docs(fiatm): expand design+synthesis, add sovereign-asset note, exchange demo & AncientGreekCoins; MBA status tick

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
walerikus 2026-06-26 22:12:04 +02:00
parent cdb598daee
commit 20f83a59bd
8 changed files with 625 additions and 42 deletions

View file

@ -0,0 +1,10 @@
Ancient Greek coins had three values, the metallic, the nominal and the commercial.
Their metallic value depended on their metal content, and was high when they were gold, lower when they were silver and much lower when they were copper.
The gold-silver ratio was initially 1:12, and this affected the monetary parities between the two metals.
By 400 BC, coins became the predominant means of exchange throughout ancient Greece, but without imposing a specific currency.
Simply, in each region they used a specific currency more than the others.
Over time, the Attic Tetradrachm, weighing 17 grams, began to prevail, with subdivisions (1/6 drachma = 1 obol), and multiples (decadrachma), while in the Sicilian colonies the liter coin was also used.
At the same time, the artistic processing of the coins evolved, which were now decorated with various figures of gods and animals.
They were minted with the help of a hammer and anvil (by striking), which is why many of the coins of this era do not have a perfect image,
while their shape is not always exactly round.

View file

@ -11,6 +11,7 @@ market / 0144 GBPm+JPYm+INRm + merchant POS / 0160 ARSm+TRYm).
| File | Role |
|------|------|
| [`fiatm_synthesis_FOR-reading-first.md`](fiatm_synthesis_FOR-reading-first.md) | **Single-source FIATm overview — start here.** Self-contained synthesis pulling the design record, the catalytic-converter hypothesis, the wallet-UI architectural naming, and the structural elaborations developed through snapshot 0163 into one reader-first document. ~700 lines. Cross-references the canonical sources rather than duplicating them. Written for a technically-engaged reader who wants the full picture in one pass. |
| [`fiatm-sovereign-asset.md`](fiatm-sovereign-asset.md) | **NEW (2026-06-20) — sovereign-asset design record.** Sharpened framings not previously canonical: **asset taxonomy** (sovereign-native MBA vs trusted / cross-chain IOU, identity / backing-location / failure-mode table); **gold-certificate-collapse-inverted thesis** (broken fiat = "former certificate with scarce backing stripped, floating paper remained"; FIATμ = injecting scarce backing under the floating fiat face); **reverse-lock** (in FIATμ the scarce asset is what's locked, the fiat is only the projected face label — opposite of the gold-certificate convention); **"unstablecoin" framing** with three-honest-outcomes table (spend / save-and-grow / save-through-dip); **§5 reflexive volatility properties** (backing demand suppresses own volatility as it scales; basket diversification; stablecoins as a tailwind not competitor); **§6 controller-simultaneity canonical statement** ("single objective, both directions — maximize fairness/attractiveness of minting in, in every regime, while never touching the fixed redemption floor"). Complements rather than supersedes `fiatm_complete-design_FOR-design-record.md`. |
| [`fiatm_complete-design_FOR-design-record.md`](fiatm_complete-design_FOR-design-record.md) | **The canonical FIATm design record.** Family intro (§0.5), three-values / Greek-coinage framing (§7a), Artemision lineage / art-of-emission / universal-substrate / why-the-lag-exists (§7a.1), 180° reversal (§7), holder experience + global scale + lag-as-opportunity (§7b), magical reversal + institutional-action asymmetry (§8 / §8.1), five-layer §12 controller, oracle integrity stack (§14) + composed-oracle for non-USD FIATm (§14a), TVL / governance / maturity ladder, implementation status, calibration program (§22), historical back-test §20a, BCH/USD volatility appendix B. Renamed from `usdm_…` to `fiatm_…` in snapshot 0155. |
| [`usdm_sound-money-note_FOR-design-record.md`](usdm_sound-money-note_FOR-design-record.md) | The original USDm-only conceptual note. **Absorbed** by the FIATm record above; retained as a historical artefact for the early framing. |
| [`usdm-and-market_diagram-report.html`](usdm-and-market_diagram-report.html) | USDm / market-integration diagram report (HTML render). |

View file

@ -83,8 +83,8 @@
footer a { color: var(--accent); text-decoration: none; }
code { font-family: var(--font-mono); font-size: 12px; padding: 1px 5px; background: var(--surface-2); border-radius: 3px; }
/* Stylized FIATμ tickers — Latin code → Greek μ on screen, like ₿ for BTC */
.t { font-weight: 600; white-space: nowrap; letter-spacing: 0.01em; }
.t .mu { color: var(--accent); font-style: italic; font-weight: 700; font-family: "Times New Roman", "Georgia", serif; padding-left: 0.5px; }
.t { font-weight: 600; white-space: nowrap; letter-spacing: 0.01em; text-transform: none; }
.t .mu { color: var(--accent); font-style: italic; font-weight: 700; font-family: "Times New Roman", "Georgia", serif; padding-left: 0.5px; text-transform: none; font-variant: normal; }
td.deviant .t .mu, th.deviant .t .mu { color: inherit; }
.brand-icon .mu { font-style: italic; }
</style>

View file

@ -240,6 +240,74 @@
textarea.wif-input:focus { border-color: var(--accent); }
.form-help { font-size: 11px; color: var(--text-2); margin: 6px 0 10px; }
.form-warning { background: var(--warning-bg); color: var(--warning); padding: 8px 12px; border-radius: var(--radius-md); font-size: 11px; margin-bottom: 12px; }
/* ─── Mobile (<= 600px) — touch-friendly tap targets, tighter spacing ─── */
@media (max-width: 600px) {
.app { padding: 12px 12px 80px; }
/* Header: stack brand on its own row, allow meta to wrap cleanly */
header { flex-direction: column; align-items: stretch; gap: 10px; padding-bottom: 12px; }
.header-meta { width: 100%; justify-content: flex-start; gap: 8px; row-gap: 8px; }
.brand { gap: 10px; }
.brand-title { font-size: 16px; }
.brand-icon { width: 34px; height: 34px; font-size: 15px; }
/* Net pill: bigger tap area, equal-width buttons */
.net-pill { flex: 1 1 auto; min-width: 0; }
.net-btn { flex: 1 1 0; padding: 9px 6px; font-size: 13px; min-height: 38px; }
/* Connect button + wallet pill */
.connect-btn { padding: 10px 14px; font-size: 13px; min-height: 38px; }
.wallet-pill { padding: 8px 10px; font-size: 12px; min-height: 34px; display: inline-flex; align-items: center; }
/* Status pill + block height pushed to their own row */
.net-status, #block-height { font-size: 11px; }
/* View tabs: bigger tap target */
.view-tab { padding: 12px 14px !important; font-size: 14px !important; min-height: 44px; }
/* Swap inputs: large tap area + readable */
.swap-input, .swap-amount { font-size: 24px !important; padding: 8px 0 !important; min-height: 44px; -webkit-appearance: none; }
/* Asset selectors / pills inside swap */
.asset-pill, .asset-select, select { min-height: 44px; font-size: 14px; }
/* Primary action button */
.primary-btn { min-height: 48px; padding: 14px 16px; font-size: 15px; }
/* Banner: a touch more compact */
.banner { padding: 12px !important; }
.banner-title { font-size: 13px; }
/* Modals: near full-screen on mobile, scrollable */
.modal { width: calc(100vw - 24px) !important; max-width: 100% !important; max-height: calc(100vh - 40px); overflow-y: auto; padding: 18px !important; border-radius: 14px !important; }
.modal-title { font-size: 16px; }
.tab { padding: 10px 12px !important; min-height: 40px; font-size: 13px !important; }
/* WalletConnect QR placeholder */
#wc-qr-placeholder { width: 200px !important; height: 200px !important; }
/* Asset list rows */
.asset-row, .modal-asset { min-height: 56px; padding: 12px !important; }
/* Card tweaks */
.card { padding: 14px !important; }
.card-title { font-size: 14px; }
/* Phase 2 button & receipt buttons */
#mint-btn { font-size: 13px !important; padding: 12px !important; min-height: 42px; }
/* WIF input: bigger paste target on mobile */
textarea.wif-input { min-height: 72px; font-size: 13px; }
}
/* Extra-narrow phones (<= 380px) — Pixel 4a / iPhone SE style */
@media (max-width: 380px) {
.app { padding: 10px 10px 80px; }
.brand-title { font-size: 15px; }
.net-btn { font-size: 12px; padding: 9px 4px; }
.swap-input, .swap-amount { font-size: 22px !important; }
}
</style>
</head>
<body>
@ -258,6 +326,7 @@
<div class="net-pill" id="net-pill">
<button class="net-btn active" data-net="demo">Demo</button>
<button class="net-btn" data-net="chipnet">Chipnet</button>
<button class="net-btn" data-net="mainnet">Mainnet</button>
</div>
<div class="net-status" id="net-status"><span class="dot"></span><span id="net-status-text">Demo mode</span></div>
<div id="block-height" style="font-family: var(--font-mono); font-size: 11px;">—</div>
@ -397,15 +466,17 @@
<span class="banner-icon">★</span>
<div>
<div class="banner-title">Rate controller adjustment targeting delay 4.2%</div>
<div id="state-banner-text">Rich vintage window arbitrage opportunity. Each USDm right now locks more BCH backing than face value. Favorable moment to swap in.</div>
<div id="state-banner-text">Rate-lag mint window — $100 USD currently mints ~$104 of USDμ face value. The controller's sats-per-USDμ hasn't caught up to the BCH price move.<br><span style="display: inline-block; margin-top: 6px; font-size: 11px; color: var(--text-2);"><b>Minting now:</b> favorable — buy more USDμ per USD while the gap is open.</span></div>
</div>
</div>
<div id="phase2-section" style="display: none; margin-top: 12px; padding: 10px; border: 1px dashed var(--accent); border-radius: var(--radius-md);">
<div style="font-size: 11px; color: var(--accent); font-weight: 600; margin-bottom: 6px;">Phase 2 — real chipnet broadcast (BETA)</div>
<div style="font-size: 11px; color: var(--text-2); margin-bottom: 8px;">
Construct a real claim transaction against the live chipnet USDm contract and broadcast it.
Your wallet must be the contract's founder/oracle (wallet <code>E</code> in the chipnet tests).
Construct a real claim transaction against the live chipnet USDμ contract and broadcast it.
<strong>Any connected wallet can mint</strong> — the demo bundles the chipnet oracle key
and signs the price attestation for you; minted tokens go to your wallet. On mainnet
the bundled key is replaced by the public oracle quorum service.
</div>
<button class="primary-btn" id="mint-btn" style="font-size: 12px; padding: 8px;">Try real swap on chipnet</button>
</div>
@ -498,6 +569,7 @@
<div class="tabs">
<button class="tab active" data-tab="import">Import WIF</button>
<button class="tab" data-tab="generate">Generate new</button>
<button class="tab" data-tab="walletconnect">WalletConnect</button>
</div>
<div class="tab-content active" data-tab-content="import">
@ -524,6 +596,24 @@
<button class="primary-btn" id="use-generated" style="margin-top: 10px;">Use this wallet now</button>
</div>
</div>
<div class="tab-content" data-tab-content="walletconnect">
<div style="font-size: 12px; color: var(--text-2); margin-bottom: 10px;">
Pair with a BCH wallet that supports WalletConnect-style session pairing (CashConnect / WC2 on BCH).
Your keys stay in the wallet app; this page only requests signatures.
</div>
<div style="background: var(--surface-2); border: 1px dashed var(--border-strong); border-radius: var(--radius-md); padding: 16px; text-align: center;">
<div id="wc-qr-placeholder" style="width: 160px; height: 160px; margin: 0 auto 12px; background: repeating-linear-gradient(45deg, var(--border) 0 4px, transparent 4px 8px); border-radius: var(--radius-sm); display: flex; align-items: center; justify-content: center; font-size: 11px; color: var(--text-3);">
QR pairing code
</div>
<code id="wc-uri" style="font-family: var(--font-mono); font-size: 10px; color: var(--text-2); display: block; margin-bottom: 10px; word-break: break-all;">wc:…pending session…</code>
<button class="primary-btn" id="wc-start-btn">Start pairing session</button>
</div>
<div style="font-size: 11px; color: var(--text-3); margin-top: 10px; line-height: 1.5;">
Compatible wallets (planned): Cashonize, Zapit, Paytaca, and any BCH wallet implementing
the CashConnect / WC2-BCH spec. WIF stays in your wallet — this dApp only sees signed payloads.
</div>
</div>
</div>
</div>
@ -601,11 +691,11 @@ const DEVIANT_ORACLE_MBA_ARTIFACT = {
// ─── Demo data (preserved) ───────────────────────────────────────────────
const CURRENCIES = [
{ sym: 'BCH', name: 'Bitcoin Cash', bal: 2.1438, ratePerBCH: 1, icon: '฿', iconBg: '#fff3c4', iconFg: '#854f0b', change: '+2.1%', changeClass: 'change-up' },
{ sym: 'USDm', name: 'US Dollar', bal: 420.50, ratePerBCH: 518.96, icon: '$', iconBg: '#eaf3de', iconFg: '#3b6d11', change: '-0.8%', changeClass: 'change-down', gap: -4.2, satsPerUnit: 192690 },
{ sym: 'EURm', name: 'Euro', bal: 280.00, ratePerBCH: 480.77, icon: '€', iconBg: '#e6f1fb', iconFg: '#185fa5', change: '+0.2%', changeClass: 'change-up', gap: -0.4, satsPerUnit: 208000 },
{ sym: 'USDm', name: 'US Dollar', bal: 420.50, ratePerBCH: 518.96, icon: '$', iconBg: '#eaf3de', iconFg: '#3b6d11', change: '-0.8%', changeClass: 'change-down', gap: -4.2, satsPerUnit: 192690, vintageMul: 1.14, vintageNote: 'minted ~3 mo ago when BCH was lower' },
{ sym: 'EURm', name: 'Euro', bal: 280.00, ratePerBCH: 480.77, icon: '€', iconBg: '#e6f1fb', iconFg: '#185fa5', change: '+0.2%', changeClass: 'change-up', gap: -0.4, satsPerUnit: 208000, vintageMul: 1.03, vintageNote: 'minted recently' },
{ sym: 'GBPm', name: 'British Pound',bal: 0, ratePerBCH: 412.50, icon: '£', iconBg: '#efeafb', iconFg: '#534AB7', change: '+0.1%', changeClass: 'change-flat', gap: -0.1, satsPerUnit: 242424 },
{ sym: 'JPYm', name: 'Japanese Yen', bal: 12500, ratePerBCH: 78125, icon: '¥', iconBg: '#fceaea', iconFg: '#a32d2d', change: '-0.4%', changeClass: 'change-down', gap: -1.1, satsPerUnit: 1280 },
{ sym: 'INRm', name: 'Indian Rupee', bal: 8200, ratePerBCH: 43478, icon: '₹', iconBg: '#faeeda', iconFg: '#854f0b', change: '+0.0%', changeClass: 'change-flat', gap: 0, satsPerUnit: 2300 },
{ sym: 'JPYm', name: 'Japanese Yen', bal: 12500, ratePerBCH: 78125, icon: '¥', iconBg: '#fceaea', iconFg: '#a32d2d', change: '-0.4%', changeClass: 'change-down', gap: -1.1, satsPerUnit: 1280, vintageMul: 1.13, vintageNote: 'minted ~6 mo ago when BCH was lower' },
{ sym: 'INRm', name: 'Indian Rupee', bal: 8200, ratePerBCH: 43478, icon: '₹', iconBg: '#faeeda', iconFg: '#854f0b', change: '+0.0%', changeClass: 'change-flat', gap: 0, satsPerUnit: 2300, vintageMul: 0.89, vintageNote: 'minted ~1 yr ago when BCH was higher (vintage at loss)' },
{ sym: 'TRYm', name: 'Turkish Lira', bal: 0, ratePerBCH: 15625, icon: '₺', iconBg: '#fceaea', iconFg: '#a32d2d', change: '-2.7%', changeClass: 'change-down', gap: -6.4, satsPerUnit: 6400 },
{ sym: 'NGNm', name: 'Nigerian Naira',bal: 0, ratePerBCH: 781250, icon: '₦', iconBg: '#eaf3de', iconFg: '#3b6d11', change: '-1.4%', changeClass: 'change-down', gap: -3.8, satsPerUnit: 128 },
{ sym: 'RUBm', name: 'Russian Ruble', bal: 0, ratePerBCH: 47619, icon: '₽', iconBg: '#efeafb', iconFg: '#534AB7', change: '-0.5%', changeClass: 'change-down', gap: -2.1, satsPerUnit: 2100 },
@ -652,6 +742,18 @@ const CHIPNET_CONTRACTS = [
{ sym: 'INRm', name: 'Indian Rupee', category: '73984cc54898ef6b7c6c3606fc654a4066379cac269710083368e471971a5ae4', address: 'bchtest:rvm42p4u6jl38vpcs02m596dyzdez9ejtu0rzds0jyhd3hkxm97dsyehj0d3s', atomicSats: 2400n, decimals: 0 },
];
// Chipnet-only oracle WIFs. Each chipnet covenant was deployed with a specific
// test wallet pubkey baked in as the `oraclePk` constructor arg. To preserve the
// "anyone can mint" FIATμ property, the demo bundles those test WIFs and signs
// the oracle attestation on the user's behalf. The connected wallet still funds
// the tx and receives the minted tokens. ON MAINNET this is replaced with a
// real oracle quorum service — these keys are CHIPNET-ONLY, no value attached.
const CHIPNET_ORACLE_WIFS = {
// wallet E: cashaddr bchtest:qpyns8t44guzvcstqgs7wvueq6n6hqgu7cpqzsfhha (from .chipnet-keys-e.json)
USDm: 'cPMrcronmBdhirwNyjLPMryTXTx7iY5cfKsuMGzqppEogV1fzz1R',
// Other deployed chipnet contracts use their own test wallets — fill in when minting flows added.
};
const CHIPNET_ENDPOINTS = [
'wss://chipnet.imaginary.cash:50004',
'wss://chipnet.bch.ninja:50004',
@ -885,18 +987,32 @@ function renderSwap() {
const banner = document.getElementById('state-banner');
const bannerText = document.getElementById('state-banner-text');
if (to.gap && Math.abs(to.gap) > 1) {
// Contextual "selling at vintage loss" banner takes priority over the global rate-lag banner
// when user is swapping FROM a FIATμ that's currently at a vintage loss.
const sellingAtLoss = from.sym !== 'BCH' && from.vintageMul && from.vintageMul < 1 && from.bal > 0;
if (sellingAtLoss) {
banner.style.display = 'flex';
banner.className = 'banner banner-warning';
banner.querySelector('.banner-icon').textContent = '⚠';
const lossPct = ((1 - from.vintageMul) * 100).toFixed(1);
const faceUsd = unitUsdValue(from) * from.bal;
const vintageUsd = from.vintageMul * faceUsd;
const lossUsd = (faceUsd - vintageUsd).toFixed(2);
banner.querySelector('.banner-title').textContent = `Selling ${from.sym} now realises a vintage loss (−${lossPct}%)`;
bannerText.innerHTML = `Your ${from.sym} vintage is currently worth ~$${vintageUsd.toFixed(2)} vs face value $${faceUsd.toFixed(2)} (a ~$${lossUsd} loss). If you can hold, waiting for BCH to recover restores the value; redeeming now locks in the loss.`;
} else if (to.gap && Math.abs(to.gap) > 1) {
banner.style.display = 'flex';
if (to.gap < 0) {
banner.className = 'banner banner-info';
banner.querySelector('.banner-icon').textContent = '★';
banner.querySelector('.banner-title').textContent = `Rate controller adjustment targeting delay ${Math.abs(to.gap).toFixed(1)}%`;
bannerText.textContent = `Rich vintage window arbitrage opportunity. Each ${to.sym} right now locks more BCH backing than face value. Favorable moment to swap in.`;
const mintBonus = (1 / (1 - Math.abs(to.gap) / 100) * 100 - 100).toFixed(1);
bannerText.innerHTML = `Rate-lag mint window — $100 currently mints ~$${(100 + parseFloat(mintBonus)).toFixed(0)} of ${to.sym} face value. The controller's sats-per-${to.sym} hasn't caught up to the BCH price move.<br><span style="display: inline-block; margin-top: 6px; font-size: 11px; color: var(--text-2);"><b>Minting now:</b> favorable — buy more ${to.sym} per USD while the gap is open.</span>`;
} else {
banner.className = 'banner banner-success';
banner.querySelector('.banner-icon').textContent = '↑';
banner.querySelector('.banner-title').textContent = `Rate controller adjustment leading +${to.gap.toFixed(1)}%`;
bannerText.textContent = `Redemption window arbitrage opportunity. Each ${to.sym} right now returns more BCH than face value. Favorable moment to swap out.`;
bannerText.innerHTML = `Rate-lag redeem window — controller rate is ${to.gap.toFixed(1)}% above current BCH market. What each ${to.sym} actually returns depends on its vintage (sats locked at mint). See My Assets for per-vintage value.<br><span style="display: inline-block; margin-top: 6px; font-size: 11px; color: var(--text-2);"><b>Minting now:</b> unfavorable — fewer ${to.sym} per USD until the rate updates.</span>`;
}
} else banner.style.display = 'none';
@ -938,6 +1054,26 @@ async function setNetwork(net) {
return;
}
if (net === 'mainnet') {
setNetStatus('connecting', 'Mainnet — not yet enabled');
document.getElementById('block-height').textContent = '—';
document.getElementById('chipnet-panel').style.display = 'none';
document.getElementById('contracts-card').style.display = 'none';
document.getElementById('connect-btn').style.display = '';
document.getElementById('wallet-pill').style.display = state.wallet ? '' : 'none';
document.getElementById('connect-btn').textContent = state.wallet ? 'Switch wallet' : 'Connect wallet';
document.getElementById('phase2-section').style.display = 'none';
applyBalances({});
renderAll();
const cbMn = document.getElementById('confirm-btn');
cbMn.textContent = 'Mainnet not yet enabled';
cbMn.disabled = true;
cbMn.style.background = 'var(--surface-2)';
setTimeout(() => setNetStatus('error', 'Mainnet — deploy pending'), 600);
if (electrum) { electrum.close(); electrum = null; }
return;
}
// Chipnet mode — start with zero balances until a wallet is connected
if (!state.wallet) {
applyBalances({});
@ -1381,6 +1517,24 @@ document.getElementById('connect-btn').addEventListener('click', () => {
document.getElementById('wif-modal').classList.add('open');
});
document.getElementById('wif-close').addEventListener('click', () => document.getElementById('wif-modal').classList.remove('open'));
document.getElementById('wc-start-btn').addEventListener('click', () => {
const btn = document.getElementById('wc-start-btn');
const uri = document.getElementById('wc-uri');
const placeholder = document.getElementById('wc-qr-placeholder');
const topic = Array.from(crypto.getRandomValues(new Uint8Array(16))).map(b => b.toString(16).padStart(2, '0')).join('');
const sym = Array.from(crypto.getRandomValues(new Uint8Array(16))).map(b => b.toString(16).padStart(2, '0')).join('');
uri.textContent = `wc:${topic}@2?relay-protocol=irn&symKey=${sym}`;
placeholder.textContent = 'Scan in wallet';
placeholder.style.background = `linear-gradient(135deg, var(--accent-bg) 25%, transparent 25%, transparent 50%, var(--accent-bg) 50%, var(--accent-bg) 75%, transparent 75%) 0 0 / 8px 8px`;
placeholder.style.color = 'var(--accent)';
btn.textContent = 'Waiting for wallet…';
btn.disabled = true;
setTimeout(() => {
btn.textContent = 'No relay connected — bridge not yet enabled';
btn.style.background = 'var(--warning-bg)';
btn.style.color = 'var(--warning)';
}, 2400);
});
document.getElementById('wif-modal').addEventListener('click', e => { if (e.target.id === 'wif-modal') e.target.classList.remove('open'); });
document.getElementById('wif-connect').addEventListener('click', async () => {
const wif = document.getElementById('wif-input').value.trim();
@ -1617,12 +1771,26 @@ async function tryMintUSDm() {
const atomicSats = usdmConfig.atomicSats; // BigInt
const founderFeeBps = 5n; // USDm fee from chipnet test (0.05%)
showMintResult(`building Contract instance…`);
// founderLockingBytecode = P2PKH(user pkh) — assumes user is the founder
const lockingHex = '76a914' + libauth.binToHex(state.wallet.pkh) + '88ac';
const founderLockingBytecode = libauth.hexToBin(lockingHex);
// Derive the chipnet oracle's key material from the bundled WIF.
// The covenant was deployed with this oracle's pubkey baked in; only
// signatures from this key satisfy OP_CHECKDATASIGVERIFY on chipnet.
// The connected wallet stays the funder + recipient — anyone can mint.
const oracleWif = CHIPNET_ORACLE_WIFS[usdmConfig.sym];
if (!oracleWif) throw new Error(`no chipnet oracle WIF bundled for ${usdmConfig.sym}`);
const oracleDecoded = libauth.decodePrivateKeyWif(oracleWif);
if (typeof oracleDecoded === 'string') throw new Error(`oracle WIF decode error: ${oracleDecoded}`);
const oraclePrivateKey = oracleDecoded.privateKey || oracleDecoded.key || oracleDecoded.keyBytes || oracleDecoded.bytes;
if (!oraclePrivateKey || oraclePrivateKey.length !== 32) throw new Error('bundled oracle WIF malformed');
const oraclePubkey = libauth.secp256k1.derivePublicKeyCompressed(oraclePrivateKey);
if (typeof oraclePubkey === 'string') throw new Error(`oracle pubkey derive failed: ${oraclePubkey}`);
const oraclePkh = libauth.ripemd160.hash(libauth.sha256.hash(oraclePubkey));
const founderLockingBytecode = libauth.hexToBin('76a914' + libauth.binToHex(oraclePkh) + '88ac');
const tokenCategoryBytes = libauth.hexToBin(usdmConfig.category);
showMintResult(`building Contract instance…`);
showMintResult(`oracle: bundled chipnet key (anyone can mint via this demo)`);
showMintResult(`funder/recipient: your wallet (${state.wallet.address.replace('bchtest:', '').slice(0, 8)}…)`);
// Provider
let provider;
if (cashscript.ElectrumNetworkProvider) {
@ -1635,7 +1803,7 @@ async function tryMintUSDm() {
try {
contract = new cashscript.Contract(
DEVIANT_ORACLE_MBA_ARTIFACT,
[tokenCategoryBytes, state.wallet.pubkey, founderFeeBps, founderLockingBytecode],
[tokenCategoryBytes, oraclePubkey, founderFeeBps, founderLockingBytecode],
{ provider, addressType: 'p2sh32' }
);
} catch (e) {
@ -1647,11 +1815,10 @@ async function tryMintUSDm() {
showMintResult(`expected: ${expectedAddr}`);
if (derivedAddr !== expectedAddr) {
showMintResult(`address mismatch — your wallet is not the chipnet USDm oracle/founder`, 'error');
showMintResult(`you need to paste wallet E's WIF from .chipnet-keys-e.json to mint`, 'error');
showMintResult(`address mismatch — bundled oracle key may be stale; check CHIPNET_ORACLE_WIFS`, 'error');
return;
}
showMintResult(`address match — wallet is the USDm founder/oracle`, 'success');
showMintResult(`address match — contract found on chipnet`, 'success');
// Compute amounts
const grossSats = atoms * atomicSats;
@ -1686,18 +1853,20 @@ async function tryMintUSDm() {
if (total < need) throw new Error(`insufficient funds: have ${total} sats, need ${need}`);
showMintResult(`picked ${picked.length} UTXO(s), total ${total} sats`);
// Oracle attestation
showMintResult(`signing oracle attestation…`);
// Oracle attestation — signed with the BUNDLED chipnet oracle key, not the
// connected wallet. The covenant verifies this against the baked-in oraclePk.
showMintResult(`signing oracle attestation (bundled chipnet oracle)…`);
const msg = new Uint8Array(16);
const dv = new DataView(msg.buffer);
dv.setUint32(0, 1, true); dv.setUint32(4, 1, true); dv.setUint32(8, 1, true);
dv.setUint32(12, Number(atomicSats), true);
const msgHash = libauth.sha256.hash(msg);
const oracleSig = libauth.secp256k1.signMessageHashSchnorr(state.wallet.privateKey, msgHash);
const oracleSig = libauth.secp256k1.signMessageHashSchnorr(oraclePrivateKey, msgHash);
if (typeof oracleSig === 'string') throw new Error(`oracle sign failed: ${oracleSig}`);
showMintResult(`oracle sig: ${libauth.binToHex(oracleSig).slice(0, 20)}…`);
// Build the transaction
// Build the transaction. The connected wallet signs its own funder UTXOs;
// the minted tokens are sent to the connected wallet's address (not the founder).
showMintResult(`building transaction via cashscript…`);
if (!cashscript.TransactionBuilder) throw new Error('cashscript.TransactionBuilder not exported');
const wif = libauth.encodePrivateKeyWif
@ -1705,7 +1874,8 @@ async function tryMintUSDm() {
: null;
if (!wif) throw new Error('could not encode WIF for signature template');
const sigTemplate = new cashscript.SignatureTemplate(typeof wif === 'string' ? wif : wif.wif);
const recipientLockingBytecode = founderLockingBytecode; // mint to same wallet
// Mint to the CONNECTED wallet — anyone can mint, recipient = the user.
const recipientLockingBytecode = libauth.hexToBin('76a914' + libauth.binToHex(state.wallet.pkh) + '88ac');
const tb = new cashscript.TransactionBuilder({ provider, allowImplicitFungibleTokenBurn: true });
tb.addInput({
@ -1824,23 +1994,48 @@ function renderPortfolio() {
const pct = totalUsd > 0 ? (usdValue / totalUsd) * 100 : 0;
const unitVal = unitUsdValue(c);
const isHeld = c.bal > 0;
return `
<div class="portfolio-card" data-sym="${c.sym}" style="${isHeld ? '' : 'opacity: 0.45;'}">
<div class="asset-icon" style="background: ${c.iconBg}; color: ${c.iconFg}; width: 36px; height: 36px; font-size: 15px;">${iconHtml(c)}</div>
<div class="portfolio-card-info">
<div style="font-weight: 600; font-size: 14px;">${c.sym}</div>
<div style="font-size: 11px; color: var(--text-2);">${c.name} · 1 ${c.sym} ≈ $${fmt(unitVal, 2)}</div>
<div class="portfolio-bar"><div class="portfolio-bar-fill" style="width: ${pct.toFixed(1)}%; background: ${c.iconFg};"></div></div>
// Vintage value — multiplier reflecting BCH price movement since user minted.
// vintageMul > 1 → BCH rose after mint → vintage worth more than face. <1 → BCH fell → loss.
// Independent of live BCH oracle so the demo story stays consistent.
let vintageBlock = '';
if (isHeld && c.sym !== 'BCH' && c.vintageMul && c.satsPerUnit) {
const vintageSats = Math.round(c.satsPerUnit * c.vintageMul);
const vintageUsdTotal = c.vintageMul * usdValue;
const deltaUsd = vintageUsdTotal - usdValue;
const deltaPct = (c.vintageMul - 1) * 100;
const sign = deltaUsd >= 0 ? '+' : '−';
const deltaColor = deltaUsd >= 0 ? 'var(--success)' : 'var(--danger)';
vintageBlock = `
<div class="vintage-row" style="margin-top: 8px; padding: 6px 8px; background: var(--surface); border-left: 2px solid ${deltaColor}; border-radius: 4px;">
<div style="font-size: 10px; color: var(--text-3); text-transform: uppercase; letter-spacing: 0.04em;">Vintage · ${vintageSats.toLocaleString()} sats locked per ${c.sym}</div>
<div style="font-size: 12px; margin-top: 2px;">
<span style="font-family: var(--font-mono);">≈ $${fmt(vintageUsdTotal, 2)} redeem value</span>
<span style="color: ${deltaColor}; font-weight: 600; margin-left: 6px;">${sign}$${fmt(Math.abs(deltaUsd), 2)} (${sign}${Math.abs(deltaPct).toFixed(1)}%)</span>
</div>
${c.vintageNote ? `<div style="font-size: 10px; color: var(--text-3); margin-top: 2px; font-style: italic;">${c.vintageNote}</div>` : ''}
</div>
<div class="portfolio-card-value">
<div style="font-family: var(--font-mono); font-size: 14px; font-weight: 500;">${fmtUnit(c.bal, c.sym)}</div>
<div style="font-size: 11px; color: var(--text-2);">$${fmt(usdValue, 2)}${isHeld ? ` · ${pct.toFixed(1)}%` : ''}</div>
<div class="portfolio-actions" style="margin-top: 6px;">
<button class="portfolio-action" data-action="${isHeld ? 'swap' : 'buy'}" data-sym="${c.sym}">${isHeld ? 'Swap' : 'Buy'}</button>
${isHeld ? `<button class="portfolio-action" data-action="send" data-sym="${c.sym}">Send</button>` : ''}
<button class="portfolio-action" data-action="receive" data-sym="${c.sym}">Receive</button>
`;
}
return `
<div class="portfolio-card" data-sym="${c.sym}" style="${isHeld ? '' : 'opacity: 0.45;'} flex-direction: column; align-items: stretch;">
<div style="display: flex; align-items: center; gap: 12px; width: 100%;">
<div class="asset-icon" style="background: ${c.iconBg}; color: ${c.iconFg}; width: 36px; height: 36px; font-size: 15px;">${iconHtml(c)}</div>
<div class="portfolio-card-info">
<div style="font-weight: 600; font-size: 14px;">${c.sym}</div>
<div style="font-size: 11px; color: var(--text-2);">${c.name} · face 1 ${c.sym} ≈ $${fmt(unitVal, 2)}</div>
<div class="portfolio-bar"><div class="portfolio-bar-fill" style="width: ${pct.toFixed(1)}%; background: ${c.iconFg};"></div></div>
</div>
<div class="portfolio-card-value">
<div style="font-family: var(--font-mono); font-size: 14px; font-weight: 500;">${fmtUnit(c.bal, c.sym)}</div>
<div style="font-size: 11px; color: var(--text-2);">$${fmt(usdValue, 2)} face${isHeld ? ` · ${pct.toFixed(1)}%` : ''}</div>
<div class="portfolio-actions" style="margin-top: 6px;">
<button class="portfolio-action" data-action="${isHeld ? 'swap' : 'buy'}" data-sym="${c.sym}">${isHeld ? 'Swap' : 'Buy'}</button>
${isHeld ? `<button class="portfolio-action" data-action="send" data-sym="${c.sym}">Send</button>` : ''}
<button class="portfolio-action" data-action="receive" data-sym="${c.sym}">Receive</button>
</div>
</div>
</div>
${vintageBlock}
</div>
`;
}).join('');

View file

@ -0,0 +1,290 @@
# FIATμ — Sovereign Backed Assets (Design Record)
FIATμ is a family of **sovereign, natively-backed assets** on Bitcoin Cash, denominated in fiat face values but backed by BCH at an exact, script-enforced rate. They are **not IOUs** and **not CDPs** — there is no debt and no liquidation risk. A FIATμ unit is **stable in its backing and its 1=1 face value, and "unstable" only in its floating market rate.** This document fixes the taxonomy that makes that claim precise, the mint/redeem mechanics, the inversion thesis (why a FIATμ unit outlasts the fiat currency it is named after), the adaptive rate controller, and the honest residual risks.
Produced via ASM (Atomic Swap Mechanism) on BCH — single-party, condition-locked, atomic mint/redeem enforced by CashScript covenants.
---
## 0. Unstablecoin — what FIATμ is, in plain words (read this first)
**Unstablecoin** (a description, not a label).
FIATμ is the first fiat-denominated currency that keeps a **1=1 face value** while being **backed by an on-chain asset (BCH) under hard consensus rules**, which makes it **always redeemable by any holder**. It is **not a CDP** — there is no debt and no liquidation risk. It is **stable in its backing and its face value, and "unstable" only because of a floating market rate.**
In simple terms:
- **Face value is always 1=1.** One USDμ is always called one dollar. You can always spend it as one dollar's worth. That never changes.
- **It is really backed.** Behind each unit sits a fixed amount of BCH, locked by code. No company holds it, no one can print more, no one can freeze it. Anyone holding the unit can always trade it back for that BCH — exactly, by the rules of the chain.
- **No debt, no loans, no liquidation.** Unlike systems like MakerDAO (CDPs), you are not borrowing against collateral, so there is nothing that can be "liquidated" or called in. You either hold the unit, or you return it and get the backing. That's it.
- **Only the market price floats.** The *face* stays 1=1; the *market value* (what people pay for it) can drift. **When BCH's market price is stable, the market value and the face value coincide — so FIATμ can be treated at market price and at face value at the same time** (it spends as a face-value dollar *and* trades at its market value, with no gap between the two). Over time, if the dollar weakens, the unit can be worth *more* than a dollar.
That last point is the whole idea: **the unit borrows the dollar's name but not the dollar's fate.** When you mint it, it starts at 1=1. After that, it follows its own path — so if the dollar gets debased, FIATμ doesn't go down with it; it can go up against it, while the backing floor never disappears.
### FIATμ as a fiat certificate (the fastest mental model)
Think of FIATμ like a **gold certificate — but a fiat certificate, with the backing bound to it by consensus instead of by an issuer's promise.** A gold certificate was paper that said "the bearer may redeem this for X gold." It had the right shape — bearer, redeemable, the backing travels with the paper — but one fatal flaw: you had to trust the **issuer** not to over-issue, stay solvent, and keep the redemption window open. History shows issuers did all the wrong things (fractional reserve, suspending convertibility, abandoning the standard).
FIATμ keeps every good property of that certificate and **deletes the issuer, replacing it with code:**
| Property | Gold certificate | **FIATμ (fiat certificate)** |
|---|---|---|
| Bearer instrument | Yes | **Yes** |
| Backing travels with it | Yes — hand over the paper, hand over the claim | **Yes — send the asset, the backing binding moves with it** |
| Redeemable for backing | At the issuer's window | **By code, no window, no intermediary** |
| Who honors redemption | **The issuer (must be trusted)** | **Consensus (no one to trust)** |
| Over-issuance (fractional reserve)? | **Possible** | **Impossible — each unit backed at mint by locked BCH, on-chain verifiable** |
| Convertibility suspendable? | **Yes — issuer can close the window** | **No — the covenant cannot refuse a valid redemption** |
| Downtime | Issuer hours, solvency, willingness | **None — ASM redeems any time, no operator** |
The binding is the point: the backing isn't "held somewhere on your behalf" — it is **bound to the certificate itself by consensus rules**, so when the certificate travels from one person to another, **the backing travels with it.** The holder never asks an intermediary to claim it; it is always already in their hands. The intermediary — the historical redemption window — is **replaced by ASM**, the algorithm that swaps the certificate back to its backing (and forward again) smoothly, any time, with **no downtime**, because consensus keeps no business hours and cannot suspend convertibility.
So FIATμ is the certificate idea **with its one historically-broken part — the trustworthy issuer — physically removed.** The only honest difference from an idealized gold certificate: the *backing asset* (BCH) fluctuates in market value, where gold was steadier. So the redemption window is perfectly honest and never closes, and the backing is always claimable in full — but its value in BCH terms varies. Backing quantity and redeemability: guaranteed. Backing value: subject to BCH.
> **A note on "asset" vs "token."** FIATμ is *implemented as* a CashToken — that is the on-chain envelope that carries it, the way a certificate is printed on paper. But FIATμ **is a backed asset**, not a "token" in the usual sense: today's tokens are overwhelmingly unbacked (value resting on speculation or a promise). FIATμ's value is redeemable backing bound by consensus. So this document calls it an **asset** (or *unit* / *certificate*), and reserves "CashToken" only for the implementation layer.
### The core insight: FIATμ is the gold-certificate collapse, run backwards
This is the conceptual key that makes everything else click. FIATμ is not merely *like* a gold certificate — it is the gold certificate's historical death **inverted**, step for step. Understanding the inversion is understanding the entire design.
**How the gold certificate died (the original sequence):**
1. **Start:** the certificate is a hard claim on gold — paper backed by scarcity, fixed redemption at the issuer's window.
2. **The break:** the issuer suspends convertibility and severs the paper from the gold.
3. **The result:** the paper keeps circulating, but now it's backed by *nothing scarce* — only the issuer's authority — and it floats freely against everything.
That third step *is* modern fiat. A floating currency is, quite literally, **a former certificate whose scarce backing was stripped out, leaving the float on nothing.** The scarcity was removed; the floating paper remained.
**FIATμ runs that exact sequence in reverse:**
1. **Start:** a floating fiat unit, backed by nothing scarce (today's dollar).
2. **The inversion:** instead of *removing* scarce backing and keeping the float, you **inject scarce backing underneath** and keep the float as a surface property.
3. **The result:** a unit that floats — like post-break fiat — **but now has hard scarce backing under it, like pre-break gold.** You have put the gold back under the floating paper.
So the floating rate is **not a flaw FIATμ shares with broken fiat — it is the same surface state with the causality flipped.** Broken fiat floats *because its backing was taken away.* FIATμ floats *while its backing was put back.* Same visible behavior (a floating rate); opposite substance (nothing underneath vs scarcity underneath).
### The reverse lock — naming the mechanism precisely
What makes the inversion possible is a reversal of **what is locked and what is the label.** The two systems lock in opposite directions:
- **Gold certificate (forward lock):** *fiat/paper is the instrument; gold is what it points at.* Authority issues the paper; the scarce asset sits passively behind it as a reserve — and can be removed.
- **FIATμ (reverse lock):** *the scarce asset is what's actually held and bound; the fiat face value is only a projection on top of it.* BCH is the locked, real thing; the fiat denomination is a *label projected onto* the locked scarcity, **not a reserve the unit points at.**
The inversion in one sentence: **a traditional certificate uses fiat as the wrapper and scarcity as the (removable) backing; FIATμ uses scarcity as the (irremovable) backing and fiat only as the face projection.** The roles of "what is real" and "what is nominal" are swapped. In the old system the *paper* was real (issuer-enforced) and the *gold* was the breakable promise; in FIATμ the *scarcity* is real (consensus-enforced, unbreakable) and the *fiat number* is the promise — but a promise about **denomination only**, not about a reserve. So it costs nothing to keep, and nothing breaks if the named fiat dies.
### Why the inversion makes the historical failure impossible
The gold certificate died at **step 2** — the issuer suspended convertibility — because a *human controlled the redemption window.* FIATμ **has no step 2.** Its backing is bound by consensus, not held by an issuer; there is no window to close and no authority to close it. **You cannot break a peg that no one is holding open.** The single failure mode that ended every historical certificate is structurally absent here, not merely discouraged.
And this reframes the floating rate completely:
- **Broken fiat hides that it floats on nothing** — it presents un-backed paper as if it had fixed worth.
- **FIATμ openly floats on something** — the float is just the scarce backing's market value, shown honestly.
The floating rate that marked the certificate's *death* marks FIATμ's *honesty.* It is not the symptom of a severed peg; it is the visible truth of real scarcity underneath, that no issuer can remove.
**The whole thesis, compressed:** *Fiat was made by stripping scarce backing out and keeping the floating paper. FIATμ is made by injecting scarce backing under a floating fiat face — a reverse lock, where the scarce asset is held and the fiat is only the projected face value. The same floating rate that was the certificate's death is FIATμ's honesty, because here the float rests on real scarcity that no one can take away, instead of on an authority's promise that anyone can break.*
### What you actually experience — three honest outcomes
Decoupling is *structural, not instant.* The unit doesn't snap away from 1=1 at mint — it's simply *free* to move. **When BCH is stable, market value and face value coincide, so the unit is usable as both at once** and sits at 1=1 day to day. That gives every holder one of three outcomes, and **all three beat holding the fiat itself:**
| You want to… | What matters to you | What FIATμ gives you |
|---|---|---|
| **Spend** | A stable, familiar unit, ~1=1 right now | Market value hovers near face; spends like the dollar, with no debasement built in |
| **Save (and grow)** | Beat the fiat over time | Face stays 1=1, but the unit can appreciate against a weakening fiat — a better store of value than the fiat |
| **Save (through a dip)** | Not get wiped out in a downturn | Market value may dip temporarily if BCH dips, but the **backing floor never breaks** — your exact BCH is always redeemable, and it recovers |
The third one is the key honesty: even the *worst* case is "your value dips temporarily but the floor holds and recovers." Fiat's *normal* case is "your value sinks permanently with no floor at all." So the worst FIATμ outcome still beats the only outcome fiat offers.
### Advantages vs disadvantages (honest)
**Advantages**
- **Real, hard backing** — fixed BCH locked by consensus, not a company's promise or reserve. Can't be inflated, frozen, or rugged.
- **Always redeemable, by anyone holding it** — the claim is in the asset itself, not tied to who minted it; redemption is exact, and divisible (return part, get that part of the backing).
- **No debt, no liquidation** — not a CDP; nothing to be margin-called.
- **Keeps fiat's usefulness, drops fiat's flaw** — familiar 1=1 unit to spend and price in, without the issuer's power to debase it.
- **Upside when fiat fails** — as the named fiat weakens, the unit can appreciate against it, with unbounded upside in a hyperinflation, while the face stays 1=1.
- **Spendable like normal money** — near 1=1 in normal conditions because BCH is mostly stable.
**Disadvantages (stated plainly)**
- **Backing value can dip with BCH.** The backing *quantity* and *redeemability* never change, but its *value in BCH terms* falls when BCH falls. The floor holds; it can just be temporarily lower. This is the one real exposure.
- **You take BCH's risk instead of the issuer's risk.** You've swapped "trust the dollar's issuer not to debase" for "accept BCH's market swings." For someone who distrusts the issuer more than the market (e.g. in a high-inflation country), that's a good trade; for someone in a very stable-currency economy, it may matter less.
- **It is not a guaranteed-1=1 market peg.** If you *need* the market price to always be exactly a dollar at every instant, this isn't that — only the *face* is fixed; the *market* floats (usually slightly, sometimes more).
- **Early/small-scale is more volatile.** The mechanisms that calm volatility (below) strengthen as adoption grows; while small, expect more movement.
- **It lives or dies with BCH.** The backing is only as sound as BCH's consensus — far more credible than a central bank's restraint, but it is the one remaining dependency.
The honest one-liner: **you trade "issuer can debase you, with no floor" for "market can dip you, with a hard floor and an upside" — denominated in the unit you already think in.**
### The deeper framing (complementary — for the reader who wants the "why")
Underneath the plain words, three sharper framings:
- **The mint is a snapshot, not a tether.** A bank-reserve-backed instrument is *welded* to its reserve — when the reserve debases, the instrument debases, because its job is to *follow* the fiat down. FIATμ removes that weld: it touches the fiat once at mint (face 1=1, market 1=1) and then the BCH backing severs the trajectory. **Fiat failure ≠ FIATμ failure** — that is the entire purpose of the design.
- **The fiat name is the launch coordinate, not the flight path.** Don't judge FIATμ by "does it track its fiat" — that is the *stablecoin/IOU* success metric and the wrong question. Ask "did it decouple cleanly at mint" — yes, by construction — then judge it on its own trajectory against scarce backing. Grading the flight path against the launch coordinate is the category error; the divergence is the wings.
- **A real-reserve-backed version would be strictly worse than fiat** — it would inherit fiat's debasement loss *and* lack any decoupling escape (and often add custody risk on top). FIATμ takes fiat's *usefulness* (the familiar unit, captured at the snapshot) and then carries *BCH's* risk profile instead of fiat's. That swap is the entire intended trade.
### The precise contrast vs stablecoins (technical)
Decoupling is the *product*, not a defect. A stablecoin **can** decouple too — but its decoupling is **single-directional and downward.** Its mechanism exists to pin it at 1=1, so the upside is *engineered out* (a stablecoin at $1.50 is "broken") while the downside stays live (depeg, break-the-buck). Its payoff is **capped at the top, open at the bottom.** FIATμ is the mirror image — and only its *market* value decouples; its *face* value stays 1=1 always.
| | Stablecoin / IOU | **FIATμ (unstablecoin)** |
|---|---|---|
| Face value | 1=1 (until depeg) | **Always 1=1** |
| Market upside | **Engineered out** (capped at 1=1) | **Open** — rides backing appreciation, exit above face |
| Market downside | **Open** (depeg, break-the-buck) | **Floored** — exact backing always redeemable, recovers |
| Tracks fiat debasement | **Yes** — follows it down | **No** — decoupled at mint |
| Debt / liquidation | Varies (some are CDPs) | **None** |
| Net exposure | Two downside risks, no upside | Floored downside, open upside |
So the precise indictment: a stablecoin is not "fiat's risk *without* decoupling" — it is **fiat's risk *plus* a downside-only decoupling.** Its "stability" suppresses the *good* direction while the *bad* one stays open. FIATμ floors the bad direction and frees the good one. (Don't judge FIATμ by "does it track its fiat" — that's the stablecoin metric and the wrong question. Ask "did it decouple cleanly at mint" — yes, by construction — then judge it on its own path. The fiat name is the launch coordinate, not the flight path.)
> **Positioning note.** "Unstablecoin" works as a *description and hook*, not the asset's identity (the asset is a sovereign backed unit, FIATμ). Pair it with an instant clarifier so "unstable" doesn't read as "risky" to a newcomer: *"unstable against fiat — because fiat is the thing falling; floored against scarcity."*
---
## 1. The asset taxonomy (the distinction everything rests on)
A unit's category is determined by **where its backing lives and what can destroy it** — not by what it's called. The meaningful distinction is sovereign native backing vs a claim on backing held elsewhere:
| | **Native MBA (FIATμ)** | Cross-chain claim |
|---|---|---|
| Identity | **Sovereign (own asset)** | Borrowed (claim on X) |
| Denomination | **Fiat/index face value** | = foreign asset |
| Backing location | **Same chain (BCH), fixed at mint** | Another chain's reserve |
| Peg enforcement | **Hard, atomic, exact, same-chain consensus** | Soft or cross-chain-verified |
| Redeem | **Exact backing, any holder, divisible** | Only if foreign chain intact + reachable |
| Fails only if… | **BCH consensus fails** | **Foreign chain OR the link fails → degrades to a bare IOU** |
**Key definitions, used precisely from here on:**
- **IOU** = a *representation of something else*; it has **no sovereign identity** — its meaning is "a claim on X held elsewhere." Two sub-kinds: *trusted-third-party* (custodian holds X; soft peg) and *algorithmic/cross-chain* (code holds X, possibly on another chain; consensus/proof peg).
- **Native MBA (FIATμ)** = a **sovereign asset** whose backing (BCH) is locked on the *same chain* and whose redemption is enforced by the *same consensus*. It does **not** represent a foreign reserve — it represents BCH locked at a face-valued rate, *labelled* in a fiat unit. No dollar is held, owed, or promised; the "USD" is a unit of denomination, not a claim on dollars.
**On the cross-chain claim — risk, not verdict.** A cross-chain claim is a legitimate instrument; it simply relocates the backing from native consensus to a counterparty chain plus the link between them. That is *more failure surface*, not a disqualification. Its honest risk: if the external network collapses or the peg breaks, the claim loses its backing and degrades to a bare IOU — the *same failure mode as fiat* (a unit whose backing is a promise that can evaporate). FIATμ avoids this not by being "better tech" but by keeping backing and enforcement under one consensus. The user picks their risk tolerance; the design's duty is to disclose which category an asset is.
---
## 2. Why FIATμ is not an IOU
An IOU's identity is **borrowed** — "I'm worth 1 USD because I claim 1 USD elsewhere." Remove the backing and it is nothing.
A FIATμ unit's identity is **sovereign** — it is a thing that exists natively, whose backing is a *hard property of the chain it lives on*, not a promise about an asset held somewhere else. There is no "elsewhere," no custodian, no soft peg, no asynchrony. The asset and its backing are one object under one consensus.
Consequence — the compromise surface:
- Trusted IOU adds a **custodian** (bribe/seize it).
- Cross-chain/algorithmic IOU adds a **foreign chain + verification path** (break either).
- **Native MBA adds nothing** — its only attack surface is BCH's own consensus, the same security the backing asset already trusts. That is what "sovereign" means here: it depends on nothing outside the consensus that already secures its backing.
---
## 3. Mint / redeem mechanics
### The rate at mint
A FIATμ unit carries a fiat **face value** and is backed by a **fixed quantity of BCH** set at the moment of mint:
```
face value = X (e.g. 1 USDμ)
backing locked = X / price(Y in X) at mint time (a fixed quantity of BCH)
```
- The **backing is fixed** — a specific amount of BCH, locked at mint, exact, script-enforced.
- The **face-to-backing rate floats** afterward as BCH/fiat moves — but the locked backing never changes.
This is the numismatic three-values model:
- **Nominal** — the face label (1 USDμ), fixed forever.
- **Accounting** — the BCH locked at this unit's mint vintage, fixed at mint, verifiable on-chain ("vintage-locked").
- **Market** — whatever it trades for now, free to float above or below either.
All three coexist without contradiction, exactly as a historical coin has a face value, a metal content, and a market price.
### Bearer + divisible (the redemption design)
Redemption is **by burning the unit, not by identity** — this is what makes FIATμ a circulating bearer asset rather than a personal vault:
- The covenant releases the locked BCH to **whoever** presents a transaction that **burns the corresponding FIATμ in the same transaction** (verified via introspection — `OP_OUTPUTTOKENAMOUNT`, etc.). It does **not** check who you are. The original minter's keys are needed only to *create* the lock, never to *release* it.
- So a FIATμ unit can be **sent, paid, swapped, traded** through any number of hands; whoever holds it can burn it to claim the backing. The claim travels with the asset.
**Divisible** via a recursive covenant: returning 0.3 of the unit burns 0.3, releases exactly 0.3 of the locked backing, and re-creates the covenant carrying the remaining 0.7 (against the 0.7 still circulating). Requires (a) a fungible, divisible CashToken and (b) recursive covenant logic. The release ratio is enforced with exact integer math (native post-May-2025 big-int) so `released = burned × (locked / minted)` never drifts — no over- or under-redemption.
---
## 4. The fixed-rate floor: no liquidation risk
FIATμ redemption is **at the fixed mint rate against the specific BCH locked at that mint** — you return the unit, you get *your own locked BCH back*, exactly. This is **not** a collateralized-debt model (MakerDAO/Liquity) where redemption sells collateral at market:
- **No market sale, no slippage, no liquidation auction, no price impact.**
- One holder redeeming just unlocks their own backing; it does not move the BCH market or anyone else's rate.
- Mass redemption returns each holder's exact locked BCH with **zero system-induced selling** — there is no liquidation cascade because there is no liquidation.
**The one and only exposure:** the backing's *value in BCH terms* can drop during BCH downturns. The backing *quantity* and *redeemability* never change. Compared to fiat — whose floor does not exist and whose purchasing power erodes permanently — a temporary, recoverable dip in a floor that *holds* is a strictly better risk profile.
---
## 5. The inversion thesis (why FIATμ outlasts its denomination)
A real fiat unit and a FIATμ unit can both read "1 USD" but are backed by opposite things:
- **Fiat USD** — backed by an *issuer's liability*, unlimited supply, controlled by a party whose historical incentive is to expand it. The unit persists; its value erodes (QE, inflation, hyperinflation, redenomination, demonetization). The holder is **long the issuer** and bears all of it with no floor.
- **FIATμ "USD"** — backed by a *fixed, scarce asset* (BCH). The face value is a label, not a claim on a printing press. The dollar's issuer has **zero power** over it. The holder is **short the issuer's ability to debase, long BCH.**
The mechanism of the inversion: FIATμ's backing is fixed and cannot be inflated. As the named fiat debases, it loses purchasing power against scarce things including BCH, so the **same FIATμ unit commands more and more of that fiat** — the worse the debasement, the more FIATμ appreciates against the fiat. There are only two outcomes, both non-catastrophic for the holder:
1. **Fiat stays sound-ish** → FIATμ tracks it, remains a familiar usable unit.
2. **Fiat debases/dies** → FIATμ detaches upward; the floor is the redeemable BCH backing (never zero while BCH exists), the upside against the dying fiat is unbounded.
There is no third outcome where the FIATμ holder is destroyed *by the fiat's failure*, because the value never depended on the fiat — only on its name.
### Why the volatility critique largely dissolves (the reflexive properties)
Naively, FIATμ's cost is "BCH volatility." But volatility is **endogenous** to the system, not a fixed external tax:
- **Reflexive backing demand.** Each FIATμ minted locks BCH out of float as backing. More FIATμ demand → more BCH locked → less liquid float → BCH shifts from *speculative* holding (volatile) to *monetary/utility* holding (sticky). The system **suppresses its own volatility as it scales.**
- **Basket diversification ("the order of the addends does not change the sum").** FIATμ is a basket of *every* currency's denomination, not one. BCH cannot be debasing against all currencies at once — a dip against a temporarily strong USD coincides with gains against weakening currencies. Single-currency volatility is real on one axis and **diversified away across the matrix**. A USD-only stablecoin sees one axis; the FIATμ system sees the whole matrix.
- **Stablecoins are a tailwind, not a competitor.** A fiat stablecoin does not strengthen its fiat — it exports the fiat's demand onto crypto rails while the issuer keeps debasing the underlying. Stablecoin growth = more undifferentiated issuer-liability claims = *more* of the debasement that intensifies FIATμ's inversion. The "competition" accelerates the disease FIATμ is the inverse of.
---
## 6. The adaptive rate controller
The controller is **not a peg defense** (there is no peg to defend — the floor is the fixed backing). It is a **mint-rate calibrator** that always tilts *entry* toward cheap-and-fair, asymmetrically by trend:
- **BCH uptrend → accelerate (catch up fast).** Backing is appreciating; a lagging rate would force newcomers to overpay (e.g. $2–3 of BCH for 1 USDμ). Acceleration snaps the rate to a fair ~1=1 quickly so **entry stays affordable** as BCH rises. Existing holders separately win — their already-minted units ride the appreciating backing and can exit at a face premium (1 USDμ = several fiat).
- **BCH downtrend → decelerate (lag deliberately).** The rate lags downward so newcomers acquire FIATμ **cheap**, opening an **arbitrage gap**. Arbitrageurs close it — and that arbitrage activity is *demand for FIATμ (hence BCH)* exactly when BCH is weak.
The elegant part: the controller **converts downside volatility into an arbitrage incentive that recruits counter-cyclical demand** — a damper powered by the thing it damps, and one that *grows with adoption* (bigger demand base → more arbitrage pressure available to absorb dips). The worst moment is engineered to be the most attractive entry.
**Single objective, both directions:** maximize the fairness/attractiveness of minting in, in every regime, while never touching the fixed redemption floor existing holders rely on. Speed up to prevent overpricing; lag to create discount.
**Funding of the downtrend arbitrage (resolved by design; magnitude measured in production).** The arbitrage profit is **not** funded by the protocol or skimmed from early adopters. Its source is the **debasement differential of the surrounding fiat environment.** The arbitrageur buys FIATμ cheap during a BCH dip; the gap closes as the rate catches up *and* as the denominating fiat continues losing purchasing power. In a sound-money world this would be a zero-sum timing transfer someone must pay for. In the *debasing* world FIATμ is built for, the fiat side is continuously sinking, so the gap is fed by the fiat's own decay — the profit is **harvested from debasement the fiat already produces**, not extracted from participants.
Therefore it is correctly **not a protocol constant.** Funding magnitude = `adoption depth × basket debasement rate` — both exogenous, live, and self-reinforcing (worse debasement → deeper arbitrage funding → stronger counter-cyclical demand). A simulation fixes the controller's *mechanism* (gear-shift, catch-up curve); the funding *magnitude* is discovered in the target environment, not a sandbox. This is the same inversion as the rest of the design, applied to the controller's economics: the arbitrage is not a cost the system carries — it is a **yield the environment provides**, scaling with the very debasement that makes FIATμ valuable. Status: mechanism complete; magnitude deferred to real economic deployment by design.
---
## 7. Honest residual risks (design targets, not weaknesses)
With the fixed-rate floor (no liquidation) and the reflexive/basket/stablecoin properties folded in, the residuals are narrow and shared by *all* monetary systems — and fiat handles them worse:
1. **Bootstrapping fragility.** The reflexive volatility-suppression loop is weak while the system is small/thin. Early on, before utility-held BCH and a broad arbitrageur base exist, volatility is less damped. Design target: grow basket breadth and demand early; the loop strengthens with scale.
2. **Correlated-crisis tail.** Basket diversification holds in normal regimes; in a synchronized global risk-off event currencies correlate and crypto can dip against the *whole* basket briefly. Mitigant: that same dip is the *widest* arbitrage gap, i.e. the strongest designed pull on new demand at the bottom.
3. **Backing-value dip (the only steady-state exposure).** A temporary drop in backing *value in BCH terms* during downturns — never in backing *quantity* or *redeemability*. Compared to fiat's floorless permanent erosion, a floor that dips and recovers is the better risk.
All three are tail/transition concerns, not steady-state structural costs. The steady-state position is: sovereign, hard-backed, exactly redeemable, debasement-proof against its named issuer.
---
## 8. The thesis in one line
FIATμ does not compete with any single currency — it competes with the **failure mode shared by all of them (issuer debasement)**, and it is the only participant in that contest whose backing *strengthens* as its rivals weaken. It keeps fiat's usefulness (a familiar unit to price and transact in) while severing fiat's fatal flaw (an issuer who can debase it), replacing issuer discretion with scarce, consensus-secured backing and a hard redemption floor. The trade it asks in return — BCH volatility instead of issuer trust — is the better deal for anyone who distrusts the issuer more than the market.
---
## Appendix — produced by ASM
- **Native ASM (single-chain):** lock asset + mint unit atomically in one BCH transaction, single-party, condition-enforced by BCH script. No counterparty, no timelock, no foreign verification. This is how FIATμ is minted and redeemed. Airtight.
- **Multi-chain ASM:** backing on chain X, unit on chain Y; trustless only if Y can natively verify X's state (IBC, EVM proof verification). Heavier, narrower applicability. FIATμ does not require it — it is native-ASM.
- **Not ASM (excluded for issuance):** any asset whose home chain cannot enforce single-party condition-based atomic mint/redeem (e.g. BTC). Such assets enter the ecosystem via HTLC direct swap, never as a native-backed FIATμ. (See the DEX architecture doc for the HTLC on/off-ramp vs ASM-mint distinction.)

View file

@ -926,6 +926,40 @@ filter can become asymmetric over time:
The asymmetry is *earned* by adoption (Layer 6) rather than imposed at genesis.
### The asymmetry's projections are simultaneous — not a primary goal with side effects
The asymmetric `d_up / d_down / N_up / N_down` pair is **one immutable rule** whose
consequences are *simultaneous projections*, not a causal chain of "the goal" and
"downstream effects." The same pair simultaneously delivers (all true at once, none derived
from any other):
- **Honest entry pricing for new buyers** — fast catch-up on uptrend means a minter pays
for $1 of face value with the BCH that is currently worth $1, not with BCH stuck at a
stale lower rate. The new buyer's mental accounting is clean: *what I paid is what I got*.
- **A discount window for new buyers during BCH crashes** — slow catch-up on downtrend
opens a favorable mint rate against cheapened BCH; if BCH recovers, the locked sats
appreciate, and the buyer captured the dip via the lag.
- **Non-clawback for existing holders** — rate adjustments **only affect new-mint pricing**.
An existing FIATm unit redeems against the BCH locked at *its* mint, exactly, by the
fixed-rate floor of §4. **The system never touches what users hold; what they earned
belongs to them.**
- **Counterweight A — counter-cyclical arbitrage** — the lag's gap recruits arbitrage that
locks real BCH into FIATm backing during crashes (the catalytic-converter mechanism in
`Parameters/FIATm/catalytic-converter-hypothesis_FOR-testing.md`).
- **Layer-B market shaping** — floor-without-ceiling: BCH downside damped through the
lag-as-shock-absorber, BCH upside unconstrained.
- **Layer-A horizon neutrality** — speculators lose both ways across full cycles; the
mechanism that delivers fairness to honest entrants also denies clean arbitrage to
short-horizon flippers.
**No hierarchy, no primary, no side effects.** Each property is a viewing angle on the same
asymmetric rule. The compact canonical statement is in the companion sovereign-asset design
record `fiatm-sovereign-asset.md` §6: *"single objective, both directions — maximize the
fairness/attractiveness of minting in, in every regime, while never touching the fixed
redemption floor existing holders rely on. Speed up to prevent overpricing; lag to create
discount."* Reading any single projection as "the design goal" and demoting the others to
"emergent consequences" introduces a causal hierarchy that isn't present in the mechanism.
### The arbitrage-during-lag self-correction (third-order benefit)
The damped lag creates a structural feedback loop that stabilizes BCH price itself:

View file

@ -12,8 +12,9 @@
> document is allowed to project; *this* document describes mechanism and stays inside the
> corpus discipline (*"enthusiasm attaches to the math model, not predicted market outcomes"*).
>
> **Date:** 2026-06-15 (FIATm synthesis, post snapshot 0163).
> **Date:** 2026-06-15 (FIATm synthesis, post snapshot 0163); refreshed 2026-06-20 (sovereign-asset framing + simultaneity).
> **Companion files in this folder:**
> - `fiatm-sovereign-asset.md` — **NEW (2026-06-20)** sovereign-asset design record: asset taxonomy (sovereign-native MBA vs cross-chain IOU), gold-certificate-collapse-inverted thesis, reverse-lock (scarcity is locked, fiat is only projected face), "unstablecoin" framing with three-honest-outcomes table, reflexive volatility properties (backing demand + basket diversification + stablecoins-as-tailwind), §6 controller-simultaneity canonical statement. Complements rather than supersedes the design record below.
> - `fiatm_complete-design_FOR-design-record.md` — the canonical design record (§0–§22 + appendices).
> - `catalytic-converter-hypothesis_FOR-testing.md` — the labelled hypothesis with structural elaboration.
> - `usdm_sound-money-note_FOR-design-record.md` — the original USDm note (absorbed into the design record; retained as historical artefact).
@ -434,6 +435,37 @@ The asymptotic end-state suggested in the design (`N_down = 21, N_up = 1, d_down
reached, the controller is structurally locked into favoring hold-and-mint over redeem-and-
sell** — irrespective of what subsequent 2-week DART signals would otherwise suggest.
### Simultaneity — one mechanism, many projections
The asymmetric `d / N` pair is **one immutable rule with simultaneous projections**, not a
primary goal with downstream side-effects. The same pair simultaneously delivers:
- **Honest entry pricing for new buyers** — fast catch-up on uptrend prevents minters from
paying $2-worth of BCH for a $1-face-value note during a rally; the rate that prices the
mint always matches the current substrate value.
- **A discount window for new buyers during BCH crashes** — slow catch-up on downtrend opens
a still-favorable mint rate against cheapened BCH; if BCH recovers, the locked sats
appreciate against the face value the user already paid for.
- **Non-clawback for existing holders** — rate adjustments **only affect new-mint pricing**.
Existing units redeem against the BCH locked at *their* mint, exactly, at the *fixed* mint
rate. **What users earned is theirs — the system never touches what users hold.** (§4 of
`fiatm-sovereign-asset.md`; the redemption-floor / no-liquidation property.)
- **Counterweight A — arbitrage** — the lag opens a gap; arbitrageurs close it by minting at
the lagged rate, recruiting BCH demand counter-cyclically.
- **Layer-B market shaping** — floor-without-ceiling: BCH downside damped, BCH upside
unconstrained (per [`bchm-time-horizon-not-direction`](../../../C:/Users/valer/.claude/projects/D--Dev-Deviant/memory/bchm-time-horizon-not-direction.md)).
- **Layer-A horizon neutrality** — speculators lose both ways across full cycles; the design
doesn't *target* them, but the mechanism that delivers fairness to honest entrants also
denies a clean arbitrage to short-horizon flippers.
**No hierarchy, no primary, no side effects.** Each property is a viewing angle on the same
asymmetric rule. The canonical compact statement is in `fiatm-sovereign-asset.md` §6:
*"single objective, both directions — maximize the fairness/attractiveness of minting in,
in every regime, while never touching the fixed redemption floor existing holders rely on.
Speed up to prevent overpricing; lag to create discount."* Reading any single projection as
"the goal" and demoting the others to "consequences" smuggles in a causal chain that isn't
there.
**Open simulator-vs-design reconciliation** (carried as outstanding work in snapshot 0163):
`sim-usdm-controller.mjs` has `N_CEILING = 144` (the simulator's hard ceiling), while the
design record's §12a.2 catalyst table reaches `N_down = 21` at 20+ catalysts and calls that
@ -738,6 +770,12 @@ What is and is not a structural claim:
### Confirmed (chipnet or back-test)
- **Sovereign-vs-IOU asset taxonomy** (sovereign-native MBA distinct from cross-chain or
trusted-third-party IOU by virtue of: same-chain backing location, no foreign verification
path, atomic redemption against the unit's own locked BCH) — design-record landing
`fiatm-sovereign-asset.md` §1 / §2 (2026-06-20). The taxonomy is the precise structural
reading of §0.5 properties 2–6 from the design record (base-layer backed, atomically
swappable, no liquidation, no over-collateralization).
- Universal `DeviantOracleMBA` covenant (one template, 7 currencies, no fork) — snapshots
0136, 0137, 0138, 0144, 0157, 0160.
- Atomic cross-asset swap inside the family — 0137 (USDm↔EURm); 0138 (6-asset market, 111
@ -752,6 +790,16 @@ What is and is not a structural claim:
0158.
- Holder × cash spread tracks fiat collapse — snapshot 0159 (USDm 2×; TRYm 25×; ARSm 158×).
- Bargain-window frequency ~25-30% across USDm/TRYm/ARSm — snapshot 0160 trajectory sim.
- **Real-data empirical run (Nov 2019 → Jun 2026 via Binance + CoinGecko)** — snapshot
0169. Confirms: controller adapts through real cycles as designed (54 catalysts fired,
N_down hit ceiling, d's saturated); the §7b *lag-as-catch-up* property is empirically
the stronger reading than *early-adopter advantage* (Nov-2019 early-adopter: −1.2% flat;
Dec-2022 bargain-hunter at cycle low: **+106%**). The §20a snapshot-0148 *"early adopter
$100 → $207"* result was Aug-2017-specific; the structurally important property is
bargain-window entry, not vintage age. See also: empirical confirmation that the
simulator's `N_CEILING = 144` is the operating asymptote (not a backstop past the
design's suggested `N_down = 21`) — sharpens the simulator-vs-design reconciliation
task.
### Hypothesis-stage (Stage-1 tested, Stage-2 pending)
@ -781,6 +829,10 @@ What is and is not a structural claim:
## 18. Corpus cross-references
**Inside this folder (`Parameters/FIATm/`):**
- `fiatm-sovereign-asset.md` — **NEW (2026-06-20)** sovereign-asset design record: asset
taxonomy (sovereign-native MBA vs cross-chain IOU), reverse-lock framing, gold-certificate-
collapse-inverted thesis, "unstablecoin" framing with three-honest-outcomes table, §6
controller-simultaneity canonical statement, §5 reflexive volatility properties.
- `fiatm_complete-design_FOR-design-record.md` — full design record (§0–§22 + appendices A, B).
- `catalytic-converter-hypothesis_FOR-testing.md` — labelled hypothesis with structural elaboration.
- `usdm_sound-money-note_FOR-design-record.md` — absorbed USDm note (historical artefact).

View file

@ -36,8 +36,9 @@ foundation it reuses. *Updated this session.*
| Item | Status | Evidence | Description |
|---|---|---|---|
| **① Rewards / loyalty coin** | ✅ engine / 📐 packaging | B above | DEA (unlimited) + reward-for-holding payout. Engine proven; not yet wrapped as one product genesis/config |
| **② Appreciating asset + dividends** | 📐 | design record Part VI | Capped/scarce share + dividends (reuses both covenants) + appreciation (market-premium **or** DRA+reserve). Not built |
| **① Rewards / loyalty coin** | ✅ **end-to-end** | `scripts/chipnet-product1-rewards-coin.mjs` (genesis `1db25717…`) | Coin claim → fee → **consensus-locked vault** → oracle pays holders **∝ holdings**: C 6u→17,400 ✓, D 4u→11,600 ✓ (ratio 1.5 == 6:4). Company never touched the pool |
| **② Shares + dividends** | 📐 | design record Part VI | Capped/scarce share + dividend ∝ shares + redeemable floor; appreciation (market-premium **or** DRA+reserve). Not built |
| **③ T-bond** | 📐 | design record §"dividend horizon" | Floor + coupon that **expires after term T** (CLTV maturity gate), then floor-only redemption. Not built |
## D. Payout hardening (designed, not built)