Skip to content

queen: key_credit.t27 -- a leased contributor key earns credit only for .t27 that landed (Closes #10589) - #10591

Draft
gHashTag wants to merge 5 commits into
masterfrom
queen-key-credit
Draft

gHashTag wants to merge 5 commits into
masterfrom
queen-key-credit

Conversation

@gHashTag

Copy link
Copy Markdown
Owner

Closes #10589

Owner, 2026-10-19 (translated): pay the TRI token as Proof of Compute -- for $TRI in exchange for .t27.

Stacked on #10567 (key_vault.t27): this branch carries its commits. Draft until #10567 lands, then the diff is the three files below.

What MiningPool verifies

Read-only, gHashTag/trinity-contracts src/MiningPool.sol and src/ChipRegistry.sol: claim checks the era, isRegistered(chipId), a nullifier, the era reward, a per-chip cap and an ECDSA signature over keccak(proof_data, era). It never inspects proof_data, and registerChip is gate-free on testnet (audit W-INTL-34). An API-key turn could be "expressed" as a proof it accepts, but only because it accepts any signed bytes from any self-registered key -- so it would prove nothing. FACTS.md section 6 also records that contract as a retired testnet experiment, not $TRI. Decision: the receipt ledger only, no pool and no claim path.

The card

specs/queen/key_credit.t27 adds only the link lease -> key id -> owner -> account -> dispatch -> state -> PR -> head -> merge -> .t27 files -> review -> outcome, and reuses verified/payout.t27, verified/signed_receipt.t27, trinet/node-work-credit.t27 and queen/dispatch.t27 for the rest:

  • only a contributor key with an account earns; a Queen pool key never does;
  • credited only when the whole chain holds, the dispatch was ACCEPTed, at least one .t27 file changed, the PR merged and closed its task, and the verdict is verified and named;
  • a key the lease does not name is an identity mismatch; a broken chain is unverifiable and charges nothing; nothing is ever slashed;
  • once per contributor per PR, one rate (REWARD_PER_JOB_MTRI) however many files;
  • paid only through payout() as PROVIDER_FEE; CREDIT_TRANSFERABLE stays false and the attestation (CI-reproduced, no device) allows testnet credit and no value flow.

The hosting cards (specs/hosting/*) were not extended: they credit deterministic k-of-n shards that hosts recompute, while a key turn is non-deterministic and its proof is review plus merge.

A credit is a reward for verified work, never a payment and never a sale (FINANCE_AND_COMPLIANCE.md section 3). The rate, the FACTS.md row and settlement are the founder's decisions; nothing here settles.

Checks (Railway lab)

  • t27c test-report: 12 of 12 pass, 0 vacuous, 3 invariants proved; the exhaustive test runs 8192 asserts (512 fact sets x 4 states).
  • t27b (aarch64 under qemu): 12 passed, 0 failed, 3 invariants held; named in docs/reports/t27b_expectations.json.
  • gen, gen-c, gen-rust, gen-verilog, gen-js, gen-ts, gen-python: all exit 0.
  • tri mutate spec: 35 of 36 killed, 0 survived, 1 unviable (forcing key_attestation to 0 fails the comptime invariant). The first run's one survivor was a runtime guard the invariant already proved; it is removed.
  • t27c seal --save then --verify: all hashes MATCH.

🤖 Generated with Claude Code

…lanes first (Closes #10564)

The rule card for the owner's demand of 2026-10-18: every API key lives in the
Queen's store, every consumer leases from it, and lanes are shared by demand
with reviews served first (never below one key's two lanes).

- specs/queen/key_vault.t27: may_serve, consumer_start, review_share,
  worker_share, holder_cap, lease_answer, retry_after_seconds, lease_step.
  8 tests (0 vacuous), 3 invariants, negative controls in every table.
- .trinity/seals/queen_QueenKeyVault.json: sealed and verified on the lab.
- tools/bees/reviewer.py: BEE_QUEEN_LEASE_URL + BEE_QUEEN_LEASE_TOKEN route
  the z.ai agent through the Queen's lease; a private ZAI_KEY_* beside a
  lease refuses to start; private keys without a lease warn. The lease token
  is stripped from the agent env. One self-test row.
- contrib/portable-claude-setup: delete the three private key rotation
  scripts (a second key pool on one machine, unused on the bench); the
  README points at the card instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 18, 2026
@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-18 19:29:30 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 45
PRs with All Checks Green 5
READY 0
FAILING 45
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 45 + 0 + 0 = 45, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=fad12492937a != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

This was referenced Oct 19, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

queen: key_credit.t27 -- a leased contributor key earns credit only for .t27 that landed (TRI Proof of Compute)

1 participant