11 no-ci = 8 merge + 1 PO spec + 2 historical checkpoints; 1 auto-resolved escalation from v0.1).

### Milestone history (compact)
| Milestone | Type | Tag | Status |
|-----------|------|-----|--------|
| v0.1 Foundation Init | feat | v0.0.9 | COMPLETE |
| v0.2 The Mesh | feat | v0.1.5 | COMPLETE |
| v0.3 Bearers & Docs | feat | v0.2.6 | COMPLETE |
| v0.4 Refinement | NFR | v0.3.4 | COMPLETE |
| v0.5 Bearers Runtime | feat | v0.4.8 | COMPLETE |
| v0.6 Nomad Web UI | feat | v0.5.6 | COMPLETE |
| v0.7 Fraternal Groups Foundation | feat | v0.6.6 | COMPLETE |

## 2. Requirement coverage
<!-- Mirror of oy-spec §4. Status: Not started | Skeleton | Runtime | Complete | Deferred | Rejected -->

### Shipped baseline (REQ-001..REQ-045) — per state-v1, unchanged this regeneration
| REQ | Title | Status | Shipped in | Module(s) | Locked? |
|-----|-------|--------|-----------|----------|---------|
| REQ-001 | Enforce Six Principles | Skeleton | v0.1 | x/* | yes |
| REQ-002 | Fee ceiling 0.1% / floor 0.01% / 1-Grain min | Complete | v0.1 | x/feecovenant | yes |
| REQ-003 | Bloom from real production only (Root Basket) | Complete | v0.2 | x/bread, x/bloom | yes |
| REQ-004 | 9 Watchers, 6-of-9 quorum | Complete | v0.1 | x/watcher | yes |
| REQ-005 | Four Freeholder signals | Complete | v0.2 | x/standing | yes |
| REQ-006 | Standing anti-gaming formula | Complete | v0.2 | x/standing | yes |
| REQ-007 | FCFS processing | Complete | v0.1 | x/bearers | yes |
| REQ-008 | OY Chain (Layer 1) | Skeleton | v0.1 | x/* (no app.go yet) | yes |
| REQ-009 | Satellite chains (Layer 2) | Skeleton | v0.2 | x/satellite | no |
| REQ-010 | Exit layer (Layer 3) | Runtime | v0.5 | x/exit, x/bridge | no |
| REQ-011 | Three Councils with Mission Lock | Runtime | v0.5 | x/council | yes |
| REQ-012 | Lexicon compliance | Complete | v0.1 (x/), v0.3 (docs/), v0.6 (web/) | lexicon_meta_test, lexicon_meta_docs, lexicon_meta_web | yes |
| REQ-013 | Bread unit with scale | Complete | v0.1 | x/bread | yes |
| REQ-014 | Three pools of storage | Complete | v0.1 | x/stash, x/vault, x/rootpool | yes |
| REQ-015 | Window primitive | Runtime | v0.2 (skeleton), v0.6 (UI) | x/window | no |
| REQ-016 | Nine Stand types | Skeleton | v0.2 | x/stand | yes |
| REQ-017 | Guilds with free Hand-Passes | Skeleton | v0.2 | x/guild | yes |
| REQ-018 | Four-tier Partner Spectrum | Runtime | v0.5 | x/partner | no |
| REQ-019 | Six bearers via Unified Bearer Layer | Runtime | v0.5 | x/bearers | yes |
| REQ-020 | Six Pacts | Skeleton | v0.2 | x/pact | no |
| REQ-021 | Mesh Bond Market with 8% cap | Runtime | v0.5 | x/bond | yes |
| REQ-022..REQ-045 | (shipped v0.3..v0.6 — see state-v1 §2 for full table) | Complete | v0.3..v0.6 | various | mixed |

### v0.7 — Fraternal Groups Foundation (REQ-046..REQ-066) — Not started
| REQ | Title | Vision § | Priority | Locked? | Status | Target phase |
|-----|-------|----------|---------|---------|--------|--------------|
| REQ-046 | Cover Pool Factory runtime | §16 | High | no | Not started | v0.7/P1 |
| REQ-047 | Cover Pool reserve target floor 1.5× annual contributions | §16 | High | yes | Not started | v0.7/P1 |
| REQ-048 | Cover Pool reserve target ceiling 2.5× (governance-tunable) | §16 | High | no | Not started | v0.7/P2 |
| REQ-049 | Cover Pool Standing gate minimums | §16, §9.3 | High | yes | Not started | v0.7/P1 |
| REQ-050 | Cover-Fee tagging at protocol layer | §16 | High | yes | Not started | v0.7/P1 |
| REQ-051 | Guild Charter + Common Bond requirement | §12 | Medium | yes | Not started | v0.7/P3 |
| REQ-052 | Cover-Charter (SoB, dispute path, gate, holding period) | §16 | High | yes | Not started | v0.7/P2 |
| REQ-053 | Chapter Federation (Parent/Chapter, secession terms, liens) | §12 | High | no | Not started | v0.7/P3 |
| REQ-054 | Mutual Aid Bond (issuance ceiling 1×–3×, coupons in Cover Calls) | §17 | High | yes | Not started | v0.7/P4 |
| REQ-055 | Cover Claims Voucher role + bond + slashing | §9.4, §15 | High | no | Not started | v0.7/P4 |
| REQ-056 | Anti-Capture Bill of Rights v0.2 | §8.2 [3] | High | yes | Not started | v0.7/P5 |
| REQ-057 | Household simplified — no formal Council, one-tap exit | §11 | Low | no | Not started | v0.7/P3 |
| REQ-058 | Confederation Voice — one-Stand-one-Vote, internal bundle | §11 | Medium | yes | Not started | v0.7/P3 |
| REQ-059 | Stand→Pier-customer boundary — escalation rule ($100k per D-074) | §11, §13 | Medium | no | Not started | v0.7/P5 |
| REQ-060 | Shadow vouch partial credit — 50% weight in Freeholder signal | §9.1 | Medium | yes | Not started | v0.7/P4 |
| REQ-061 | Disclaimer cadence — per charter signing | §11 | Low | yes | Not started | v0.7/P3 |
| REQ-062 | Pool governance hybrid (Host + 3 elected + Watcher observer) | §16 | High | yes | Not started | v0.7/P2 |
| REQ-063 | MAB holder — surplus seniority only, no Voice at dissolution | §17 | Medium | yes | Not started | v0.7/P4 |
| REQ-064 | Secession cooling — 21d Cover-active / 14d non-Cover | §4.6 [3] | Medium | yes | Not started | v0.7/P5 |
| REQ-065 | Cover Pool category staging — Phase 2/3/4 | §16 | High | yes | Not started | v0.7/P2 |
| REQ-066 | Pier selection — Guild Council chooses, reversible, Pier Selection Index | §13 | Medium | no | Not started | v0.7/P5 |

### v0.8+ — Risk Mitigations + Infrastructure Economics (REQ-067..REQ-097) — Deferred to v0.8
> All 31 REQs deferred to v0.8 per D-081 (§7 authoritative). Listed here for visibility; not started this milestone.
| REQ | Title | Status | Target milestone |
|-----|-------|--------|-----------------|
| REQ-067..REQ-072 | Cluster A — Trust-minimization attacks | Deferred | v0.8 |
| REQ-073..REQ-076 | Cluster B — Economic structural | Deferred | v0.8 |
| REQ-077..REQ-081 | Cluster C — Capture & centralization | Deferred | v0.8 |
| REQ-082..REQ-086 | Cluster D — Identity & reputation | Deferred | v0.8 |
| REQ-087..REQ-091 | Cluster E — Adoption & organic | Deferred | v0.8 |
| REQ-092..REQ-097 | Infrastructure Economics | Deferred | v0.8 |

## 3. Locked constants (const firewall)
<!-- Amending any row requires an explicit override line in oy-spec §9. -->
| Const | Value | Module | Why locked |
|-------|-------|--------|-----------|
| MissionLockAmendable | false | x/council | vision §19 — non-amendable |
| CouponCapBps | 800 (8%) | x/bond | vision §17, D-028 |
| CouponFloorBps | 0 (0%) | x/bond | vision §17, D-028 |
| LendingCouponCapBps | 800 | x/hub | D-028 mirror (REQ-030 cross-const test) |
| LendingCouponFloorBps | 0 | x/hub | D-028 mirror (REQ-030 cross-const test) |
| HandPassFeeBps | 0 | x/guild | vision §12, D-025 |
| FeeCeilingBps | 10 (0.1%) | x/feecovenant | vision §18, REQ-002 |
| FeeFloorBps | 1 (0.01%) | x/feecovenant | vision §18, REQ-002 |
| SignalKindCount | 4 | x/standing | AUDIT §193 P1-2 (defensible; expansion deferred to v0.7+ governance) |
| BearerTypeCount | 6 | x/bearers | vision §14, REQ-019 |
| BridgeStatusCount | 4 | x/bridge | D-036 |
| ExitStatusCount | 5 | x/exit | D-036 |
| PartnerTierCount | 4 | x/partner | vision §13, REQ-018 |
| StandTypeCount | 9 | x/stand | vision §11, REQ-016 |
| PactTypeCount | 6 | x/pact | vision §16, REQ-020 |
| CouncilKindCount | 3 | x/council | vision §19, REQ-011 |
| WatcherQuorum | 6-of-9 | x/watcher | vision §7, REQ-004 |
| WatcherVetoQuorum | 6 (param-tunable [2,9]) | x/council | D-065 |
| MaturityThresholdDays | 90 | x/stash | vision §9.1, REQ-005 |
| GrainsPerBread | 10000 | x/bread | vision §4, REQ-013 |
| TargetBloomRateBasisPoints | 450 (4.5%) | x/bloom | vision §6 |
| AnchorCredentialStatusCount | 4 | x/partner | v0.5 addition (additive) |
| OYSATLink.SurveillanceResistant | true | x/bearers | vision §14, locked |
| ServiceKindCount | 4 | x/services | D-040 |
| HubServiceCount | 3 | x/hub | D-039 |

### v0.7 planned const additions (GRILL-ratified D-086..D-090)
| Const | Value | Module | REQ | Why locked |
|-------|-------|--------|-----|-----------|
| CoverReserveFloorAnnualContribX | 1.5 | x/cover (NEW) | REQ-047 (locked) | vision §16 — 1.5× annual contributions floor, mission-locked |
| CoverReserveCeilingAnnualContribX | 2.5 | x/cover (NEW) | REQ-048 (not locked — governance-tunable within 1.5×–2.5×) | vision §16 — upper bound of bounded range |
| CoverStandingGateTrusted | 4.0 (Trusted bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Travel gate minimum (Pool MAY tighten, NEVER loosen). D-090(3): enforced at BOTH launch handler AND Params-amendment ValidateBasic. |
| CoverStandingGatePreferred | 4.5 (Preferred bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Health-MCS gate minimum. D-090(3): dual check. |
| MABIssuanceCeilingAnnualSurplusMultiple | 3 | x/bond (extended) | REQ-054 (locked) | vision §17 — 3× annual surplus mission-locked ceiling |
| MABCouponCapBps | 800 (reuse CouponCapBps) | x/bond | REQ-054 (locked) | coupon bounded by existing CouponCapBps (D-028) — no new const, cross-const test extends |
| CoolingSecessionCoverActiveDays | 21 | x/guild (extended) | REQ-064 (locked) | vision §4.6 — secession cooling, secured at founding, not reducible |
| CoolingSecessionNonCoverDays | 14 | x/guild (extended) | REQ-064 (locked) | vision §4.6 — secession cooling, secured at founding, not reducible |
| StandPierEscalationAnnualPassVolumeCents | 10000000 ($100k in Grain-cents) | x/stand (extended) | REQ-059 (not locked) | D-074 ruling — TBD-X = $100k annual Pass volume; simtest placeholder (no USD/Grain oracle) |
| CoverClaimsVoucherBondMultipleAvgCall | 10 | x/cover (NEW) | REQ-055 (not locked) | §9.4, §15 — bond default 10× avg Call size per Pool. D-090(2): bond = max(10× avg, MinimumVoucherBond) — cold-start fallback. |
| AntiCaptureBillOfRightsCount | 13 | x/cover (NEW) | REQ-056 (locked) | §8.2 — 13 rights codified, non-amendable, non-waivable. D-090(1): RightID type + 13 Waivable* consts + ValidateBasic gate land in P2 (NOT P5). |
| ShadowVouchWeightMultiplier | 0.5 | x/standing (extended) | REQ-060 (locked) | vision §9.1 — Shadow vouch 50% weight in Community Endorsement signal |
| PierCarriesVoice | false | x/guild (extended) | REQ-053 / FR-VOICE-6 (locked, D-087) | vision §12 — Pier does NOT carry Voice; mission-locked invariant (12th const per GRILL D-087) |

> Note: the v0.8 const firewall extensions named in oy-spec §7 v0.8 acceptance
> (`EyeQuorumMin=7`, `AnchorConcentrationCapBps=2000`,
> `MABCouponMaxAnnualSurplusMultiple=3`, `BondIssuerSurplusCeilings={1×,2×,3×}`,
> `CoolingSecessionCoverActive=21 days`, `CoolingSecessionNonCover=14 days`,
> `CoverReserveFloorAnnualContribX=1.5`) overlap with v0.7's REQ-047/049/054/
> 064 const additions. The v0.7 additions above land the v0.7-locked subset
> (REQ-047/049/054/064 locked=yes); the v0.8 acceptance list is the v0.8
> consolidated const firewall update that will add the remaining Cluster A–E
> consts (`EyeQuorumMin`, `AnchorConcentrationCapBps`, etc.). The cooling
> consts and CoverReserveFloor land in v0.7 because their REQs are v0.7;
> v0.8's acceptance row re-lists them as a consolidated checkpoint, not a
> re-introduction.

## 4. Deferred / out-of-scope (do NOT re-propose without §9 override)
| Item | Deferred from | Reason | Revisit at |
|------|--------------|--------|------------|
| Cover Pool seniority mechanics | v0.1 Q7 | unstated math | **UNBLOCKED v0.7** — REQ-046..REQ-050 now supply the seniority/gate math; promoting to runtime this milestone |
| SignalKind 4->5 enum expansion | v0.4 AUDIT §193 P1-2 | locked-const change; defensible at 4 | v0.8+ governance vote (not v0.7 scope) |
| Governance spam deposit/bond | v0.5 REVIEW P1 | mainnet-readiness | v0.8+ (Cluster C, REQ-077 adjacent) |
| CLOB per-tx front-running (batch auction) | v0.5 REVIEW P1 | mainnet-readiness | v0.8+ |
| Real IBC light-client simtest | v0.5 REVIEW P1 | mainnet-readiness | v0.8+ (Cluster A, REQ-068 adjacent) |
| CLOB `restingBookForBond` O(n) -> prefix-key | v0.5 REVIEW P2 | mainnet perf | v0.8+ |
| `emitMatchEventHook` testability | v0.5 REVIEW P2 | minor | v0.8+ |
| Live chain launch / mainnet / real IBC channels | v0.1 (D-020) | skeleton-first until mainnet gate | v0.8+ (Year 3 target) |
| Real `oyd` daemon / `app.go` / `cmd/oyd` | v0.6 OOS | no chain runtime exists | v0.8+ (v0.7 Cover Pool "live on testnet" = simtest-grade keeper runtime, not mainnet) |
| Real institutional Anchors onboarding | v0.5 OOS | credential lifecycle in simtest only | v0.8+ |
| Real bearer transports (hardware/RF) | v0.5 OOS | message handlers + simtest only | v0.8+ (Year 3) |
| Authentication / sessions / real key mgmt | v0.6 OOS | mock; Reach created by form submission | v0.8+ |
| Persistence (in-memory mock store) | v0.6 OOS | resets on restart | v0.8+ |
| i18n / multi-language UI | v0.3/v0.6 OOS | single-language | v0.8+ |
| Yield Token, Travel + 11 service categories | ROADMAP Phase 4 | Maturity (Years 4-5) | Year 4+ |
| Maya's Day integration spec | v0.1 Q1 | Mesh Experience component | Phase 2 |
| Standing anti-gaming sub-tables | v0.1 Q2 | formula locked; sub-tables deferred | v0.8+ |
| Pier credential routing (e-Residency, biometrics) | v0.1 Q5 | deferred | v0.8+ |
| Experimental bond forms | v0.1 Q6 | Phase 4+ only | Year 4+ |
| Processor share tier boundary exact volumes | v0.1 Q8 | deferred | v0.8+ |
| Docs bread-scale.md fix (outdated vs code consts) | v0.6 P1+ | doc-drift fix, not UI feature | next docs touch |
| **Sovereign Anchor SPEC** (`oy-sovereign-anchors`) | v0.7 §5 | infrastructure-scale, separate SPEC; experimental, not load-bearing | post-v0.7 (PO D-076) |
| **USZ classification runtime** | v0.7 §7 | depends on Anchor pre-commitment framework (v0.8 REQ-095) | v0.8 |
| **Cluster A–E + Infrastructure Economics (REQ-067..REQ-097)** | v0.7 §7 / D-081 | §7 authoritative — v0.7 ships REQ-046..066 only | v0.8 |
| **Pier-Routed Legal Wrapper** | v0.7 §5 | OPTIONAL per PO; default-no-wrapper; not implemented as code | never (optional value-add) |
| **Watcher/Voucher operating-expense compensation absolute cap ($TBD-W)** | v0.7 §8 Q6 | v0.8 REQ-096; annual 5% Bloom cap ruled (D-078), absolute cap deferred | v0.8 |

## 5. Drift flags (ciagent -> PO)
<!-- Differences between oy-spec (latest) and what the ciagent has shipped. -->
- Lexicon drift: **none**
- Locked-const drift: **none** (v0.7 const additions are net-new, not amendments)
- REQ-shape drift: **none** (oy-spec v3 net-new-only diff ingested; REQ-046..REQ-097 added to coverage §2; baseline REQ-001..REQ-045 unchanged)
- Architecture drift: **planned** — v0.7 introduces a NEW module `x/cover` (Cover Pool Factory + Anti-Crowding-Out firewall + Anti-Capture Bill of Rights). The existing `x/pact` `PactCover` enum value remains as a cross-reference (G-003 by-ID-string). This mirrors the D-039 precedent (`x/hub` split out of `x/pact`'s `PactHubAPI` in v0.3). Will be ratified at GRILL (P0).
- Spec-version drift: **none** — oy-spec v3 ingested at commit d10bf5e; this state-v2 reflects it.

## 6. Constraints honored (firewall status)
- **G-003** production import firewall: GREEN (by-ID-string rule at type level; expected_keepers.go shims for keeper cross-calls). v0.7 `x/cover` will follow the same pattern — no production struct imports across `x/<module>/types`.
- **G-006** go.mod zero-dep: CONTROLLED EXCEPTION — cosmos-sdk v0.50.8 + ibc-go v8.2.1 added in v0.5 (D-055 GRILL-approved, scoped to runtime phases; types/ packages stay dep-free). v0.7 `x/cover` keeper will use the same SDK runtime substrate; no new Go deps expected.
- **G-028** go.mod diff baseline (v0.6 vs v0.5.0): EMPTY. v0.7 target: EMPTY (no new Go deps; `x/cover` keeper uses existing SDK).
- **REQ-012** lexicon firewall: GREEN — 3 meta-tests (x/, docs/, web/) all passing. v0.7 will extend to a 4th meta-test if Cover surfaces add user-facing strings (pending RESEARCH); otherwise the existing 3 suffice.
- **Mission Lock** non-amendable: GREEN — `MissionLockAmendable=false` unchanged; `MissionLockAmendmentRejected` ProposalKind rejected at ValidateBasic (D-064). v0.7 Anti-Capture Bill (REQ-056) extends this: 13 rights non-amendable + non-waivable by any Charter.
- **Coverage** >=80% on shipped packages: GREEN (v0.5 keepers 82.1%-92.5%; v0.6 web/store 98.1%, web/handlers 89.2%, lexicon_meta_web 100%). v0.7 target: `x/cover` + extensions >=80%.
- **Feature purity gate** (v0.7): GREEN target — no breaking schema changes to locked-const firewall; G-003 intact; go.mod unchanged.
- **No subsidies** (v0.7 §5 NEW): GREEN by construction — v0.7 does not introduce any Root-Pool operating-expense subsidy or transfer-payment analog. The Anti-Crowding-Out firewall (D-079, REQ-047/050) rejects any code path routing Cover-Fees outside contributor-pool semantics. Infrastructure financing is out of v0.7 scope (v0.8 REQ-092..095).
- **Anchor no-Voice** (v0.7 §5 NEW): GREEN by construction — v0.7 does not grant Voice to any Anchor. The Cover Pool Council (REQ-062) = Pool Host + 3 elected Masons + Watcher observer; no Anchor seat. MAB holders (REQ-063) have NO Voice. Sovereign Anchors are out of v0.7 scope (experimental per §5).

## 7. Open PO decisions before next milestone
<!-- The PO should rule on these in oy-spec §8 or §7 before v0.7 P0. -->

### Resolved this regeneration (D-074..D-081 — PO recommendations accepted as binding at full autonomy)
| ID | §8 Q | Decision | Rationale | Confidence | Affects |
|----|------|----------|-----------|------------|--------|
| D-074 | Q1 (TBD-X) | **$100k annual Pass volume** for Stand→Pier-customer escalation | PO rec accepted; soft upgrade not ban | 0.85 | REQ-059 (v0.7/P5) |
| D-075 | Q2 (TBD-Z) | **<10 Holders/km² AND strategic value ≥ mission score, OR sovereign request, OR Mesh Council supermajority** | PO rec accepted; formula locked for v0.8 USZ | 0.80 | REQ-095 (v0.8) |
| D-076 | Q3 (Sovereign Anchor SPEC) | **Separate SPEC `oy-sovereign-anchors`**; experimental, not load-bearing v0.7 | PO rec accepted; infrastructure-scale ≠ legal-wrapper-scale | 0.85 | §5 constraint (v0.7) |
| D-077 | Q5 (Standing gate timing) | **Factory runtime** — gates are protocol-layer | PO rec accepted; gates bind at x/cover Factory, not first live Pool | 0.88 | REQ-049 (v0.7/P1) |
| D-078 | Q6 (Watcher/Voucher cap) | **Annual cap = 5% of Root-Pool Bloom**; absolute $TBD-W deferred to v0.8 | PO rec accepted; 5% Bloom ruled now, absolute cap later | 0.82 | REQ-096 (v0.8) |
| D-079 | Q7 (Anti-Crowding-Out firewall) | **Separate `x/cover/firewall` package + `lexicon_meta_cover`-style meta-test** (defense in depth) | PO rec "separate firewall" accepted; runtime subpackage rejects code paths + meta-test rejects doc drift | 0.84 | REQ-047/050 (v0.7/P1) |
| D-080 | Q8 (MAB use-of-proceeds) | **Tagged streaming + Watcher-witnessed release** (defense in depth) | PO rec accepted; tagged streaming auto-Stills on misuse, Watcher witnesses release | 0.85 | REQ-054 (v0.7/P4) |
| D-081 | Q4 (Risk mitigation sequencing) | **§7 authoritative** — v0.7 ships REQ-046..066 only; Cluster A+B+C are v0.8 | PO rec overridden by §7 acceptance text; §7 is the milestone contract | 0.90 | v0.7 scope (all REQ-046..066) |

### Remaining open (post-v0.7 — for v0.8 P0)
1. **$TBD-W absolute Watcher/Voucher cap** — deferred to v0.8 REQ-096 (D-078 partial ruling).
2. **Sovereign Anchor SPEC scope** — `oy-sovereign-anchors` to be authored by PO before v0.8 P0 (D-076).
3. **v0.8 Cluster A–E sequencing within v0.8** — which of REQ-067..REQ-097 ship in v0.8 P1..PN? PO should pick a subset or rule "all 31 in v0.8".
4. **Pen-test third party** — v0.7 §7 acceptance requires "pen-test ≥1 independent third party"; at full autonomy with no external third party available, the ciagent will run a self-administered adversarial review (ci-griller persona) and log this as an assumption unless the PO rules otherwise before P6.
5. **`oyd` daemon** — still no `app.go`/`cmd/oyd`; v0.7 Cover Pool "live on testnet" = simtest-grade keeper runtime. PO should decide whether v0.8 starts the daemon or continues simtest-only.
6. **SignalKind 4->5 expansion** — still deferred to v0.8+ governance vote (not v0.7 scope).

## 8. Build/test status
- `go build ./...`: GREEN (baseline confirmed 2026-08-19 on main @ d10bf5e)
- `go test ./...`: GREEN (all packages; v0.5 keepers + v0.6 web + lexicon meta-tests all passing)
- Coverage: all shipped keeper packages >=80%; web packages >=89%
- Lexicon meta-tests: 3/3 GREEN (x/, docs/, web/)
- Last green commit: d10bf5e (docs(spec): v3 net-new-only)

---

_`oy-state` is regenerated by the ciagent. Do not edit by hand._