TEST TOKN role and reserve protocol

The pilot is a separate test chain, ID 2026090604. Its canonical manifest binds the actual genesis and deployed contract addresses. It promises no production TOKN, redemption, value or independent operation. The production 500 TOKN node grant continues to require a production-chain proof.

The coordinator reserves 2,560 TEST TOKN in state/pilot/round/ledger.json:

This is a local reservation backed by the dedicated TEST treasury, not an on-chain restriction on its key. The coordinator can spend that treasury and must preserve the reserved balance. Before new role payments, the tool requires backing for every unpaid bucket plus one TEST TOKN for transaction fees. Task principal and reviewer-fee buckets remain reserved for explicit escrow funding; the role payment command cannot spend those buckets. Fund and reconcile each exercise through the reviewed escrow workflow before participants begin it.

The initial ledger has six empty slots: validator-1, validator-2, validator-3, worker, reviewer-1, reviewer-2. The bootstrap coordinator is the client and cannot occupy an external slot. Distinct wallets, declared public identities and controller disclosures are required. A signature proves wallet authorization; it cannot prove that two people or machines are independent.

The minimal TEST participant package supports role consent without a node or operator toolbox: follow its public/README.md workflow using prepare-role-ack, sign-role-ack and inspect-role-ack. It pins the public round, verifies the live TEST network before preparation and signs offline with only the participant's wallet key. The resulting {ack, signature} artifact is compatible with the coordinator import below. It sends no transaction or automatic submission.

For the separate source operator workflow, the approved round ledger is the signing input. Participants inspect its terms, chain, genesis, actual contract addresses, role budget and hash before signing. The published pilot manifest includes pilotRound.signingInput, a public signing copy with no private evidence or imported signatures. Extract that JSON object from the authenticated manifest and save it as state/pilot/round/ledger.json in the separate participant checkout. Do not replace an existing local ledger or import a coordinator key. The source operator toolbox mounts that checkout's pilot directory; it must contain only that participant's own keys. The minimal public wallet kit does not contain coordinator or validator tooling.

scripts/pilot-round.mjs runs only inside the isolated pilot toolbox. Inspect its JSON help schema before an explicit action; arguments below are a schema, not commands containing fake identities or values.

Evidence paths are regular files below the participant's state/pilot mount, at most 64 KiB, with no symlink traversal. validBefore is a UNIX timestamp between 30 minutes and 14 days ahead at import. ACK files are named with the role and actual deadline; a new signature never silently replaces an earlier file. The ACK evidence commitment is SHA-256 of the exact evidence-file bytes. The EIP-712 domain is TEST TOKN Pilot Roles, version 1, the pilot chain and registry. The value binds roundHash, role, wallet, identity, controller, evidenceHash, and validBefore. These ACKs authorize role participation only. They are separate from candidate validator consent and on-chain cohort ACKs.

A control review document uses schema tokn-pilot-control-review/1, with the exact roundHash, role, wallet, identity, controller, approved: true, nonzero evidenceHash, and participation. The latter is pending, approved, or worker-prepaid. The coordinator must inspect the underlying evidence. Validator participation approval requires the agreed synchronized ten-block observation and actual controller review; contract-role approval records both exercise checkpoints, irrespective of verdict. Worker prepayment is explicit and confirmed before the intentionally rejected exercise. The tool records the curator's decision; it does not automatically judge evidence or quality. A pending qualification may explicitly advance to approved, retaining history.

Gas and bond payments require a current ACK and control review. Participation payments additionally require the recorded qualification or worker prepayment. Every role/bucket has one fixed recipient, amount and action ID. The ledger lock serializes reads and writes; the transaction journal saves signed bytes before broadcast. A retry after an interrupted confirmation reconciles those same bytes even when the ACK has since expired. Existing signatures do not expire on-chain. Never delete journals or sign an alternative transfer for the same payment.

After a crashed toolbox, stop all signing toolboxes before recovering a stale lock. The host utility scripts/recover-signing-lock.py --pilot-round archives the ledger lock, and --pilot archives a signing lock if also present. Run Python through uv; both refuse recovery while a toolbox runs or the lock is less than two minutes old. Repeat the exact original payment action afterward.

No volunteer identity or acceptance is inferred from the operator-controlled QA rehearsal. Opening recruitment requires the maintainer's publication and external endpoint checks. Activating the cohort additionally requires three actual candidate operators, their bonds, consents and ACKs, the real notice, fresh signed reciprocal mesh evidence and common history. Completing M0 needs all six external roles and measured operation after the bootstrap is stopped.