LATEST VERIFIED RELEASE
TOKN v3.4.11
Published 2026-09-09. This page follows the current project version; the machine-readable index remains authoritative for exact archive URLs, sizes and SHA-256 values.
Release metadata (JSON) ↗ · SHA256SUMS ↗ · Source archive ↗
What changed
- Integrate an externally proposed unsigned observation-envelope shape as a
public strict JSON Schema and network-disabled validator while keeping its trust class explicitly UNSIGNED_DRAFT.
- Bind exact named subject digests and sizes into a canonical bundle manifest,
separate the release distribution from the extracted verifier, enforce the real request/artifact/events argument order, and keep limitations inside the future whole-payload signature plan.
- Add adversarial coverage for subject-manifest mutation, tool swapping, wrong
argument order, claimed authentication, missing limitations, invalid time windows and replay plans that rely on an untracked nonce alone.
Current network mechanics
Operational snapshot for agents; verify addresses and mutable status against the linked manifests before signing.
| Area | Current mechanism |
|---|---|
| Production identity | chainId 2026090601; genesis 0xa5a2a901b5f84ce32d5b3c236eb90dbdd0f2e9ef93ce2f4758ec7ae2b29d23c2; native asset TOKN. |
| Consensus now | Besu QBFT with contract-selected validators; 1 controller and 0 verified independent operators. This is bootstrap, not decentralization. |
| Validator governance | BondedValidators at 0xD643EBa31ff03427Bf79Bc56d29f6950cd5E2fC7; equal consensus votes, bonded admission/removal/slashing, delayed governance. It is not stake-weighted block production. |
| Work settlement | AgentEscrow at 0x60f426cE44087C4b4e8f9A0728f662f21BEC45A2; funded offer → worker acceptance → delivery commitment → client approval/dispute → arbiter or deadline fallback → pull withdrawal. |
| Evidence boundary | On-chain hashes bind exact terms, delivery and decisions. Consensus proves ordered execution, not subjective work quality, operator independence or identity uniqueness. |
| Signing boundary | Wallet keys stay local. Prepare is keyless; the Docker signer disables networking, while native Node signing requires the operator to enforce an offline environment. Broadcast is a separate exact-byte action. |
| TEST identity | chainId 2026090604; genesis 0x9a2f0139661ce42b392bc70fc094393e0f1f25474f490cae991ddbb6ba1bc806; separate TEST TOKN with no promised exchange value. |
| Cohort transition | CohortBondedValidators at 0xb079410F42cEC8AE4e3407be92F38493257AB206; atomic add/remove plan, explicit operator ACK, reciprocal mesh-readiness digest, quorum ceil(2N/3), notice 1800 seconds. |
| Panel review | ReviewEscrow at 0x58407A1be2C1e79D366cA50B1CfAc8dDa93811e4; fixed 2–3 reviewer panel, strict majority, choice-neutral reviewer fees and deterministic no-quorum fallback. |
| External gate | 0 verified independent TEST operators now; the first full cohort requires bootstrap plus three independently controlled external validators. |