Normative specification of the FLOP protocol.

The implementation specification of the FLOP Network: notation, message and storage formats, extrinsic interfaces, state machines, algorithms, and protocol invariants. This is the authoritative reference an implementer builds against. It is the math/spec companion to the Whitepaper (conceptual) and Litepaper (overview).

How to read this document — see §0 first. The section bodies are normative and describe the target protocol using RFC 2119 keywords (MUST/SHOULD/MAY). Everything an implementer needs to satisfy conformance lives in the numbered sections and in Appendices A (parameters), F (message & storage formats), and G (extrinsic index). Everything that is not a requirement — design rationale, decision provenance, prior art, formal-proof citations — is confined to the Rationale & sources trailer at the end of each section, and to Appendix B. Implementation status (what is built vs. designed) is not carried in the normative body; it lives in one place, the Conformance & Status Matrix (Appendix H). Unresolved values/mechanisms are numbered stubs in Appendix E — Open Specification Items; the body references a stub rather than restating an open debate.

Decision provenance. Ratified positions are recorded once in decisions/v0.4.md (D-04xx, MADR-shaped, immutable once merged, superseded by ID in later versions). Where a normative rule cites a D-id, the citation is provenance only — the rule itself is stated in full in the body; the reader never needs the decision record to implement.

0. Conformance & Reading Guide

Normative keywords. The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL are to be interpreted as in RFC 2119 / RFC 8174 when, and only when, they appear in capitals. Lower-case uses carry no normative weight. A statement with no keyword is descriptive context, not a requirement.

What is normative. The numbered section bodies (§1–§15), Appendix A (Parameter Reference), Appendix F (Message & Storage Formats), and Appendix G (Extrinsic Index) are normative. Appendices B (Sources), C (Miner Lifecycle — a worked walkthrough), D (Fee & Revenue Map — a derived summary), E (Open Items), and H (Conformance & Status Matrix) are informative except where they restate a normative rule and cite its home section.

Section skeleton. Each protocol section is organized as:

1. Requirements — the normative rules (MUST/SHOULD/MAY).
2. Data structures — field · type · encoding · constraint (or a pointer into Appendix F).
3. Interfaces — extrinsics/functions: signature · origin · preconditions · errors · events (or a pointer into Appendix G).
4. State machine — states and a transition table, where the section defines one.
5. Rationale & sources (non-normative) — why the design is as it is, decision IDs, prior art, and formal-proof citations. An implementer MAY ignore this trailer.

Not every section needs every part; a part is present only where it carries content.

Reading the parameters. Every protocol constant is named in Appendix A, which is generated from params/flop-protocol-params.yaml (the single machine-checked source, gated by scripts/check_params.py). A parameter named in the body links to its generated #param-<name> anchor. Concrete figures appearing inline are worked examples; the value of record is always Appendix A.

Implementation status is out of band. This specification describes the protocol FLOP targets, not a snapshot of the codebase. The build state of each requirement — implemented, in progress, or designed — is tracked only in Appendix H, together with the code path and any tracking issue. The body contains no [LIVE]/[PARTIAL]/[PLANNED] tags and no commit/PR references, so a requirement's wording does not change as code lands.

Trust-domain principle. FLOP's verification architecture rests on an explicit rule that recurs throughout §3, §7, §11, and §12: a fallback verification layer MUST occupy a different trust domain from the fast path it backs. In particular, protocol soundness MUST NOT rest on any single hardware root of trust. TEE attestation is one assurance tier (§3.3) and is OPTIONAL, not a precondition for participation or settlement; the mandatory execution-integrity floor is the TEE-independent stack of activation commitments, sampled re-execution, and slashing (§3.4–§3.5). This is ratified as D-0432; the non-TEE (SOFT) tier's end-to-end definition is the open item E.33.

Terminology and clocks. §1 fixes the notation, the role glossary, and the canonical protocol-clock table with its coupling invariants. All durations assume 1-second blocks.

0.1 System architecture (informative reading map)

FLOP is a verified-inference settlement layer: a Substrate/FRAME chain where autonomous agents pay miners for attested inference, validators finalize and police it, and the token economy is gated on useful, verified, demanded work. The actors:

End-to-end happy path (one paid session):

How the sections compose (what each depends on):

• §2 Consensus is the base: BABE authors, AlephBFT finalizes. Every irreversible action anywhere reads its finalized prefix — settlement (§12), HTLC refund (§10), slashing (§11), DA prune (§5.3).
• §15 Validators is the staked set that runs §2, performs §3.6 attestation, and hosts §5.3 DA; its committee gate (§2.3) needs §3's verified-work signal.
• §7 Calibration produces B_p / serving caps consumed by §4 metering, §6.1 miner stake, §8 vesting, and the §11 settlement gate.
• §3 Verification decides what may be credited; it consumes §7 caps, §5.3 DA (evidence), and §12 transcripts. §4 Metering defines the G_n unit that §8, §9, §11, and §12 all key on.
• §12 Sessions is the settlement hot path — it reads §2 finality, §3 verification, §4 G_n, §5.3 DA, §7 caps — and feeds §8/§9 (economics). §5.3 DA stores the evidence §3/§12 disputes fetch.
• §9 Emission / §8 Vesting are the economic outputs, gated on demanded+verified §4 work; §10 HTLC moves value cross-chain in/out. §14 Governance controls parameters/upgrades over all of the above.
• §11 Invariants and §13 Failure semantics cross-cut every section; §6 supplies the accounts, keys, and escrow primitive the whole system is built on (crypto/accounts: §6.5).

Appendices are reference surfaces: A parameters · F message/storage formats · G extrinsics · H conformance/status · I runtime composition (pallet indices). A companion yellowpaper-attribution.md maps each requirement to its proof + code.

1. Notation, Conventions & Glossary

Quantities are exact integers on-chain unless noted; rationals use fixed-point (parts-per-million, ppm, or parts-per-thousand, ppt). FLOP balances carry 18 decimals; VFY denotes the 10¹⁸ base-unit constant (1 VFY = 1 FLOP). ‖ denotes concatenation; SHA256 and blake2_256 denote the respective 32-byte hashes.

1.1 Glossary — roles vs software

A node is software; every other term below is a staked or delegated role. Validators and miners each run a node plus role-specific services. The terms are used in exactly these senses throughout.

Attestation authority. There is no separate oracle role. Active validators verify TEE quotes off-chain and submit signed ValidatorAttestation bundles; a BFT quorum of active validators (§3.6, §13.3) is the on-chain attestation authority.

1.2 Protocol clocks — canonical table

Every time constant that a security argument depends on, in one place. Coupling invariants are the rules that keep the clocks consistent; enforced couplings are checked in code, principled ones are review rules. All durations assume 1-second blocks. Values of record are in Appendix A.

Reading rule (normative review gate). A shorter clock MUST NOT be able to strand a longer one it secures: disputes fit inside retention, stake outlives disputes, checkpoints outlive exits, enactment outlives unbonding. Any change to one of these values MUST re-check the coupling column.

1.3 Acronyms & technical terms

Every acronym and non-obvious technical term used in this spec, expanded once. Protocol-internal identifiers (open_channel, report_data, …) are defined at their point of use and in Appendices F–G; the roles/symbols are §1.1.

Consensus & runtime

PoUI & verification

Data availability & storage

Economics, governance & crypto

Threat-model frameworks (referenced, not defined here): OWASP Agentic Top-10, ATFAA, STRIDE, and MITRE ATLAS are external catalogues cited in §12.3.

2. Consensus

FLOP's consensus is a BFT-DAG (AlephBFT class) under the Substrate/FRAME runtime. A stake-weighted, PoUI-gated sampler selects distinct committee identities; once selected, those identities participate as committee seats in AlephBFT. BABE authors blocks; AlephBFT finalizes them — GRANDPA (Substrate's default finality gadget) is not used. BABE's one-second slot is fixed; no finality-latency or throughput profile is specified until E.46 is measured under a disclosed workload and topology.

2.1 Requirements

• R2.1 — Block authoring. Blocks MUST be authored by BABE at a fixed 1 s interval.
• R2.2 — Finality. A block MUST be treated as irreversible only once it is within the AlephBFT finalized prefix. Every fund-releasing, expiry, slashing, or pruning action MUST read the finalized prefix via hp_consensus::FinalizedPrefix (AlephBFT-backed through pallet_aleph::LastFinalized), never the chain tip.
• R2.3 — Byzantine tolerance. AlephBFT safety MUST be evaluated against Byzantine committee seats, because selected members sign with equal voting weight. The safety premise MUST be strictly fewer than one third Byzantine seats: 3f < n, where f is the Byzantine seat count and n is the realized committee size. Eligible-set or realized-committee stake fraction MUST NOT replace this seat bound.
• R2.4 — Committee gate. Finality-committee membership MUST be restricted to the PoUI-gated set: stake at or above the effective minimum and a recent accepted verification duty (R15.4c; hp_consensus::select_committee; §2.3, §15.4). Eligibility MUST NOT require the validator to execute inference, produce PoUI proofs, or hold a GPU or TEE. A bootstrap exception or minimum-safe-size profile MUST be ratified before that mode can claim conformance (E.42).
• R2.5 — Committee size. The finalizing committee MUST be a stake-weighted random sample of finality_committee_size distinct members drawn without replacement from the eligible set, seeded by BABE-VRF epoch randomness (§15.4).
• R2.6 — Engine isolation. Finality-assuming pallets MUST depend only on the hp_consensus::FinalizedPrefix interface, so the finality engine can be swapped without touching them. FRAME MUST remain the sole execution/state layer.
• R2.7 — Byte budget. A claimed throughput/finality profile MUST state its admitted byte and weight budgets and validate them under a disclosed workload and network topology (§5.2, E.46).

2.2 Target parameters

The committee cap of 100 is cost-derived. At the original 1.5 FLOP floor the validator reward pool sustained ~112 bare-metal validators, which is where the cap of 100 was sized. D-0436 doubled the floor to 3 FLOP/block, so that pool now sustains ~224: the cap sits roughly 2.2x inside the ceiling rather than at it, and validator cost is no longer the binding constraint on committee size. Capture analysis is parameterized by realized committee size; an N=100 bound MUST NOT be applied to an undersized committee. Bootstrap and minimum-safe-size behavior are E.42.

2.3 Safety — the three sub-proofs

PoUI gates production on stake + verified useful work, not hashpower, so a longest-chain Nakamoto safety theorem does not apply and MUST NOT be relied upon. Safety instead decomposes into three independent sub-proofs, each in its own trust domain:

1. Sybil cost. Each committee identity costs a stake bond + attested silicon (where claimed) + an accepted calibration cap plus background Ghost-Task exposure (§2.4). This bounds the stake an adversary can amass per unit capital. A separate sampling analysis must bridge that cost to the honest-seat premise of (2).
2. BFT ordering safety under honest seats. Given < ⅓ Byzantine committee seats, AlephBFT atomic broadcast supplies its agreement and total-order result (adopted from AlephBFT; not re-proven here). The PoUI/stake gate constrains eligibility but does not by itself establish this realized seat premise.
3. Verification integrity. Committee eligibility requires a recent accepted verification duty (R15.4c — attesting, adjudicating, auditing; never proof production), and rewards/settlement are gated by the tiered verification stack (§3). Subject to actual enforcement of the gate and verification bridge (E.42–E.44, E.52), this constrains stake-only eligibility and unverified reward credit. It does not prove honest consensus behavior.

The probabilistic bridge from eligible-set composition to the realized seat premise is unresolved (E.42). In particular, weighted sampling of distinct identities with unequal stake is not binomial sampling by aggregate attacker stake. SelectionTailDominated in the Lean model is an explicit hypothesis, not a theorem about the implemented sampler. Capture analysis must model the actual eligible identities, their weights, the without-replacement draw, stake splitting, small eligible pools, repeated epochs, and BABE-VRF seed influence.

2.4 Sybil model — safety sub-proof (1)

With production gated by stake + attested hardware (not hashpower), a Sybil is many identities seeking extra reward, voting weight, or penalty-dodging. Per-identity cost is a triple moat:

Sybil cost(N identities) = N · (stake bond ≥ min_miner_self_stake)
                         + N · (genuine attested silicon, where a HARD/TEE cap is claimed)
                         + N · (accepted burst cap + background Ghost-Task exposure)

Residual attacks and required mitigations:

The triple moat's TEE term is decisive for the HARD tier, where an identity is bound to a distinct attested device. A SOFT (non-TEE) identity is instead bounded by stake + calibration + spot-check exposure; its per-identity demand-floor exclusion is E.33.

Rationale & sources (non-normative)

Consensus is the ratified stake-BFT-DAG (Q1 = D2). The choice within DAGs is the finality model: GHOSTDAG buys throughput at the cost of probabilistic finality and an honest-hashpower assumption, which PoUI removes; a BFT-DAG orders the DAG with Byzantine agreement so the committed prefix is irreversible at commit under the < ⅓ Byzantine-seat premise. Stake governs eligibility and sampling weight, while the current signature verifier counts seats; these are separate quantities. The only DAG option with a direct FRAME precedent is Aleph Zero. The prior PoW-GHOSTDAG fork was deleted (unintegrated; its safety proof void under PoUI). Prior art: the BABE-authors / AlephBFT-finalizes split is the availability-finality (Ebb-and-Flow, arXiv:2009.04987) resolution; AlephBFT (arXiv:1908.05156 / 2312.14506) supplies expected-constant-round asynchronous agreement; deterministic BFT in a block DAG (arXiv:2102.09594; Shoal++ arXiv:2405.20488; Lemonshark arXiv:2604.03974). The decomposition is confirmed by results that a non-PoW longest-chain rule can be insecure (arXiv:2505.14891) and that optimization-PoUW inherits PoW's honest-majority need (arXiv:2405.19027) — both avoided by not using a longest-chain rule.

Written sub-proofs: q14-sybil-cost-proof.md, q14-bft-ordering-safety.md, q14-useful-work-integrity.md; options analysis consensus-runtime-composition.md; implementation record alephbft-integration-plan.md; Sybil cost model sybil-mitigation.qnt. The committee-sampling risk bridge is machine-checked in FlopSpecs/CommitteeSampling.lean; its tail bound is conditional on SelectionTailDominated. The finite quorum-intersection and certificate-nonforking argument is proved in FlopSpecs/Consensus.lean: Committee.quorum_inter_gt_third and FinalCtx.nonforking. For AlephBFT's equal-seat committee, instantiate the model's weight function with one per seat: the fault premise is 3f < n and a quorum has 3q > 2n distinct signers. For n = 100, this permits at most 33 Byzantine seats and requires 67 signatures. The proof assumes quorum-certified finalization and honest non-equivocation; it does not establish the sampler's honest-seat premise or the running protocol's liveness. Review evidence and counterexamples: prepublication-evidence.md. Exact population enumeration and real-sampler regression scope: committee-sampler-evidence.md. The current sampler returns all members of any nonempty eligible pool of at most 100; when no active validator has recent work, the runtime retries with a stake-only set. These modes are implementation status, not safety evidence; Appendix H and E.42 track the conformance gap. Provenance: D-0401, D-0501 (seat-count premise and conditional sampling bridge). Status: Appendix H.

3. Proof of Useful Inference — Verification Architecture

PoUI answers: did a miner execute the claimed inference (this model, this output) using the claimed compute, or spoof a cheaper one? No single primitive does this cheaply, so FLOP uses a tiered hybrid whose central rule is that the fallback layer occupies a different trust domain from the fast path (§0). ZK-proving the forward pass is out of scope: prover cost scales with proven FLOPs at 10³–10⁶× blowup — prove a cheap check, never the forward pass.

3.1 Requirements

• R3.1 — Execution-integrity floor (TEE-independent, mandatory). Every settled session MUST carry a TOPLOC activation commitment (§3.4) over its turns. Missing required evidence MUST fail settlement closed; there is no TOPLOC-less settlement lane.
• R3.2 — TEE is optional. A TEE attestation (§3.3) MAY back a session and, where present, raises its assurance tier (HARD) and its permitted value cap. Protocol soundness MUST NOT depend on TEE integrity: if a TEE quote is forged or its trust root fails, acceptance MUST still require an independently enforced fallback with a stated error bound. Combining marginal error probabilities by multiplication MUST require a justified conditional-independence model; without it, two enforced gates support only the general intersection bound min(ε_tee, ε_fallback). A non-TEE (SOFT) miner class is a first-class participant (D-0432; its end-to-end definition is the open item E.33).
• R3.3 — Independent re-execution. Security against a compromised fast path MUST come from optimistic re-execution in a different trust domain (§3.5), with collectible collateral and aggregate exposure satisfying the stated p_effective deterrence condition (E.45).
• R3.4 — Settlement gate. Crediting on the direct PoUI proof rail MUST require a BFT quorum of distinct active validators (§3.6): ceil(active_count × validator_attestation_threshold).max(1).
• R3.5 — Binding. An accepted proof/attestation MUST bind, at minimum, task_hash, the metered gn_weight, the measured model_hash, and the output_hash; a mismatch on any bound field MUST reject (OutputHashMismatch / root mismatch).
• R3.6 — Replay. Each task_hash MUST be creditable at most once (ProcessedTasks guard).

3.2 The verification stack

3.3 Tier 1 — TEE attestation & measuring model_hash (optional / HARD tier)

Where a session runs under confidential computing, NVIDIA CC (H100/H200/Blackwell) + an Intel TDX host CVM attest a genuine device, CC-mode/VRAM encryption, and firmware/RTMR measurements; the host quote (MRTD, RTMR0-3, report_data) is checked by DCAP / dcap-qvl. The attestation proves the environment, not which model ran — so it never substitutes for the Tier-2/3 floor.

Measuring model_hash. When a TEE session claims a model, the commitment to the loaded weights MUST be a measured dm-verity Merkle root, not a passed-in checksum:

1. Pack all weight shards + index + config into one read-only EROFS image with a dm-verity Merkle tree (4 KB blocks). The root hash is the commitment; the kernel verifies every block on read and faults on mismatch, so the engine can only read the committed weights. The reproducible packer is [tools/modelpack].
2. The miner CVM MUST extend the root into RTMR3 (or measure it via kernel cmdline into MRTD) so it appears in the signed quote and flows into report_data.
3. The chain stores expected roots per (model, precision) in pallet_model_registry and MUST accept a TEE proof only if the quote's measured root ∈ registry (fail-closed Vk::V3; the dstack verifier parses the TDX event log, replays it to the quote's RTMR3, and requires the registry root among the RTMR3 events). Quantization changes the bytes → changes the root, so each precision variant is a distinct commitment (consistent with TOPLOC precision detection).

Output binding. report_data MUST also commit output_hash; the validator MUST reject a mismatch. Decode-policy binding. report_data MUST commit decode_policy_hash — a canonical digest over greedy/temperature/top-p/top-k/seed plus transform id. Governance MAY pin a model to an allowed decode-policy set in the registry (≤ max_decode_policies_per_model); absent a pin, policy rollout is unblocked. The full binding preimage is in Appendix F.

3.4 Tier 2 — TOPLOC activation commitments (mandatory floor)

TOPLOC commits the top-128 values+indices of each token's last hidden state, polynomial-encoded to ~258 bytes / 32 tokens. A verifier re-executes a single prefill and compares exponent intersections then mantissa error against a per-(model, precision) governance-calibrated band.

• R3.4a. A TOPLOC commitment MUST be present for every session (R3.1) and published to DA to feed Tier 3. A cryptographic detection bound additionally requires that the commitment bind the challenged activation vector, challenge randomness be fixed after commitment, and openings be checked against that commitment; the end-to-end protocol bridge is E.43.
• R3.4b. Band adjudication MUST be fail-closed per (model, precision, backend, GPU) cell: until a cell's hetero-hardware activation gate passes, the cell is commitment-required but adjudication-inert (no silent accept). The two-threshold policy is accept / escalate / slash; a middle escalate verdict MUST route to the escalation lifecycle within channel_toploc_escalation_window_blocks, never to silent accept.
• R3.4c. Unauthorized model/precision/prompt/decode/numerical substitution MUST be treated as disputable execution fraud. TOPLOC's detection claim is limited to validated cells and the commitment, challenge, and adjudication assumptions in E.43. Answer quality is out of protocol scope — a market/reputation remedy, never a protocol fraud verdict. This boundary is normative.

The tolerance-band formula combines an honest-divergence model with a secret-challenge projection model; the committed per-cell constants (kappa_profile_hash, band_tau_accept, band_tau_slash, …) are in Appendix A. These formulas give conditional mathematical bounds under their stated distributions. They do not establish empirical detection for every model/backend/GPU cell or prove that the deployed commitment, challenge, opening, audit, and adjudication path enforces those assumptions. Under a broken TEE, the abstract AND-combinator retains the supplied fallback bound; the bound is only as strong as the fallback and operational bridge independently established in E.43.

3.5 Tier 3 — Independent optimistic re-execution & slashing

Security against a compromised fast path is conditional on effective re-execution in a different trust domain. A Proof-of-Sampling game targets a random fraction: results are posted under bond and a different miner re-runs sampled work. For a risk-neutral miner under fixed monitoring and credible, collectible penalties, a necessary deterrence inequality is

p_effective · collectible_penalty  >  total_profitable_exposure

• R3.5a. There MUST exist ≥1 honest standing challenger — the session agent (for its own channel) or an active validator (for any channel), per §12.1.
• R3.5b. Slashable collateral MUST cover aggregate concurrent exposure, not only a single job; high-value jobs SHOULD escalate to a ZK spot-proof (§3.6). The reservation and payoff model is unresolved in E.45.
• R3.5c. Disputes MUST resolve over data available outside the miner's host. Validator-hosted DA removes miner-only custody but is not independent of a validator coalition (§5.3). The dispute bisection MAY use O(n²) Freivalds spot-checks so only a single layer/GEMM is re-run at the leaf.
• R3.5d — Re-execution lane. Re-execution of sampled or challenged turns MUST be performed by bonded checkers in a different trust domain from the miner, never by validators. The floor is three checkers per turn — distinct operators from the miner and from each other, VRF-assigned — returning a unanimous verdict; any disagreement, or unavailable evidence, model or capacity, MUST escalate (§12.1) and MUST NOT become an implicit accept. A checker verdict carrying a TEE attestation of the re-execution is an OPTIONAL strengthening that raises the verdict's assurance tier and permitted value cap; it MUST NOT lower the floor. Before co-signing a mismatch or clear quorum at the §3.6 threshold, a validator MUST verify the assignment, the checkers' bonds, the signatures' binding to the commitment and turn, and unanimity. Checker identity MUST be a calibrated miner identity of §2.4 — capacity-proportional self-stake, accepted calibration cap and an independently attested hardware fingerprint — plus the checker bond; a bare bonded account is not checker-eligible. Assignment MUST be stake-weighted VRF sampling over that pool excluding the session miner's account and fingerprint, and the three assigned checkers MUST carry pairwise-distinct fingerprints, so an adversary holding share q of the pool's selection weight captures all three seats with probability at most q³, bounded by the Sybil cost of §2.4. A unanimous accept is not final: within the R12.1f challenge window any standing challenger MAY escalate it, drawing a fresh assignment disjoint from the first, and a checker whose verdict is overturned MUST forfeit its bond. Verdict fields and checker payment are E.53.

Here p_effective is the probability chain P(selected) · P(data | selected) · P(challenge | selected,data) · P(included | selected,data,challenge) · P(upheld | selected,data,challenge,included) · P(collectible | selected,data,challenge,included,upheld). Every factor conditions on all preceding events; this is the chain rule, not an independence or Markov assumption. The inequality alone does not establish a Nash equilibrium for challengers, coalitions, bribery, or Byzantine actors. Slashing is pallet_miner_slashing; the session dispute game is §12.1.

3.6 Tier 4 — On-chain settlement, ZK aggregation & validator BFT quorum

The direct per-proof rail settles synthetic/ghost, calibration, and simulator work; paid agent sessions settle through the compute channel (§12.1), with the validator quorum acting there as dispute resolver rather than per-credit gatekeeper. On the direct rail:

• R3.6a. A miner submits a proof via submit_stark_batch(...), recorded in PendingVerifications with replay protection (ProcessedTasks[task_hash]).
• R3.6b. Crediting MUST require a validator BFT quorum. Validators run DCAP/dstack TEE quote verification off-chain and submit signed ValidatorAttestation bundles via submit_validator_attestations. The chain MUST: verify each sr25519 signature; check every signer is an active validator (pallet_validators::ActiveValidators); enforce agreement on (task_hash, gn_weight, latency_ms, model_hash, output_hash, decode_policy_hash, tee_type, quote_verified, event_log_verified, hardware_id_hash) across the bundle; require both verification booleans; and require ceil(active_count × validator_attestation_threshold).max(1) distinct validators (default threshold validator_attestation_threshold = 2/3, root-governable).
• R3.6c. On quorum the chain MUST verify the report_data binding + output_hash match, credit gn_weight, and fire OnProofVerified.

There is no separate oracle registry; the attestation authority is the BFT committee already securing consensus. The Aggregate pallet collects verified statement hashes (keccak256) into per-domain Merkle roots for cross-chain dispatch; the settlement verifiers (Groth16-161 … EZKL-169, TEE-170) are zkVerify aggregation — they do not prove the inference. Optional ZK spot-proofs cover top-value jobs.

Rationale & sources (non-normative)

The stack draws on published mechanisms and prototypes (TEE confidential inference — Azure CVMs, Phala, Tinfoil; dm-verity model measurement — Tinfoil Modelpack; TOPLOC activation commitments — Prime Intellect, arXiv:2501.16007; TEE fast path + sampled re-execution + slashing — VeriLLM ~1% cost arXiv:2509.24257, SPEX arXiv:2503.18899, EigenAI arXiv:2602.00182 whose deterministic inference removes the FP-noise band, Optimistic TEE-Rollups arXiv:2512.20176; weight-into-attestation binding — Laminator arXiv:2406.17548, Attestable Audits arXiv:2506.23706). The TEE-optional reframe is grounded in the machine-checked sessionVerifier_survives_broken_tee (the abstract AND-combinator retains its supplied fallback bound under a forged quote) and the SOFT-tier design (E.33). Successor commitment schemes (TensorCommitments arXiv:2602.12630, DiFR arXiv:2511.20621, log-prob tracking arXiv:2512.03816) slot in as measured (ε, φ) points — their gains are verification cost, not the guarantee.

Walkthroughs: ELI5 · Feynman · session-lifecycle-runbook.md. Tiered hub: verification-architecture.md, verification.md, verification-economics-bounds.md, dispute-reexecution-tradeoffs.md, formal-to-implementation-bridge.md. Band derivation: toploc-band-derivation.md; operational R1–R4: toploc-r1-r4-research.md. Tier-3 primitives: freivalds-bisection-spec.md, distribution-audit-tier-design.md, cheap-miner-hardware-profiles.md, claim-then-audit-image-commitments.md. GPU-work measurement + premium cert lane: gpu-work-measurement-verification-study.md, batch-work-certificates-spike.md, gemm-certificate-format-spec.md, kv-commitment-carryover-design.md, zk-prover-overhead-audit-lane.md; stack governance verification-scheme-registry.md. Trust surface: docs/trust-surface.md. Review evidence and assumption classifications: prepublication-evidence.md. Conditional audit payoffs, shared collateral, and collection-path evidence: audit-economics-evidence.md. Provenance: D-0404 (measured model_hash), D-0406/D-0414 (attestation authority), D-0431 (TOPLOC required), D-0501 (claim scope and conditional guarantees). Formal: FlopSpecs/Crypto.lean, FlopSpecs/TeeAttestationFlow.lean, FlopSpecs/Verification.lean, FlopSpecs/VerificationComparison.lean, verification/proof-verification.qnt. Status: Appendix H.

4. Effective-FLOP Metering

4.1 Requirements

• R4.1 — Unit. Work MUST be accounted in versioned reference-work units F_eff, with G_n = floor(F_eff / 10⁹). This is a deterministic protocol accounting convention; it is distinct from physical FP16/INT8/INT4 instruction counts, energy, latency, and certificate weights.
• R4.2 — Reference-work accounting. G_n MUST be computed from execution inputs by the shared deterministic no_std primitive (hp_poui::flop_meter, mirrored in tee-bridge/inference/attestor/flop_meter.py), not derived from bare 2·P·N. Inputs include the prompt/context lengths, generated-token count, active-parameter/MoE terms, and attention term defined by the reference formula. Running the meter inside a TEE does not make it a physical instruction counter or establish unmodeled routing, cache, batching, or speculative-decoding work.
• R4.3 — Tripwire is reject-only. A sanity tripwire MUST reject (never clamp or rewrite) a claim whose implied throughput gn·1000/latency_ms exceeds throughput_tripwire_gflops_per_sec (fail-closed, governance-toggle, default-on). The per-GPU MLPerf ceiling and the under-report floor activate where the attested GPU id / attested token counts are bound (transcript-leaf g_n).
• R4.4 — Representation. Settled G_n is an unsigned count of whole billion-reference-FLOP units. Direct-rail claims use u64; session leaves, receipts, aggregates, and balances use u128. Both use fixed-width little-endian integers in signed/hashed preimages and SCALE's fixed-width encoding in calls and storage. Implementations MUST floor once at F_eff / 10⁹, reject a value outside the destination width, and use checked aggregation; they MUST NOT round, clamp, reinterpret historical values, or attach physical FP16/INT8/INT4-op, joule, latency, or certificate-weight semantics to this field. Those measurements are separately typed telemetry.
• R4.5 — Cache accounting. Wire profile v1 bills the full prompt/context term in the reference formula, including a reused KV-cache prefix. Cache reuse may reduce latency or physical work but does not discount settled G_n. A proof-bound cache discount requires a new meter/profile version; it MUST NOT silently change existing leaf or receipt amounts (E.22; #1153).

4.2 The op-count model

The reference-work count accounts active params (MoE-aware), the quadratic attention term, and embedding; it is KAT-pinned against the analytic count on reference models (Llama-3-8B → 16, Llama-3-70B → 140 G_n/token; Rust ⇄ Python parity). Cross-checks (GPU performance counters via CUPTI/DCGM; energy via nvml) read inside the enclave as physical bounds.

The bare heuristic is a sanity check only (R4.3), never a billed amount:

F_eff ≈ 2 · P_active · N  +  2 · n_layer · n_ctx · d_attn   (attention term)

Per-token, per-layer: QKV 6d², attn output 2d², FFN 16d². The bare 2·P·N is ~2–3× accurate (it omits the quadratic attention term, embedding/unembed, LayerNorm/softmax; MoE uses active params; KV-cache is a bandwidth, not a FLOP, effect). Reference examples (≈, under stated architecture assumptions): Llama-3-8B 16, DeepSeek-V3 74, and Llama-3-70B 140 G_n/token. Proprietary-model figures are not protocol measurements.

Pricing vs. work. Pricing is quoted in tokens with context/model multipliers while work is metered in F_eff (flop-poui fee (base+priority)·gflops/1000·precision_mult). The transaction fee's recipient split is specified in §9 / Appendix D.

Rationale & sources (non-normative)

Reference-work G_n with a reject-only tripwire (never rewriting the billed amount) is D-0405; D-0501 clarifies that the meter is an accounting rule rather than exact physical measurement. Grounding: latency-gflop-calibration.md, workload-class-metering.md, gpu-precision-tripwire-note.md. Formal: FlopSpecs/Calibration.lean, FlopSpecs/Computable.lean. Review evidence: prepublication-evidence.md. Open: E.34 (non-LLM workload classes) and E.22 (proof-bound cache discount). Status: Appendix H.

5. On-chain / Off-chain Architecture & Sizing

5.1 The split

Verification asymmetry (normative). The chain MUST NOT re-execute the model; it adjudicates attestations and disputes only. Trust shifts to (a) hardware RoT where claimed, (b) economic slashing, (c) independent re-execution — never the executor.

5.2 Block & transaction sizing

The runtime configures a 5 MiB maximum block length: Normal dispatch may consume at most 3,932,160 B (75%), while Operational dispatch may use the full 5,242,880 B. Its independent ref-time ceiling is 750,000,000,000 per block, with 562,500,000,000 available to Normal dispatch; proof size is also a weight dimension. Base block/extrinsic work and competing traffic consume these envelopes.

These are admission maxima, not a propagation, execution, throughput, serving, or finality profile. The former 125,000 B scenario is withdrawn by D-0502. Whether bytes, ref-time, proof size, state access, serving capacity, or finality communication binds first requires E.46's runtime and network measurements.

5.3 The verified-task footprint & sovereign DA

A verified task MUST commit only ~32 B per blob on-chain, not the bytes. The ~2 MB StarkProof cap is a submission call-data path (it rides the extrinsic transiently and prunes with the block), not permanent storage — proofs/quotes/I-O live in DA, referenced by hash:

direct-rail attestation Vec bytes/claim = compact_len(quorum_size) + 275 B × quorum_size
off-chain (DA, by DataRef)              = proof_data, TEE quote (5–10 KB), event log (≤256 KB)

The current fixed-field SCALE size is 275 B per ValidatorAttestation; the signed subset is 179 B. The signature bundle is linear in quorum size. The source-checked SCALE fixtures include the runtime pallet/call indices, v5 bare preamble, outer compact length, and embedded validator signatures. Under the default two-thirds rule, 100 active validators require 67 signatures: the argument vector is 18,427 B and the complete extrinsic is 18,434 B. At the supported active-set maximum of 200, 134 signatures produce 36,852 B and 36,859 B respectively. The seven-byte difference is two call-index bytes, one bare-preamble byte, and a four-byte length prefix. The finality committee is a separate set capped at 100; 1,000 active validators is not a supported runtime state. No constant-size signature aggregation is specified. These byte measurements are not divided into a throughput claim; charged weights, competing traffic, and finality remain separate constraints. Full fixtures and limitations: prepublication evidence.

DA requirements (sovereign, validator-hosted, FLOP-denominated).

• R5.3a. DA storage MUST use no external currency/token/network dependency; validators are the storage nodes under stake. pallet_da_registry keeps only a DataRef = (commitment, provider_id, retention_class) plus the assigned validator subset and audit bookkeeping; the erasure-coded bytes (Reed–Solomon rate ½, da_shard_count R=6, any da_min_replication_factor k=3 reconstruct) live off-chain on a deterministic stake-weighted subset (hash(commitment) → subset). Because the publisher can influence a commitment, the assignment's anti-grinding rule, operator/failure-domain diversity, repair process, and cumulative retention budget remain open in E.47.
• R5.3b — Serve-or-slash. Retrievability audits (the Ghost-Task known-answer pattern) MUST slash a bounded amount (da_serve_or_slash_percent, Liveness class, not fraud) of a non-serving validator's bond. A penalty MUST be re-derived from the live validator set (never stale-slashing a rotated-out provider).
• R5.3c — No per-byte DA fee. DA is a validator duty, funded from the validator share of block rewards + fees; there MUST NOT be a per-byte DA fee or DA-fee income stream. Serve-or-slash is the enforcement that the already-paid-for duty is performed.
• R5.3d — Retention classes. Ephemeral (≥ challenge window, then prunable) covers quotes/proofs/transcripts/I-O — no charge, spam-bounded because such blobs are creatable only through fee-bearing flows. Leased covers model weights + dm-verity images — a fixed term with no storage fee but a refundable anti-spam deposit (bytes × da_lease_deposit_per_byte, held under a dedicated hold reason, returned in full on prune or withdrawal — never revenue), extendable by anyone for free (top_up_lease, tx fee only), pruned only after lease_end + grace (14 d) and only while no consumer holds a usage pin. Pruning MUST be recoverable: the dm-verity root is deterministic, so re-upload reproduces the same commitment and identity (MeasuredRoots) survives.
• R5.3e — Reorg-safe serving. The off-chain indexer MUST serve only heights inside the AlephBFT finalized prefix (a finalized block can never orphan), never the best tip.

Leasing supersedes an unbounded "persistent" tier — model relevance is 6–12 months. Moving the TEE quote off the miner's HTTP server removes miner-only custody. It does not make availability independent of the validator set: registration, an unexpired record, successful spot audits, and reconstructability over the full dispute lifecycle are distinct predicates. Serve-or-slash is an incentive conditional on audits and repair, not an unconditional availability guarantee (E.47).

Rationale & sources (non-normative)

Sizing target and sovereign-DA decision: D-0402 (sovereign validator DA), D-0412 (DA is a validator duty, no per-byte fee; supersedes the fee provisions of D-0402/D-0407), D-0407 (leased model storage). Full design da-sovereign-validator-design.md; sizing indexer-scaling.md, scaling-500k-agents.md, scaling-500m-1b-agents.md, r3-throughput-ceiling.md. Formal: FlopSpecs/DataAvailability.lean, FlopSpecs/DaProviderRotation.lean, FlopSpecs/IndexerReorgSafety.lean, da/da-retrievability.qnt. Review arithmetic and availability assumptions: prepublication-evidence.md. Provenance clarification: D-0501. Status: Appendix H.

6. Base-Layer Primitives & Agent Autonomy

6.1 Primitives

FLOP's economic layer is account/nonce-based Substrate (zero UTXO). The available primitives:

Capacity-proportional miner self-stake (normative). Required miner self-stake MUST be linear in calibrated throughput with no cap (a cap makes the largest miners' inflation fraud +EV):

required_self_stake(B_p) = min_miner_self_stake + miner_capacity_stake_per_gflop · B_p

with min_miner_self_stake = 10,000 FLOP and miner_capacity_stake_per_gflop = 0.01 FLOP/(GFLOP·s). The coefficient guards emission-inflation fraud: the realized extra reward over the dispute window W for a miner claiming X·B_p is r·(X−1)·B_p·W (linear in B_p), so a constant k tracks the security floor k_min(EV) = ((1−p)/p)·(X−1)·P·W / B_total. The onboarding form of this bound is Appendix C.1.

6.2 Agent autonomy — operating without per-action consensus

pallet_session_keys + pallet_agent_wallet let an owner pre-authorize a delegate agent with a lifetime cap, per-tx and daily caps (epoch-reset), a pallet/destination allowlist, and a circuit breaker (circuit_breaker_window / circuit_breaker_tx_count / circuit_breaker_flop_cap). The session-key lifetime MUST be ≤ 864,000 blocks (SessionKeysMaxDuration). This is approximately 10 elapsed days only at uninterrupted 1 s target cadence; missed or delayed blocks extend the elapsed lifetime.

• R6.2a. Within its bounds, a delegate MUST be able to act with no per-action consensus — only deterministic on-chain checks — so agents run unattended, submitting asynchronously; validators order.
• R6.2b. The owner MUST be able to revoke at any time. Spending MUST be blocked at the session cap (§11 INV-02), the daily cap, and the circuit breaker; a captured session key MUST be bounded by these caps.

6.3 Transaction / state model

FLOP retains the account model; going fully UTXO-native is ratified as not adopted.

• Cross-agent parallelism is free — independent agents touch disjoint accounts; the BFT-DAG orders their concurrent blocks.
• Intra-agent txs serialize on a single u32 nonce (one in-flight; head-of-line blocking). Implementations SHOULD give each agent its own account (via agent-wallet) so the nonce serializes only its own stream, and MAY add 2-D / parallel nonces (multiple lanes per account) to remove head-of-line blocking. This is largely mooted by sessions (§12.1): a streaming session touches the chain only at OPEN/SETTLE.

A UTXO payment side-rail remains an option for a pure high-frequency micropayment hot path; it is not a second state model.

6.4 Collaborative pool & composition

The escrow primitive ("pool funds and collaborate") has landed as pallet_compute_channel (§12.1): a two-party (agent↔miner) escrow whose payout is conditioned on a settlement/dispute verdict, with mandatory timeout-refund and proven conservation (escrow = miner_pay + refund + held). It is deliberately the generalizable escrow primitive.

• R6.4a. An escrow MUST conserve funds, pay out only on quorum/verdict or timeout-refund, account per-participant, and never let a single party withdraw the pool.

The N-party generalization (shared funds, programmable quorum split) and the MPP fan-out of one session across miners are future work; until then compose multisig + treasury or 1:1 HTLC. The wider composition target is three declarative, bounded, conservation-safe layers: composable spend conditions (Miniscript-style — delivered), attenuable capabilities (UCAN/macaroon-style, generalizing §6.2 session keys — future), and a terminating multi-party escrow (Marlowe-style — the primitive above).

6.5 Cryptographic primitives & accounts

The primitives every other section relies on, pinned in one place. Consensus-critical: a change here is an encoding/soundness change (§14.1).

Accounts.

• R6.5a. An account is a 32-byte AccountId (SS58-encoded for display under the chain's SS58Prefix; devnets use distinct prefixes). Extrinsics address accounts via MultiAddress<AccountId, ()>.
• R6.5b. An account MUST hold ≥ the existential deposit (EXISTENTIAL_DEPOSIT = 0.01 FLOP) or be reaped. Balances carry 18 decimals; the base unit is VFY (1 VFY = 1 FLOP).
• R6.5c. Intra-account transactions serialize on a monotonic u32 nonce (§6.3); a delegate agent SHOULD hold its own account so its nonce stream is independent.

Signature schemes. The runtime signature type is MultiSignature (signer MultiSigner), admitting sr25519, ed25519, and ecdsa/secp256k1. Usage by role is fixed:

• R6.5d. Post-quantum resistance is out of scope (§12.4): a scalable quantum adversary breaks sr25519/ed25519/secp256k1 (Shor) and halves SHA-256 preimage security (Grover). The boundary is explicit, not silent.

Hash functions. Each is fixed to its role; do not substitute:

• R6.5e — Domain separation. A signed or hashed payload MUST be domain-separated so a signature or commitment from one context cannot be replayed in another: the transcript leaf binds session_id ‖ turn_index (§12.1b), task_hash binds agent ‖ nonce ‖ model_hash ‖ … (App. F.1), and report_data binds the full (task_hash, gn_weight, …, tee_type) tuple (§3.3).

Rationale & sources (non-normative)

Provenance: D-0408 (single validator-staking system), D-0413 (value-coupled stake floor), D-0416 (stake-ordered rotation), D-0417 (declarative spend-condition layer, UTXO not adopted), D-0418 (capacity-proportional miner stake, provisional pending sim calibration), D-0403 (sessions as the escrow primitive's first instance). Grounding: agent-composition-primitives.md, agent-token-lifecycle.md, model-selection-pricing-inference.md, miner-capacity-stake-calibration.md. Prior art: Miniscript, Simplicity, Clarity, Marlowe, Move resources, UCAN. Status: Appendix H.

7. Hardware Calibration & Drift

C_emp = floor(Σ G_job · 10⁶ / (Δblocks · u_min))
C_hard = min(C_emp, d_hard · Σ_s n_s C_sku(s))

7.1 Entry — benchmark burst

R7.1. A miner MAY enter after a chain-timed burst of independently issued, correctness-verified calibration jobs. Each credential MUST bind miner, task hash, expected work, issue/resolution blocks, pack ID, and output commitment; it MUST have been issued no earlier than the claimed burst start and MUST be consumed once.

R7.1a. accept_benchmark_burst MUST fail closed on: zero cap; fewer than calibration_min_verified_jobs; a window shorter than calibration_min_burst_blocks; stale/unverified credentials; verified work below C_emp · Δblocks · u_min; insufficient capacity-proportional self-stake; or an initial cap accepted within calibration_min_recalibration_interval_blocks. The capacity deposit MUST be present before cap activation.

• SOFT tier — with no attested GPU inventory; the cap is bounded by empirical work, capacity stake, and carries the surge multiplier + spot-check exposure (soft_tier_spot_check_rate_ppm).
• HARD tier — attestation binds up to calibration_max_gpu_inventory_entries distinct (SKU,count) entries. The host ceiling is the sum of per-device governed ceilings, discounted by calibration_provisional_discount_ppm, then bounded by empirical throughput. R7.1b. An attested inventory with any missing governed SKU ceiling MUST fail closed and MUST NOT downgrade to SOFT. Inventory entries MUST be canonicalized by SKU.

R7.1c. Calibration is per miner host. C_emp includes all attached GPUs and production batching/concurrency once; it MUST NOT be multiplied by GPU count, channel count, session count, or batch size.

The SOFT tier is the non-TEE path (§3.2, R3.2); its end-to-end settlement/dispute policy is E.33.

7.2 Renewable cap

R7.2. An accepted cap is a lease of calibration_lease_blocks. At the exact expiry boundary every registration, PoUI, stake/vesting, and compute-channel consumer MUST fail closed. renew_benchmark_cap requires at least calibration_renewal_min_verified_jobs fresh one-shot jobs issued at or after a miner-declared renewal trigger. That trigger MUST NOT be in the future or older than calibration_renewal_max_age_blocks. Their aggregate verified work MUST cover C_effective × max(1, current_block − renewal_trigger) × calibration_min_utilization_ppm / 10^6. Job count alone MUST NOT renew a cap. Renewal MUST NOT increase either empirical or effective capacity.

The accepted effective cap MUST remain frozen for its lease. A governed SKU-ceiling change MUST NOT silently alter or disable an already accepted cap. The changed ceiling applies at the next versioned renewal or initial acceptance, where it may only tighten renewal capacity.

The fixed three-phase Dyno is removed. There is no alternate legacy cap or governance force-finalize path. Long-window statistical degradation/downshift remains E.22; until then renewal proves continued correct execution, liveness, and minimum short-window throughput but does not raise or statistically re-estimate the cap.

7.3 Drift & re-calibration

Drift detection builds on canary tasks (fixed-seed, known-answer) via the Synthetic Task Engine, checking correctness (catches SDC and precision-cheating — INT4 changes outputs at equal op-count) and timing (throttling). The correctness canary itself is live (§8.1); the statistical layer — EWMA baseline + control charts → re-calibration on breach, and an MLPerf plausibility ceiling — is designed (E.22).

R7.3. The miner supervisor MUST request renewal after every process/host restart and chain reconnect, and when one day remains on the lease. An expired unchanged host MAY recover with the renewal pack. When (SKU,count) inventory or the device/driver/firmware fingerprint changes, the prior cap MUST be invalidated and a new §7.1 burst MUST complete. Missed renewal canaries expire the cap. Open sessions retain their snapshotted cap/version as an upper bound; a later versioned renewal may tighten settlement, and new sessions use the latest calibration_version.

The independent Ghost issuer MUST maintain a calibration reserve independently of organic demand: 64 jobs for a host without a stored cap and eight for a host with one. Miner-triggered acceptance does not authorize miner-chosen work. Initial replacement is throttled; renewal is not, because it consumes fresh credentials and cannot increase capacity.

Drift and cheating MUST be distinguished by signature: drift is slow, monotonic, temperature-correlated, outputs correct; cheating is a step change, wrong outputs, or throughput above the attested ceiling. Latency adjustment: Adjusted_G_n = G_n · clamp(target/actual, 0.5, 1.5) (tracked; reward weighting is E.22).

Rationale & sources (non-normative)

Provenance: D-0405 (measured G_n), D-0418 (capacity stake), D-0433 (quick entry, renewable cap, lifecycle revalidation). Priced miner BOM: validator-miner-hardware-costs.md. SDC/drift detector literature: arXiv:2502.12340, arXiv:2605.04213, arXiv:2604.10390. Formal: FlopSpecs/CalibrationFastPath.lean, FlopSpecs/CalibrationDrift.lean, FlopSpecs/Calibration.lean. Open: E.22 (statistical degradation, cache-aware metering, aggregate multi-channel reservation, MLPerf data). Status: Appendix H.

8. Performance-Locked Vesting

UnlockRate = ( G_n_actual / B_p )²  =  R_p²        (R_p = 0.5 → unlock 0.25)
Blackout:  capacity < 10% for blackout_revoke_blocks continuous blocks  →  grant revoked (1.0× slash)

• R8.1. A work-vesting grant's unlock rate MUST be the convex R_p² (underperformance is penalized super-linearly; R_p² ≤ R_p).
• R8.2. A continuous capacity blackout below 10% for blackout_revoke_blocks MUST revoke the grant (1.0× slash).

8.1 Synthetic Task Engine (Ghost Tasks)

For a HARD-tier miner, the Validator Leader injects encrypted "Ghost Tasks" sealed to the miner's TEE key. They are intended to be indistinguishable from real tasks before execution, so the attested hardware must stay operational (also the HARD-tier anti-time-slicing mechanism, §2.4, and correctness canary, §7). A SOFT miner has no TEE key; its challenge delivery, identity binding, and demand-floor eligibility are part of the unresolved SOFT profile (E.33), so the sealed-task guarantee does not apply to that tier.

• R8.1a. Ghost Tasks are fixed-seed / known-answer. An incorrect result MUST complete nothing and apply a bounded escrow slash (OnGhostTaskFailed) — deliberately not the PoUI 100%-slash + blacklist fraud path, so transient drift is not treated as fraud. A correct result completes the task; a missed deadline expires it.
• R8.1b. Failed Ghost Tasks MUST burn/re-route the vesting tokens they gate.

Encrypted issuance, demand-floor auto-injection, and the known-answer correctness canary are the engine's core; statistical drift-vs-cheat discrimination and canary-triggered re-calibration are §7 / E.22.

Rationale & sources (non-normative)

Grounding: ghost-task-sampling-design.md (sampling, GhostTaskCommitment/MinerExecutionEvidence/CheckerVerdict, issuer/checker split + appeal), miner-capacity-stake-calibration.md. Formal: FlopSpecs/Vesting.lean (unlock_le_ratio). Status: Appendix H.

9. Emission & Supply

9.1 Requirements

• R9.1 — Block reward source. The per-block reward MUST be sourced from params/flop-protocol-params.yaml (initial_block_reward, mirrored to RewardInitialPerBlock), not hardcoded or per-second. It follows the fixed halving schedule and is not subject to a governance emission ceiling above it — the genesis reward is the bound (emission ≤ 96).
• R9.2 — Halving. Emission MUST halve geometrically, floored: 96 → 48 → 24 → 12 → 6 → 3 after max_halvings = 5, then floor_reward = 3 FLOP/block forever. All unlocks are block-by-block linear (no cliffs). Cumulative emission through the halving phase (end of era 5, ~year 12) is 11,920,608,000 FLOP; it reaches 2·R₀·H = 12,109,824,000 FLOP at the end of era 6 (~year 14) — not a hard cap; the perpetual floor then adds floor_annual_emission = 94,608,000 FLOP/yr forever.
• R9.3 — Subsidy. The Labs/Foundation subsidy MUST be a separate mint (flop-subsidy), on top of — never part of — the block reward. Each of FLOP Labs and the FLOP Foundation MUST receive subsidy_per_block_per_recipient = 8 FLOP/block in halving era 0, and the rate MUST halve on the same 63,072,000-block boundaries as the block reward (8 → 4 → 2 → 1 → 0.5 per recipient) and be exactly 0 from era 5 — the subsidy TERMINATES on the same boundary where the reward FLOORS. Era 4's 0.5 FLOP is fractional in FLOP but exact in base units (5 × 10¹⁷), and the implementation MUST NOT truncate it. Duration is subsidy_duration_blocks = 315,360,000 blocks (5 eras, ~10 years); total minted = 63,072,000 × (16 + 8 + 4 + 2 + 1) = 1,955,232,000 FLOP.
• R9.4 — Genesis. Genesis is work-first (no VC pre-mint, no auction, no team allocation). genesis_supply = 4,400,000,000 FLOP MUST be allocated to exactly four genesis buckets and nothing else: the three airdrops — genesis_miner_airdrop, genesis_validator_airdrop, genesis_agent_airdrop (3,600,000,000 FLOP together, 1,200,000,000 each) — plus the ecosystem reserve genesis_reserve = 800,000,000 FLOP, which is a genesis allocation but not an airdrop. The four MUST sum to genesis_supply exactly. The validator cohort is definitionally the aggregate bond — validator_min_stake × validator_active_set_cap — so a change to the bond floor moves this cohort and therefore genesis_supply (D-0440).
• R9.5 — Committee premium. The validator 10% pool MUST NOT be increased by an inference surcharge or a second mint. It is split inside the pool with weight stake_i × (1.1 if i ∈ current finality committee else 1.0), integer dust assigned deterministically so payouts sum exactly to the pool. This holds unchanged under the four-way split: the agent and staker legs are carved out of the miner residual (miner_share_ppt 900 → 750 ppt), never added on top, so validator_share_ppt stays at 100 ppt.
• R9.6 — Transaction-fee split. The tx-fee recipient split MUST be tx_fee_burn_percent_live = 10% burn (BurnFees), with the block author receiving tx_fee_author_share_percent_live = 100% of the unburned remainder (accounting as 80 ppt miner-proxy + 10 ppt validator share co-located on the author until per-miner G_n fee attribution splits the miner share). Tips are 100% to the author. The ratified target is 80% miners / 10% validators / 10% burn; the author-proxy accounting is the interim realization. Full taxonomy: Appendix D.
• R9.12 — Agent & staker legs. The agent_share_ppt = 100 ppt and staker_share_ppt = 50 ppt legs MUST be minted every distribution period to two protocol-derived sovereign pool accounts (PalletId, §9.3 R9.10 shape), one per leg. Onward distribution from either pool MUST NOT occur until its distribution policy is ratified (E.40); the pools accrue and the mint is evented. The two legs MUST be carved from the miner share, so the four legs sum to 1000 ppt with the validator pool unchanged (§9.1 R9.5).

9.2 Survival governor (default OFF, governance-armed)

A state-dependent supply-side governor MAY be armed by governance to damp the exodus spiral near collapse thresholds only (governor_default_enabled = false): a utilization-indexed emission damping (lift miner reward when utilization is low; indexed on utilization, never price — anti-Terra; governor_emission_damping_util_floor / governor_emission_damping_max_boost) and a dynamic burn schedule (10→15→25% by era: governor_dynamic_burn_tier1 … tier3). The Day-730 participant-revenue cliff (miners 72 → 36, validators 9.6 → 4.8 FLOP/block) is the first stress case; total per-block issuance falls by exactly half there (112 → 56), because the subsidy halves alongside the reward rather than sunsetting. The deepest total-issuance step is now Day 3650 (era 5), where the reward reaches its perpetual floor and the subsidy terminates outright: 7 → 3 FLOP/block, a 4/7 ≈ 57.1% drop.

Demand-coupled rewards (invariant). PoUI MUST pay only for work with a payer-authorized demand record, the applicable verification evidence, and settlement, or for the explicitly bounded synthetic-task bootstrap floor. A payer-authorized record proves protocol demand; it does not prove an economically independent customer. A miner-controlled payer can buy genuine inference and recycle much of the payment while pursuing work rewards. Whether this is profitable depends on unrecoverable compute, fees, capital, audit costs, reward and rebate schedules, and coalition ownership; the external-demand and wash-demand model is E.49.

9.3 Genesis configuration

The consensus-critical genesis essentials (the operational deployment runbook — GENESIS_AND_DESUDO_RUNBOOK — stays separate).

• R9.7 — Supply at genesis. Total genesis supply MUST be genesis_supply = 4,400,000,000 FLOP (18 decimals), held at genesis only by the three airdrop cohorts and the ecosystem reserve of §9.1 R9.4 — no VC pre-mint, no auction, no team allocation. No block reward has been emitted at genesis; era 0 emission begins with block production.
• R9.8 — Chain-spec constants. Fixed at genesis and consensus-visible: 18 decimals, base unit VFY (1 VFY = 1 FLOP); the user-facing ticker via TOKEN_SYMBOL (a mainnet branding step, §14.2); the SS58 prefix (SS58Prefix; mainnet SS58_ZKV_PREFIX, devnets a distinct prefix — §6.5); 1 s block time; existential deposit 0.01 FLOP.
• R9.9 — Initial authorities. The genesis chain spec MUST seed the initial validator set and its session keys (BABE + AlephBFT), bootstrapping the §2 finality committee. Post-genesis the set evolves only through §15 rotation; there is no other way to enter ActiveValidators.
• R9.10 — Protocol sovereign accounts. The FLOP Foundation and FLOP Labs accounts are protocol-derived (PalletId sovereign accounts; mainnet SHOULD bind each to a multisig). They are the genesis-defined recipients/sinks for the Labs/Foundation subsidy (§9.1 R9.3), slash proceeds and the delegated-loss waterfall (§11.3), and the failed-session penalty φ (§12.1d) — never miner revenue.
• R9.11 — Bootstrap origin & de-sudo (one-way). At genesis, Root is held by pallet_sudo (§14.1, index 50) — a public dev key on devnet, a multisig on mainnet. Governance is not the sole Root authority until the de-sudo handoff neuters and removes pallet_sudo and routes RawOrigin::Root to the protocol_upgrade track (§14.1). The production runtime MUST NOT expose a Sudo key or a non-governance Root path after handoff. An arbitrary governance-approved set_code can replace these guards; the claim is therefore scoped to approved runtime code (§14.1, E.50).

Rationale & sources (non-normative)

Provenance: D-0440 (validator bond 305,505 → 1,200,000, carrying the validator cohort 305,505,000 → 1,200,000,000 and the pool 3,500,000,000 → 4,400,000,000; supersedes D-0438's pool and D-0435's bond, leaves emission untouched), D-0438 (genesis pool 2,483,460,000 → 3,500,000,000 with the four cohorts re-cut; supersedes the D-0421/D-0435 pool sizes, leaves emission untouched), D-0436 (five halvings, 3 FLOP floor, 5-era subsidy — supersedes D-0421's sixth-halving clause and amends D-0435's subsidy schedule), D-0435 (four-way split, halving subsidy), D-0421 (work-first genesis), D-0408 (validator split), D-0410 (survival governor). Bootstrap-in-equilibrium (token seigniorage subsidizing useful inference below compute cost — the Duplexia regime): Pass et al., Economics of PoUW, arXiv:2606.06700, with FLOP's duplex overhead δ ≈ low single-digit % (below Pearl's cuPOW ~10% reference, arXiv:2606.04819) machine-checked as Duplexia.subsidy_below_cost. Grounding: halving-exodus-boundary-conditions.md, fee-design.md, miner-validator-economics.md, agent-token-economics.md, f2-exodus-threat-model.md, pouw-landscape-2026.md. Review demand/value-risk evidence: prepublication-evidence.md. The subsidy and participant-economics claims remain conditional on external-demand, distribution, collateral-value, and concurrent-exposure inputs in E.8, E.35, E.38–E.40, and E.49. Provenance clarification: D-0501. Full model: Tokenomics Specification. Formal: tokenomics-supply.qnt, FlopSpecs.lean, FlopSpecs/HalvingBoundary.lean. Status: Appendix H.

10. HTLC Atomic Swap

has-station implements create/redeem/refund_htlc and create_cross_chain_htlc.

10.1 Requirements

• R10.1 — Local atomicity & conservation. Each FLOP-leg hashlock H = SHA256(s) MUST permit at most one of redeem/refund, conserve locked funds, and forbid double-claim. End-to-end cross-chain completion is conditional on the named pair's finality, inclusion, preimage, timeout, identity, fee, and relayer assumptions in §10.2–§10.3; it is not an unconditional atomicity guarantee.
• R10.2 — Timelock symmetry. After converting the foreign duration to one-second FLOP blocks, T_FLOP MUST satisfy T_other + max(ceil(T_other × p / 100), max_finality_stall + current_finality_lag), where p is htlc_timelock_symmetry_safety_margin_percent and max_finality_stall is max_finality_stall. This margin is a necessary admission condition, not by itself a timely-inclusion guarantee.
• R10.3 — Refund reorg-safety. A refund MUST be gated on the AlephBFT finalized head, not the tip (a tip-gated refund is reorg-unsafe).
• R10.4 — Relayer trust. relay_preimage MUST be permissioned (root-managed allowlist, register_relayer / RegisteredRelayers): a relayer only releases an already-locked HTLC to itself on a valid preimage. Deployments additionally assume that this allowlisted account is the intended counterparty because an order recipient is not bound in the runtime call.
• R10.5 — Multi-block settlement. A long generation MUST lock an estimated max G_n and settle the actual amount at redemption from the attested token count; timeout auto-refunds.

10.2 Chain-pair qualification

The FLOP-leg state machine and each counter-chain component are distinct. Pair-level completion depends on unresolved choices for direction, chain/asset/participant binding, per-leg finality and observation, timeout orientation and margins, recovery, and transaction inclusion. E.48 tracks those choices and the evidence needed to qualify a named pair; Appendix H records implementation status.

10.3 Incentive robustness

Plain HTLC is cheap to attack (MAD-HTLC): a rational counterparty can bribe fee-maximizing block authors to withhold an honest redeem/refund until the timelock flips. A finalized-prefix refund removes one local reorganization hazard; it does not guarantee that a redeem is included before its deadline. The local contract proves that at most one redeem/refund transition succeeds under its state machine. Cross-chain atomicity additionally assumes per-leg finality, timely inclusion, correct timeout orientation, preimage availability, and relayer recovery. The fee-floor deterrence theorem is conditional on an honest fee at least the coalition's remaining extractable value. The fee and inclusion design needed to discharge that premise remains open in E.48.

Rationale & sources (non-normative)

Prior art: MAD-HTLC (arXiv:2006.12031), He-HTLC (ePrint 2022/546) which burns a share of the colluding path. Provenance: HTLC formal→pallet mapping in formal-to-implementation-bridge.md; trust claim htlc.counter_chain_bribery_residual in trust-manifest.toml; bridge options docs/bridge/settlement.md. Review assumptions: prepublication-evidence.md. Provenance clarification: D-0501. Internal qualification evidence: chain-pair HTLC evidence. Formal: FlopSpecs/Temporal.lean (htlc_atomic, refund_within_tlock), FlopSpecs/HtlcIncentives.lean (collusion_deterred, no_burn_floor), FlopSpecs/HtlcRefundFinality.lean (refund_final_safe), htlc-atomic-swap.qnt. Status: Appendix H.

11. Security Invariants

Quint/TLA+ models under ../formal-specs/ describe versions of the invariants below. The invariants are normative. A model-checking result applies to the stated model, assumptions, explored bounds, and tool run; a model file alone is not a proof of every implementation execution. The attribution index and Appendix H separate those artifacts from runtime enforcement and open conformance obligations.

11.1 Enforced invariants

Still open (flagged, not yet enforced): INV-S03 pallet allowlist (extract_pallet_name), INV-S05 immediate session revocation.

11.2 Session G_n settlement gate

• R11.2. Channel settle / force_settle MUST call GnSink::validate_session_gn before payout or credit: a non-zero aggregate G_n MUST fit the credit domain, the miner efficiency ceiling, the finalized calibration cap, the §6.1 capacity bond, and the reject-only throughput tripwire (§4.1).
• R11.2a. This is a plausibility bound, not execution validation. settle MUST verify each submitted VerifiedTurn signature and Merkle path against one final_root, reject duplicate or out-of-range turn indices, checked-sum the submitted g_n values, and require that sum to equal aggregate_gn (verified_work_from_turns; §12.1). This authenticates the submitted leaf values and their arithmetic. It does not prove that the claimed execution occurred or that the submitted turns exhaust an independently committed transcript (E.43/E.44).

11.3 Validator slashing table

pallet_validators is the single authority for validator penalties.

Collusion/forgery/TEE stay flat 100% (evidence-backed fraud). Equivocation is the only correlated, recoverable class (a lone double-sign is most often an honest failover bug). On every slash path the loss order (delegated-loss waterfall) MUST be: operator self-stake first, then native delegators pro-rata, then sponsors at the fault rate.

Rationale & sources (non-normative)

Provenance: D-0409 (slashing-table reconciliation), D-0420 (correlated equivocation), D-0419 (unbonding slash-lock). The P0 agent-economics sweep (INV-02, fail_task, session nonce, payout atomicity) closed the four flagged-not-enforced invariants. Grounding: formal-specs-agent-economics.md, session-work-verification-gap.md, fee-design.md, economic-security-proofs.md, network-valuation.md (value-coupled floor V_booked = a·n_eff + b·n_eff² + c·v̄·D₂, C5/D-0413). Formal: FlopSpecs/Security.lean (StakingSlashing, CoCVoC), FlopSpecs/Sessions.lean, channel/session-gn-integrity.qnt. Status: Appendix H.

12. Agents as Market Actors — Sessions & Settlement

FLOP's compute consumers are autonomous, strategic AI agents. This section specifies the settlement path they use (attested streaming sessions), the per-identity caps that bound them, and the market-actor threat class they create.

12.1 Sessions — attested streaming & aggregate settlement

Inference settles through pallet_compute_channel — the sole inference-dispatch path (the former per-task 4-extrinsic RPC rail is removed). A cooperative happy path has two primary lifecycle inclusions, open_channel and settle; unilateral close, evidence publication, escalation, and disputes add calls. Settlement bytes and verification cost are not constant: settle carries and verifies submitted turns, signatures, and Merkle paths; pairwise duplicate scanning is quadratic in submitted turn count. The inference stream remains off-chain, but throughput depends on encoded bytes, runtime weight, evidence calls, committee load, and GPU capacity (E.46).

• R12.1a — Reserved capacity, not metered refund. Escrow at open_channel is the payment for reserved capacity; settle pays the reserved amount in full (no settlement fee). Under-use MUST NOT be refunded. The only refund paths are a non-delivery timeout, an upheld fraud dispute, or a failed/early-terminated session (R12.1d).
• R12.1b — Transcript. The enclave (or, on the SOFT path, the miner session key) MUST sign each turn (session_id ‖ turn_index ‖ H(input) ‖ H(output) ‖ G_n) into a running Merkle accumulator; the agent MUST verify and counter-sign a receipt over the cumulative root before accepting output. Uniqueness is session_id‖turn_index; replay protection is the monotonic counter. settle posts the final root + aggregate G_n. These signatures prove agreement on a receipt and sum; they do not prove that the output resulted from the claimed execution. The current cooperative path pays and credits the co-signed claim immediately. Public reward eligibility and late-fraud recovery therefore remain open in E.44.
• R12.1c — Tier-specific model binding. A HARD-tier open_channel and settle MUST verify the proof's measured dm-verity root against the registry (ModelRegistryQuery::verify_measured_root); a wrong root at settle MUST reject. The SOFT profile has no TEE-measured root; its model/decode binding, evidence predicate, value cap, and dispute path are E.33.
• R12.1d — Failed/early close split. On the unilateral force_settle → finalize path the miner keeps the two-part tariff P = BasePerTurn·n + rate_G·G_claimed (flat per-turn payment over n turns plus claimed reference-work converted into payment units). G_n is the whole-reference-GFLOP integer from R4.4 and the current conversion is exactly one channel pay unit per stored G_n unit; this is a tariff constant, not an assertion that one G_n equals one FLOP base unit. Existing values and escrow amounts are unchanged. channel_base_per_turn = 1, so P is bounded below by the converted work term, the agent is refunded (1−φ)·(E−P), and the penalty φ·(E−P) (refund_penalty_phi_percent = 20%) MUST be burned/routed to the Foundation — never the miner. A miner-fault non-delivery uses φ = 0 (full refund). Conservation: P + (1−φ)(E−P) + φ(E−P) = E.
• R12.1e — Over-use. Handled by abort or in-place top_up_escrow (Lightning splice-in); the aggregate-G_n accumulator already grows unbounded, only the escrow cap is raised.
• R12.1f — Disputes (fraud only). Optimistic settlement + bisection over the transcript root: a challenge resolves at a single contested turn (signature + Merkle-membership check); a non-response within channel_dispute_response_window_blocks MUST default to a fraud verdict → slash via the miner-slashing forgery path + agent refund. Disputes cover protocol fraud only (wrong measured root, inflated G_n vs transcript, forged signatures, non-delivery) — never output quality. The challenge window (channel_dispute_window_blocks = 7 d) MUST be ≤ DA retention W (14 d). Standing is the session agent (its own channel) + any active validator (any channel); arbitrary public challengers MUST be rejected before bond lock.
• R12.1g — Finality-stall recovery. Deadlines MUST read hp_consensus::FinalizedPrefix and economic deadlines MUST freeze while finality stalls. Funds MUST NOT release from an unfinalized best head. Recovery is restored AlephBFT finality or an explicitly ratified checkpoint procedure under §13.0a; unresolved channels remain frozen until that recovery establishes a finalized prefix.
• R12.1h — Session length & re-attestation. Trust shifts to the session enclave key attested once at open_channel. A channel MUST bound blast radius by a max duration D_max / max turns n_max (channel_max_settlement_turns caps a bundle at 1,024), and SHOULD re-attest every k turns with k ≤ min(Bond / v_turn, T_tcb / t_turn).

Capacity disposition. No session-control transactions-per-block, finalized-lifecycles-per-second, or inclusion/finality-latency target is specified. D-0502 withdraws the former 96/128 admission and 48/64 lifecycle figures because they were derived from call count rather than serialized size, charged weight, state execution, competing traffic, serving load, and network finality. Admission remains subject to the runtime's byte, two-dimensional weight, state, and validity gates. A future profile MUST reserve measured settlement/dispute headroom under congestion and satisfy E.46 before making a capacity claim.

12.2 Per-identity capacity reservation

• R12.2. The session per-identity in-flight reservation cap MUST be enforced at open/force_open: base max_active_reservations_base plus one slot per escrow_per_reservation_slot escrowed; freed on settle/expire/timeout/fraud. Per-block work is bounded by the consensus max_gn_weight (≤ 1 PFLOP / payload). High-value/blast-radius audit forcing uses high_value_gn_threshold and audit_quantum_gn.

12.3 Market-actor threat class

Autonomy creates a threat surface none of the target/vector models (§3.1, §2.4, §6.2) cover: tacit algorithmic collusion (RL bidding agents learn supra-competitive prices with no communication), compute hoarding/cornering, wash/Sybil bidding, attestation-gamed pricing, MEV-on-compute, and reservation griefing. The FLOP asymmetry: TEE-bonded miners are Sybil-hard supply while lightweight agents are Sybil-soft demand, so §2.4's Sybil cost MUST extend to the demand side (registered stake + reservation = a capital floor linear in identity count).

• R12.3. A collusion response MUST perturb the mechanism (re-randomize the auction, coarsen the grid, inject synthetic demand) rather than punish individuals (no provable intent). Monitoring gauges (bid-dispersion collapse, held/circulating ratio, utilization→scarcity) drive both the detector and the §9.2 governor.

12.4 Cryptographic adversary model

Every proof in this spec assumes a classical PPT adversary (Crypto.lean is a symbolic Dolev–Yao model). It is not quantum-resistant: a scalable quantum adversary breaks sr25519/ed25519 (Shor) and halves SHA-256 preimage security (Grover). Post-quantum migration is out of scope until a PQ primitive is on the roadmap; the boundary is explicit (crypto.quantum_adversary, trusted/todo).

Rationale & sources (non-normative)

Provenance: D-0403 (capacity-reservation sessions), D-0422 (refundable failed sessions), D-0424 (dispute standing), D-0427 (withdrawn throughput target), D-0430 (degraded-state matrix), D-0501 (verification, finality, unit, and claim-scope clarifications), D-0502 (capacity disposition). Frame threats on OWASP Agentic Top-10 (2026) + ATFAA/STRIDE + MITRE ATLAS. Controlled repeated-auction evidence finds that LLM bidders produce supra-competitive outcomes in small markets and return toward competition as bidder count grows (Tolety 2025); this empirically grounds R12.3 but is not an assumption of the formal deterrence theorem. Grounding: agent-market-threat-and-compute-economics.md, r2-payment-channel-sessions.md, session-matching-orderbook-vs-agent-select.md, session-migration-semantics.md, f1-f2-store-of-compute-and-network-survival.md, compute-spot-market-formation.md, frcr-methodology-v0.md, triz-ifr-agent-market-ideas.md (C-TRIZ pass: system IFR, open-contradictions ledger, verification/discovery/fairness clusters), proposal-capacity-reservation-units.md (CRU — bonded forward compute, ratified as D-0434; implementation as forward-dated channels), term-curve-methodology-v0.md (the observational CRU forward curve: terminal bonded settlements only, 1d/7d/30d buckets, quantity-weighted median under publication floors — never blended with spot FRCR), dispute-window-rightsizing.md (the 7 d → ~1 d rightsize analysis, deferred). Agent-security cluster: security-across-domains.md, agent-security.md, agent-specific-security.md. Formal: DemandSideSybil.lean, ChannelPayoutLiveness.lean, FlopSpecs/Sessions.lean, formal-specs/channel/channel-settlement.qnt. ChannelPayoutLiveness::escape_safe models the prior best-head escape and is not a witness for R12.1g after D-0501; the finality-safe replacement needs a new witness. Review evidence: prepublication-evidence.md. Status: Appendix H.

13. Failure Semantics — Actor × Failure Matrix

Machine-legible failure semantics per actor: failure → detection signal → protocol response → what the agent observes → recovery. Adversary model: agents are fast and may be malicious; miners may be malicious; validators may crash or collude. Rows marked [GAP] are unhandled/unspecified (indexed in Appendix E); rows marked [OOS] are out of protocol scope by design. Per-row implementation status lives in Appendix H. Economic mass-failure (exodus chains C1–C7) is in f2-exodus-threat-model.md.

13.0 Degraded-state settlement policy (normative)

R13.0. A liveness repair MAY extend or pause a window, but it MUST NOT convert missing or stale evidence into a miner payout. Each degraded-state row below is a normative settlement policy:

13.1 Miner (malicious or crashed)

13.2 Validator (consensus + DA + leader duties)

13.3 Validator attestation quorum (BFT fraction)

Active validators run DCAP/dstack off-chain and submit ValidatorAttestation bundles; the chain checks distinct active-validator signatures against ceil(active_count × validator_attestation_threshold).max(1) (default 2/3).

13.4 Finality & block production

13.5 Agent (fast, malicious, or crashed)

13.6 Publisher

13.7 Off-chain infrastructure

Rationale & sources (non-normative)

Provenance: D-0430 (degraded-state matrix), D-0409/D-0420 (slashing), D-0416 (rotation), D-0424 (dispute standing), D-0426 (checkpoints). Grounding: da-loss-beyond-k-dispute-default.md, validator-attestation-outage-degraded-mode.md, session-migration-semantics.md, session-discovery-reputation.md. Finality-stall stance: docs/plans/FINALITY_STALL_STANCE.md. Formal: SettlementOrdering.lean, account-recovery.qnt, formal-specs/channel/settlement-degraded-window.qnt. Status: Appendix H.

14. Governance & Protocol Upgrades

Governance is OpenGov: pallet_referenda, pallet_conviction_voting, custom Origins, pallet_scheduler + pallet_preimage (enactment/timelock/large-call storage), pallet_treasury, pallet_multisig, pallet_proxy (with a Governance filter). Break-glass: pallet_emergency_override (root-only, emergency_override_timelock = 72 h, emergency_override_cooldown = 7 d) and pallet_emergency_pause (granular per-pallet/global circuit breaker with auto-expiry).

14.1 Requirements

• R14.1 — Protocol-upgrade track. The production protocol_upgrade (Root) track MUST route RawOrigin::Root so a referendum can dispatch set_code / any EnsureRoot call. Approval MUST be flat protocol_upgrade_approval = 67% (BFT 2/3); support MUST meet the turnout floor protocol_upgrade_support_floor (linear 50% → 15% of ActiveIssuance); enactment MUST be timelocked protocol_upgrade_enactment_timelock = 14 d via the Scheduler. Decision period, prepare/confirm, and decision deposit are E.9.
• R14.2 — Bootstrap submit gate. Through the first halving (block 63,072,000), protocol-FIP submission MUST sit solely with the FLOP Foundation (EnsureFoundationProtocolSubmit) — submit control, not vote control; approval/support/timelock still apply. The gate sunsets at that boundary.
• R14.3 — De-sudo. Governance is not "live" until every EnsureRoot site is reachable through a governance origin and pallet_sudo is neutered (remove_key) and absent from the production runtime. This is a property of the approved runtime code, not an invariant against a future Root set_code replacement.
• R14.4 — Enactment boundary. A forkless change (on-chain WASM set_code) MUST follow the storage-compat discipline (spec_version bump + try-runtime). A coordinated change (consensus engine, host functions, P2P, finality gadget) cannot be enacted by a runtime call: governance authorizes, a node-binary release activates at an upgrade-deadline block height.
• R14.5 — Current-runtime safety envelope. Parameter-update calls exposed by the approved runtime MUST NOT leave the safety envelope (≥67% approval, ≥15% quorum, ≥14 d timelock, ≥1200 stake floor, no self-disable); each such enactment MUST be rate-limited (governance_param_max_step_pct). These guards and their formal model do not constrain arbitrary replacement code dispatched through Root set_code. Safety across runtime replacement depends on review, voter approval, and social governance; the approved-code assumption is E.50.
• R14.6 — Circuit breaker. A hardcoded protected set (consensus/inherents, Scheduler/Preimage, governance voting, the breaker itself, Sudo) MUST NOT be pausable; pauses MUST auto-expire. Post-de-sudo, the pause origin MUST stay fast (an ops multisig, not the timelocked track), with a distinct resume origin.

14.2 FIP binding

A FIP is a numbered off-chain design doc. On-chain, a protocol_upgrade referendum binds to it via referenda.set_metadata (a Preimage hash of the FIP text); no structured on-chain FIP metadata is required.

Rationale & sources (non-normative)

Provenance: D-015 (67% + break-glass), D-0415 (adopt OpenGov, supersede the custom FIP pallet SPEC-024), D-0425 (Foundation submit gate through first halving), D-0501 (current-runtime scope and approved-code assumption). Work breakdown: docs/plans/GOVERNANCE_ACTIVATION_PLAN.md. Formal: FlopSpecs/Governance.lean (GovernanceTransition), governance/governance.qnt. These witnesses quantify over the modeled permitted updates, not arbitrary replacement bytecode. Review evidence: prepublication-evidence.md. Open: E.9 (track magnitudes), E.50 (arbitrary-upgrade scope). Status: Appendix H.

15. Validators — Onboarding, Duties, Selection & Rotation

Validators are the staked security base: each authors blocks (BABE), finalizes them (AlephBFT), attests miners' proofs (§3.6), adjudicates checker verdicts (§3.5), and hosts the sovereign DA layer (§5.3). Pallet pallet_validators; committee gate hp_consensus::select_committee.

15.1 Roles

A validator secures consensus and, as part of that role, verifies and co-signs miners' attestations and checker verdicts via a BFT quorum. A validator function MUST NOT require executing inference, producing PoUI proofs, or owning a GPU or TEE: committee eligibility is verification liveness (§15.4), and re-execution is a checker duty (§3.5). Validators are not miners — a validator account MAY also register as a miner, but miner activity confers no validator eligibility.

15.2 Onboarding (normative)

Registration is self-signed and permissionless above the stake floor. register freezes the account's full reducible balance as self-stake and places the validator in ValidatorQueue, not directly in ActiveValidators — promotion happens only through rotation (§15.5).

Delegation (min 100 FLOP, ≤ max_delegators_per_miner-class bound) and commission follow §6.1.

15.3 Duties & resource intensity

The one heavy leg is DA storage/serving; no validator duty requires a GPU or TEE. A production validator SHOULD provision the reference profile of validator-miner-hardware-costs.md §2.1: 8 physical cores at ≥3.4 GHz with SMT off, 32 GB ECC RAM, 4 TB enterprise NVMe (chain state plus DA custody under §5.3 retention), and a 1 Gbps symmetric unmetered link — the AlephBFT-class node reference plus storage.

15.4 Selection — the PoUI-gated committee

• R15.4a. The finality committee MUST be drawn by filtering ActiveValidators to those meeting effective_minimum_stake() and a recent accepted verification duty (R15.4c; stake and verification liveness — §2.3 sub-proofs 1 & 3), then randomly sampling finality_committee_size = 100 distinct members stake-weighted without replacement off a BABE-VRF seed (hp_consensus::sample_committee_weighted). pallet_aleph snapshots this committee each epoch and exposes authorities() to finality-aleph.
• R15.4b. The sampling seed MUST be BABE-VRF epoch randomness (fixed for the epoch, one epoch old), domain-separated per rotation. This delays and limits current-author influence; it does not by itself prove unbiasability. The seed-influence and repeated-draw analysis is E.42.
• R15.4c — Verification liveness. A validator's recency signal (LastVerifiedWork) MUST be refreshed only by an on-chain accepted verification duty: (a) being a signer of an accepted validator attestation bundle (R3.6b); (b) being a signer of an accepted TOPLOC mismatch or escalation-clear quorum (R3.5d, §12.1); (c) an accepted DA retrievability-audit response (R5.3b); (d) an accepted dispute opening by a validator (R12.1f); (e) a correct answer to a protocol-issued known-answer verification challenge — the §8.1 Ghost-Task pattern applied to verification: a VRF-selected fixture (an attestation bundle or a DA opening of a protocol-seeded liveness blob) whose expected verdict the chain already holds. Every signer of an accepted bundle or quorum MUST be credited. Prover credit (OnProofVerified) MUST NOT refresh it. The signal is recent when within WorkRecencyWindow = 86,400 blocks. Because (a)–(d) exist only when there is traffic, the protocol MUST issue every active validator at least one challenge (e) per window from block initialization rather than a privileged origin, with a response deadline that falls before the validator's current recency lapses, so an honest validator on a quiet or fresh chain cannot age out. Gate wiring is E.52.

If the eligible pool has fewer than 100 identities, selection MUST follow the ratified minimum-safe-size and bootstrap profile in E.42 before claiming conformance. An N=100 capture bound does not apply to a smaller realized committee, and paid work alone does not establish honest consensus behavior.

Composite performance score = 40% uptime + 30% block_rate + 20% accuracy + 10% latency (performance_score_weights); it is the rotation-floor input.

15.5 Rotation & set size

Rotation runs in on_initialize every validator_rotation_interval_blocks (~30 d) plus manual rotate.

• R15.5. Rotation MUST eject the bottom validators_to_eject = 50 and promote the top validators_to_promote = 50 from ValidatorQueue whose stake ≥ the current minimum; ejected validators serve ejection_cooldown_blocks (~7 d) then rejoin with stake topped to the current minimum. Ranking MUST be by stake subject to a minimum-performance floor (verification liveness per R15.4c + uptime), so padding the liveness signal does not improve rank (only clearing the floor remains gameable).

• R15.5b. The active set MUST NOT exceed validator_active_set_cap = 1,000. register admits to ValidatorQueue, never directly to the active set; rotation MUST promote from the queue only while a slot is free, so the cap bounds ActiveValidators and never registration. Queued validators hold stake and may do useful work; they are not finality-eligible until promoted.

Set size. The active set is capped at 1,000; the finalizing committee is 100 (§15.4), sampled from the active set, so the two are separate bounds. Effective set size below the cap is governed by rotation throughput and the stake gate.

15.6 The validator across the session lifecycle

Inference streams off-chain, so ordinary validation does not re-execute every inference turn. Settlement still performs work proportional to submitted turns, signatures, and Merkle paths, and sampled audits add off-chain re-execution by the checker lane (R3.5d), never by the validator itself. Validator touchpoints:

Two distinct co-signings: (a) the validator BFT attestation quorum co-signs a proof for G_n credit on the direct rail; (b) the agent co-signs each turn's receipt and the settlement receipt. Only (a) is a validator duty; any re-execution behind either is the checker lane's (R3.5d). Miner and model selection is agent-driven (open_channel names the miner and pins model_hash); there is no on-chain scheduler.

15.7 Slashing & recovery

pallet_validators is the single penalty authority (§11.3 table). Fraud (Collusion / Equivocation / EvidenceForgery / TeeAttestationFailure) = 100% burn + eject + blacklist; Liveness = 1% + jail; extended downtime = 5% + kick. Correlated equivocation follows the recoverable curve. validator_unbonding_blocks = 21 d with a slash-lock while a session/dispute/audit is open, safely > the 14 d DA retention W.

Rationale & sources (non-normative)

Provenance: D-0408 (single validator-staking system), D-0413 (value-coupled floor), D-0416 (stake-ordered rotation), D-0437 (active-set cap), D-0409/D-0419/D-0420 (slashing/unbonding), D-0501 (seat premise and cooperative-credit scope), D-0439 (verification liveness; CPU-class validator). Grounding: validator-miner-hardware-costs.md (§2.1 reference profile and comparables), miner-validator-economics.md, da-sovereign-validator-design.md, miner-capacity-stake-calibration.md, r2-payment-channel-sessions.md, session-work-verification-gap.md, prepublication-evidence.md, session-matching-orderbook-vs-agent-select.md. Ops guide: docs/onboarding/validator.md. Formal: FlopSpecs/Sessions.lean, formal-specs/channel/channel-settlement.qnt. Status: Appendix H.

Appendix A — Parameter Reference

The table below is generated from params/flop-protocol-params.yaml (the canonical machine-checked contract; every value is mirrored into runtime / SDK / sim code and gated by scripts/check_params.py). Regenerate with uv run --script scripts/gen_param_table.py; drift fails just verify-whitepaper. Each row is anchored #param-<name>, and prose links to the corresponding generated anchor. This table is the single authoritative list of the values themselves.

Enforced parameters (params/flop-protocol-params.yaml); every value below is mirrored into code and gated by scripts/check_params.py. Link a parameter anywhere in the spec with its generated #param-<name> anchor.

Genesis

Emission & Rewards

Developer Subsidy (separate from block reward)

Staking & Delegation

Compute-channel timing bounds

Sessions / capacity reservations (A1 anti-spam)

Finality-stall safe mode (compute-channel)

PoUI simulator-mode safety flag (#297 CRIT-02 / RT-C02)

F2 supply-side governor (default OFF; governance-settable)

Governance

Consensus / finality committee

Validator security policy

Metering tripwire

Compute-channel settlement

Derived TOPLOC band (governance-set per model/precision; #685, #705)

Model registry (decode-policy sets)

Metering cert tokens-per-byte band (#871)

Metering cert circuit version + guest image-id registry (#929)

Transaction fees (live values)

Data availability

Agent wallet / session keys

Reference-only — canonical documented values, single-site or not yet wired for cross-language enforcement (enforce: false).

Cross-language names (canonical ⇄ Rust ⇄ Lean ⇄ Quint). The same protocol value carries a different identifier per language by convention; values agree where a language pins the real (non-demo) figure. Enforced rows are value-gated against the Rust site by check_params.py.

Derived quantities & narrative constants — structural values, formulas, and mechanism constants that are not part of the machine-checked numeric contract above (so they live here, not in the params file):

The open/unset values referenced above are specified as numbered fill-in stubs in Appendix E — Open Specification Items.

Appendix B — Sources

Decision record (ratified positions, MADR + changelog): Decisions v0.4 — D-0401..D-0432 (consensus, sovereign DA, sessions, measured model_hash, measured G_n, validator-native attestation, governance, rotation-by-stake, composability, capacity-proportional miner stake, unbonding slash-lock, correlated equivocation, TOPLOC required, TEE-optional) + the v0.3 → v0.4 changelog.

Research corpus (each doc carries its full citation set): the whitepaper/research/ directory is the long-form grounding for every section; the per-section Rationale & sources trailers link the docs relevant to each. Cross-cluster index: triz-issue-decomposition.md (papers mapped to every open issue). Superseded/critical-review context: yellowpaper-critical-review.md (baseline audit). Reference specs: Protocol Spec · Tokenomics Spec · Formal specs.

Supporting literature (2025-26 scan; full set in the TRIZ doc):

• Consensus/finality — non-PoW longest-chain (in)security arXiv:2505.14891 · PoUW security arXiv:2405.19027 · deterministic BFT in a block DAG arXiv:2102.09594 · Shoal++ arXiv:2405.20488 · Lemonshark arXiv:2604.03974 · Ebb-and-Flow arXiv:2009.04987 · Aleph arXiv:1908.05156.
• PoUW economics — Pass et al. equilibrium arXiv:2606.06700 · usefulness gap (Pearl cuPOW) arXiv:2606.04819 · PoUW from arbitrary matmul arXiv:2504.09971.
• Verifiable inference — VeriLLM arXiv:2509.24257 · SPEX arXiv:2503.18899 · EigenAI arXiv:2602.00182 · Optimistic TEE-Rollups arXiv:2512.20176 · TOPLOC arXiv:2501.16007.
• TEE / model integrity — Laminator arXiv:2406.17548 · Attestable Audits arXiv:2506.23706 · NVIDIA CC whitepaper · dm-verity kernel docs · Tinfoil model identity.
• SDC / drift — arXiv:2502.12340 · arXiv:2605.04213 · arXiv:2604.10390.
• Composition — Miniscript · Simplicity · Clarity · Marlowe · Move resources arXiv:2004.05106 · UCAN.
• HTLC — MAD-HTLC arXiv:2006.12031 · He-HTLC ePrint 2022/546.
• Collusion — Calvano 2020 + arXiv:2504.05335.

Appendix C — Miner Lifecycle (End-to-End)

A worked walkthrough of the honest path (informative; the normative rules are §4–§8, §12). Operator steps: docs/onboarding/miner.md.

C.1 Onboard. Bond ≥ the capacity-proportional requirement (§6.1) via miner_staking::register_miner(commission); unbonding is slash-locked while any session/dispute/audit is open. Complete the §7 timed benchmark (SOFT: no inventory ceiling; HARD: bounded by the summed attested (SKU,count) ceiling). Deposit capacity stake before activation; the worker renews the seven-day cap from fresh canaries. Register each served model via model_registry::register_miner(...) and bind the measured dm-verity root (set_measured_root; §3.3).

C.2 Go live. Sessions are agent-initiated and 1:1; an agent selects a miner off-chain (model_registry::find_best_miners) and opens a channel. On-chain discovery/reputation is future; the chain emits reputation signals (FailedAcks) for an off-chain router.

C.3 Establish. Cooperative: after an RA-TLS handshake attests the enclave, the agent calls open_channel(miner, model_hash, measured_root, precision, enclave_key, agent_key, sla, escrow, nonce); escrow is reserved and is the price. Permissionless: force_open(...) places the channel in PendingAck { ack_deadline = now + AckWindow }; the named miner accepts with force_ack(channel_id, enclave_key); otherwise expire_force_open refunds in full and records FailedAcks only when escrow ≥ min_force_open_escrow_for_failed_ack.

C.4 Serve. Each turn the enclave signs a leaf (session_id ‖ turn_index ‖ H(input) ‖ H(output) ‖ G_n) into a running Merkle accumulator; the agent verifies and counter-signs a receipt over the cumulative root before accepting output. If the agent refuses to co-sign, the miner settles unilaterally at the last mutual receipt. Re-attestation recurs every k turns (§12.1h).

C.5 Claim. At close the miner posts the final root, aggregate G_n, and last mutual receipt in settle/force_settle; crediting is immediate after GnSink::validate_session_gn (a plausibility bound — §11.2), then payout_settlement feeds the aggregate G_n into the WorkVesting/BlockRewards accumulator. The settle path re-checks the measured root against the registry.

C.6 Close. settle (both signatures → immediate payout, no under-use refund); force_settle → finalize (challenge window 7 d ≤ W); timeout (non-delivery → full refund, φ=0); failed/early close (three-way split, §12.1d); dispute (fraud only — bisection; non-response → fraud verdict).

C.7 Extend/chain. top_up_escrow raises the reserved-capacity cap. Past D_max/n_max re-open with a fresh handshake. Mid-session crash recovery is receipt-fenced (pay only the highest co-signed cumulative receipt; unacked tail bounded by MaxUnackedGn); recovery is a fresh reopen on another miner with client-held context replay.

Grounding: miner-capacity-stake-calibration.md, r2-payment-channel-sessions.md.

Appendix D — Fee & Revenue Map

One payer → recipient → sink taxonomy for every money flow (informative summary of §4.2, §5.3, §9, §11, §12). Participant revenue (miner/validator earnings) is named separately from protocol runway (Labs/Foundation subsidy) and from refundable deposits (never revenue). Emission is minted; fees/escrows are transfers; burns and Foundation receipts are sinks.

Runtime-constant ⇄ SDK/explorer cross-map and the residual indexer schema cleanup (reward_distributions burn_share/treasury_share/staking_share vs. the emitted miner_share+validator_share) are tracked as an implementation cleanup, not a protocol decision. Provenance: D-0435, D-0408, D-0403, D-0412, D-0407, D-0409, D-0421. Grounding: fee-design.md, miner-validator-economics.md, agent-token-economics.md.

Appendix E — Open Specification Items

Each unresolved value/definition/mechanism has a numbered stub: what must be specified, a placeholder to model against until it ratifies, its home section(s), and the blocking decision/task. Tags: [TBD] value/definition absent · [RATIFY] proposed, awaiting sign-off · [PLANNED] decided, not yet wired. To close an item: write the value into its home section, then delete the stub (closed numbers are retired, not reused).

E.8 — Value-coupled floor k + retarget cadence [TBD]. Set k in effective_minimum_stake = max(baseline, k·V_booked) and its governance retarget cadence. Placeholder: k ≥ m·κ/(θNσδ); slow-cadence retarget from the indexer D₂/n_eff. Home: §11, §15.2. Blocking: #556.

E.9 — Governance track magnitudes [RATIFY]. Sign off the protocol_upgrade track values. Placeholders: min_support linear 50% → 15% of ActiveIssuance; decision period 28 d; prepare/confirm 2 h / 24 h; decision deposit high-FLOP, magnitude TBD. Home: §14.1. Blocking: #681.

E.22 — Aggregate reservation + statistical drift + cache-aware metering [PLANNED] (M6/M13). Quick-canary count, timed packs, lease/renewal cadence, restart supervisor, expiry, multi-GPU fingerprint invalidation, and deposit-before-activation are live under D-0433. Remaining: miner-wide capacity reservation across overlapping channels; rolling eligible-work coverage and automatic degradation downshift; canonical production fingerprint acquisition; per-SKU MLPerf plausibility datasets; and a proof-bound cached-prefix witness so reused prompt prefill is not charged again. SPEC-026 applies ceiling rejects, co-signed EWMA rebates, reputation, and slashing only for timing fraud. Home: §4, §7, §13.1. Decision: D-0433. Blocking: follow-up to #1070.

E.23 — Minimum-escrow / bonded-reservation economics [TBD] (A10). Dust count is bounded by the per-identity reservation cap and the min_force_open_escrow_for_failed_ack floor, but the general pricing of a minimum escrow / bonded reservation is unspecified. Home: §13.5. Blocking: ENG-10 (#220).

E.24 — Ordering-game / MEV analysis [PARTIAL] (V7). Strict dispute guard vs. non-strict finalize guard commute at a fixed finalized head; the residual force-settle path exposure is ≤ one escrow. Binding settlement mode in the signed receipt or defining protocol path priority removes the choice. Operational maxDelay, FOCIL enforcement, and path-binding remain open. Home: §13.2. Blocking: #445.

E.27 — Session max-duration extension + re-attestation cadence wiring [PARTIAL]. The cadence bound k ≤ min(Bond/v_turn, T_tcb/t_turn) is specified; in-place max-duration extension and the re-attestation cadence are not yet wired. Home: §12.1, Appendix C. Blocking: #682 (SPEC-025).

E.41 — Active-set cap vs. BABE authority bound [PLANNED]. D-0437 ratifies validator_active_set_cap = 1,000, but the runtime cannot reach it: MaxAuthorities = MAX_ACTIVE_VALIDATORS = 200, and ValidatorSessionManager::new_session passes the whole ActiveValidators set to pallet_session untruncated, so an active set above 200 collides with the authority bound. Resolve by either (a) raising MAX_ACTIVE_VALIDATORS to the cap, making every active validator a BABE authority, or (b) specifying a selection rule that draws the authority set as a subset of the active set — a third sampling layer alongside the §15.4 committee draw, and therefore consensus-critical. Also open in the same item: enforcing the cap on the rotation promote path (today only the ConstU32<10_000> storage bound applies) and aligning that bound, which is a storage-layout change needing a decode-compat test. Home: §15.5, §15.4. Decision: D-0437. Blocking: #1393.

E.42 — Committee seat-capture model [TBD]. Establish a capture bound for the implemented weighted-without-replacement draw over distinct eligible identities. The model must use seat count as the AlephBFT safety variable and cover unequal stakes, small eligible pools, stake splitting, repeated draws, and BABE-VRF seed influence. Retain the 40 Byzantine identities at stake 1 versus 61 honest identities at stake 3, drawing 100 of 101, as a regression case: Byzantine aggregate stake is 40/223 ≈ 17.94% while every draw contains 39 or 40 Byzantine seats. Placeholder: no aggregate-stake/binomial bridge; conformance requires a separately justified strict <⅓ Byzantine-seat premise. Also specify the zero-duty bootstrap fallback, the nonempty-but-undersized duty pool, and a minimum safe committee response; an N=100 bound cannot apply silently when the implementation returns fewer seats. Home: §2.3, §13.2, §15.4. Blocking: new consensus decision, exact sampler analysis, undersized/bootstrap policy, and formal witness. Tracking: #848.

E.43 — End-to-end verification/error bridge [TBD]. Specify and test the commitment/challenge/opening protocol that connects TOPLOC's empirical detector and projection formula to settlement: activation-vector binding, post-commit challenge randomness, opening verification, quantization/backend distributions, adaptive attacks, DA publication, audit selection, and adjudication. State conditional error terms; use a product only with justified conditional independence. Placeholder: artifact presence records a claim but does not establish execution correctness or a cryptographic false-accept rate. Home: §3.2–§3.5, §12.1, Appendix F. Blocking: protocol design, adversarial matrix, and implementation-to-proof conformance test. Tracking: #1493.

E.44 — Cooperative work-credit eligibility [TBD]. Define when a co-signed session receipt becomes eligible for public work rewards. Signatures, Merkle membership, and sum equality prove agreement and arithmetic, not claimed execution. Specify required audit/finality treatment, false-work rejection or recovery, late-fraud effects on issued rewards, evidence availability, calibrated-cell admission, audit timing, and challenge standing. Placeholder: cooperative payout transfers reserved escrow, while public work credit carries no end-to-end correctness claim until this rule ratifies. Home: §3.6, §9, §11.2, §12.1, §15.6. Blocking: colluding payer+miner adversarial test on the actual reward path and a protocol decision. Tracking: #1494.

E.45 — Effective-challenge incentive model [TBD]. Define players, utilities, challenger rewards and costs, coalition/bribery behavior, exposure horizon, collectible collateral, and miner-wide reservation across concurrent channels. Expand p_effective into availability, selection, inclusion, correct adjudication, and collection events, with each factor conditioned on all prior events and without an independence or Markov assumption. Placeholder: total_profitable_exposure < p_effective × collectible_penalty is a conditional risk-neutral deterrence budget, not a unique-equilibrium or zero-fraud theorem. Home: §3.5, §6.1, §11.3, §12.2. Blocking: aggregate reservation E.22 plus a ratified payoff model. Tracking: #1495.

E.46 — Direct/session capacity evidence [PENDING; PARTIAL EVIDENCE]. This mechanism remains open. Internal source-checked fixtures reproduce exact SCALE bytes for supported direct active-set/quorum sizes and cooperative/unilateral settlement over turn/path limits, a duplicate-last bundle, TOPLOC evidence publication, and dispute calls. It includes runtime pallet/call indices, v5 bare and v4 signed framing, signature/extension fields, compact length prefixes, DA references, hashes, configured Normal/Operational envelopes, and charged weights. The direct weight is an identified unbenchmarked stub; session weights do not parameterize path length or duplicate scanning. The runtime-benchmark build remains blocked by an internal dependency inconsistency (#550), so no benchmark/runtime hash is claimed. No disclosed network matrix or raw log exists. Detailed failure diagnostics and their reproducer remain private while the mechanism is pending; the public summary records only the fixtures' bounded scope and limitations. D-0502 proposes withdrawing the 125,000 B, 96/128 transaction, 48/64 lifecycle, and sub-second-finality figures from the v0.5 profile; ratification is pending. Home: §2.2, §5.2–§5.3, §12.1, §15.6; evidence: prepublication-evidence.md. Blocking: resolve #550, generate dedicated weights, and run the recorded committee/topology/loss/load/co-load/fault matrix with negative and recovery outcomes. Tracking: #1496.

E.47 — DA availability and anti-grinding model [TBD]. Specify commitment-assignment anti-grinding, operator and failure-domain diversity, publisher limits, audit/repair timing, repair bandwidth, and the cumulative storage/retention budget across the full session+challenge lifecycle. Distinguish registry freshness, audit success, and actual reconstruction. Placeholder: validator DA removes miner-only custody; availability remains conditional on the stated threshold and repair assumptions. Home: §3.5, §5.3, §13.0, Appendix F. Blocking: failure model, grinding analysis, and lifecycle recovery test. Tracking: #1497.

E.48 — Cross-chain HTLC pair conformance [TBD]. Specify the exact chain and asset identifiers, participant/recipient and hashlock binding, preimage owner/reveal path, timeout orientation and margins, per-leg finality and timely-inclusion assumptions, relayer failure recovery, and the fee/inclusion premise required by HtlcIncentives::collusion_deterred. Closure evidence must exercise both legs under the ratified profile and record timestamps, finality identifiers, and hashed raw RPC/log inputs. Placeholder: FLOP-leg conservation and mutually exclusive redeem/refund are supported; every end-to-end cross-chain atomicity claim remains PENDING and must not be presented as conforming. Home: §10. Blocking: chain-pair design, implementation, and closure evidence. Tracking: #1498.

E.49 — Independent-demand and value-at-risk model [TBD]. Model miner+agent+validator coalitions, self-dealing genuine work, reward recycling, subsidy cliffs, audit outage, adverse FLOP price, attacker ownership/control concentration, and aggregate exposure in external assets. Separate protocol-authorized demand from economically independent demand and legitimate bootstrapping from profitable wash demand. Placeholder: no external-demand inference from a co-signed paid receipt; value-coupled security remains conditional on E.8/E.35 and unresolved genesis/reward distributions E.38–E.40. Home: §9, §11, §12.3, §15. Blocking: coalition payoff simulation and disclosed input distributions. Tracking: #735.

E.50 — Arbitrary runtime-upgrade scope [TBD]. Define the approved-code/social-governance assumption for Root set_code, including review, publication, voter verification, emergency handling, and what claims survive arbitrary bytecode replacement. Placeholder: current-runtime parameter guards, de-sudo state, and formal update invariants apply only to the approved runtime and modeled calls. Home: §9.3, §14. Blocking: governance threat model and upgrade-review policy. Tracking: #1499.

E.51 — Canonical wire-format operational binding [PARTIAL]. The byte formats, strict decoders, domain/version tags, explicit leaf dispatch, and cross-language vectors are fixed. Remaining: production task producers and validator/oracle consumers must derive task_hash v1 from the deployment genesis, agent, nonce, model, payload, and commit inputs and reject a caller-supplied mismatch; resumed pre-E.51 channels and stored checkpoints must retain their legacy receipt profile while new channels remain v1-only. Placeholder: the direct rail treats task_hash as an opaque H256, and receipt selection is safe only when the channel's profile marker survives the entire resume/checkpoint path. Home: §3.6, §12.1, Appendix F. Blocking: producer-to-validator wiring and cross-version resume-to-settlement tests. Tracking: #1500.

E.52 — Verification-liveness gate wiring [PLANNED]. R15.4c is ratified (D-0439) but the runtime still refreshes LastVerifiedWork from prover credit (ValidatorWorkRecorder on OnProofVerified, with who = the miner) and from nothing else; no duty is protocol-issued (issue_audit and ghost tasks are root-only) and no validator attestation client exists. Wire the accepted-duty writers (attestation-bundle signers, TOPLOC/escalation quorum signers, DA audit responses, validator dispute openings), remove the prover adapter, make the rotation floor read the same signal, add the per-window known-answer challenge issuance (fixture set in runtime/genesis; da_registry::issue_audit cannot serve it — it rejects when no blob exists) and its parameter, and record the storage-naming choice (a rename is a storage-key change: decode-compat test). Placeholder: until wired, the committee behaves as the zero-duty bootstrap fallback of E.42 (stake-only), and a validator that also mines is the only one that passes the gate. Home: §2.3, §15.2–§15.5, Appendix H. Blocking: #1552 (runtime), #1554 (attestation client).

E.53 — Re-execution checker lane [PLANNED]. R3.5d is ratified (D-0439) but the shipped TOPLOC checker has each validator re-run prefill (toploc-checker.ts GPU executor; report_toploc_mismatch quorum over validator-recomputed distances). Specify and wire the checker registry keyed to calibrated miner identity (attested hardware fingerprint + capacity stake, §2.4) and its bond, stake-weighted VRF assignment of three fingerprint-distinct checkers per sampled or challenged turn (capture ≤ q³), re-challenge of a unanimous accept with a disjoint draw and bond forfeiture on overturn, the verdict fields carried by report_toploc_mismatch(_claim) (assignment proof, bond reference, signed distance over the commitment), the validator-side verification before co-signing, escalation on any non-unanimous or unavailable result (§12.1), the OPTIONAL TEE-attested verdict tier, and checker payment through claim_audit_fee bound to the assignment. Placeholder: validators re-execute; no bond or independence among checkers. Home: §3.5, §12.1, §15.6, Appendix F/G. Blocking: #1553.

E.31 — DA-loss terminal settlement split [TBD]. Base matrix is live (temporary DA extends once; unrecoverable fails closed with full escrow refund + challenger-bond return). Residual: the precise "pay last co-signed cumulative receipt, refund the unverifiable tail" split. Placeholder: full escrow refund on terminal unrecoverable DA. Home: §13.0, §13.2. Blocking: #267.

E.32 — Sponsored stake refund semantics [PARTIAL]. Base refundable sponsored stake landed. Still open: whether sponsored stake can satisfy self-stake, sponsor refund authority, reward ownership, slash waterfall, per-sponsor/operator caps, testnet-only flags, disclosure. Placeholder: sponsor-owned principal is slashable backing; refund only after role unbonding + finalized prefix; mainnet does not count sponsor stake as self-stake without a ratified decision. Home: §11, §15, Appendix C/D. Blocking: #683.

E.33 — SOFT-tier (non-TEE) miner class [TBD]. Define the non-TEE assurance tier end to end: entry (verified calibration burst + stake, no TEE/SKU evidence), settlement (miner session-key turn signatures

• agent receipt in place of enclave signatures), dispute resolution (validator quorum over checker-lane re-execution, R3.5d, instead of enclave-sig proof), spot-check rate, per-miner demand-floor exclusion (no hardware identity ⇒ per-miner floor payments are Sybil-farmable), and pricing disclosure to agents. Placeholder: SOFT = discounted provisional cap + surge multiplier ≥ 1 + soft_tier_spot_check_rate_ppm; HARD = min(empirical, discounted SKU) when TEE evidence exists. This item is the load-bearing dependency of the ratified TEE-optional reframe (D-0432, §3.2 R3.2): the SOFT tier is admitted as first-class but its settlement/dispute path is not yet fully specified. Home: §3.2, §4, §7, §12, §13. Blocking: #650.

E.34 — Work-certificate workload classes beyond LLM [PARTIAL]. Class-aware G_n metering (LLM/diffusion/world-model/policy-control + class-adjusted tripwire ceilings) landed. Still open: per-class certificate coverage and verification choice, premium pricing floors, freezing workload_class on the cert wire format. Placeholder: non-LLM classes launch TEE + sampled-audit replay; GEMM sum-check is the premium inline option; certs priced ≥ 1.5×. Home: §4, §7. Trackers: #532–#535.

E.35 — Validator-stake bidirectional retarget and aggregate κ [TBD]. Define the stake-floor reduction mechanism (bounded step, TWAP window, hysteresis, hard floor at the CoCVoC baseline, announcement/grace ≥ unbonding) and whether κ_cc and the aggregate stake-to-secured-value target (~20%) unify into one ratified κ. Placeholder: no down-retarget; base floor ratifying at ~1.16M FLOP. Home: §11. Blocking: #556.

E.36 — External-work attestor classes [TBD]. Define market-grade attestor sets for escrow-settled off-chain work (data curation, PR review, API SLA): registry shape, set-version pinning at escrow creation, mandatory timeout arms, assurance labeling (market-grade never presented as protocol-grade). Home: §13, Appendix D. Blocking: #637.

E.37 — Attested-transport privacy posture (CVE-2026-33697) [TBD]. Relay attacks on attested TLS break evidence↔channel binding; settlement integrity is unaffected (money moves only against the on-chain-committed enclave key's signatures) but session confidentiality and the open_channel rendezvous inherit exposure. Placeholder: no session-privacy claims beyond TEE memory encryption; rendezvous treated as untrusted transport. Home: §12, §13. Blocking: #635.

E.38 — Genesis allocation & airdrop vesting [TBD]. The path that distributes genesis_supply has no normative section: §8 specifies work-vesting only, so airdrop-vesting's tier set, linear schedule, performance adjustment, and claim path are unspecified, as is the testnet→mainnet conversion that funds it. Still open: cap levels and the sublinear form on the conversion score, activity minimums, what the validator cohort converts on, the agent vesting horizon (90-day linear in the pallet vs. a three-year Y1/Y2/Y3 release in the sim params), whether spend-to-unlock ships, and the unallocated-remainder disposition (reserve vs. burn). D-0438 sharpened two of these rather than closing any: at genesis_agent_airdrop = 1,200,000,000 a 3:1 spend-to-unlock over a Y1–Y3 release would require 900,000,000 FLOP of inference spend from locked balances against a projected 823,547,471 FLOP of total network spend over the same window — infeasible before the pacing, the ratio, or the window is re-specified; and the reserve leg now releases 20% at TGE with the remainder in tranches, which has no on-chain controller. D-0440 leaves the agent leg untouched — the pool resize did not change genesis_agent_airdrop, so that infeasibility stands exactly as stated — and re-paces the reserve leg to 20% at Season 0 (160,000,000) plus eight half-year seasons of 80,000,000, still with no on-chain controller. What D-0440 does close is the collateral-to-float gap D-0438 opened: the validator cohort is the aggregate bond, so raising validator_min_stake to 1,200,000 restored the bonded share of genesis from 8.73% to 27.27% (E.39's sibling concern; ECON-009 C1/G2, #1353). Placeholder: zero incremental emission — allocations are carved from the fixed genesis supply, never minted; per-cohort pools do not cross-subsidize; sponsored stake is not allocation; balance is never a scoring term. Home: §8, §9.3. Blocking: #257, #1176, #1354, #1357.

E.39 — Validator-reward liquidity [RATIFY]. Decide whether validator block-reward earnings stay auto-compounded into locked stake (D-0408) or are issued fully liquid, with only the stake requirement locked. Placeholder: current behaviour — the validator 10% pool auto-compounds into locked stake; the workbook (rev 2026-08-20) ratifies 0% reward lock but the distribution hook is unchanged. Home: §9, §6.1. Blocking: #1356.

E.40 — Agent & staker leg distribution [TBD]. Specify how the agent_share_ppt (10%) and staker_share_ppt (5%) pools are paid out: the eligible set (the staker leg is defined as all FLOP stakers other than miners and validators), the pro-rata basis (agents: verified inference spend, unconfirmed), cadence, dust handling, and whether payouts are liquid on issue. Until this ratifies both legs accrue in sovereign pool accounts and are never distributed (§9.1 R9.12). Placeholder: pro-rata by stake for the staker leg, pro-rata by settled inference spend for the agent leg. Home: §9. Blocking: #1350, #1351.

Appendix F — Message & Storage Formats

Canonical on-the-wire and on-chain field layouts (normative). All hashes are 32 bytes; multi-field preimages concatenate (‖) fields in the order listed. SCALE is the codec for on-chain storage/extrinsic payloads unless noted. The canonical positive/negative corpus is evidence/wire-format-v1.json, validated by evidence/wire-format-v1.schema.json. Generate or check it with uv run --script scripts/generate_wire_format_vectors.py [--check]; Rust, TypeScript, and Python tests consume that same file.

F.0 Codec and rejection profile

• Fixed unsigned integers are exactly u8/u16/u32/u64/u128, little-endian. Encoders MUST reject negative or overflowing inputs; no saturation, truncation, floating-point conversion, or rounding is permitted. H256, AccountId32, public keys, and signatures are raw 32/32/32/64-byte strings.
• SCALE struct fields concatenate in declaration order. Enum discriminants are one byte and listed below; bool is 00/01; Option<T> is 00 or 01 ‖ T; Vec<T> is canonical SCALE Compact<u32>(count) ‖ items. Unknown tags, invalid booleans/options, non-minimal compact integers, truncated fields, bounds violations, or trailing bytes inside a length-delimited object MUST be rejected.
• Compact<u32> uses one byte below 2⁶, two below 2¹⁴, four below 2³⁰, and 03 ‖ u32LE otherwise. Lengths are element counts, never byte counts. The public corpus includes 0, every mode boundary, u32::MAX, truncated encodings, overlong encodings, and values wider than u32.
• Hashes are over the exact bytes shown, with no implicit SCALE, UTF-8 terminator, length, or personalization beyond an explicit domain. sr25519 uses the Substrate b"substrate" signing context and signs the stated message bytes or 32-byte leaf hash.

F.1 Identity & binding preimages

The direct rail's runtime cannot reconstruct task_hash because the payload, commit, agent, and nonce are not all call arguments. Its deployed enforcement starts at exact equality with the pending H256 and local replay rejection. This is an explicit trust boundary, not an implicit fallback: cross-deployment protection depends on the active validators enforcing the producer-side v1 derivation before attesting.

F.2 Attestation & proof (direct rail, §3.6)

F.3 Session transcript (compute-channel, §12.1)

Accepted-version cutoff. A present ChannelDecodePolicies[channel_id] accepts only explicitly tagged V2/V3 leaves and requires an equal policy hash; an absent marker (a channel opened before policy binding) accepts explicit V0–V3. ChannelWireProfiles[channel_id]=1 requires receipt v1; an absent marker accepts only the historical untagged 96 B receipt preimage, and an unknown value fails closed. New opens write the decode-policy and wire-profile markers. Existing channel records and amounts are not rewritten. V2 remains an explicitly lower evidence format and MUST NOT be reported as V3/TOPLOC-bound assurance; #1404 owns removing that remaining acceptance or adding a binding.

DA transcript container. Current SDKs emit FCC4 ‖ channel_id:H256 ‖ turn_count:u32LE, followed by each turn as leaf_version:u8 ‖ turn_index:u32LE ‖ h_in ‖ h_out ‖ g_n:u128LE ‖ has_policy:u8 [‖ policy_hash] ‖ h_ids:H256 ‖ toploc_hash:H256 ‖ recv:u64LE ‖ done:u64LE ‖ latency:u64LE ‖ enclave_sig:[u8;64] ‖ has_ack:u8 [‖ send:u64LE ‖ receive:u64LE ‖ agent_sig:[u8;64]]. has_* is exactly 0/1. FCC4 version/field consistency is fail-closed: V0/V1 have no policy and zero V3 fields; V2 has a policy and zero V3 fields; V3 has a policy and non-zero h_ids. Decoders consume exactly the declared turns and reject trailing/truncated bytes. Rust/TS may read historical unprefixed/FCC2/FCC3 blobs only to migrate them into an explicit in-memory leaf version; they never make an on-chain version choice from signature success.

F.4 Data availability (§5.3)

F.5 TOPLOC band constants (§3.4)

Per-(model, precision) governance-set constants consumed by band_verdict / report_toploc_mismatch: kappa_profile_hash, band_tau_accept, band_tau_slash (see toploc_band_tau_accept_bf16_milli, toploc_band_tau_slash_bf16_milli). Two-threshold policy: accept / escalate / slash; a cell is adjudication-inert (commitment-required) until its hetero-hardware gate passes.

F.6 Acceptance/settlement trace

Appendix G — Extrinsic Index

The consensus-critical extrinsics an implementer builds against (normative signatures; errors/events abbreviated). The full on-chain operation map is On-Chain Flows.

G.1 Compute channel — pallet_compute_channel (sole inference-dispatch path, §12.1)

G.2 PoUI direct rail — pallet_flop_poui (synthetic/ghost/calibration/simulator, §3.6)

G.3 Staking, calibration, vesting, DA, HTLC

Appendix H — Conformance & Implementation-Status Matrix

The single home for implementation status (kept out of the normative body, §0). Status legend: LIVE implemented · PARTIAL partly implemented · PLANNED designed, not wired · GAP unhandled/unspecified · OOS out of protocol scope by design. This appendix is informative and tracks the codebase; the normative requirement is always the cited section.

H.1 Core protocol

H.2 Verification (§3)

H.3 Metering, sizing, DA (§4–§5)

H.4 Primitives, calibration, vesting, emission (§6–§9)

H.5 HTLC, invariants, sessions, governance, validators (§10–§15)

Regenerating the evidence-coverage matrix. The per-section research/Lean/Quint/Julia backing is generated separately into yellowpaper-coverage.md via just yellowpaper-regen.

Per-requirement attribution. A finer, requirement-level map (each R-id → its Lean theorem / Quint invariant / Rust code path) is kept in the companion index yellowpaper-attribution.md. It is non-normative and lives outside the spec by design — it exposes proof-artifact and code-path detail the normative body omits.

Appendix I — Runtime Composition

The construct_runtime! inventory (source: pallets/runtime/zkverify/src/lib.rs). Pallet indices are consensus- and encoding-critical: they prefix every dispatch and storage key, so an index change is a breaking runtime upgrade requiring a migration (§14.1). Indices are stable identifiers, not a sequence — gaps are intentional (removed pallets are not reused). This appendix is normative for the index values.

Core / system

Consensus

Removed (D-0408): pallet_staking (was 7) and bags_list (was 19) — validators (96) is the sole authority source (§6.1).

Governance & utility

Bootstrap (removed at mainnet genesis handoff)

FLOP protocol

Settlement verifiers (160–170) — zkVerify aggregation, not inference proofs (§3.6): common (160), groth16 (161), risc0 (162), ultraplonk (163), plonky2 (165), fflonk (166), sp1 (167), ultrahonk (168), ezkl (169), tee (170).