{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://stels.io/schemas/genesis-smart-1.0.production.json", "title": "STELS Genesis Smart Document v1.0 (Production/Regulator-Ready)", "description": "Production-grade JSON Schema for STELS monochain genesis configuration. Structure validation only; runtime MUST enforce policy invariants described in $comment.", "$comment": "JSON Schema Draft 2020-12. Runtime MUST implement Genesis Validator for: cross-field equality, hash/signing-view validation, threshold math (k<=n; k>=ceil(2/3 n) where required), balance conservation, committee/quorum math, and compliance invariants. Spec refs: JSON Schema 2020-12 :contentReference[oaicite:3]{index=3}; MiCA overview :contentReference[oaicite:4]{index=4}; FATF Travel Rule/VA guidance :contentReference[oaicite:5]{index=5}.", "type": "object", "additionalProperties": false, "$defs": { "sha256_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "SHA256 hex (64 chars)" }, "genesis_hash": { "type": "string", "pattern": "^genesis:sha256:[0-9a-f]{64}$", "description": "Genesis hash with prefix" }, "base58_address": { "type": "string", "pattern": "^[1-9A-HJ-NP-Za-km-z]{25,34}$", "description": "Base58 address. Runtime: verify checksum, version_byte, network prefix policy." }, "unit_interval": { "type": "number", "minimum": 0, "maximum": 1, "description": "Number in [0,1]" }, "non_negative_int": { "type": "integer", "minimum": 0, "$comment": "Runtime: validate <= Number.MAX_SAFE_INTEGER (or use bigint in implementation)." }, "decimal": { "type": "number", "description": "Decimal number" }, "sign_domain_array": { "type": "array", "minItems": 2, "prefixItems": [ { "type": "string", "minLength": 1, "description": "Context (tx/genesis/cosign/notary/crl/...)" }, { "type": "integer", "description": "chain_id must equal network.chain_id" } ], "items": { "oneOf": [ { "type": "string", "minLength": 1 }, { "type": "number" } ] }, "description": "Signing domain [context, chain_id, ...]. Runtime: prefixItems[1] == network.chain_id." }, "k_of_n_threshold": { "type": "object", "required": ["type", "k", "n"], "additionalProperties": false, "properties": { "type": { "type": "string", "const": "k-of-n" }, "k": { "type": "integer", "minimum": 1 }, "n": { "type": "integer", "minimum": 1 } }, "$comment": "Runtime: k <= n. Production policies may require k >= ceil(2/3*n) for upgrades/emergency." }, "k_n_pair": { "type": "object", "required": ["k", "n"], "additionalProperties": false, "properties": { "k": { "type": "integer", "minimum": 1 }, "n": { "type": "integer", "minimum": 1 } }, "$comment": "Runtime: k <= n." }, "staking_unbond_entry": { "type": "object", "required": ["amount", "available_at"], "additionalProperties": false, "properties": { "amount": { "$ref": "#/$defs/non_negative_int" }, "available_at": { "type": "string", "format": "date-time" } }, "$comment": "Unbonding chunk. Runtime: available_at >= now at creation; withdraw moves matured amount back to balance. Slashing applies to bonded+unbonding to prevent escape." }, "staking_effective_model": { "type": "object", "required": ["formula", "rating_multiplier", "lock_multiplier", "stake_cap_source"], "additionalProperties": false, "properties": { "formula": { "type": "string", "enum": [ "effective_stake = clamp(stake, min_stake, max_stake) * lock_multiplier * rating_multiplier" ] }, "stake_cap_source": { "type": "string", "enum": ["staking_policy", "monetary.rewards.staking"], "description": "Where max_stake/min_stake are sourced from (must be consistent)." }, "lock_multiplier": { "type": "object", "required": ["mode", "min", "max", "formula"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["linear-clamp"] }, "min": { "$ref": "#/$defs/decimal", "$comment": "Minimum lock_multiplier value (typically 0)" }, "max": { "$ref": "#/$defs/decimal", "$comment": "Maximum lock_multiplier value (typically 1)" }, "formula": { "type": "string", "enum": [ "lock_multiplier = clamp((lock_ms - min_lock_ms) / (max_lock_ms - min_lock_ms), min, max) where lock_ms = max(0, locked_until - now_or_activation)" ], "$comment": "Mathematical formula for calculating lock_multiplier. lock_ms is the remaining lock duration in milliseconds. now_or_activation is max(now, genesis.activation_time) to ensure consistent calculation at genesis. clamp ensures result is in [min, max] range." } }, "$comment": "Runtime: lock_multiplier in [min,max], recommended [0,1]. Formula: lock_ms = max(0, locked_until - now_or_activation), then lock_multiplier = clamp((lock_ms - min_lock_ms) / (max_lock_ms - min_lock_ms), min, max). min_lock_ms and max_lock_ms are from staking_policy.lock_policy." }, "rating_multiplier": { "type": "object", "required": ["min", "max", "formula"], "additionalProperties": false, "properties": { "min": { "$ref": "#/$defs/decimal" }, "max": { "$ref": "#/$defs/decimal" }, "formula": { "type": "string", "enum": [ "rating_multiplier = min + (rating/100) * (max - min)" ] } }, "$comment": "Recommended: min=0.5 max=1.2. Runtime: rating in [0,100]." } } }, "staking_policy": { "type": "object", "required": [ "enabled", "types", "currency", "bonding_ms", "activation_delay_epochs", "lock_policy", "unbonding_policy", "slashing_policy", "effective_stake_model", "events_channel" ], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "types": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["participation", "notary", "worker", "governance"] }, "uniqueItems": true }, "currency": { "type": "string", "minLength": 1, "$comment": "Runtime: must match parameters.currency.symbol and parameters.fees.currency." }, "bonding_ms": { "type": "integer", "minimum": 0 }, "activation_delay_epochs": { "type": "integer", "minimum": 0 }, "lock_policy": { "type": "object", "required": ["min_lock_ms", "max_lock_ms"], "additionalProperties": false, "properties": { "min_lock_ms": { "type": "integer", "minimum": 0 }, "max_lock_ms": { "type": "integer", "minimum": 1 } }, "$comment": "Runtime: max_lock_ms > min_lock_ms. lock_score uses locked_until-now." }, "unbonding_policy": { "type": "object", "required": ["unbonding_ms", "cooldown_epochs"], "additionalProperties": false, "properties": { "unbonding_ms": { "type": "integer", "minimum": 1 }, "cooldown_epochs": { "type": "integer", "minimum": 1 } }, "$comment": "Production: unbonding_ms should be > epoch_ms*3 (anti stake-hop). Runtime enforces relation using consensus.committee.epoch_ms." }, "slashing_policy": { "type": "object", "required": ["enabled", "rules"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "rules": { "type": "object", "additionalProperties": false, "properties": { "double_sign": { "$ref": "#/$defs/unit_interval" }, "equivocation": { "$ref": "#/$defs/unit_interval" }, "downtime": { "$ref": "#/$defs/unit_interval" } } } }, "$comment": "Runtime: penalties apply to stake.amount and unbonding[].amount. Also can decrease rating." }, "effective_stake_model": { "$ref": "#/$defs/staking_effective_model" }, "events_channel": { "type": "string", "minLength": 1, "default": "staking/events", "$comment": "Runtime: channel must exist in stels_runtime.channels[].id" } }, "$comment": "Runtime invariants: staking.currency == parameters.currency.symbol; and staking caps must match monetary.rewards.staking when rewards.staking.required==true." }, "compliance_policy": { "type": "object", "required": ["enabled", "jurisdiction", "aml", "travel_rule", "audit", "data_retention", "risk", "disclosures"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "jurisdiction": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 2 }, "description": "Jurisdictions for regulatory perimeter (e.g., EU, BE, UA, US-CA)." }, "aml": { "type": "object", "required": ["mode", "sanctions_screening", "monitoring", "recordkeeping"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["not-a-vasp", "vasp-like", "casp-like"] }, "sanctions_screening": { "type": "boolean" }, "monitoring": { "type": "string", "enum": ["basic", "risk-based"] }, "recordkeeping": { "type": "object", "required": ["enabled", "retention_days"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "retention_days": { "type": "integer", "minimum": 0 }, "storage_channel": { "type": "string", "minLength": 1, "$comment": "Channel/namespace for recordkeeping storage (e.g., 'audit' for 7-year retention)" } } } }, "$comment": "Align with risk-based approach expectations for VA/VASP contexts. :contentReference[oaicite:6]{index=6}" }, "travel_rule": { "type": "object", "required": ["enabled", "threshold_value", "threshold_currency", "data_minimum"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "implementation": { "type": "string", "enum": ["off-chain"], "$comment": "Travel Rule implementation: off-chain = VASP infrastructure handles PII, on-chain only stores compliance proofs" }, "threshold_value": { "$ref": "#/$defs/decimal" }, "threshold_currency": { "type": "string", "minLength": 1, "description": "e.g., EUR or USD" }, "fx_oracle": { "type": "object", "required": ["source", "update_frequency_ms", "acceptable_staleness_ms", "dispute_policy"], "additionalProperties": false, "properties": { "source": { "type": "string", "enum": ["external"], "$comment": "FX oracle source: external (e.g., Chainlink, custom oracle)" }, "update_frequency_ms": { "type": "integer", "minimum": 1, "$comment": "How often FX oracle updates (milliseconds)" }, "acceptable_staleness_ms": { "type": "integer", "minimum": 1, "$comment": "Maximum acceptable staleness for FX data (milliseconds)" }, "dispute_policy": { "type": "string", "enum": ["reject_if_stale"], "$comment": "Policy for handling stale FX data: reject_if_stale = reject transactions if FX data is stale" } }, "$comment": "FX oracle configuration for SLI/EUR conversion. Required for Travel Rule threshold evaluation. For mainnet, FX oracle must be configured separately." }, "data_minimum": { "type": "object", "required": ["originator", "beneficiary"], "additionalProperties": false, "properties": { "originator": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["name", "address", "date_of_birth", "account_id"] } }, "beneficiary": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["name", "account_id"] }, "$comment": "Required off-chain data fields for beneficiary (e.g., name, account_id). On-chain only stores compliance proof, not PII." } }, "$comment": "Data minimum requirements. These refer to off-chain records, not on-chain storage. On-chain only stores: proof_hash, compliance_timestamp, vasp_id." }, "on_chain_storage": { "type": "object", "required": ["pii_allowed", "store_proof_hash", "store_timestamp", "store_vasp_id"], "additionalProperties": false, "properties": { "pii_allowed": { "type": "boolean", "$comment": "Whether PII is allowed on-chain. Must match data_retention.pii_allowed (false for off-chain implementation)." }, "store_proof_hash": { "type": "boolean", "$comment": "Store hash of compliance proof on-chain" }, "store_timestamp": { "type": "boolean", "$comment": "Store compliance timestamp on-chain" }, "store_vasp_id": { "type": "boolean", "$comment": "Store VASP identifier on-chain" } }, "$comment": "On-chain storage policy for Travel Rule compliance. No PII is stored on-chain, only compliance proofs." }, "scope": { "type": "array", "items": { "type": "string", "enum": ["vasp_on_off_ramp_only"] }, "$comment": "Travel Rule scope: vasp_on_off_ramp_only = applies only to VASP fiat on/off ramps, not to all transactions" } }, "$comment": "Travel Rule readiness (FATF Rec.16). Exact local implementation depends on jurisdiction. :contentReference[oaicite:7]{index=7}" }, "audit": { "type": "object", "required": ["enabled", "tamper_evidence", "log_channels", "external_auditor_ready"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "tamper_evidence": { "type": "string", "enum": ["hash-chain", "witnessed", "none"] }, "log_channels": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 0 }, "external_auditor_ready": { "type": "boolean" } }, "$comment": "Auditability should align with ISMS expectations; see ISO/IEC 27001 baseline. :contentReference[oaicite:8]{index=8}" }, "data_retention": { "type": "object", "required": ["policy", "pii_allowed", "encryption_required"], "additionalProperties": false, "properties": { "policy": { "type": "string", "enum": ["minimal", "standard", "extended"] }, "pii_allowed": { "type": "boolean" }, "encryption_required": { "type": "boolean" } } }, "risk": { "type": "object", "required": ["framework", "incident_response", "business_continuity"], "additionalProperties": false, "properties": { "framework": { "type": "string", "enum": ["iso27001-aligned", "nist-aligned", "custom"] }, "incident_response": { "type": "boolean" }, "business_continuity": { "type": "boolean" } } }, "disclosures": { "type": "object", "required": ["whitepaper_uri", "risk_factors_uri", "governance_uri"], "additionalProperties": false, "properties": { "whitepaper_uri": { "type": "string", "format": "uri" }, "risk_factors_uri": { "type": "string", "format": "uri" }, "governance_uri": { "type": "string", "format": "uri" } }, "$comment": "MiCA expects transparency/disclosure for offers/admission to trading depending on classification and role. :contentReference[oaicite:9]{index=9}" } } } }, "required": [ "$schema", "version", "network", "genesis", "content", "protocol", "wallet_protocol", "addressing", "consensus", "intrinsics", "smart_ops_spec", "parameters", "tx_rules", "tx_schema", "schemas", "state", "monetary", "security", "governance", "signing_keys", "signatures", "stels_runtime", "stels_policy", "observability", "staking", "compliance", "legal" ], "properties": { "$schema": { "type": "string", "const": "https://stels.io/schemas/genesis-smart-1.0.production.json", "description": "Self-describing genesis instance schema URI." }, "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(-[a-zA-Z0-9.-]+)?$" }, "network": { "type": "object", "required": ["id", "name", "environment", "chain_id"], "additionalProperties": false, "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "environment": { "type": "string", "enum": ["devnet", "testnet", "mainnet"] }, "chain_id": { "type": "integer", "minimum": 1 } } }, "genesis": { "type": "object", "required": ["id", "created_at", "activation_time", "previous_genesis_id", "issuer", "upgrade_policy"], "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/genesis_hash", "$comment": "Runtime: genesis.id must match content.hash-derived id." }, "created_at": { "type": "string", "format": "date-time" }, "activation_time": { "type": "string", "format": "date-time", "$comment": "Runtime: activation_time >= created_at." }, "previous_genesis_id": { "oneOf": [ { "type": "null" }, { "$ref": "#/$defs/genesis_hash" }, { "type": "string", "const": "genesis" } ] }, "issuer": { "type": "object", "required": ["org", "contact"], "additionalProperties": false, "properties": { "org": { "type": "string", "minLength": 1 }, "contact": { "type": "string", "format": "email" } } }, "upgrade_policy": { "type": "object", "required": ["allowed", "requires_threshold", "envelope_domain"], "additionalProperties": false, "properties": { "allowed": { "type": "boolean" }, "requires_threshold": { "$ref": "#/$defs/k_of_n_threshold" }, "envelope_domain": { "type": "array", "minItems": 1, "items": { "oneOf": [ { "type": "string" }, { "type": "number" } ] } } }, "$comment": "Production: require >=2/3 threshold; enforce upgrade delay and key rotation in policy/runtime." } } }, "content": { "type": "object", "required": ["hash_alg", "hash", "size", "hash_scope", "size_scope"], "additionalProperties": false, "properties": { "hash_alg": { "type": "string", "enum": ["sha256"] }, "hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "$comment": "Runtime: content.hash must match genesis.id hash (genesis.id = 'genesis:sha256:' + hash). Hash is computed over hash_scope." }, "size": { "type": "integer", "minimum": 0, "$comment": "Size in bytes of the canonicalized document (gls-det-1) without signatures and content.hash. This is the same document that is hashed for content.hash. Formula: byteLength(UTF8(gls-det-1(document_without_signatures_and_content_hash)))." }, "hash_scope": { "type": "string", "const": "gls-det-1(document_without_signatures_and_content_hash)", "$comment": "Hash scope: document is canonicalized using gls-det-1, then excluded fields are: $.signatures (all signatures), $.content.hash (self-reference), $.content.size (optional, can be recalculated). Formula: SHA256(UTF8(gls-det-1(document_without_signatures_and_content_hash))). This ensures all clients hash the same content without self-referential fields." }, "size_scope": { "type": "string", "const": "utf8-bytes(gls-det-1(document_without_signatures_and_content_hash))", "$comment": "Size scope: UTF-8 bytes of canonicalized document (gls-det-1) without signatures and content.hash. This matches hash_scope for consistency. Formula: byteLength(UTF8(gls-det-1(document_without_signatures_and_content_hash)))." }, "genesis_signing_view_exclude": { "type": "array", "items": { "type": "string", "pattern": "^/[a-z0-9_/]+$" }, "$comment": "JSON Pointer exclude list for genesis hashing/signing (RFC 6901). Ensures all implementations exclude the same fields consistently. Example: [\"/signatures\", \"/content/hash\", \"/content/size\"]" } } }, "protocol": { "type": "object", "required": ["tx_version", "vm_version", "canonicalization", "encoding", "canon_specs", "sign_domains", "smart_execution", "genesis_validation"], "additionalProperties": false, "properties": { "tx_version": { "type": "string", "pattern": "^smart-[0-9]+\\.[0-9]+$" }, "vm_version": { "type": "string", "minLength": 1 }, "canonicalization": { "type": "string", "pattern": "^gls-det-[0-9]+$" }, "encoding": { "type": "string", "enum": ["utf-8"] }, "smart_execution": { "type": "object", "required": ["model", "turing_complete", "sandbox", "syscalls_allowed"], "additionalProperties": false, "properties": { "model": { "type": "string", "enum": ["host-native-intrinsics", "wasm-hosted-intrinsics"], "$comment": "Execution model: host-native-intrinsics (pure intrinsics, no VM) or wasm-hosted-intrinsics (WASM engine with intrinsics)" }, "turing_complete": { "type": "boolean", "$comment": "Whether execution is Turing-complete (false = bounded execution only)" }, "sandbox": { "type": "object", "required": ["type", "memory_isolated", "no_syscalls"], "additionalProperties": false, "properties": { "type": { "type": "string", "enum": ["process-isolation", "vm-isolation", "namespace-isolation"], "$comment": "Sandbox type: process-isolation (separate process), vm-isolation (VM-based), namespace-isolation (OS namespaces)" }, "memory_isolated": { "type": "boolean", "$comment": "Whether memory is isolated from host (true = no shared memory)" }, "no_syscalls": { "type": "boolean", "$comment": "Whether syscalls are denied (true = no syscalls allowed)" } }, "$comment": "Sandbox configuration: defines isolation mechanism for deterministic execution across different implementations (Rust/Deno/Go)" }, "syscalls_allowed": { "type": "boolean", "$comment": "Whether syscalls are allowed (false = no filesystem/network/clock access). Must be false when sandbox.no_syscalls=true." }, "fuel_metering": { "type": "boolean", "$comment": "Whether fuel metering is enabled. MUST be true for deterministic execution bounds. Time-based bounds (max_ms) are non-deterministic across hardware. Fuel-based bounds (max_fuel) are deterministic and prevent DoS attacks. Runtime MUST use fuel bounds for execution limits, NOT time bounds." }, "fuel_per_op": { "type": "object", "additionalProperties": { "type": "object", "required": ["max_fuel", "description"], "additionalProperties": false, "properties": { "max_fuel": { "type": "integer", "minimum": 1, "$comment": "Maximum fuel units for this operation (deterministic step-based limit). Runtime MUST count fuel units (not time) for execution bounds." }, "description": { "type": "string", "minLength": 1, "$comment": "Description of operation complexity" } } }, "$comment": "Fuel bounds per operation (deterministic step-based limits). Required when fuel_metering=true. Each operation has a maximum fuel cost that is deterministic across all implementations. Runtime MUST use fuel bounds for execution limits. Key = operation name (e.g., 'assert.time'), value = {max_fuel, description}." }, "fuel_overhead": { "type": "object", "required": ["parsing", "canonicalization", "signature_validation", "state_access", "total"], "additionalProperties": false, "properties": { "parsing": { "type": "integer", "minimum": 0, "$comment": "Fuel cost for parsing and validating transaction structure" }, "canonicalization": { "type": "integer", "minimum": 0, "$comment": "Fuel cost for canonicalizing transaction for signing view" }, "signature_validation": { "type": "integer", "minimum": 0, "$comment": "Fuel cost for validating signatures (ECDSA verification)" }, "state_access": { "type": "integer", "minimum": 0, "$comment": "Fuel cost for accessing account state (read balances, etc.)" }, "total": { "type": "integer", "minimum": 0, "$comment": "Total fuel overhead per transaction (sum of parsing + canonicalization + signature_validation + state_access). CRITICAL: Runtime MUST count overhead + sum(operation_fuel) <= max_fuel_per_tx. This ensures all implementations use the same fuel calculation model." } }, "$comment": "Fuel overhead model - formally defined. Overhead includes: transaction parsing, canonicalization, signature validation, state access. This overhead is separate from operation fuel costs and applies once per transaction. Runtime MUST use this model to prevent implementation divergence." }, "max_fuel_per_tx": { "type": "integer", "minimum": 1, "$comment": "Maximum fuel per transaction - formally tied to max_ops. Formula: max_fuel_per_tx >= max_ops * max(max_fuel_per_op) + fuel_overhead.total. Runtime MUST reject transactions where overhead + sum(operation_fuel) > max_fuel_per_tx. This is a deterministic step-based limit, NOT a time-based limit." }, "worst_case_cpu_bounds": { "type": "object", "additionalProperties": { "type": "object", "required": ["max_ms", "description"], "additionalProperties": false, "properties": { "max_ms": { "type": "integer", "minimum": 1, "$comment": "Maximum CPU time in milliseconds for this operation (informational estimate only, NOT used for execution limits)" }, "description": { "type": "string", "minLength": 1, "$comment": "Description of operation complexity" } } }, "$comment": "Worst-case CPU bounds per operation (informational only, NOT used for execution limits). These are approximate time estimates for monitoring/debugging purposes only. Runtime MUST use fuel bounds (fuel_per_op) for execution limits, NOT time bounds. Time-based bounds are non-deterministic across different hardware." }, "max_cpu_per_tx_ms": { "type": "integer", "minimum": 1, "$comment": "Maximum total CPU time per transaction in milliseconds (informational estimate only, NOT used for execution limits). This is for monitoring/debugging purposes only. Runtime MUST use max_fuel_per_tx for execution limits, NOT this time-based limit. Time-based bounds are non-deterministic across different hardware." } }, "$comment": "Smart transaction execution context: defines execution model, Turing-completeness, sandboxing, and syscall restrictions. Required for regulatory clarity and runtime implementation." }, "genesis_validation": { "type": "object", "required": ["procedure", "failure_policy"], "additionalProperties": false, "properties": { "procedure": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["normalize_state_accounts_order", "canonicalize", "compute_hash", "verify_signatures", "verify_stake_invariants", "verify_supply_conservation", "verify_compliance_flags"] }, "$comment": "Ordered validation steps: normalize_state_accounts_order (sort accounts by address, lexicographic ascending), canonicalize document, compute hash, verify signatures, verify stake invariants, verify supply conservation, verify compliance flags" }, "failure_policy": { "type": "string", "enum": ["reject-and-halt", "warn-and-continue"], "$comment": "Policy when validation fails: reject-and-halt = reject genesis and halt node startup (required for mainnet), warn-and-continue = log warning but continue (testnet only)" }, "error_codes": { "type": "boolean", "$comment": "Optional: whether to return structured error codes for each validation step" } }, "$comment": "Genesis validation procedure: defines ordered steps for external auditors and validators to validate genesis document at startup. failure_policy='reject-and-halt' is required for mainnet to prevent forks." }, "canon_specs": { "type": "object", "propertyNames": { "type": "string", "pattern": "^[a-z0-9_.-]+$" }, "additionalProperties": { "type": "object", "maxProperties": 32, "additionalProperties": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" } ] } } }, "sign_domains": { "type": "object", "required": ["tx", "cosign", "notary", "genesis", "crl"], "additionalProperties": false, "properties": { "tx": { "$ref": "#/$defs/sign_domain_array" }, "cosign": { "$ref": "#/$defs/sign_domain_array" }, "notary": { "$ref": "#/$defs/sign_domain_array" }, "genesis": { "$ref": "#/$defs/sign_domain_array" }, "crl": { "$ref": "#/$defs/sign_domain_array" } } } } }, "wallet_protocol": { "type": "object", "required": ["name", "version", "sign_alg", "hash_alg", "sig_encoding", "ecdsa_nonce", "message_canon", "pubkey_format"], "additionalProperties": false, "properties": { "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+$" }, "sign_alg": { "type": "string", "enum": ["ecdsa-secp256k1"] }, "hash_alg": { "type": "string", "enum": ["sha256"] }, "sig_encoding": { "type": "string", "minLength": 1 }, "ecdsa_nonce": { "type": "string", "enum": ["rfc6979"] }, "message_canon": { "type": "string", "pattern": "^gls-det-[0-9]+$" }, "pubkey_format": { "type": "string", "enum": ["secp256k1-compressed-hex"] } } }, "addressing": { "type": "object", "required": ["version_byte", "pubkey_format", "address_encoding", "preferred_encoding", "payload", "checksum", "address_prefix"], "additionalProperties": false, "properties": { "version_byte": { "type": "integer", "minimum": 0, "maximum": 255, "$comment": "Version byte for address encoding. Must produce address_prefix when combined with pubkey_format, address_encoding, and checksum." }, "address_prefix": { "type": "string", "minLength": 1, "maxLength": 1, "$comment": "Address prefix character (e.g., 'g'). Runtime MUST enforce: all valid addresses start with this prefix. This is derived from version_byte + encoding + checksum algorithm." }, "pubkey_format": { "type": "string", "enum": ["secp256k1-compressed-hex"] }, "address_encoding": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["base58"] } }, "preferred_encoding": { "type": "string", "enum": ["base58"] }, "payload": { "type": "string", "minLength": 1 }, "checksum": { "type": "string", "minLength": 1, "$comment": "Checksum algorithm specification. Format: 'SHA256(version_byte||h160)[0..4] (custom-checksum-v1, not base58check)'. CRITICAL: Algorithm details: (1) version_byte = 1 byte (0x62 = 98), (2) h160 = RIPEMD160(SHA256(pubkey_compressed)) = 20 bytes, (3) concat = version_byte || h160 (21 bytes), (4) hash = SHA256(concat) = 32 bytes, (5) checksum = hash[0..4] = first 4 bytes, (6) endianness: all values in big-endian, (7) address = base58(version_byte || h160 || checksum). Test vectors required for mainnet (problems.txt H3)." }, "address_test_vector": { "type": "object", "required": ["pubkey", "address"], "additionalProperties": false, "properties": { "note": { "type": "string", "$comment": "Optional note for illustrative test vectors (e.g., 'Illustrative only; pubkey not curve-valid')" }, "pubkey": { "type": "string", "pattern": "^[0-9a-f]{66}$", "$comment": "Compressed secp256k1 public key (hex, 66 chars: 0x02/0x03 + 64 hex chars). For production, must be a valid secp256k1 curve point. For illustrative test vectors, may be a placeholder with note." }, "address": { "$ref": "#/$defs/base58_address", "$comment": "Corresponding address (must start with address_prefix)" }, "checksum_verification": { "type": "object", "required": ["version_byte_hex", "h160_hex", "checksum_input_hex", "checksum_output_hex", "checksum_bytes_hex"], "additionalProperties": false, "properties": { "version_byte_hex": { "type": "string", "pattern": "^[0-9a-f]{2}$", "$comment": "Version byte in hex (e.g., '62' for 98)" }, "h160_hex": { "type": "string", "pattern": "^[0-9a-f]{40}$", "$comment": "RIPEMD160(SHA256(pubkey)) in hex (20 bytes = 40 hex chars)" }, "checksum_input_hex": { "type": "string", "pattern": "^[0-9a-f]{42}$", "$comment": "version_byte || h160 in hex (21 bytes = 42 hex chars)" }, "checksum_output_hex": { "type": "string", "pattern": "^[0-9a-f]{64}$", "$comment": "SHA256(checksum_input) in hex (32 bytes = 64 hex chars)" }, "checksum_bytes_hex": { "type": "string", "pattern": "^[0-9a-f]{8}$", "$comment": "First 4 bytes of checksum_output in hex (4 bytes = 8 hex chars)" } }, "$comment": "Checksum verification test vector: step-by-step breakdown of checksum calculation. CRITICAL for mainnet: all implementations MUST produce identical checksum from same inputs. Endianness: all values in big-endian (network byte order)." } }, "$comment": "Test vector: pubkey → address mapping for wallet/node implementation verification. This ensures all implementations produce the same address from the same public key. For production, pubkey must be a valid secp256k1 compressed public key. If using a placeholder pubkey, include a 'note' field explaining it's illustrative only. CRITICAL: checksum_verification field provides step-by-step checksum calculation for custom-checksum-v1 algorithm verification (problems.txt H3)." } } }, "consensus": { "type": "object", "required": ["type", "description", "window_ms", "network_clock_skew_ms", "time_source", "committee", "notary_registry", "finality_certificate", "notary_envelope", "state_root"], "additionalProperties": false, "properties": { "type": { "type": "string", "const": "blockless-quorum" }, "description": { "type": "string", "minLength": 1 }, "window_ms": { "type": "integer", "minimum": 1 }, "network_clock_skew_ms": { "type": "integer", "minimum": 1, "$comment": "Maximum allowed clock skew between nodes for P2P network synchronization (ms). Used for notary-median time source. This is different from tx_rules.timestamp_rule which is for mempool admission window (transaction age limit). network_clock_skew_ms controls consensus time synchronization, while timestamp_rule controls mempool admission." }, "time_source": { "type": "object", "required": ["mode", "fallback", "skew_enforcement_ms"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["notary-median"], "$comment": "Time source mode: notary-median = use median of notary timestamps for consensus time. CRITICAL: This defines 'now' for finalization. For mempool admission, 'now' = local validator time (NTP-synced). For finalization, 'now' = median(notary_time) from committee." }, "fallback": { "type": "string", "enum": ["system-ntp"], "$comment": "Fallback time source if notary-median is unavailable (uses system NTP time)" }, "skew_enforcement_ms": { "type": "integer", "minimum": 0, "$comment": "Skew enforcement interval in milliseconds. Runtime: skew_enforcement_ms <= network_clock_skew_ms." } }, "$comment": "Time source definition: CRITICAL distinction between mempool 'now' (local validator time) and finalization 'now' (median of notary timestamps). This prevents mempool/finalization timestamp mismatch." }, "committee": { "type": "object", "required": ["mode", "epoch_ms", "quorum_rule", "bootstrap"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["all-active-notaries"], "$comment": "Committee mode: all-active-notaries means all active notaries are in the committee. Committee size N = count(active_notaries) per epoch, quorum calculated from actual N. SCALING NOTE: With large committees (N > 256), certificate size grows (O(N) signatures). Current limit: max_signers=256 in finality_certificate.encoding. For N > 256, runtime MUST: (1) Select subset of active notaries (top 256 by effective_stake), OR (2) Use committee shards (multiple certificates), OR (3) Switch to BLS aggregation (constant size). CRITICAL: max_signers=256 is hard limit - cannot exceed without aggregation/sharding." }, "epoch_ms": { "type": "integer", "minimum": 1 }, "committee_size": { "type": ["integer", "null"], "minimum": 1, "$comment": "DEPRECATED: Not used in all-active-notaries mode. Committee size is determined by count(active_notaries) per epoch. Kept for backward compatibility only." }, "quorum_rule": { "type": "object", "required": ["type", "num", "den", "round_up"], "additionalProperties": false, "properties": { "type": { "type": "string", "const": "fraction" }, "num": { "type": "integer", "minimum": 1 }, "den": { "type": "integer", "minimum": 1 }, "round_up": { "type": "boolean" } }, "$comment": "Runtime: num<=den; quorum in [1..committee_size]." }, "selection": { "type": "object", "required": ["rng", "vrf_alg", "seed_source", "weight", "vrf_key_required", "vrf_pubkey_format"], "additionalProperties": false, "properties": { "rng": { "type": "string", "const": "vrf" }, "vrf_alg": { "type": "string", "enum": ["ed25519-vrf"] }, "seed_source": { "type": "string", "enum": ["prev_epoch_beacon"] }, "weight": { "type": "string", "enum": ["stake"] }, "vrf_key_required": { "type": "boolean", "$comment": "If true, VRF keys are required (separate from signing_keys for genesis/upgrade). VRF keys use ed25519-vrf, signing_keys use ecdsa-secp256k1." }, "vrf_pubkey_format": { "type": "string", "enum": ["ed25519-pubkey-hex"], "$comment": "Format for VRF public keys (ed25519-pubkey-hex = 66 chars hex starting with 02/03/04)" }, "max_committee_size": { "type": "integer", "minimum": 1, "default": 256, "$comment": "Maximum committee size for certificate signing (default: 256, matches finality_certificate.encoding.max_signers). When active_notaries > max_committee_size, runtime MUST use committee_cap_policy to select subset. This prevents O(N) certificate size growth. CRITICAL: This is NOT a decentralization limit - it's a certificate size limit. All active notaries can still participate in consensus, but only selected subset signs certificates." }, "committee_cap_policy": { "type": "object", "required": ["mode", "selection_algorithm", "algorithm"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["vrf-top-stake", "top-stake", "vrf-sample"], "$comment": "Selection mode when active_notaries > max_committee_size: vrf-top-stake = VRF selection from top N by effective_stake (recommended), top-stake = deterministic top N by stake, vrf-sample = pure VRF from all notaries" }, "selection_algorithm": { "type": "string", "minLength": 1, "$comment": "Formal selection algorithm description. Runtime MUST implement this exact algorithm to prevent consensus divergence. Example: 'sort_by_effective_stake_desc_then_vrf_sample_top_n' = (1) Sort by effective_stake descending, (2) Take top max_committee_size, (3) VRF sample from this group" }, "algorithm": { "type": "object", "required": ["effective_stake_formula", "sorting", "top_candidates_multiplier", "vrf_selection", "stability_rule"], "additionalProperties": false, "properties": { "effective_stake_formula": { "type": "string", "$comment": "Formula for calculating effective_stake. Must be deterministic. Example: 'stake.amount' = direct stake amount from state.registries.notary[address].stake.amount at epoch boundary snapshot." }, "sorting": { "type": "object", "required": ["primary_key", "primary_order", "tie_break_key", "tie_break_order"], "additionalProperties": false, "properties": { "primary_key": { "type": "string", "$comment": "Primary sort key (e.g., 'effective_stake')" }, "primary_order": { "type": "string", "enum": ["asc", "desc"], "$comment": "Sort order for primary key" }, "tie_break_key": { "type": "string", "$comment": "Tie-break key when primary key values are equal (e.g., 'address')" }, "tie_break_order": { "type": "string", "enum": ["asc", "desc"], "$comment": "Sort order for tie-break key" } }, "$comment": "Sorting specification with tie-break rules. Prevents consensus divergence in selection order." }, "top_candidates_multiplier": { "type": "integer", "minimum": 1, "$comment": "Multiplier for top candidates pool. M = min(count(eligible), max_committee_size * multiplier). Larger multiplier allows more VRF randomness but increases computation." }, "vrf_selection": { "type": "object", "required": ["seed_source", "seed_format", "seed_endian", "permutation_algorithm", "output_count"], "additionalProperties": false, "properties": { "seed_source": { "type": "string", "const": "prev_epoch_beacon", "$comment": "Source of VRF seed" }, "seed_format": { "type": "string", "const": "sha256(gls-det-1(prev_epoch_finality_certificate))", "$comment": "32-byte seed: SHA256 over canonicalized previous epoch certificate" }, "seed_endian": { "type": "string", "const": "big", "$comment": "Seed bytes in network byte order" }, "permutation_algorithm": { "type": "string", "const": "fisher-yates-shuffle", "$comment": "Deterministic shuffle of notary list using VRF output" }, "output_count": { "type": "string", "const": "max_committee_size", "$comment": "Select exactly max_committee_size notaries" } }, "$comment": "VRF selection specification with exact seed format and endianness. Prevents consensus divergence in VRF usage." }, "stability_rule": { "type": "string", "$comment": "Stability guarantee. Must be deterministic given epoch state and VRF seed. Example: 'deterministic_given_epoch_state_and_vrf_seed'" } }, "$comment": "Formal deterministic algorithm specification. Runtime MUST implement exactly as specified to prevent consensus divergence. Includes effective_stake calculation, sorting with tie-break, top candidates selection, VRF permutation, and stability guarantees." } }, "$comment": "Committee cap policy with formal deterministic algorithm specification. Prevents consensus divergence where different clients implement different selection logic. All active notaries participate in consensus, but only selected subset signs certificates." } }, "$comment": "VRF selection: VRF keys are separate from signing_keys. signing_keys (secp256k1) are for genesis/upgrade, VRF keys (ed25519) are for committee selection. CRITICAL SCALING (problems.txt H1): When active_notaries > max_committee_size (default 256), runtime MUST: (1) Sort all active notaries by effective_stake (descending), (2) Use VRF to select top max_committee_size notaries for certificate signing, (3) All notaries still participate in consensus (voting, state updates), but only selected subset signs finality certificates. This prevents certificate size from exceeding max_signers=256 limit." }, "activation_delay_epochs": { "type": "integer", "minimum": 0 }, "churn_limit": { "type": "object", "required": ["enter_frac", "exit_frac"], "additionalProperties": false, "properties": { "enter_frac": { "$ref": "#/$defs/unit_interval" }, "exit_frac": { "$ref": "#/$defs/unit_interval" } }, "$comment": "Runtime: enter_frac + exit_frac < 0.2 (recommended). DEPRECATED in all-active-notaries mode (not applicable)." }, "bootstrap": { "type": "object", "required": ["enabled", "initial_members", "initial_committee_size", "exit_condition"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean", "$comment": "If true, bootstrap mode is active. In bootstrap mode, committee is fixed to initial_members until exit_condition is met." }, "initial_members": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "$comment": "List of kid (key identifiers) for initial bootstrap committee members. These are the first 5 notaries at genesis." }, "initial_committee_size": { "type": "integer", "minimum": 1, "$comment": "Initial committee size during bootstrap (e.g., 5). Quorum is calculated from this size: ceil(num/den * initial_committee_size)." }, "exit_condition": { "type": "object", "required": ["type", "min"], "additionalProperties": false, "properties": { "type": { "type": "string", "enum": ["min_active_notaries"], "$comment": "Exit condition type: min_active_notaries means exit bootstrap when count(active_notaries) >= min" }, "min": { "type": "integer", "minimum": 1, "$comment": "Minimum number of active notaries required to exit bootstrap mode (e.g., 6). Once this threshold is reached, committee automatically switches to all-active-notaries mode." } }, "$comment": "Exit condition: when met, bootstrap mode ends and committee becomes all-active-notaries. Example: type='min_active_notaries', min=6 means exit when 6+ active notaries exist." } }, "$comment": "Bootstrap configuration: initial fixed committee (e.g., 5 members) until enough active notaries exist (e.g., 6+). After exit_condition is met, committee becomes all-active-notaries (N = count(active_notaries))." } } }, "notary_registry": { "type": "object", "required": ["min_stake", "bonding_ms", "unbonding_ms", "slash", "key_rotation", "identity_spec"], "additionalProperties": false, "properties": { "min_stake": { "$ref": "#/$defs/non_negative_int" }, "bonding_ms": { "type": "integer", "minimum": 0 }, "unbonding_ms": { "type": "integer", "minimum": 0 }, "slash": { "type": "object", "required": ["double_sign", "surround_vote"], "additionalProperties": false, "properties": { "double_sign": { "$ref": "#/$defs/unit_interval" }, "surround_vote": { "$ref": "#/$defs/unit_interval" } } }, "key_rotation": { "type": "object", "required": ["min_interval_ms"], "additionalProperties": false, "properties": { "min_interval_ms": { "type": "integer", "minimum": 0 } }, "$comment": "Key rotation policy: minimum interval between key rotations" }, "identity_spec": { "type": "object", "required": ["consensus_pubkey_format", "vrf_pubkey_format", "proof_of_possession_required"], "additionalProperties": false, "properties": { "consensus_pubkey_format": { "type": "string", "enum": ["secp256k1-compressed-hex"], "$comment": "Format for consensus signing public key (for notary certificates). Must match signing_keys format (ecdsa-secp256k1)." }, "vrf_pubkey_format": { "type": "string", "enum": ["ed25519-pubkey-hex"], "$comment": "Format for VRF public key (for committee selection). Must match consensus.committee.selection.vrf_pubkey_format. Format: 66 chars hex starting with 02/03/04." }, "proof_of_possession_required": { "type": "boolean", "$comment": "If true, notary must provide proof of possession (signature binding) linking consensus_pubkey and vrf_pubkey to the same notary identity. Prevents key substitution attacks." }, "rotation_rules": { "type": "object", "required": ["consensus_key_rotation", "vrf_key_rotation"], "additionalProperties": false, "properties": { "consensus_key_rotation": { "type": "string", "enum": ["independent", "coupled"], "$comment": "Independent = consensus key can rotate separately from VRF key. Coupled = both keys must rotate together." }, "vrf_key_rotation": { "type": "string", "enum": ["independent", "coupled"], "$comment": "Independent = VRF key can rotate separately from consensus key. Coupled = both keys must rotate together." } }, "$comment": "Key rotation rules: defines whether consensus and VRF keys can rotate independently or must rotate together." } }, "$comment": "Notary identity specification: defines required keys (consensus_pubkey for certificates, vrf_pubkey for committee selection) and binding rules. CRITICAL: Both keys must be part of notary identity in state registry to prevent key substitution attacks." } } }, "finality_certificate": { "type": "object", "required": ["hash_alg", "alg", "encoding"], "additionalProperties": false, "properties": { "hash_alg": { "type": "string", "enum": ["sha256"] }, "alg": { "type": "string", "const": "ecdsa-secp256k1-multi" }, "encoding": { "type": "object", "additionalProperties": { "type": "object", "properties": { "max_signers": { "type": "integer", "minimum": 1, "maximum": 256, "$comment": "Maximum number of signers in certificate. For all-active-notaries mode with large committees, this limits certificate size. Runtime MUST enforce: len(signatures) <= max_signers. Recommended: 256 for ecdsa-secp256k1-multi (prevents O(N) signature collection overhead). For future: BLS aggregation can support unlimited signers with constant-size signature." } } } } }, "$comment": "Production: choose ONE canonical algorithm per network (runtime enforces). max_signers=256 limits certificate size for all-active-notaries mode, preventing O(N) signature collection overhead. Future: BLS aggregation can support unlimited signers." }, "notary_envelope": { "type": "object", "required": ["schema_ref", "sign_domain", "equivocation_policy"], "additionalProperties": false, "properties": { "schema_ref": { "type": "string", "minLength": 1 }, "sign_domain": { "$ref": "#/$defs/sign_domain_array" }, "equivocation_policy": { "type": "object", "required": ["action", "ban_ms"], "additionalProperties": false, "properties": { "action": { "type": "string", "enum": ["ban"] }, "ban_ms": { "type": "integer", "minimum": 0 } } } } }, "state_root": { "type": "object", "required": ["algorithm", "canonicalization", "model", "scope", "input"], "additionalProperties": false, "properties": { "algorithm": { "type": "string", "enum": ["sha256"], "$comment": "Hash algorithm for state root computation" }, "canonicalization": { "type": "string", "pattern": "^gls-det-[0-9]+$", "$comment": "Canonicalization method for state root computation" }, "model": { "type": "string", "enum": ["hash-of-canonical-json"], "$comment": "State root computation model: hash-of-canonical-json = SHA256(UTF8(gls-det-1(state_object)))" }, "scope": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["state.accounts", "state.aliases", "state.registries"], "$comment": "State root scope: which state sections are included" }, "$comment": "State root includes: accounts, aliases, registries (from genesis.state). Excludes: mempool, logs, metrics, audit namespaces." }, "input": { "type": "string", "const": "gls-det-1({accounts,aliases,registries})", "$comment": "Input format: canonicalized JSON object containing only scope fields" }, "note": { "type": "string", "minLength": 1, "$comment": "Optional note clarifying state root computation and exclusions" } }, "$comment": "State root definition: defines how state_root, registry_root, and committee_root are computed. Model: hash-of-canonical-json = SHA256(UTF8(gls-det-1({accounts,aliases,registries}))). Required for independent validators to reproduce state roots." } } }, "intrinsics": { "type": "object", "required": ["determinism", "registry", "dispatch", "security"], "additionalProperties": false, "properties": { "security": { "type": "object", "required": ["enclave"], "additionalProperties": false, "properties": { "enclave": { "type": "object", "required": ["enabled"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "attestation": { "type": "string", "enum": ["sgx", "tz", "wasm-shield"] }, "verification_required": { "type": "boolean" } }, "allOf": [ { "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["attestation"] } } ] } } }, "determinism": { "type": "object", "required": ["profile", "io", "state_access"], "additionalProperties": false, "properties": { "profile": { "type": "string", "enum": ["pure-deterministic"] }, "io": { "type": "object", "required": ["network", "filesystem", "clock"], "additionalProperties": false, "properties": { "network": { "type": "string", "enum": ["denied"] }, "filesystem": { "type": "string", "enum": ["denied"] }, "clock": { "type": "string", "enum": ["logical-only"] } } }, "state_access": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } } } }, "registry": { "type": "array", "minItems": 1, "items": { "type": "object", "required": ["name", "version"], "additionalProperties": true, "properties": { "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } } } }, "dispatch": { "type": "object", "required": ["resolver", "policy", "semver", "unknown_method"], "additionalProperties": false, "properties": { "resolver": { "type": "string", "enum": ["max-satisfying"] }, "policy": { "type": "string", "enum": ["prefer_latest_minor"] }, "semver": { "type": "object", "required": ["allow", "deny"], "additionalProperties": false, "properties": { "allow": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "deny": { "type": "array", "items": { "type": "string", "minLength": 1 } } } }, "unknown_method": { "type": "string", "enum": ["reject"] } } } } }, "smart_ops_spec": { "type": "object", "required": ["types", "limits"], "additionalProperties": false, "properties": { "types": { "type": "array", "items": { "type": "object", "required": ["op", "schema", "semantics"], "additionalProperties": false, "properties": { "op": { "type": "string", "enum": ["assert.time", "assert.balance", "assert.compare", "transfer", "emit.event"] }, "schema": { "type": "object", "additionalProperties": true }, "semantics": { "type": "string", "minLength": 1 } } } }, "limits": { "type": "object", "required": ["max_ops", "max_ops_bytes", "max_event_data_bytes"], "additionalProperties": false, "properties": { "max_ops": { "type": "integer", "minimum": 1 }, "max_ops_bytes": { "type": "integer", "minimum": 1 }, "max_event_data_bytes": { "type": "integer", "minimum": 1, "$comment": "Maximum event data size in BYTES (not characters). Runtime MUST enforce: byteLength(UTF-8(event.data)) <= max_event_data_bytes. This is different from emit.event.schema.data.maxLength (1024) which counts characters in JSON Schema. For multi-byte UTF-8 characters (e.g., emoji, non-ASCII), byte limit takes precedence over character count. Runtime rule: byteLength(UTF-8(data)) <= 1024." } } } } }, "parameters": { "type": "object", "required": ["fees", "currency", "limits", "treasury_address", "kv_limits", "mempool", "gate"], "additionalProperties": false, "properties": { "fees": { "type": "object", "required": ["base", "per_byte", "currency"], "additionalProperties": false, "properties": { "base": { "type": "integer", "minimum": 0 }, "per_byte": { "type": "integer", "minimum": 0 }, "raw_per_byte": { "type": "integer", "minimum": 0, "$comment": "Optional: only present when raw_policy.allowed=true. For mainnet-hard (raw_policy.allowed=false), this field is omitted (no dead parameters)." }, "currency": { "type": "string", "minLength": 1 } }, "$comment": "Fee structure: base + per_byte. raw_per_byte is optional and only present when raw_policy.allowed=true (not for mainnet-hard). Runtime MUST enforce: if raw_policy.allowed=false, then raw_per_byte must be omitted." }, "currency": { "type": "object", "required": ["symbol", "decimals", "fee_unit", "name"], "additionalProperties": false, "properties": { "symbol": { "type": "string", "minLength": 1 }, "decimals": { "type": "integer", "minimum": 0, "maximum": 18 }, "fee_unit": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 } }, "$comment": "Runtime: currency.symbol must equal parameters.fees.currency and tx_rules.fees_currency." }, "limits": { "type": "object", "required": ["max_tx_size", "max_signatures"], "additionalProperties": false, "properties": { "max_tx_size": { "type": "integer", "minimum": 1 }, "max_signatures": { "type": "integer", "minimum": 1 } } }, "treasury_address": { "$ref": "#/$defs/base58_address" }, "kv_limits": { "type": "object", "required": ["value_max_bytes"], "additionalProperties": false, "properties": { "value_max_bytes": { "type": "integer", "minimum": 1 }, "raw_soft_cap_bytes": { "type": "integer", "minimum": 1, "$comment": "Optional: only present when raw_policy.allowed=true. For mainnet-hard (raw_policy.allowed=false), this field is omitted." }, "tx_raw_ttl_ms": { "type": "integer", "minimum": 0, "$comment": "Optional: only present when raw_policy.allowed=true. For mainnet-hard (raw_policy.allowed=false), this field is omitted." } }, "$comment": "KV limits: value_max_bytes is always required. raw_soft_cap_bytes and tx_raw_ttl_ms are optional and only present when raw_policy.allowed=true (not for mainnet-hard)." }, "mempool": { "type": "object", "required": ["max_pending_per_address", "max_pending_bytes_per_address", "reject_siblings_on_prev_hash", "reject_duplicate_prev_hash", "priority", "ttl_ms"], "additionalProperties": false, "properties": { "max_pending_per_address": { "type": "integer", "minimum": 1 }, "max_pending_bytes_per_address": { "type": "integer", "minimum": 1 }, "reject_siblings_on_prev_hash": { "type": "boolean" }, "reject_duplicate_prev_hash": { "type": "boolean" }, "priority": { "type": "string", "minLength": 1 }, "ttl_ms": { "type": "integer", "minimum": 0 } } }, "gate": { "type": "object", "required": ["ttl_ms", "max_per_address", "max_total", "eviction", "on_expire"], "additionalProperties": false, "properties": { "ttl_ms": { "type": "integer", "minimum": 0 }, "max_per_address": { "type": "integer", "minimum": 1 }, "max_total": { "type": "integer", "minimum": 1 }, "eviction": { "type": "string", "enum": ["lru"] }, "on_expire": { "type": "string", "enum": ["reject"] } } } } }, "tx_rules": { "type": "object", "required": ["tx_hash", "signing_view_exclude", "time_window_ms", "timestamp_rule", "admission_skew_ms", "finalization_skew_ms", "now_definition", "max_tx_size", "min_fee", "fees_currency", "require_prev_hash", "fee_policy_composition", "fee_calculation", "mempool_priority", "raw_policy", "methods_policy", "signature_binding", "signing_domain_rule", "fair_ordering"], "additionalProperties": false, "properties": { "tx_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "$comment": "Canonical transaction hash with prefix. Preimage: SHA256(UTF8(gls-det-1(tx_without_signatures_and_content_hash))) using tx_rules.signing_view_exclude." }, "signing_view_exclude": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "time_window_ms": { "type": "integer", "minimum": 0 }, "timestamp_rule": { "type": "string", "minLength": 1, "$comment": "Mempool admission rule: maximum transaction age (e.g., 'abs(tx.timestamp - now) <= 59000'). This is different from consensus.network_clock_skew_ms which is for P2P clock synchronization. timestamp_rule controls mempool admission window, while network_clock_skew_ms controls consensus time synchronization. CRITICAL PROTOCOL (problems.txt H2): Formal definition of 'now': (1) Mempool admission: 'now' = local_validator_time (system clock, NTP-synced). Validator checks timestamp_rule using local time before admitting tx to mempool. (2) Finalization: 'now' = median(notary_time) from committee (consensus.network_clock_skew_ms tolerance). Notaries use median time for finalization certificate timestamp. This distinction prevents mempool/finalization mismatch - mempool uses local time (fast admission), finalization uses consensus time (agreed by committee)." }, "admission_skew_ms": { "type": "integer", "minimum": 1, "$comment": "Mempool admission window: maximum transaction age in milliseconds (e.g., 5000ms = 5 seconds for mainnet-hard). This is the window for mempool admission using local_validator_time. Must be wider than finalization_skew_ms to allow some clock drift, but tight enough to prevent DoS attacks (recommended: 2-5 seconds for mainnet-hard)." }, "finalization_skew_ms": { "type": "integer", "minimum": 1, "$comment": "Finalization window: maximum timestamp skew for consensus finalization in milliseconds (e.g., 500ms). This MUST match consensus.network_clock_skew_ms for consistency. Used with notary_median_time for finalization. Must be tight to prevent consensus divergence (recommended: 500ms to match network_clock_skew_ms)." }, "timestamp_max_skew_ms": { "type": "integer", "minimum": 1, "$comment": "Use admission_skew_ms instead. Kept for backward compatibility. Mempool admission window: maximum transaction age in milliseconds. This is the numeric value corresponding to timestamp_rule. Different from consensus.network_clock_skew_ms (P2P clock skew for consensus time)." }, "now_definition": { "type": "object", "required": ["mempool", "finalization"], "additionalProperties": false, "properties": { "mempool": { "type": "string", "enum": ["local_validator_time"], "$comment": "Time source for mempool admission: 'local_validator_time' = system clock (NTP-synced) on validator node. Used when checking timestamp_rule during mempool admission. This allows fast admission without waiting for consensus time." }, "finalization": { "type": "string", "enum": ["notary_median_time"], "$comment": "Time source for finalization: 'notary_median_time' = median(notary_time) from committee, computed using consensus.time_source.mode (notary-median). Used when creating finality certificates and validating transaction timestamps during finalization. This ensures all nodes agree on 'now' for finalization." } }, "$comment": "Formal definition of 'now' for timestamp validation. Prevents mempool/finalization mismatch by using different time sources: mempool uses local time (fast), finalization uses consensus time (agreed). Runtime MUST implement both correctly." }, "max_tx_size": { "type": "integer", "minimum": 1 }, "min_fee": { "$ref": "#/$defs/decimal" }, "fees_currency": { "type": "string", "minLength": 1 }, "require_prev_hash": { "oneOf": [{ "type": "boolean" }, { "type": "string", "enum": ["per-address-seq"] }], "$comment": "Prev hash requirement policy. Boolean true = always required. String 'per-address-seq' = null allowed only for first tx per address (when accounts[from].last_tx_hash==null). For subsequent transactions, prev_hash MUST equal accounts[from].last_tx_hash." }, "fee_type_in_signing_view": { "type": "string", "enum": ["string"], "$comment": "Fee type in signing_view - must be string for consensus safety. All numeric fee values in signing_view MUST be serialized as strings (not integers) to prevent consensus divergence between implementations (JS number vs bigint vs string). Rule: fee in signing_view = string representation of decimal(8) value." }, "fee_policy_composition": { "type": "string", "minLength": 1 }, "fee_calculation": { "type": "object", "maxProperties": 32, "propertyNames": { "type": "string", "pattern": "^[a-z0-9_.-]+$" }, "additionalProperties": true }, "mempool_priority": { "type": "object", "maxProperties": 32, "propertyNames": { "type": "string", "pattern": "^[a-z0-9_.-]+$" }, "additionalProperties": true }, "raw_policy": { "type": "object", "required": ["allowed"], "additionalProperties": false, "allOf": [ { "if": { "properties": { "allowed": { "const": false } } }, "then": { "$comment": "When allowed=false, only 'note' field is present. All other raw-related fields are omitted to avoid dead parameters in production profile." } }, { "if": { "properties": { "allowed": { "const": true } } }, "then": { "required": ["encoding", "max_raw_bytes", "require_hash", "bind_in_signature", "mime_allowed", "pii_allowed", "encryption", "tx_raw_ttl_ms"], "properties": { "encoding": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "max_raw_bytes": { "type": "integer", "minimum": 0 }, "require_hash": { "type": "boolean" }, "bind_in_signature": { "type": "boolean" }, "mime_allowed": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "pii_allowed": { "type": "boolean" }, "encryption": { "type": "array", "items": { "type": "string", "enum": ["none"] }, "$comment": "AES-GCM disabled until full IV/AAD/tag/key specification is standardized. Enable only when protocol.crypto_specs defines parameters." }, "tx_raw_ttl_ms": { "type": "integer", "minimum": 0 } } } } ], "properties": { "allowed": { "type": "boolean", "$comment": "If false, raw transactions are disabled and all raw-related fields are omitted (mainnet-hard: no dead parameters)" }, "note": { "type": "string", "minLength": 1, "$comment": "Optional note clarifying that raw is disabled (mainnet-hard: no dead parameters). Only present when allowed=false." } }, "$comment": "Raw policy: when allowed=false, only 'note' field is present (no dead parameters). When allowed=true, all raw-related fields are required. All numeric as integer. No formulas in schema; if you need dynamic rule, keep it in canon_specs + runtime validator." }, "methods_policy": { "type": "object", "required": ["max_methods", "max_methods_bytes", "types", "cosign", "binding"], "additionalProperties": false, "properties": { "max_methods": { "type": "integer", "minimum": 1 }, "max_methods_bytes": { "type": "integer", "minimum": 1 }, "types": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "cosign": { "type": "object", "required": ["sig_encoding", "kid_format", "deadline_required", "require_approver_address_match", "rate_limit", "action_fee", "sign_domain"], "additionalProperties": false, "properties": { "sig_encoding": { "type": "string", "minLength": 1 }, "kid_format": { "type": "string", "minLength": 1 }, "deadline_required": { "type": "boolean" }, "require_approver_address_match": { "type": "boolean" }, "rate_limit": { "type": "object", "required": ["per_approver_per_minute"], "additionalProperties": false, "properties": { "per_approver_per_minute": { "type": "integer", "minimum": 1 } } }, "action_fee": { "type": "object", "required": ["enabled", "amount", "currency"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "amount": { "type": "integer", "minimum": 0 }, "currency": { "type": "string", "minLength": 1 } } }, "sign_domain": { "$ref": "#/$defs/sign_domain_array" } } }, "binding": { "type": "string", "minLength": 1 } } }, "signature_binding": { "type": "string", "minLength": 1 }, "signing_domain_rule": { "type": "object", "required": ["domain_source", "domain_field_purpose", "domain_field_validation", "message_to_sign_includes"], "additionalProperties": false, "properties": { "domain_source": { "type": "string", "const": "protocol.sign_domains.tx", "$comment": "Full signing domain array source" }, "domain_field_purpose": { "type": "string", "const": "identifier", "$comment": "Domain field is marker only" }, "domain_field_validation": { "type": "string", "const": "must_match_first_element", "$comment": "Domain field must equal protocol.sign_domains.tx[0]" }, "message_to_sign_includes": { "type": "string", "const": "full_domain_array", "$comment": "Signing message includes full domain array to prevent cross-chain reuse" } }, "$comment": "Explicit signing domain binding rule. Clarifies that domain field in signatures is only an identifier, while actual signing uses full protocol.sign_domains.tx array. Prevents cross-chain/cross-version signature reuse attacks by ensuring signatures are bound to specific chain/version." }, "fair_ordering": { "type": "object", "required": ["mode"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["none", "vrf", "commit-reveal"] } } } }, "$comment": "Runtime: enforce tx_rules.max_tx_size == parameters.limits.max_tx_size and fees_currency == parameters.currency.symbol." }, "tx_schema": { "type": "object", "required": ["smart", "governance", "notary_registry"], "additionalProperties": false, "properties": { "smart": { "type": "object", "required": ["$schema", "$id", "title", "type", "required", "additionalProperties"], "additionalProperties": false, "properties": { "$schema": { "type": "string", "format": "uri" }, "$id": { "type": "string", "format": "uri" }, "title": { "type": "string", "minLength": 1 }, "type": { "type": "string", "const": "object" }, "required": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "additionalProperties": { "type": "boolean" }, "properties": { "type": "object", "description": "Full property definitions for regulator/auditor compliance", "additionalProperties": true, "patternProperties": { "^[a-z_][a-z0-9_]*$": { "type": "object", "description": "Property definition following JSON Schema property format" } } } } }, "governance": { "type": "object", "required": ["$schema", "$id", "title", "type", "required", "additionalProperties"], "additionalProperties": false, "properties": { "$schema": { "type": "string", "format": "uri" }, "$id": { "type": "string", "format": "uri" }, "title": { "type": "string", "minLength": 1 }, "type": { "type": "string", "const": "object" }, "required": { "type": "array", "items": { "type": "string" } }, "additionalProperties": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" } ] } }, "$comment": "Governance transaction schema. Defines structure for governance.upgrade, governance.pause, and governance.unpause transactions. Must include type, method, from, fee, currency, prev_hash, timestamp, signatures, and type-specific fields (upgrade_target, pause_reason, unpause_justification)." }, "notary_registry": { "type": "object", "required": ["$schema", "$id", "title", "type", "required", "additionalProperties"], "additionalProperties": false, "properties": { "$schema": { "type": "string", "format": "uri" }, "$id": { "type": "string", "format": "uri" }, "title": { "type": "string", "minLength": 1 }, "type": { "type": "string", "const": "object" }, "required": { "type": "array", "items": { "type": "string" } }, "additionalProperties": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" } ] } }, "$comment": "Notary registry transaction schema. Defines structure for notary.registry transactions. Must include type, method, from, fee, currency, prev_hash, timestamp, signatures, and registry_data (consensus_pubkey, vrf_pubkey, proof_of_possession)." } } }, "schemas": { "type": "object", "required": ["notary_certificate_v2", "execution_receipt_v1"], "additionalProperties": false, "properties": { "execution_receipt_v1": { "type": "object", "required": ["$schema", "$id", "type", "required", "additionalProperties", "properties"], "additionalProperties": false, "properties": { "$schema": { "type": "string", "format": "uri", "const": "https://json-schema.org/draft/2020-12/schema" }, "$id": { "type": "string", "format": "uri", "const": "stels://schemas/execution-receipt-v1.json" }, "type": { "type": "string", "const": "object" }, "required": { "type": "array", "items": { "type": "string" }, "contains": { "enum": ["epoch", "worker_id", "tx_hash", "ops_hash", "ops_count", "state_root", "notary_certificate"] }, "$comment": "Required fields: epoch, worker_id, tx_hash, ops_hash, ops_count, state_root, notary_certificate" }, "additionalProperties": { "type": "boolean", "const": false }, "properties": { "type": "object", "additionalProperties": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "object" }, { "type": "array" } ] }, "$comment": "Properties: epoch (integer, minimum 0), worker_id (string, minLength 1), tx_hash (string, pattern ^[0-9a-f]{64}$), ops_hash (string, pattern ^[0-9a-f]{64}$), ops_count (integer, minimum 0), state_root (string, pattern ^[0-9a-f]{64}$), notary_certificate (object, $ref: stels://schemas/notary-certificate-v2.json)" } }, "$comment": "Execution receipt schema: proof of worker execution for fee distribution. Referenced by monetary.fee_distribution.worker_verification.proof.schema_ref. ops_hash is computed as: SHA256(UTF8(gls-det-1(ops array only, in execution order))). This ensures all workers compute the same ops_hash for the same operations." }, "notary_certificate_v2": { "type": "object", "required": ["$schema", "$id", "type", "required", "additionalProperties"], "additionalProperties": false, "properties": { "$schema": { "type": "string", "format": "uri" }, "$id": { "type": "string", "format": "uri" }, "type": { "type": "string", "const": "object" }, "required": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "additionalProperties": { "type": "boolean" }, "properties": { "type": "object", "description": "Full property definitions for regulator/auditor compliance", "additionalProperties": true, "patternProperties": { "^[a-z_][a-z0-9_]*$": { "type": "object", "description": "Property definition following JSON Schema property format" } } } } } } }, "state": { "type": "object", "required": ["accounts", "aliases", "registries"], "additionalProperties": false, "properties": { "accounts": { "type": "array", "minItems": 0, "items": { "type": "object", "required": ["address", "balance"], "additionalProperties": false, "properties": { "address": { "$ref": "#/$defs/base58_address" }, "balance": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Balance in base units as string (not integer) to prevent consensus divergence across JS/Rust/Go/Python for values >2^53. All monetary fields (balance, stake.amount, fee, supply) MUST be strings matching /^[0-9]+$/ pattern. No floats, no scientific notation, no implicit type conversion." }, "last_tx_hash": { "type": ["string", "null"] }, "stake": { "type": "object", "required": ["amount", "status"], "additionalProperties": false, "properties": { "amount": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Stake amount in base units as string (not integer) to prevent consensus divergence across JS/Rust/Go/Python for values >2^53. All monetary fields MUST be strings matching /^[0-9]+$/ pattern." }, "locked_until": { "type": ["string", "null"], "format": "date-time" }, "status": { "type": "string", "enum": ["free", "bonding", "active", "unbonding"], "description": "Stake lifecycle status" }, "unbonding": { "type": "array", "minItems": 0, "items": { "$ref": "#/$defs/staking_unbond_entry" } } }, "$comment": "Runtime: stake.amount <= balance+stake.amount (i.e., conservation). eligibility: stake.amount >= min_stake for rewards if required." }, "mined_total": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Mined total in base units as string (not integer) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern." }, "rating": { "type": "integer", "minimum": 0, "maximum": 100 } } } }, "aliases": { "type": "object", "additionalProperties": { "type": "string" } }, "registries": { "type": "object", "required": ["intrinsics", "genesis", "notary"], "additionalProperties": false, "properties": { "intrinsics": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1, "pattern": "^[^@]+@[^@]+$" } }, "genesis": { "$ref": "#/$defs/genesis_hash" }, "notary": { "type": "object", "required": ["registry_root", "total_stake", "epoch", "committee_root"], "additionalProperties": false, "properties": { "registry_root": { "$ref": "#/$defs/sha256_hash" }, "total_stake": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Total stake in base units as string (not integer) to prevent consensus divergence across JS/Rust/Go/Python for values >2^53. All monetary fields MUST be strings matching /^[0-9]+$/ pattern." }, "epoch": { "type": "integer", "minimum": 0 }, "committee_root": { "$ref": "#/$defs/sha256_hash", "$comment": "Merkle root of committee members. At genesis (epoch 0), this is zero (bootstrap value) until first VRF selection (epoch 0→1). First committee is selected using VRF from consensus.committee.selection. Committee root computation: 1) Committee members selected via VRF (ed25519-vrf) from notary registry. 2) Each leaf = canonicalized JSON: gls-det-1({kid: string, pubkey: string (secp256k1-compressed-hex), effective_stake: integer, vrf_pubkey: string (ed25519-pubkey-hex), epoch: integer}). 3) Leaf hash = SHA256(UTF8(gls-det-1(leaf_object))). 4) Merkle tree: internal nodes = SHA256(left_child || right_child), leaves = leaf hash. 5) committee_root = Merkle root (SHA256 hex, 64 chars)." }, "bootstrap": { "type": "boolean", "$comment": "Bootstrap flag: true at genesis (epoch 0) before first VRF committee selection, false after first VRF selection (epoch 0→1). Indicates committee_root is a bootstrap value, not an error." } } } } } } }, "monetary": { "type": "object", "required": ["supply_cap", "minting", "faucet", "rewards", "adaptive_engine", "treasury_policy", "fee_distribution", "rewards_mode_switch", "disclaimer", "circulating_supply_model"], "additionalProperties": false, "properties": { "supply_cap": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Maximum total supply in base units as string (not integer) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern. Runtime invariant: circulating_supply_genesis = sum(state.accounts[*].balance) and uncirculated = virtual_reserve (reward_pool_initial for virtual-ledger mode). Payments from treasury reserve do not create minting, only unlock from reserve. circulating_supply + uncirculated <= supply_cap. NOTE: Current issuance plan (genesis circulating + treasury rewards) describes maximum ~4.25M SLI (20.24% of cap). Remaining 16.75M SLI (79.76% of cap) may be unlocked via future governance upgrades or other mechanisms, but current protocol does not specify automatic issuance beyond treasury rewards." }, "circulating_supply_model": { "type": "object", "required": ["genesis_circulating", "uncirculated_supply", "release_mechanism"], "additionalProperties": false, "properties": { "genesis_circulating": { "type": "string", "const": "sum(state.accounts[*].balance)", "$comment": "Genesis circulating supply = sum of all account balances at genesis" }, "uncirculated_supply": { "type": "string", "enum": ["virtual_treasury_reserve", "physical_treasury_balance"], "$comment": "Uncirculated supply: virtual_treasury_reserve (for virtual-ledger mode) or physical_treasury_balance (for physical-balance mode)" }, "release_mechanism": { "type": "string", "enum": ["treasury_reward_decrement", "treasury_transfer"], "$comment": "Release mechanism: treasury_reward_decrement (decrease reward_pool, increase balances, no minting) or treasury_transfer (transfer from treasury balance)" } }, "$comment": "Circulating supply model: formalizes supply vs circulating relationship for audit/exchange/regulator clarity. Genesis circulating = sum of account balances. Uncirculated = virtual reserve (reward_pool_initial) for virtual-ledger mode. Payments from treasury do not create minting, only unlock from reserve. Minting policy is defined at monetary.minting level (not duplicated here)." }, "minting": { "type": "string", "enum": ["disabled", "enabled"] }, "faucet": { "type": "object", "required": ["rate_per_request", "cooldown_ms"], "additionalProperties": false, "properties": { "rate_per_request": { "type": "integer", "minimum": 0 }, "cooldown_ms": { "type": "integer", "minimum": 0 } } }, "treasury_policy": { "type": "object", "required": ["reward_cap_total", "reward_cap_per_year", "reward_cap_per_epoch", "currency", "reward_pool_mode", "bootstrap_rule"], "additionalProperties": false, "properties": { "reward_cap_total": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Total treasury allocation for bootstrap rewards in base units as string (not integer) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern. Example: 4.2M SLI = '420000000000000' base units" }, "reward_cap_per_year": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Maximum rewards per year from treasury in base units as string (not integer) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern." }, "reward_cap_per_epoch": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Maximum rewards per epoch from treasury in base units as string (not integer) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern." }, "currency": { "type": "string", "minLength": 1 }, "reward_pool_mode": { "type": "string", "enum": ["virtual-ledger", "physical-balance"], "$comment": "virtual-ledger = accounting-only (part of pre-minted supply), physical-balance = actual treasury address balance" }, "reward_pool_initial": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Initial reward pool amount in base units as string (not integer) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern. Must match reward_cap_total for virtual-ledger." }, "accounting": { "type": "string", "enum": ["decrement-only"], "$comment": "Accounting method: decrement-only means pool can only decrease" }, "accounting_model": { "type": "string", "enum": ["virtual-reserve-cap", "treasury-transfer"], "$comment": "Accounting model: virtual-reserve-cap = virtual cap (not physical balance, part of authorized emission cap), treasury-transfer = transfers from treasury_balance (counted in circulating). For virtual-reserve-cap: rewards = decrease reward_pool + increase recipient balances from total supply (no new minting)." }, "bootstrap_rule": { "type": "object", "required": ["enabled", "max_multiplier"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean", "$comment": "If true, treasury rewards are limited by fees collected: treasury_reward_per_epoch <= max_multiplier * fees_collected_per_epoch" }, "max_multiplier": { "$ref": "#/$defs/decimal", "$comment": "Maximum multiplier for bootstrap rule: treasury_reward <= max_multiplier * fees_collected. Recommended: 1.0-3.0. Prevents subsidy-spam economic exploit where treasury rewards exceed real network demand." } }, "$comment": "Bootstrap rule: prevents subsidy-spam exploit by limiting treasury rewards to a multiple of fees collected. Runtime MUST enforce: if enabled, treasury_reward_per_epoch = min(reward_cap_per_epoch, max_multiplier * fees_collected_per_epoch). This ensures treasury only amplifies real demand, not replaces it." } }, "$comment": "Treasury policy: controls bootstrap rewards. When treasury is empty, rewards switch to fee-only mode. reward_pool_mode defines whether pool is virtual (accounting) or physical (treasury address balance). For virtual-ledger mode with accounting_model='virtual-reserve-cap': reward_pool_initial is a virtual cap (not physical balance, part of authorized emission cap) - rewards = decrease reward_pool + increase recipient balances from total supply (no new minting). Bootstrap rule prevents economic exploit where treasury rewards exceed real network fees." }, "fee_distribution": { "type": "object", "required": ["validators_bps", "workers_bps", "treasury_bps", "insurance_bps", "burn_bps", "total_bps", "distribution_addresses", "distribution_rules", "distribution_algorithm"], "additionalProperties": false, "properties": { "validators_bps": { "type": "integer", "minimum": 0, "maximum": 10000, "$comment": "Share of fees to validators/notaries in basis points (e.g., 4000 = 40%)" }, "workers_bps": { "type": "integer", "minimum": 0, "maximum": 10000, "$comment": "Share of fees to workers/execution in basis points (e.g., 3000 = 30%)" }, "treasury_bps": { "type": "integer", "minimum": 0, "maximum": 10000, "$comment": "Share of fees to treasury reserve in basis points (e.g., 2000 = 20%)" }, "insurance_bps": { "type": "integer", "minimum": 0, "maximum": 10000, "$comment": "Share of fees to governance/insurance in basis points (e.g., 1000 = 10%)" }, "burn_bps": { "type": "integer", "minimum": 0, "maximum": 10000, "$comment": "Share of fees to burn (permanently destroyed) in basis points (e.g., 500 = 5%). Creates deflationary pressure and reduces spam incentive." }, "total_bps": { "type": "integer", "const": 10000, "$comment": "Total must equal 10000 basis points (100%). Runtime MUST enforce: validators_bps + workers_bps + treasury_bps + insurance_bps + burn_bps == 10000." }, "distribution_addresses": { "type": "object", "required": ["insurance_address", "treasury_address"], "additionalProperties": false, "properties": { "insurance_address": { "$ref": "#/$defs/base58_address", "$comment": "Insurance/governance address (receives 100% of insurance_bps share)" }, "treasury_address": { "$ref": "#/$defs/base58_address", "$comment": "Treasury address (already defined in parameters.fees.treasury_address, referenced here for clarity)" } }, "$comment": "Fixed addresses for insurance and treasury shares. Validators/workers use pro-rata rules (defined in distribution_algorithm)." }, "distribution_rules": { "type": "object", "required": ["validators_rule", "workers_rule"], "additionalProperties": false, "properties": { "validators_rule": { "type": "string", "enum": ["pro-rata-by-effective-stake"], "$comment": "Validators share distributed pro-rata by effective_stake among active notary/validators" }, "workers_rule": { "type": "string", "enum": ["pro-rata-by-verified-ops"], "$comment": "Workers share distributed pro-rata by verified ops (after caps + fairness modifier)" } }, "$comment": "Distribution rules for validators and workers (pro-rata methods). Fixed addresses are in distribution_addresses." }, "worker_verification": { "type": "object", "required": ["model", "proof", "verification_epoch_window", "invalid_ops_policy", "verified_ops_definition"], "additionalProperties": false, "properties": { "model": { "type": "string", "enum": ["notary-attested", "committee-verified", "execution-receipt"], "$comment": "Verification model: notary-attested (notary certifies execution), committee-verified (committee validates), execution-receipt (receipt-based)" }, "proof": { "type": "object", "required": ["type", "schema_ref"], "additionalProperties": false, "properties": { "type": { "type": "string", "enum": ["execution-receipt"], "$comment": "Proof type: execution-receipt (execution proof with receipt schema)" }, "schema_ref": { "type": "string", "format": "uri", "const": "stels://schemas/execution-receipt-v1.json", "$comment": "Schema reference for execution receipt (defined in schemas.execution_receipt_v1)" } }, "$comment": "Proof specification: execution-receipt with schema reference to schemas.execution_receipt_v1" }, "verification_epoch_window": { "type": "integer", "minimum": 1, "$comment": "Epoch window for verification (ops verified within N epochs are considered valid)" }, "invalid_ops_policy": { "type": "string", "enum": ["discard-and-penalize", "discard-only", "penalize-stake"], "$comment": "Policy for invalid ops: discard-and-penalize (discard ops and penalize worker), discard-only (discard ops only), penalize-stake (penalize worker stake)" }, "verified_ops_definition": { "type": "object", "required": ["source", "requires_notary_certificate", "epoch_alignment"], "additionalProperties": false, "properties": { "source": { "type": "string", "enum": ["execution_receipt"], "$comment": "Source of verified ops: execution_receipt (from execution_receipt_v1 schema)" }, "requires_notary_certificate": { "type": "boolean", "$comment": "Whether notary certificate is required for verification (true = execution_receipt must include valid notary_certificate)" }, "epoch_alignment": { "type": "string", "enum": ["same-epoch", "within-window"], "$comment": "Epoch alignment: same-epoch (ops must be in same epoch as receipt), within-window (ops verified within verification_epoch_window)" } }, "$comment": "Verified ops definition: formalizes what 'verified-ops' means for fee distribution. Prevents disputes about what counts as executed." } }, "$comment": "Worker verification: defines what 'verified-ops' means for fee distribution. Required to prevent economic exploits. proof.type='execution-receipt' with schema_ref to schemas.execution_receipt_v1. verified_ops_definition formalizes the verification criteria." }, "distribution_algorithm": { "type": "object", "required": ["validators_method", "workers_method", "insurance_method", "treasury_method"], "additionalProperties": false, "properties": { "validators_method": { "type": "string", "const": "pro-rata-by-effective-stake", "$comment": "Validators share → pro-rata by effective_stake among active notary/validators" }, "workers_method": { "type": "string", "const": "pro-rata-by-verified-ops", "$comment": "Workers share → pro-rata by verified ops (after caps + fairness modifier)" }, "insurance_method": { "type": "string", "const": "fixed-address", "$comment": "Insurance share → 100% to insurance_address" }, "treasury_method": { "type": "string", "enum": ["fixed-address", "replenish-reward-pool"], "$comment": "Treasury share → fixed address or replenish reward_pool (if virtual-ledger mode)" } }, "$comment": "Distribution algorithm: defines how each share is distributed" } }, "$comment": "Fee distribution in basis points (integer only for canonicalization). Applies when treasury is empty (fee-only mode). Sum must equal 10000 (100%). Runtime MUST enforce: total_bps == 10000." }, "rewards_mode_switch": { "type": "object", "required": ["bootstrap", "on_treasury_empty", "irreversible"], "additionalProperties": false, "properties": { "bootstrap": { "type": "string", "enum": ["treasury"], "$comment": "Bootstrap phase uses treasury rewards" }, "on_treasury_empty": { "type": "string", "enum": ["fee-only"], "$comment": "When treasury is empty, switch to fee-only mode" }, "irreversible": { "type": "boolean", "$comment": "If true, switch from bootstrap to fee-only is irreversible (regulatory requirement)" } }, "$comment": "Explicit mode switch: guarantees no re-enabling of treasury rewards after switch to fee-only (regulatory requirement)" }, "disclaimer": { "type": "object", "required": ["no_profit_guarantee", "staking_is_security_mechanism", "rewards_are_fees", "token_is_not_equity"], "additionalProperties": false, "properties": { "no_profit_guarantee": { "type": "boolean", "$comment": "No profit guarantee - rewards depend on network usage" }, "staking_is_security_mechanism": { "type": "boolean", "$comment": "Staking is a security mechanism, not an investment" }, "rewards_are_fees": { "type": "boolean", "$comment": "Rewards are fees from network operations, not emission" }, "token_is_not_equity": { "type": "boolean", "$comment": "Token is not equity - no ownership rights" } }, "$comment": "Legal disclaimer: required for regulatory compliance (UA, EU, VASP)" }, "rewards": { "type": "object", "required": ["mode", "source", "unit", "rate_per_unit", "max_per_epoch", "staking", "rating_model", "disable_on_treasury_empty", "caps", "invariants"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["disabled", "execution-mining", "bootstrap", "fee-only"] }, "source": { "type": "string", "enum": ["minting", "treasury", "fees", "hybrid"] }, "unit": { "type": "string", "enum": ["smart_op", "tx", "gas_unit"] }, "rate_per_unit": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Reward rate per unit in base units as string (not decimal) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern. Example: 0.001 SLI = '100000' base units (with 8 decimals)." }, "max_per_epoch": { "type": "string", "pattern": "^[0-9]+$", "$comment": "Maximum rewards per epoch in base units as string (not integer) to prevent consensus divergence. All monetary fields MUST be strings matching /^[0-9]+$/ pattern." }, "disable_on_treasury_empty": { "type": "boolean", "$comment": "If true, rewards from treasury stop when treasury_policy.reward_cap_total is exhausted" }, "fee_reward_ratio": { "$ref": "#/$defs/decimal", "$comment": "Minimum fee per op relative to reward per op. Runtime SHOULD enforce: effective_fee_per_op >= rate_per_unit * fee_reward_ratio. Recommended: 1.0-1.2. Prevents economic exploit where 'printing rewards' is cheaper than 'fuel' (fees)." }, "caps": { "type": "object", "required": ["global_ops_cap_per_epoch", "per_worker_ops_cap_per_epoch", "overflow_policy"], "additionalProperties": false, "properties": { "global_ops_cap_per_epoch": { "$ref": "#/$defs/non_negative_int", "$comment": "Global maximum operations per epoch across all workers (calculated from max_per_epoch / rate_per_unit)" }, "per_worker_ops_cap_per_epoch": { "$ref": "#/$defs/non_negative_int", "$comment": "Maximum operations per epoch per worker (from worker_execution_policy.max_ops_per_epoch)" }, "overflow_policy": { "type": "string", "enum": ["pro-rata-scale-down", "first-come-first-served", "priority-based"], "$comment": "Policy when total ops exceed global_ops_cap_per_epoch: pro-rata-scale-down = scale all rewards proportionally, first-come-first-served = cap at first N ops, priority-based = use worker priority" } }, "$comment": "Reward caps: global vs per-worker limits and overflow handling" }, "invariants": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "$comment": "Runtime invariants: mathematical constraints that MUST hold. Example: 'max_per_epoch == rate_per_unit * caps.global_ops_cap_per_epoch'" }, "staking": { "type": "object", "required": ["required", "currency", "min_stake", "max_stake"], "additionalProperties": false, "properties": { "required": { "type": "boolean" }, "currency": { "type": "string", "minLength": 1 }, "min_stake": { "$ref": "#/$defs/non_negative_int" }, "max_stake": { "$ref": "#/$defs/non_negative_int" } } }, "vrf_fairness": { "type": "object", "required": ["enabled", "modifier_range"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "modifier_range": { "type": "object", "required": ["min", "max"], "additionalProperties": false, "properties": { "min": { "$ref": "#/$defs/decimal" }, "max": { "$ref": "#/$defs/decimal" } } }, "seed_source": { "type": "string", "enum": ["prev_epoch_beacon", "tx_hash"] } }, "allOf": [ { "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["seed_source"] } } ] }, "decentralization_guard": { "type": "object", "required": ["enabled", "gini_threshold", "penalty_multiplier", "metrics"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "gini_threshold": { "$ref": "#/$defs/decimal" }, "penalty_multiplier": { "$ref": "#/$defs/decimal" }, "metrics": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["gini", "theil", "nakamoto"] } } } }, "layers": { "type": "object", "required": ["execution"], "additionalProperties": false, "properties": { "execution": { "type": "boolean" }, "worker_execution": { "type": "boolean" }, "worker_execution_policy": { "type": "object", "required": ["min_ops_per_epoch", "max_ops_per_epoch", "max_reward_share", "effective_reward_cap_rule"], "additionalProperties": false, "properties": { "min_ops_per_epoch": { "$ref": "#/$defs/non_negative_int" }, "max_ops_per_epoch": { "$ref": "#/$defs/non_negative_int" }, "max_reward_share": { "$ref": "#/$defs/unit_interval", "$comment": "Maximum share of max_per_epoch that a single worker can receive (e.g., 0.3 = 30%)" }, "effective_reward_cap_rule": { "type": "string", "$comment": "Formal rule for calculating effective worker reward cap. Runtime MUST enforce: effective_worker_reward = min(per_worker_ops_cap_per_epoch * rate_per_unit, max_reward_share * max_per_epoch). This ensures deterministic calculation across all runtime implementations." } } } }, "allOf": [ { "if": { "properties": { "worker_execution": { "const": true } } }, "then": { "required": ["worker_execution_policy"] } } ] }, "rating_model": { "type": "object", "required": ["mode", "weights", "window_ms", "stake_range", "lock_range", "mined_normalization", "behavior"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["fair-stake-lock-mined-v1"] }, "weights": { "type": "object", "required": ["stake", "lock", "mined", "behavior"], "additionalProperties": false, "properties": { "stake": { "$ref": "#/$defs/unit_interval" }, "lock": { "$ref": "#/$defs/unit_interval" }, "mined": { "$ref": "#/$defs/unit_interval" }, "behavior": { "$ref": "#/$defs/unit_interval" } }, "$comment": "Runtime: weights sum to 1.0 (tolerance)." }, "window_ms": { "type": "integer", "minimum": 1 }, "stake_range": { "type": "object", "required": ["min", "max"], "additionalProperties": false, "properties": { "min": { "$ref": "#/$defs/non_negative_int" }, "max": { "$ref": "#/$defs/non_negative_int" } } }, "lock_range": { "type": "object", "required": ["min_ms", "max_ms"], "additionalProperties": false, "properties": { "min_ms": { "type": "integer", "minimum": 0 }, "max_ms": { "type": "integer", "minimum": 1 } } }, "mined_normalization": { "type": "object", "required": ["mode", "target_yield"], "additionalProperties": false, "properties": { "mode": { "type": "string", "enum": ["relative-to-expected"] }, "target_yield": { "$ref": "#/$defs/decimal" } } }, "behavior": { "type": "object", "required": ["enabled", "anomaly_detection"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "latency_weight": { "$ref": "#/$defs/decimal" }, "availability_weight": { "$ref": "#/$defs/decimal" }, "stability_weight": { "$ref": "#/$defs/decimal" }, "anomaly_detection": { "type": "object", "required": ["enabled", "penalty_threshold"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "penalty_threshold": { "$ref": "#/$defs/decimal" } } } } } } } } }, "adaptive_engine": { "type": "object", "required": ["enabled", "adjustment_rules"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "inflation_target": { "$ref": "#/$defs/decimal" }, "activity_target": { "$ref": "#/$defs/non_negative_int" }, "adjustment_rules": { "type": "object", "required": ["inflation_increase", "activity_decrease", "centralization_increase"], "additionalProperties": false, "properties": { "inflation_increase": { "type": "string", "enum": ["decrease_rate", "increase_max_per_epoch"] }, "activity_decrease": { "type": "string", "enum": ["decrease_min_stake", "increase_rate"] }, "centralization_increase": { "type": "string", "enum": ["increase_lock_range", "increase_min_stake"] } } } } } }, "$comment": "Production: prefer integer base-units for balances/stake to avoid float rounding." }, "security": { "type": "object", "required": ["der_requirements"], "additionalProperties": false, "properties": { "der_requirements": { "type": "object", "required": ["lowS", "canonical_DER"], "additionalProperties": false, "properties": { "lowS": { "type": "boolean" }, "canonical_DER": { "type": "boolean" } } } } }, "governance": { "type": "object", "required": ["upgrade_envelope", "revocation", "emergency_pause"], "additionalProperties": false, "properties": { "upgrade_envelope": { "type": "object", "required": ["schema", "sign_domain", "threshold"], "additionalProperties": false, "properties": { "schema": { "type": "object", "required": ["fields"], "additionalProperties": false, "properties": { "fields": { "type": "array", "items": { "type": "string", "minLength": 1 }, "$comment": "Upgrade envelope fields (e.g., ['upgrade_id', 'new_genesis_hash', 'chain_id', 'timestamp']). Runtime MUST enforce: upgrade_id uniqueness invariant - each upgrade_id can only be used once per chain_id. If upgrade_id already exists in upgrade history, reject the upgrade. This prevents replay attacks and ensures upgrade sequence integrity." } } }, "sign_domain": { "$ref": "#/$defs/sign_domain_array" }, "threshold": { "$ref": "#/$defs/k_of_n_threshold", "$comment": "Must have type: 'k-of-n' for consistency with other thresholds (emergency_pause.trigger_threshold, signatures.threshold)" } }, "$comment": "Upgrade envelope: defines structure and signing requirements for genesis upgrades. All upgrades must be signed by threshold k-of-n signing_keys. Runtime MUST enforce upgrade_id uniqueness invariant: each upgrade_id can only be used once per chain_id. If upgrade_id already exists in upgrade history, reject the upgrade. This prevents replay attacks and ensures upgrade sequence integrity." }, "revocation": { "type": "object", "required": ["crl", "sign_domain"], "additionalProperties": false, "properties": { "crl": { "type": "object", "required": ["seq", "revoked"], "additionalProperties": false, "properties": { "seq": { "type": "integer", "minimum": 1 }, "revoked": { "type": "array", "minItems": 0, "uniqueItems": true, "items": { "type": "string", "minLength": 1 }, "$comment": "Empty array allowed at genesis (no revoked keys initially). Runtime MUST enforce: if revocation.enabled=true, then revoked.length >= 1 after first revocation." } } }, "sign_domain": { "$ref": "#/$defs/sign_domain_array" } } }, "emergency_pause": { "type": "object", "required": ["allowed", "trigger_threshold", "max_duration_ms"], "additionalProperties": false, "properties": { "allowed": { "type": "boolean" }, "trigger_threshold": { "$ref": "#/$defs/k_of_n_threshold", "$comment": "Must have type: 'k-of-n' for consistency with other thresholds (upgrade_envelope.threshold, signatures.threshold)" }, "max_duration_ms": { "type": "integer", "minimum": 0 }, "pause_mode": { "type": "object", "required": ["mempool_admission", "finalization", "smart_exec", "allow_unpause_tx", "allowed_methods_during_pause"], "additionalProperties": false, "properties": { "mempool_admission": { "type": "string", "enum": ["deny_all", "deny_all_except_allowed_methods", "allow_all"], "$comment": "Mempool admission policy during pause. 'deny_all' = block all transactions. 'deny_all_except_allowed_methods' = block all except methods in allowed_methods_during_pause (bypasses pause). 'allow_all' = no restrictions. CRITICAL: allowed_methods_during_pause ALWAYS bypasses mempool_admission regardless of this setting." }, "finalization": { "type": "string", "enum": ["deny_all", "deny_all_except_allowed_methods", "allow_all"], "$comment": "Finalization policy during pause. 'deny_all' = block all finalization. 'deny_all_except_allowed_methods' = block all except methods in allowed_methods_during_pause (bypasses pause). 'allow_all' = no restrictions. CRITICAL: allowed_methods_during_pause ALWAYS bypasses finalization regardless of this setting." }, "smart_exec": { "type": "boolean", "$comment": "Block smart.exec intrinsic execution" }, "allow_unpause_tx": { "type": "boolean", "$comment": "CRITICAL (problems.txt C1): Whether regular transactions with unpause method are allowed. MUST be true if 'governance.unpause' is in allowed_methods_during_pause to prevent policy conflict. true = regular transactions with method='governance.unpause' are allowed and bypass pause restrictions. false = unpause only via governance envelope. This prevents consensus divergence where different validators interpret the policy differently." }, "allowed_methods_during_pause": { "type": "array", "items": { "type": "string", "minLength": 1 }, "$comment": "List of methods allowed during pause (e.g., ['governance.unpause', 'governance.upgrade', 'notary.registry']). CRITICAL PROTOCOL RULE: These methods ALWAYS bypass mempool_admission and finalization blocks, regardless of pause_mode settings. This prevents governance deadlock - ensures governance operations can always execute even during emergency pause. Runtime MUST check this list BEFORE applying mempool_admission or finalization restrictions." } }, "$comment": "Emergency pause semantics - what exactly is paused during emergency. CRITICAL PROTOCOL: allowed_methods_during_pause methods are checked FIRST and ALWAYS bypass mempool_admission and finalization restrictions. This is a hard protocol rule to prevent governance deadlock. Runtime implementation: (1) Check if method in allowed_methods_during_pause → allow, (2) Otherwise apply mempool_admission/finalization policy." }, "operational_during_pause": { "type": "object", "required": ["governance_upgrade", "notary_operations", "state_queries"], "additionalProperties": false, "properties": { "governance_upgrade": { "type": "boolean", "$comment": "Governance upgrade transactions are still allowed" }, "notary_operations": { "type": "boolean", "$comment": "Notary operations (registry, etc.) are still allowed" }, "state_queries": { "type": "boolean", "$comment": "Read-only state queries are still allowed" } }, "$comment": "What remains operational during emergency pause" } } } } }, "signing_keys": { "type": "array", "minItems": 1, "items": { "type": "object", "required": ["kid", "alg", "public_key", "not_before", "not_after", "purpose"], "additionalProperties": false, "properties": { "kid": { "$ref": "#/$defs/base58_address" }, "alg": { "type": "string", "enum": ["ecdsa-secp256k1"] }, "public_key": { "type": "string", "pattern": "^0[23][0-9a-f]{64}$" }, "not_before": { "type": "string", "format": "date-time" }, "not_after": { "type": "string", "format": "date-time" }, "purpose": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["genesis-sign", "upgrade-sign"] } } } } }, "signatures": { "type": "object", "required": ["threshold", "signers"], "additionalProperties": false, "properties": { "threshold": { "$ref": "#/$defs/k_of_n_threshold" }, "signers": { "type": "array", "minItems": 1, "items": { "type": "object", "required": ["kid", "sig", "alg"], "additionalProperties": false, "properties": { "kid": { "$ref": "#/$defs/base58_address" }, "sig": { "type": "string", "pattern": "^30[0-9a-f]{2,}$", "minLength": 136, "maxLength": 144 }, "alg": { "type": "string", "enum": ["ecdsa-secp256k1"] } } } } }, "$comment": "Runtime MUST enforce: len(signers) >= threshold.k, all kid unique, all kid ∈ signing_keys, sig verifies over gls-det-1(genesis signing view). uniqueItems does not guarantee uniqueness - runtime MUST check explicitly." }, "stels_policy": { "type": "object", "required": ["profile", "strict_mode", "rules_version"], "additionalProperties": false, "properties": { "profile": { "type": "string", "enum": ["devnet", "testnet", "mainnet-hard"] }, "strict_mode": { "type": "boolean" }, "rules_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+$" } } }, "stels_runtime": { "type": "object", "required": ["storage", "channels"], "additionalProperties": false, "properties": { "storage": { "type": "object", "required": ["kv_namespaces"], "additionalProperties": false, "properties": { "kv_namespaces": { "type": "array", "minItems": 1, "items": { "type": "object", "required": ["name", "purpose", "retention_ms"], "additionalProperties": false, "properties": { "name": { "type": "string", "minLength": 1 }, "purpose": { "type": "string", "enum": ["state", "mempool", "metrics", "ai_training", "logs", "audit"] }, "retention_ms": { "type": "integer", "minimum": 0 } } } } } }, "channels": { "type": "array", "minItems": 0, "items": { "type": "object", "required": ["id", "kind"], "additionalProperties": false, "properties": { "id": { "type": "string", "minLength": 1 }, "kind": { "type": "string", "enum": ["pubsub", "stream", "queue"] } } } } } }, "observability": { "type": "object", "required": ["metrics", "logging"], "additionalProperties": false, "properties": { "metrics": { "type": "object", "required": ["enabled", "endpoints"], "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "endpoints": { "type": "array", "items": { "type": "string", "format": "uri" }, "minItems": 0 } } }, "logging": { "type": "object", "required": ["level"], "additionalProperties": false, "properties": { "level": { "type": "string", "enum": ["debug", "info", "warn", "error"] } } } } }, "staking": { "$ref": "#/$defs/staking_policy" }, "compliance": { "$ref": "#/$defs/compliance_policy" }, "legal": { "type": "object", "required": ["jurisdiction", "entity", "policies"], "additionalProperties": false, "properties": { "jurisdiction": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }, "entity": { "type": "object", "required": ["name", "registration_id"], "additionalProperties": false, "properties": { "name": { "type": "string", "minLength": 1 }, "registration_id": { "type": "string", "minLength": 1 } } }, "policies": { "type": "array", "minItems": 0, "items": { "type": "string", "minLength": 1 } } } }, "deployment": { "type": "object", "required": ["profile", "deployed_at", "deployed_by"], "additionalProperties": false, "properties": { "profile": { "type": "string", "enum": ["mainnet"] }, "deployed_at": { "type": "string", "format": "date-time" }, "deployed_by": { "type": "string", "minLength": 1 } } } }, "allOf": [ { "if": { "properties": { "network": { "properties": { "environment": { "const": "mainnet" } } } } }, "then": { "required": ["deployment", "stels_policy", "compliance", "legal", "staking"], "properties": { "deployment": { "type": "object", "required": ["profile", "deployed_at", "deployed_by"], "additionalProperties": false, "properties": { "profile": { "type": "string", "const": "mainnet" }, "deployed_at": { "type": "string", "format": "date-time" }, "deployed_by": { "type": "string", "minLength": 1 } } }, "stels_policy": { "properties": { "profile": { "const": "mainnet-hard" }, "strict_mode": { "const": true } } }, "observability": { "properties": { "metrics": { "properties": { "enabled": { "const": true } } } } }, "monetary": { "properties": { "minting": { "const": "disabled" }, "faucet": { "properties": { "rate_per_request": { "const": 0 } } } } }, "compliance": { "properties": { "enabled": { "const": true } } }, "staking": { "properties": { "enabled": { "const": true } } } } }, "$comment": "Mainnet hardening: strict policy, compliance enabled, minting disabled, faucet off. Regulator-facing: legal+compliance required." }, { "if": { "properties": { "monetary": { "properties": { "rewards": { "properties": { "mode": { "const": "execution-mining" } } } } } } }, "then": { "properties": { "monetary": { "properties": { "rewards": { "required": ["vrf_fairness", "decentralization_guard"] } } } } } } ] }