docs(spec): v3 net-new-only — v0.7 fraternal groups + v0.8 risk mitigations
Ingest oy-spec v3 (net-new-only diff against spec-v2): - 52 new REQs REQ-046..REQ-097 (v0.7 REQ-046..066, v0.8+ REQ-067..097) - §5: 4 new constraints (no subsidies, Anchor no-Voice, Sovereign Anchors separate SPEC, Pier-Routed Legal Wrapper OPTIONAL) - §7: v0.7 Fraternal Groups Foundation + v0.8 Risk Mitigations plan - §8: 8 open questions with PO recommendations - Trimmed restated baseline/Principles/Lexicon/invariants (locked, in force) Per PO ruling 2026-08-18. ciagent acknowledges; P0 will regenerate oy-state v2.
This commit is contained in:
+150
-111
@@ -1,140 +1,179 @@
|
||||
# OpenYield Spec — spec-v1
|
||||
# OpenYield Spec — spec-v3 (net new only)
|
||||
Owner: <product owner>
|
||||
Status: draft
|
||||
Ingested as: oy-spec
|
||||
|
||||
> This is the **only** document the product owner (PO) sends to the ciagent for
|
||||
> implementation. The ciagent consumes it to regenerate PROJECT.md,
|
||||
> REQUIREMENTS.md, and ARCHITECTURE.md. Nothing else is read from upstream.
|
||||
>
|
||||
> In return the ciagent maintains **one** sibling file — `oy-state` — that tells
|
||||
> the PO what exists, what's locked, what's deferred, and what drift exists
|
||||
> between this spec and the shipped code. Read `oy-state` before editing
|
||||
> `oy-spec`; it prevents re-proposing shipped or explicitly-deferred REQs.
|
||||
>
|
||||
> `oy-spec` and `oy-state` are the only two docs that cross the PO<->ciagent
|
||||
> boundary. All other `.ciagent/oy/*.md` files are ciagent-internal working
|
||||
> memory — do not edit them.
|
||||
> This spec contains ONLY net new requirements, constraints, and decisions for v0.7+ scope. Locked-vision baseline (REQ-001..REQ-021), shipped REQs (REQ-022..REQ-045 per `oy-state` §2), Principles [locked], Lexicon [locked], and pre-filled project invariants are NOT restated; they remain in force per vision v3.0 and prior spec revisions. This is the diff against spec-v2.
|
||||
|
||||
## 1. Objective
|
||||
<!-- <=3 sentences: what the mesh is and who it serves -->
|
||||
|
||||
The v0.7 milestone delivers **Fraternal Groups Foundation** — Cover Pools, Chapter Federation, Mutual Aid Bonds, and the Anti-Capture Bill of Rights v0.2 — adapting the 1890–1930 fraternal benefit-society model for borderless digital service [3]. The v0.8+ roadmap layers in **Risk Mitigations + Infrastructure Economics** — Cluster A–E risk register closures, infrastructure underwriting primitives (Relay Fee Schedule, Coverage Standing Bonus, IYB with subordination, USZ classification), Watcher/Voucher compensation, and the Anchor no-Voice clause. Two PO rulings bind this revision: **no subsidies** (Root-Pool operating-expense subsidies and transfer-payment analogs are forbidden), and **Anchor no-Voice** (Anchors — including Sovereign Anchors — receive preferred contract terms only, never governance Voice).
|
||||
|
||||
## 2. Vision source
|
||||
- Document: Vision v3.0 (22 sections)
|
||||
- Locked commitments (non-amendable sections):
|
||||
<!-- list section numbers that are non-amendable -->
|
||||
Vision v3.0 [1]; SPEC-001 `oy-fraternal-groups` v0.2 [3]. All locked commitments remain in force; **no vision amendments proposed**.
|
||||
|
||||
## 3. Principles [locked]
|
||||
1. Real value
|
||||
2. Sustainability
|
||||
3. Mission-lock
|
||||
4. Openness
|
||||
5. Ownership
|
||||
6. Self-service
|
||||
<!-- one line per principle — the ciagent enforces these as REQ-001 -->
|
||||
Locked per vision v3.0 §2. Not restated.
|
||||
|
||||
## 4. Requirements (net new)
|
||||
|
||||
> REQ-001..REQ-021 are locked-vision baseline (in force, not restated). REQ-022..REQ-045 are shipped per `oy-state` §2 (not restated). New REQs continue from REQ-046.
|
||||
|
||||
### v0.7 — Fraternal Groups Foundation (REQ-046..REQ-066)
|
||||
|
||||
#### Fraternal Group Primitives (REQ-046..REQ-056)
|
||||
|
||||
## 4. Requirements
|
||||
<!-- Each row: ID | Title | Vision § | Priority | Locked? | Acceptance criteria -->
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-001 | Enforce Six Principles | §2 | High | yes | <!-- criteria --> |
|
||||
| REQ-002 | Fee ceiling 0.1% / floor 0.01% / 1-Grain min | §18 | High | yes | <!-- criteria --> |
|
||||
| REQ-003 | Bloom from real production only (Root Basket) | §6 | High | yes | <!-- criteria --> |
|
||||
| REQ-004 | 9 Watchers, 6-of-9 quorum | §7 | High | yes | <!-- criteria --> |
|
||||
| REQ-005 | Four Freeholder signals | §9.1 | High | yes | <!-- criteria --> |
|
||||
| REQ-006 | Standing anti-gaming formula | §9.2 | High | yes | <!-- criteria --> |
|
||||
| REQ-007 | FCFS processing | §15 | High | yes | <!-- criteria --> |
|
||||
| REQ-008 | OY Chain (Layer 1) | §7 | High | yes | <!-- criteria --> |
|
||||
| REQ-009 | Satellite chains (Layer 2) | §7 | Medium | no | <!-- criteria --> |
|
||||
| REQ-010 | Exit layer (Layer 3) | §7 | Medium | no | <!-- criteria --> |
|
||||
| REQ-011 | Three Councils with Mission Lock | §19 | High | yes | <!-- criteria --> |
|
||||
| REQ-012 | Lexicon compliance | §3 | High | yes | <!-- criteria --> |
|
||||
| REQ-013 | Bread unit with scale | §4 | High | yes | <!-- criteria --> |
|
||||
| REQ-014 | Three pools of storage | §5 | High | yes | <!-- criteria --> |
|
||||
| REQ-015 | Window primitive | §10 | High | no | <!-- criteria --> |
|
||||
| REQ-016 | Nine Stand types | §11 | Medium | yes | <!-- criteria --> |
|
||||
| REQ-017 | Guilds with free Hand-Passes | §12 | Medium | yes | <!-- criteria --> |
|
||||
| REQ-018 | Four-tier Partner Spectrum | §13 | Medium | no | <!-- criteria --> |
|
||||
| REQ-019 | Six bearers via Unified Bearer Layer | §14 | Medium | yes | <!-- criteria --> |
|
||||
| REQ-020 | Six Pacts | §16 | Medium | no | <!-- criteria --> |
|
||||
| REQ-021 | Mesh Bond Market with 8% cap | §17 | Medium | yes | <!-- criteria --> |
|
||||
| REQ-046 | Cover Pool Factory runtime | §16 | High | no | Factory rejects category launches below in-force reserve floor; supports Cover-Charter deployment; Watcher attestation pipeline operational; category staging per REQ-065 |
|
||||
| REQ-047 | Cover Pool reserve target floor 1.5× annual contributions | §16 | High | yes | 1.5× minimum reserve codified in `x/pact/cover`; mission-lock semantic enforced; below-floor auto-pause of Cover-Fee routing |
|
||||
| REQ-048 | Cover Pool reserve target ceiling 2.5× (governance-tunable within bounds) | §16 | High | no | Watcher escalation to 2.5× after 12 months operating history; Pool Council MAY vote within bounded range 1.5×–2.5× |
|
||||
| REQ-049 | Cover Pool Standing gate minimums | §16, §9.3 | High | yes | Travel ≥ Trusted 4.0; Health-MCS ≥ Preferred 4.5; Pool Council MAY tighten but NEVER loosen below protocol minimum |
|
||||
| REQ-050 | Cover-Fee tagging at protocol layer | §16 | High | yes | Cover-Fee Grains carry `category_tag`; settlement engine rejects category-mismatched Calls (FR-COVER-11); Pool-level fungibility preserved for net-reserve accounting |
|
||||
| REQ-051 | Guild Charter + Common Bond requirement | §12 | Medium | yes | At formation: Common Bond declared + hash-pinned; Public Profile published (bond summary, disclaimers, Mason count or "private", Pier wrapper if any) |
|
||||
| REQ-052 | Cover-Charter (Statement of Beliefs, dispute path, gate, holding period) | §16 | High | yes | Cover-Charter distinct from governance charter; signed by Cover Pool Host + witnessed by Watcher at deployment; amendments require Pool supermajority + 7-day cooling + Watcher + Counsel; protocol does NOT enforce SoB content (FR-CHTR-5) |
|
||||
| REQ-053 | Chapter Federation (Parent/Chapter, secession terms, liens at founding) | §12 | High | no | Parent Guild + Chapters model; Chapters inherit + may tighten but not loosen; secession terms coded at founding; good-standing liens at founding (not freely increasable); Chapter retains mesh-level Voice (Pier does NOT carry Voice per FR-VOICE-6) |
|
||||
| REQ-054 | Mutual Aid Bond (issuance ceiling 1×–3×, coupons in Cover Calls) | §17 | High | yes | Issuance ceiling mission-locked at 3× annual surplus; coupons payable in Cover Calls or mutual-aid credits (NEVER Bread); coupon rate bounded by `CouponCapBps=800`; use-of-proceeds locked to reserve build-out; default recapture per FR-MAB-7; Watcher attestation at deployment + quarterly audit |
|
||||
| REQ-055 | Cover Claims Voucher role + bond + slashing | §9.4, §15 | High | no | Specialization of Voucher role; bond default 10× avg Call size per Pool; reviews each Call independently (no self-adjudication, FR-CPCV-2); slashing via §9.4 mechanism with cross-Pool applicability (NFR-SEC-8); bounded earnings |
|
||||
| REQ-056 | Anti-Capture Bill of Rights v0.2 | §8.2 [3] | High | yes | 13 rights codified in code; cannot be amended or waived by any Charter; covers one-tap exit, no tax on personal Stash, audit-able Voice, cooling, Watcher inspection, Freeholder voucher, Counsel escalation, Anchored-Bread conversion, Wayfarer's Record, secession (founding terms), non-Cover-access, category-mismatch refusal |
|
||||
|
||||
## 5. Constraints
|
||||
- 14 modular components, 6 cross-component interfaces
|
||||
- Mission Lock non-amendable
|
||||
- Lexicon firewall: banned terms = bank, deposit, interest, yield, currency, dollar/euro, account, savings, depositor
|
||||
- Skeleton-first until mainnet gate (D-020 pattern)
|
||||
- Zero Go deps except GRILL-approved runtime exceptions
|
||||
- Coverage >=80% on shipped packages
|
||||
- Multi-project mode active; project slug = `oy`
|
||||
#### Architect Recommendations Q1–Q10 (REQ-057..REQ-066)
|
||||
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-057 | Household simplified — no formal Council, one-tap exit | §11 | Low | no | Household Stand may operate without formal Council; one-tap exit is the dispute path |
|
||||
| REQ-058 | Confederation Voice — one-Stand-one-Vote, internal bundle | §11 | Medium | yes | Confederation aggregates member Stand Voice one-per-Stand; member Stands may bundle delegated Voice internally via §19 delegation |
|
||||
| REQ-059 | Stand→Pier-customer boundary — escalation rule (TBD-X volume threshold) | §11, §13 | Medium | no | When annual volume > TBD-X, Stand is invited to Hub API; soft upgrade, not a ban. **TBD-X = PO ruling needed (§8)** |
|
||||
| REQ-060 | Shadow vouch partial credit — 50% weight in Freeholder signal | §9.1 | Medium | yes | Shadow vouch weight = 0.5× in Community Endorsement signal (vs 1.0× for non-Shadow vouch) |
|
||||
| REQ-061 | Disclaimer cadence — per charter signing | §11 | Low | yes | Jurisdictional disclaimer surfaced at every charter signing; not session-bounded |
|
||||
| REQ-062 | Pool governance hybrid (Host + 3 elected + Watcher observer) | §16 | High | yes | Cover Pool Council = Pool Host + 3 Masons elected by Pool-eligible Masons + Watcher observer seat; Cover Calls require majority with Watcher observer present |
|
||||
| REQ-063 | MAB holder — surplus seniority only, no Voice at dissolution | §17 | Medium | yes | Mutual Aid Bond holders rank after Cover-Fee contributors but before Bread holders in Pool-surplus distributions (FR-MAB-4); NO Voice in Pool dissolution decisions (claimants, not Masons) |
|
||||
| REQ-064 | Secession cooling — 21d Cover-active / 14d non-Cover | §4.6 [3] | Medium | yes | Chapter secession cooling: 21 Mesh-days if Cover-active, 14 Mesh-days if non-Cover; secured at founding, not reducible; lien audit required; Cover Call / Bond covenant clearance required before secession completes |
|
||||
| REQ-065 | Cover Pool category staging — Phase 2/3/4 | §16 | High | yes | Phase 2: Travel + Health-MCS + Income-Pause; Phase 3: Equipment/Loss + Life-Burial + Road-Side; Phase 4: Cyber-Skimming + Guild-Internal-Mutual-Aid; Factory respects staging and rejects out-of-phase launches |
|
||||
| REQ-066 | Pier selection — Guild Council chooses, reversible, Pier Selection Index | §13 | Medium | no | Guild Council chooses Pier at formation; reversible by Cover Pool supermajority + Counsel witness; mesh maintains Pier Selection Index (jurisdictional reliability, fiduciary record, integration quality); SPEC-001 §8.3 Pier-Routed Legal Wrapper remains OPTIONAL with default-no-wrapper stance |
|
||||
|
||||
### v0.8+ — Risk Mitigations + Infrastructure Economics (REQ-067..REQ-097)
|
||||
|
||||
> All REQs in this section are LOCKED unless otherwise specified. Each maps to a Cluster A–E mitigation in the risk register.
|
||||
|
||||
#### Cluster A — Trust-minimization attacks (REQ-067..REQ-072)
|
||||
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-067 | Smart contract audit cadence + bounty + Still/Stir | §20 | High | yes | ≥2 independent audits before each Phase transition (high/critical remediated pre-launch); severity-graded bounty (Cat >$1M, Crit >$100k); module-level Still/Stir with Watcher-witnessed halt; canary 5→25→100% on parameter changes; >72h time-lock on parameter changes unless emergency Mesh Council + Watcher witness |
|
||||
| REQ-068 | Bridge pause semantics + multi-path + daily Watcher attestation | §7 | High | yes | `BridgeStatusCount=4` (Active→Paused→Frozen→Sunset); rate-limit per bridge per cycle; ≥2 independent paths for any mission-critical satellite; Watcher daily attestation of bridge balances (mismatch → auto-Still); Root-Pool-funded insurance pool |
|
||||
| REQ-069 | Eye quorum ≥7 + diversity + TWAP | §16 | High | yes | ≥7 Eyes per asset class; median (not mean); geographic/organizational diversity (no single Eye jurisdiction >25% weight); TWAP minimum 1-hour window; outlier rejection at 2σ, alerts at 1σ; Eye reputation with slashing bond (Watcher model); mesh-level Still per asset class on variance breach |
|
||||
| REQ-070 | Watcher 6-of-9 + 100k bond + daily cadence + fork-recovery | §7 | High | yes | All vision §7 + fork-recovery path: governance can fork from a captured Watcher set within Mission Lock bounds; rotation on instability metric (missed attestations, peer-deviation); slashing at 100,000 Bread bond per bad attestation |
|
||||
| REQ-071 | Anchor concentration cap 20% + redemption gate + auto-Still | §6 | High | yes | Any single Anchored-Bread ≤20% of Root Basket (governance-tunable within bounds); 24–72h redemption gate when anchor deviates >2% from peg; quarterly stress tests Watcher-witnessed; auto-Still for the affected stream |
|
||||
| REQ-072 | RWA venue multi-custodian + multi-jurisdiction minimum + Watcher attestation | §6 | High | yes | ≥3 independent custodians with segregated accounts; jurisdictional spread preferred (≥2 jurisdictions where commercially feasible) but NOT load-bearing; Watcher attestation per venue (reserves, NAV, audit reports); Watcher + Counsel sign-off substitution path within 30 days; insurance where commercially available |
|
||||
|
||||
#### Cluster B — Economic structural (REQ-073..REQ-076)
|
||||
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-073 | Sovereign reserve — ≥2 independent entities | §6, §13 | High | yes | ≥2 independent reserve entities (different legal forms; jurisdiction selection driven by legal robustness + banking reliability + regulatory clarity — NOT by jurisdiction count); segregated accounts; quarterly third-party audits; ≥2 banking partners per currency; cash-equivalents only at entity level |
|
||||
| REQ-074 | Root Basket liquidity tier 7-day 10%-redemption target | §6 | Medium | yes | Short-duration T-bills ~35% working (liquidity tier); 7-day, 10%-redemption stress test target <1% slippage; staged redemption gates above $X with 24h hold; facility lines at banking partners where feasible |
|
||||
| REQ-075 | Mutual Aid Bond default recapture + seniority | §17 | High | yes | MAB coupons in Cover Calls (NEVER Bread, FR-MAB-3); seniority per FR-MAB-4 (Cover-Fee contributors > MAB > Bread holders); Watcher quarterly review + red-flag escalation on miss; default recapture per FR-MAB-7; mission-lock on bond covenant upper 8% lower 0% (REQ-021) |
|
||||
| REQ-076 | Forex Engine multi-venue + Watcher daily attestation | §13 | Medium | yes | ≥3 counterparties per major currency corridor; annual counterparty due diligence; real-time exposure caps per counterparty; Watcher daily attestation on Forex reserve balances; governance substitution within composition bounds |
|
||||
|
||||
#### Cluster C — Capture & centralization (REQ-077..REQ-081)
|
||||
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-077 | Governance capture — multi-source Voice + Mission Lock + supermajority + cooling | §19 | High | yes | Multi-source Voice per §19 (Bread 1/1000, Freeholder full Voice, one-Mason-one-Vote opt-in, Guild delegation); Mission Lock list enforced (six non-amendable items); supermajority ≥67% + 7-day cooling on any governance action affecting funds; Watcher right of inspection on governance logs; `MissionLockAmendmentRejected` ProposalKind reverts amendment vote at protocol layer (D-064) |
|
||||
| REQ-078 | Processor FCFS + dynamic share (parity with Processors, extended to relay operators per REQ-092) | §15 | High | yes | FCFS (not fee-auctioned); geographic proximity wins; light client ~30MB / 1-3% battery/day; dynamic processor share auto-declining 50→30→20→10% as volume grows |
|
||||
| REQ-079 | Partner/Pier capture — self-service default + Window revoke + pay-to-play | §13 | High | yes | Self-service default (Principle 6) — no Partner required for any product; Window one-tap revoke; pay-to-play model (Piers pay OY, not reverse); mesh-level Pier Selection Index; Cover-Charter amendments require Watcher witness + Counsel signature; Chapter retains mesh-level Voice regardless of Pier fiduciary role |
|
||||
| REQ-080 | Pool governance capture — hybrid + Cover Claims Voucher + Chapter secession | §16 | High | yes | Hybrid Pool governance (REQ-062); Cover Calls require majority with Watcher observer; Cover Claims Voucher independent adjudication (REQ-055); Chapter secession right (founding terms, REQ-064); MAB holders have NO Voice (REQ-063) |
|
||||
| REQ-081 | Secession abuse — lien-bounding + cooling + lien audit | §4.6 [3] | Medium | yes | Good-standing liens codified at founding, not freely increasable (FR-CHAP-7); cooling periods 21d Cover-active / 14d non-Cover (REQ-064); secession requires Chapter Head signature + Good-Standing Lien audit; Cover Call / Bond covenant clearance required before secession completes; Parent Guild Treasury receives pro-rata Cover-Fee settlement for in-flight Cover Calls |
|
||||
|
||||
#### Cluster D — Identity & reputation (REQ-082..REQ-086)
|
||||
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-082 | Sybil on Standing — Bayesian prior + distinct counterparties + time decay | §9.2 | High | yes | Bayesian prior weight 10 (§9.2); minimum distinct counterparties 3/10/30; time-decayed Bayesian average penalizes burst-rating; Diversity Bonus × Voucher Weight resists amplification; Watcher attestation on Freeholder transition; 90-day Stash Maturity signal |
|
||||
| REQ-083 | Window abuse — 5-property semantics + rate-limit enforcement | §10 | High | yes | Window enforces 5 properties (Scope, Duration, Rate-limit, Audit log, Revoke); one-tap revoke works mid-service; audit log exportable to Holder's Stash at any time; rate-limit enforcement is protocol-layer with Watcher-witnessed violations; Partner abuse triggers Window closure + Partner status review |
|
||||
| REQ-084 | Vouching cascade — vouch slashes voucher + Watcher detection | §9.1, §9.4 | Medium | yes | Vouch requires skin-in-the-game — vouchee's Crack slashes voucher's Standing; Freeholder min-counterparties = 10 makes cascade hard to bootstrap; Watcher detection on rapid vouch sequences; Voucher Weight tapers with chain depth |
|
||||
| REQ-085 | Norm chilling — Cover opt-in + dispute path + public profile | §4.9 [3] | Medium | yes | Cover opt-in (FR-NORM-4); non-participation MUST NOT deny other mesh products; norms enforced only through dispute path (FR-NORM-2), never unilateral Council; norm violations counted toward §9.4 slashing history (visible reputation consequence); Pool Public Profile must publish Statement if any (FR-CHTR-4 + FR-GLD-11); protocol never enforces SoB content |
|
||||
| REQ-086 | Registry as identity — Shadow pseudonymity + schema minimalism | §11 | Medium | yes | Shadow Stand pseudonymous at protocol layer (FR-SHADOW-2 + §11); public/private visibility Holder-chosen (not Registry-mandated); Window reads explicit + rate-limited + logged + revocable (NFR-PRI-3); Watcher witness on private Stand registry access; Registry base schema excludes identity-grade fields (no names, no biometrics, no Pier credentials) |
|
||||
|
||||
#### Cluster E — Adoption & organic (REQ-087..REQ-091)
|
||||
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-087 | Cycle defaults — Cover integration + hash-committed order | §16, §11 | Medium | yes | Cover Pool integration with default ranking (SPEC-001 §12.1); Cycle Host order hash-committed (FR-CIRCLE-1); Counsel-mediated dispute path (FR-CIRCLE-4); Circle pauses via Still on default; restarts after resolution |
|
||||
| REQ-088 | Charter ambiguity — linter + Counsel review | §11 | Low | yes | Charter-template linter at Registry submission (covers common fields); Counsel review at chartering for any non-standard Charter; Counsel right to amend within 30-day ambiguity window without unanimous Mason approval |
|
||||
| REQ-089 | Cross-chain drift — Watcher per-chain attestation + canonical routing | §7, §20 | Medium | yes | Watchers re-attest per chain (per REQ-068 daily cadence + `BridgeStatusCount=4`); cross-chain Mirror registry with rolling snapshots per cycle for Stand Registry reads; Stand Registry reads route to canonical source via Window; drift triggers Paused bridge-status |
|
||||
| REQ-090 | Fee-Covenant override — Mission Lock + smart-contract enforcement + Council vote revert | §18, §19 | High | yes | Fee ceiling 0.1%, floor 0.01%, 1-Grain minimum non-amendable (Mission Lock); smart-contract enforcement with Watcher attestation; `MissionLockAmendmentRejected` ProposalKind reverts any Council vote to amend (D-064); structural ceiling on governance capture |
|
||||
| REQ-091 | Adverse selection — Standing gate + holding period + Pool tightening | §16 | High | yes | Standing-gate minimums mission-locked (REQ-049: Trusted 4.0 Travel / Preferred 4.5 Health-MCS); 30-day default holding period (FR-COVER-9); Pool tightening permitted but not loosening below protocol minimum; Cover Claims Voucher independent review of high-risk claims; aggregate statistics public (NFR-PRI-4) to drive Pool-level gate tuning |
|
||||
|
||||
#### Infrastructure Economics (REQ-092..REQ-097)
|
||||
|
||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
||||
|----|-------|----------|---------|---------|---------------------|
|
||||
| REQ-092 | Relay Fee Schedule (parity with Processors, auto-declining) | §15 | High | yes | Per-packet relay fee for OY-LR / OY-BLE / OY-WiFi-Direct relay operators; paid in Bread from protocol-fee pool; auto-declining on same schedule as Processor share (50→30→20→10%); self-balancing supply (dense zones saturate, sparse zones attract premium) |
|
||||
| REQ-093 | Coverage Standing Bonus (supplement Committed Capital, not replace) | §9.1 | Medium | yes | Sustained infrastructure provision (90-day rolling relay uptime, Watcher attestation) counts as a Standing signal; supplements (does NOT replace) Committed Capital (which remains 1+ active Pact OR 60+ day Guild per §9.1); same anti-gaming rules apply |
|
||||
| REQ-094 | Infrastructure Yield Bond (with structural subordination) | §17 | Medium | yes | IYB coupon from Root-Pool infrastructure budget; bounded by `CouponCapBps=800`; use-of-proceeds locked to infrastructure build-out; standard IYB for high-density (commercial trade routes, dense corridors); subordinated IYB for transitional USZs (Anchor takes first loss, local fee revenue takes upside); Watcher attestation at deployment + every quarterly audit |
|
||||
| REQ-095 | Universal Service Zone classification (no subsidies) | §13 | Medium | yes | USZ designation via Mesh Council vote within bounds; ≥3 criteria (density, strategic value, mission-aligned override); opt-in (zones choose to be USZs); **NO SUBSIDIES** — infrastructure capital sourced EXCLUSIVELY from (a) Anchor pre-commitment, (b) Sovereign Anchor partnerships, (c) subordinated IYB; market decides whether USZ infrastructure is built; **TBD-Z density formula = PO ruling needed (§8)** |
|
||||
| REQ-096 | Watcher/Voucher operating-expense compensation (capped) | §7, §19 | Medium | yes | Watcher + Voucher compensation paid from Root-Pool operating budget; capped annually by Mesh Council vote within bounds; NOT from Bond Market fees (avoids fee-maximization race); audited quarterly by Watchers; Counsel = civic contribution, no operating-expense compensation |
|
||||
| REQ-097 | Anchor no-Voice clause (Anchor = preferred terms, zero Voice) | §13, §19 | High | yes | Anchors (commercial per §13) — and Sovereign Anchors — receive preferred contract terms only; ZERO Voice in any Council; no Voice transfer to underlying governments or institutions; Pier Selection Index surfaces Anchor reputation; no "no masters" violation, no matter the Anchor's institutional weight |
|
||||
|
||||
## 5. Constraints (net new)
|
||||
|
||||
> Pre-filled project invariants (14 components, lexicon firewall, Mission Lock non-amendable, etc.) remain in force per spec-v2 and prior revisions; not restated.
|
||||
|
||||
Net new for spec-v3:
|
||||
|
||||
- **No subsidies.** Root-Pool operating-expense subsidies, transfer-payment analogs, and welfare-state derivatives are **FORBIDDEN**. Capital for infrastructure is sourced exclusively from Anchor pre-commitment underwriting, Sovereign Anchor partnerships, and subordinated Infrastructure Yield Bond structures. *(oy-spec-v3, PO ruling 2026-08-18)*
|
||||
- **Anchor no-Voice.** Anchors (per §13) — including Sovereign Anchors — receive preferred contract terms only. **ZERO Voice in any Council.** No Voice transfer to underlying governments or institutions. *(oy-spec-v3, PO ruling 2026-08-18)*
|
||||
- **Sovereign Anchors require separate SPEC.** The Sovereign Anchor framework is too infrastructure-scale to fold into oy-spec. Forthcoming SPEC: `oy-sovereign-anchors`. Until that SPEC ships, USZ infrastructure financing via Sovereign Anchor partnerships is **experimental, not load-bearing**. *(oy-spec-v3, PO ruling 2026-08-18)*
|
||||
- **Pier-Routed Legal Wrapper is OPTIONAL.** Default stance: no wrapper required. SPEC-001 §8.3 menu is value-add for Chapters/Guilds that want a legal seat, not a requirement. *(oy-spec-v3, per session refactor)*
|
||||
|
||||
## 6. Lexicon [locked]
|
||||
- Banned: bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor
|
||||
- Required replacements: account -> Reach, deposit -> receive-asset, interest -> coupon, yield -> bloom, currency -> asset
|
||||
Locked per vision v3.0 §3. Not restated.
|
||||
|
||||
## 7. Milestone intent
|
||||
- Current shipped: v0.6 (Nomad Web UI) — COMPLETE
|
||||
- Next: <!-- v0.7 target — one paragraph + the REQ-IDs it draws from -->
|
||||
- Out-of-scope this milestone:
|
||||
<!-- list -->
|
||||
|
||||
## 8. Open questions for the ciagent
|
||||
<!-- bulleted; the ciagent logs assumptions if unanswered at autonomy=full -->
|
||||
- **Current shipped:** v0.6 (Nomad Web UI) — v0.5.6 — COMPLETE [2]
|
||||
- **Next: v0.7 — Fraternal Groups Foundation.** Ships REQ-046..REQ-056 (Cover Pool Factory + Cover-Charter + Chapter Federation + Mutual Aid Bond + Cover Claims Voucher + Anti-Capture Bill v0.2) + REQ-057..REQ-066 (architect recommendations Q1–Q10).
|
||||
- *Acceptance:* ≥1 Cover Pool live on testnet with reserve enforcement + Standing gate + category tagging; ≥1 Parent Guild with Chapter in secession-eligible formation with good-standing liens declared at founding; ≥1 Mutual Aid Bond issuance with Cover-Call coupon settlement + use-of-proceeds lock to reserve build-out; Anti-Capture Bill v0.2 reviewed by bonded Counsel; pen-test ≥1 independent third party; high/critical findings remediated.
|
||||
- **v0.8 — Risk Mitigations + Infrastructure Economics.** Ships REQ-067..REQ-097 (Cluster A–E mitigations + Relay Fee Schedule + Coverage Standing Bonus + IYB + USZ classification + Watcher/Voucher compensation + Anchor no-Voice).
|
||||
- *Acceptance:* all listed REQs in §4 v0.8+ implemented with regression tests; `oy-state` §3 const firewall extended with `EyeQuorumMin=7`, `AnchorConcentrationCapBps=2000`, `MABCouponMaxAnnualSurplusMultiple=3`, `BondIssuerSurplusCeilings={1×, 2×, 3×}`, `CoolingSecessionCoverActive=21 days`, `CoolingSecessionNonCover=14 days`, `CoverReserveFloorAnnualContribX=1.5`.
|
||||
- **Out-of-scope additions for v0.7:**
|
||||
- Sovereign Anchor SPEC (forthcoming; experimental only this milestone per §5)
|
||||
- USZ classification runtime (deferred to v0.8 — depends on Anchor pre-commitment framework)
|
||||
- Pre-existing deferred items per `oy-state` §4 remain deferred (not restated here)
|
||||
|
||||
## 8. Open questions (net new)
|
||||
|
||||
> Pre-existing PO decisions tracked in `oy-state` §7 remain open unless addressed here.
|
||||
|
||||
1. **TBD-X volume threshold** for Stand→Pier-customer boundary escalation (REQ-059). PO recommendation: **$100k annual Pass volume**.
|
||||
2. **TBD-Z density formula** for USZ classification (REQ-095). PO recommendation: **<10 Holders per km² AND strategic value ≥ mission score, OR sovereign request, OR mission-aligned override via Mesh Council supermajority**.
|
||||
3. **Sovereign Anchor SPEC scope decision.** Separate SPEC (`oy-sovereign-anchors`) or fold into `oy-pier`? PO recommendation: **separate SPEC** — Sovereign Anchors are infrastructure-scale, not legal-wrapper-scale; v0.7 status is *experimental, not load-bearing* per §5.
|
||||
4. **Risk mitigation sequencing.** Which of REQ-067..REQ-091 ship in v0.7 vs deferred to v0.8? PO recommendation: **Cluster A + B + C ship in v0.7 (immediate existential + economic + capture risks); Cluster D + E + REQ-092..REQ-097 ship in v0.8 (immune-system + adoption + infrastructure economics).**
|
||||
5. **Standing gate enforcement timing.** When does REQ-049 (Cover Pool Standing gate minimums) bind? At Cover Pool Factory runtime (v0.7) or at first live Cover Pool deployment (v0.7 acceptance)? PO recommendation: **Factory runtime — gates are protocol-layer.**
|
||||
6. **Watcher/Voucher operating-expense cap.** Mesh Council vote within bounds; PO recommendation: **annual cap = 5% of Root-Pool Bloom, capped at $TBD-W absolute**.
|
||||
7. **Anti-Crowding-Out Covenant enforcement code.** The covenant is in §1 / §2.3 of SPEC-001 [3]; does the ciagent codify it as a separate `x/cover` package firewall (parallel to lexicon_meta tests), or embed it in Cover Pool Factory validation? PO recommendation: **separate firewall** — parallel to lexicon meta-tests; rejects any code path that would route Cover-Fees outside contributor-pool semantics.
|
||||
8. **MAB use-of-proceeds lock enforcement.** Per REQ-054, MAB proceeds are locked to reserve build-out. Does the ciagent codify this as tagged streaming with auto-Still on misuse detection, or as a Watcher-quorum-only release? PO recommendation: **tagged streaming + Watcher-witnessed release** (defense in depth).
|
||||
|
||||
The ciagent logs assumptions if these are unanswered at autonomy=full (decision_confidence_threshold 0.6, clarify_budget 10).
|
||||
|
||||
## 9. Changelog
|
||||
<!-- Every spec revision MUST be a `docs(spec):` commit (see Rules below). -->
|
||||
|
||||
| Spec-v | Date | Commit (docs(spec):) | What changed | REQs affected |
|
||||
|--------|------|----------------------|--------------|---------------|
|
||||
| v1 | <!-- date --> | <!-- docs(spec): initial spec --> | baseline (backfilled from shipped v0.6 state) | all existing |
|
||||
| v1 | (template date) | docs(spec): initial spec | Pre-filled REQ-001..REQ-021 locked-vision baseline; §1, §2, §5, §6 placeholders | REQ-001..REQ-021 |
|
||||
| v2 | 2026-08-18 | docs(spec): v0.7 fraternal groups + risk mitigations + infrastructure economics, no subsidies, anchor no-voice | Comprehensive revision — added REQ-046..REQ-097 (52 new REQs); folded SPEC-001 v0.2 §4 functional requirements and §12.2 architect recommendations as protocol REQs; eliminated Root-Pool subsidy layer; added Anchor no-Voice clause and Sovereign Anchors as separate SPEC; Pier-Routed Legal Wrapper downgraded to OPTIONAL; three new constraints added to §5; §1 expanded with fraternal scope; §7 split into v0.7 + v0.8 plan; 8 open questions logged | REQ-046..REQ-097 (new); §1, §5, §7, §8 |
|
||||
| **v3** | **2026-08-18** | **docs(spec): net new only — trim restated sections** | **Trim: removed restated REQ-001..REQ-021 baseline table (locked, in force), locked Principles restatement, locked Lexicon restatement, pre-filled project invariants from §5; §2 reduced to vision document reference only; §6 reduced to locked-pointer; §7 reduced to v0.7 + v0.8 milestone plan + new out-of-scope additions. Keep: REQ-046..REQ-097 unchanged; new §5 constraints unchanged; 8 new §8 questions unchanged.** | **No new REQs; net-new-only diff against spec-v2** |
|
||||
|
||||
---
|
||||
|
||||
## Rules (PO <-> ciagent contract)
|
||||
## Rules (PO ↔ ciagent contract)
|
||||
Locked per spec-v2 / template. Not restated.
|
||||
|
||||
- **One document each way.** No slides, sidecar notes, or direct edits to
|
||||
generated docs. If you want to change product intent, edit `oy-spec`; if you
|
||||
want to know what the ciagent did, read `oy-state`.
|
||||
- **Every REQ the ciagent implements must appear in §4 with acceptance
|
||||
criteria.** Vague criteria -> vague implementation.
|
||||
- **Mark a REQ `[locked]`** only if a future spec revision must not change it
|
||||
without an explicit override line in §9. Locked REQs map to const firewalls
|
||||
the ciagent defends with regression tests (listed in `oy-state` §3).
|
||||
- **The ciagent regenerates `oy-state` at every milestone ship AND at P0 of the
|
||||
next milestone if `oy-spec` changed since the last `oy-state`.** `oy-state`
|
||||
is authoritative for "what exists"; PROJECT.md is internal working memory.
|
||||
- **Before proposing a new REQ in §4, grep `oy-state` §2 (coverage) and §4
|
||||
(deferred).** Re-proposing an existing or explicitly-deferred REQ is a no-op
|
||||
and will be flagged as drift in the next `oy-state` §5.
|
||||
- **When §4 or §6 change,** the ciagent regenerates PROJECT/REQUIREMENTS and
|
||||
flags drift. When §3/§5 only change, no regeneration is needed.
|
||||
## Commit convention
|
||||
Locked per spec-v2 / template. Not restated.
|
||||
|
||||
## Commit convention (mandatory for `oy-spec`)
|
||||
---
|
||||
|
||||
- Every commit that modifies `oy-spec` MUST use a Conventional Commit message:
|
||||
|
||||
```
|
||||
docs(spec): <imperative summary <=72 chars>
|
||||
|
||||
<optional body: what changed in §4/§6 and why; >=1 line per REQ affected>
|
||||
```
|
||||
|
||||
- Examples:
|
||||
```
|
||||
docs(spec): add REQ-046 governance spam deposit (§4)
|
||||
|
||||
Opens REQ-046 per oy-state §4 deferred item "governance spam deposit".
|
||||
Acceptance: proposal deposit >= 1 Loaf, slashable on spam.
|
||||
```
|
||||
```
|
||||
docs(spec): lock REQ-002 fee ceiling — overrideable only via §9
|
||||
|
||||
REQ-002 fee covenant locked per vision §18; any future change requires an
|
||||
explicit §9 changelog override line.
|
||||
```
|
||||
|
||||
- The ciagent will **REJECT** any `oy-spec` commit whose subject does not match
|
||||
`docs(spec): ...`. This makes spec changes grep-able and ties each
|
||||
implementation milestone back to the spec revision that authorized it (via
|
||||
the §9 Changelog row referenced in the commit body).
|
||||
- **No squash merges, `fixup!`, or empty commits** for `oy-spec`. Every edit
|
||||
is a real `docs(spec):` commit on the default branch.
|
||||
End of `oy-spec` v3 — net-new-only diff against spec-v2. Awaiting ciagent acknowledgment + P0 generation of new `oy-state` per regeneration rule in §7.
|
||||
Reference in New Issue
Block a user