# Single material amendment and activation boundary

## Recommended decision

Accept for continued isolated/operator qualification the **compound native protocol**: every credited record must include independently recomputed, correctly signed, registered nonempty useful computation, while a separate fresh resource proof secures ordering. Do not activate mainnet or funded rewards yet. This is one chosen implementation, not a menu of speculative mechanisms.

Exact proposed ratification (does NOT itself authorize activation):

> I ratify ComputeNet's mandatory-useful-plus-complementary-resource ordering amendment, identified by the final reviewed source/manifest digest. Each work-bearing record requires one unique registered useful computation, bound to its exact context and eligible producer, plus fresh SHA256 resource work over its complete header/body commitments. Receipt counts, holdings, payments, fees and identities confer no consensus weight. All full nodes recompute eligible outputs. Correct known answers may qualify once on a canonical branch; signed metadata is not physical-work metering or proof of customer demand. Greatest fully validated accumulated expected resource work selects history, with probabilistic, reversible confirmations and no irreversible BFT finality. I accept the additional energy cost and explicit honest-effective-resource, network, bootstrap and economic-security assumptions. No permanent founder admission/voting/upgrade privilege is introduced. Initial financial operation, if separately qualified and authorized, uses only exact customer-authorized funded payouts and producer fees, zero new issuance. The historical50-COMPUTE/210000issuance-ordinal halving schedule and21million cap remain; future issuance activation, eligibility, cadence and recipients require a separate explicit decision. Ratification is not permission to deploy, pay, issue, mine or change governance.

The source digest must be filled from the final immutable package, not an unseen future version. Owner assent cannot establish an honest resource majority, operator independence or an economic security budget.

## Precise security model and trade-off

Classical accumulated-resource security assumes independent unpredictable hash trials, sufficient honest effective resource versus adversary, propagation/eclipsing bounds and correct validators. Useful tasks remain a mandatory validity condition, but are not counted as the scarce security resource. This deliberately changes the failed pure receipt-as-scarcity assumption. SHA256 optimised/ASIC resources can dominate; useful-job costs reduce honest effective throughput. Self-dealing fees can be recycled and are not an attack-cost floor. Paid budget, costs and participation cannot be inferred from valid signatures or passing tests.

Initial entropy:2..16 public contributors commit256bit contributions, unanimously freeze the commit set using durable one-freeze journals, then reveal. All contributors are required; one withholding aborts bootstrap. At least one genuinely independent unpredictable contribution and externally witnessed timely release are required to resist pre-activation precomputation; transcripts alone cannot prove either. Test entropy is intentionally synthetic, not production entropy. Contributors have a one-shot bootstrap veto, **no ongoing admission/finality role**. Do not reset/retry selectively after seeing a seed; abort and review bias risk. Post-activation proofs bind parent/height/producer/body. Copying an unaltered valid record adds no weight; changing its producer/context/content requires fresh proof. Correct known results may be reused off-chain but not credited twice on a canonical branch.

Semantic uniqueness is registered algorithm/source plus normalised exact input, independent of runtime/package/order/customer/key. This is not proof of semantic novelty across arbitrary programmes or all outside computation. Bounded documentSHA and integer aggregation are the only current qualification classes. An attacker may choose easy distinct inputs; each still requires full fresh resource proof. Unknown algorithms or empty tasks fail closed. Honest task shortage stalls consensus; payment availability is not guaranteed during shortage. No empty/control issuance or founder override repairs a stall.

The prior resource-selected BFT capture12/16 can no longer generate valid canonical certificates: QCs have no authority here. A resource majority **can** construct a superior-work fork and reverse settled transactions. No finite unconditional reorganisation bound exists. Confirmation depth3,30seconds,window4,initial target(2^256-1)//256 and pow limit(2^256-1)//16 are **disposable fixture parameters only**, not a production recommendation. Local block/branch/byte capacities stop admission rather than alter canonical validity. Honest/adversarial resource and WAN assumptions have not been measured for a production network. Classic Bitcoin/backbone analysis motivates this model; its numeric bounds are not claimed to prove this variable-target/useful-gated implementation: https://bitcoin.org/bitcoin.pdf and https://eprint.iacr.org/2014/765.

Linear bonded/stake weighting is rejected for this launch: the protected342/350holding is171/175(~97.714%)of current supply, greater than2/3 by itself if fully bonded. Preserving holdings and choosing it would concentrate consensus in the founder, not demonstrate independence. Capping identities does not fix beneficial ownership. No stake lock, burn, hidden allocation, token migration or new issuance was implemented.

## Activation prerequisites: concrete outside inputs

1. **Protocol/economics:** explicit amendment above, final source pin, reviewed retained-history compatibility, named funding/issuance choice. Recommended initial zero issuance with existing schedule preserved, exact signed customer prices, no mandatory burn/deposit or promised yield. Customers fund all verifiers+producer fees; fee rates are explicit quote values, not an invented sustainable budget.
2. **Actual security resources/operators:** independently controlled keys/infrastructure and sustained effective honest resourceH after founder outage; plausible adversarial/optimised/rental resourceA, useful-verification/propagation overhead, funding/cost/uptime commitments and multiple independent peer paths. Require H sufficiently exceeds A under a reviewed network model; merely H>A without delay/cost analysis is insufficient. Select production target/adjustment/confirmation/at-risk caps only after these inputs. No production target or minimum funding number is defensible from one emulated CPU. No third-party commitments currently exist. Public qualification instructions and source permit participation without founder credentials. A paid independent audit is not silently reinstated; any unaudited experiment must say so. A formal theorem or external audit has not been fabricated.
3. **Release/target acceptance:** trusted maintainer-signed exact final manifest (current qualification checksums are not such a signature); fully specified compatible upgrade from preservedh7, target-native sandbox/TLSedge/load+WAN qualification, single authoritative writer inventory/fencing, verified restore, retained-history dry-run, fresh both-host checksums/completebackups/recovery/SSH/containment and exact Gamma→Seed writable authority. The current bridge only audits actualh7; mainnet staging/listening/writing stays rejected. A future writable arm is not hidden in this package and needs qualified versioned migration after ratification.
4. **Financial canary:** identified consenting payer+four explicit recipient publicaddresses, signed order/transactions for exactly0.00000008COMPUTEtotal=four0.00000001payouts+four0.00000001producerfees, no substitutes. One ordinary founder verifier plus separately administered recipients if that participation is claimed. Separate funding/activation authority, exact height/window/target/confirmation limits and independent reconciliation. No production signing keys or consents have been supplied.

These inputs cannot be implemented into existence. Until supplied, production financial activation is BLOCKED; public fixed-work service remains live. Immediate next action is to ratify or reject the concrete complementary-resource amendment and invite real off-mainnet resource evidence via the published instructions—not approve an unsafe mainnet cutover.

## Deployment/recovery: exact bounded scope after those gates

No live command in this source activates consensus. Preserve both containments, current public service and historicalmining. First approvedGammaoperation: read-only actualh7/source/backup/provenance audit and shadow non-writing target qualification. Then separately approveSeedshadow. No service switch follows automatically. Before writablecutover freeze oldwriters, verify exclusivelease/fencing and exactsnapshot+prefix+ordinal7, install only finalsigned/pinnedsource/privateTLS/config, start one approvedwriter in an isolated closed network, independently replay frommultiplepeers; then separately authorize admission/publication/canary. Each real operation needs exact artifact/hostactions/currentconfigpins/backup+console/evidence/abort criteria.

Before any accepted new canonical record, a failed staging/service change can restore the previous nonfinancial service configuration after proving no stateadvance. **After any canonical advancement there is no h7rollback or oldwriter resurrection.** Retain/replay current validated history; recover forward from independently verified peers/snapshots, upgrade forward with retained-history/versioncompatibility. Stale adminrestore is rejected; valid superior-resource forks remain a protocol risk. Stop local payment acceptance on ambiguity, reorg, policy/source drift, capacity/corruption, lost peers/resourcecoverage or key compromise; retain evidence and alert. A local service stop is not a global consensus override and cannot revoke already broadcast signatures. Never automatically refund/retry a reorged reward. Reconcile exacttxIDs/order/nullifiers/inclusion/payer/recipient/producer/supply before any additional authorized action. No admin protocol emergency key or permanent founder governance role exists. Operators voluntarily adopt reviewed versioned source; upgrade coordination and source-distribution concentration still require actual independent acceptance.