Test USD
Permanent no-value demonstration product.
- Bitcoin signet
opencsv-test-usd-v2- Existing test root, database, backup, and fee tree
- Exact test-only manifests
- Never promoted or converted
Hard separation
Two products. No migration.
Future production USD
Inactive until every review and owner gate passes.
- Bitcoin mainnet
- New deployment identifier
- Fresh root, database, backup namespace, and BIP84 fee tree
- Deployment-scoped
opencsv-mainnet-account-v1derivation - Versioned release binding exact non-test issuer manifests
Exact release input
A valid manifest list is not enough.
Mainnet refuses loose issuer policy. The candidate wallet recomputes one commitment over the production deployment, registry version, ordered manifests and priorities, activation phase, exact rollout ceilings, source revision, and public approval receipts before it can arm a consumer write.
Bound into the commitment
- Format and registry versions
- Exact production deployment
- Ordered issuer manifests and priorities
- Candidate, limited, or general phase
- Transfer, batch, daily, reserve, and fee ceilings
- Registry v2 exact asset-to-issuance-policy commitments
- Source revision + public approval receipts
- Highest version persists in database + backup
- Wallet signature binds the snapshot to one operation
- Mint authorization binds its exact funding outpoint
planned/fee_reservedresume advances that same operation- Crash resume revalidates it before parsing or network I/O
- Fee bump revalidates it before chain checks or signing
Reproducible policy bytes
opencsv-registryuses the account wallet's Rust serializer and verifier- Verification requires the deployment expected by the app
- Create-new output is durably synced and never overwritten
- Structural validity is not activation authority
- The public candidate has zero issuers and cannot write
Fails closed, stays readable
- Loose mainnet issuer list
- Activated release with zero issuers or a placeholder revision
- Mutated manifest, priority, phase, or limit
- Wrong deployment or network
- Authority-key aliases or noncanonical encoding
- Missing, substituted, or cross-operation authorization
- Unavailable or substituted signed funding outpoint
- Issuance replay, sequence gap, or stale supply floor
- Older version or same-version conflict
- Candidate writes:
production_activation_not_authorized - V4 limited/general writes:
production_root_vk_authentication_required - Mainnet mint writes:
production_issuance_not_authorizedwithout exact threshold evidence
Still not proven
- D5: independent recursive root-key authentication
- Backing or solvency
- Redemption or legal enforceability
- Brand authority
- Real threshold-key custody and ceremony
- Approved issuer policy or signed mint envelope
- Operational readiness
The consumer registry selects spendable instruments; it is not mint authority. The stacked Rust candidate requires registry v2 to commit an exact threshold policy, then requires every mint to carry signatures over its registry, policy, recipient, amounts, exact confirmed funding outpoint, sequence, and supply transition. Operation and supply-floor admission are atomic and backup-carried. A crash resumes that one operation; it cannot reuse the approval or substitute another fee coin. The signed outpoint prevents an older valid backup from replaying one approval with fresh Bitcoin funding. There is still no real policy, authority key set, production issuer, or activation.
Activation sequence
Every transition has a receipt.
Elapsed time changes nothing. Source, build, manifest, review, and owner receipts must identify the exact state transition.
Unconfigured
Read, restore, sync, and export evidence. New consumer Bitcoin writes return production_usd_not_configured.
Candidate
Freeze deployment, registry v2, consumer rollout ceilings, threshold-key ceremony, issuance policy, supply envelope, recovery namespace, and build inputs. The committed phase is candidate; writes stay disabled.
Reviewed
Independent protocol, wallet, Signal, operational, and issuer reviews approve exact hashes. The release remains candidate and cannot write.
Distribution candidate
A reproducible signed build passes recovery and signet acceptance. Distribution still needs explicit owner approval; policy remains candidate.
Limited activation
Requires D5 root-key authentication first. A higher limited release then permits fresh wallets only inside its exact transfer, batch, daily, reserve, and miner-fee ceilings.
General activation
Requires limited-operation evidence, incident procedures, support readiness, and a higher general release. Its ceilings still apply.
Evidence gates
Code is only one part.
Protocol + implementation
- D5 canonical recursive root-key authentication
- Adversarial custom-root rejection
- Exact-green Rust and Signal tips
- Independent adversarial approval
- Regenerated formal ledger and axiom audit
- Mainnet mismatch, revocation, crash, reorg, RBF, and recovery tests
- Reproducible binaries and archive identity
Product + issuer
- Canonical manifest and asset ID
- Authenticated issuer authority and terms
- Backing and redemption claims reviewed by responsible humans
- Issuer key ceremony and incident runbooks
- Independent issuance authorization with operation, rolling-window, and cumulative supply ceilings
- Supply audit and contact procedure
Wallet + operations
- Fresh-root backup and restore
- Primary and linked-device permissions
- Two pinned raw-byte operators on distinct hosts
- Direct relay plus two distinct compact-filter peers
- Rollout limits, monitoring, and freeze procedure
- Explicit approval for the first mainnet action
Human decisions
These still block activation.
- Real issuer identities and authority
- Production terms, redemption, and legal review
- Deployment identifier and registry v2 bytes
- Issuer and administrative threshold-key custody
- Issuance policy, review quorum, and supply envelope
- Registry review quorum and emergency governance
- Final observer operators and certificate-pin lifecycle
- Initial value limits and incident owners
- Release channel, tester population, and support commitments