# Orb documentation - current testnet release

Updated October 13, 2026. Orb Web3 runs at https://joinorb.online, independently of the normal Orbita service/database. That origin serves the **October 13 build**: the Open Ledger with its public demo community anchored on chain, the voice stage, `/developers`, `/proofs`, `/independent`, the metered assistant and the wallet transfer fix are live there, and the served whitepaper PDF and contract manifests match this tree byte for byte. `orb.168-138-150-148.sslip.io` still answers, but Orb now names `https://joinorb.online` as its canonical origin, so a visitor on the old name can read pages while the origin check refuses their writes; every submission link points at the domain. Network for spending, trading and games: Monad testnet 10143. Test tokens have no promised value. No mainnet launch or token sale is enabled.

Every document in this folder is English, so the judging panel and outside contributors can read it; `npm run check:docs:language` fails on a Markdown file that drifts back into Portuguese. The app interface remains multilingual. `npm run docs:sync` mirrors these files into `public/docs/`.

## Start here

- [Scalable encrypted archive](orb-chat-scale.md): October 4 local integration,
  replicated raw CID blocks, testnet paged index, resumable source, leased workers,
  shared epoch keys and measured fixture scope. Offsite production setup remains.

- [Portable chat and encrypted archives](orb-portable-chat.md): October 3 local UI,
  independent wallet recovery, full ciphertext on public Monad testnet, operator
  keeper and explicit boundaries. Real Privy acceptance remains pending.

- [October 2 candidate validation](orb-release-candidate-2026-10-02.md): fresh full
  offline/browser gates, production HTTP results and the remaining real-account work.
- [Funded testnet contract rehearsal](orb-testnet-rehearsal-2026-10-02.md): 16 public
  transactions, mission reward and separate demo swaps; standalone EOA wallets,
  with real Privy acceptance still pending.
- [Metropolis submission checklist](orb-submission-checklist.md): prioritized
  English worklist, public-source/demo requirements and real-account gates.
- [Submission text](orb-submission-text.md): the description, the Monad integration, how to test and the honest limits,
  cut into the pieces a submission form asks for.
- [Community portability](orb-community-portability.md): connect the independent
  public identity in normal community settings, with hosted-owner and wallet checks.
- [Complete contribution rehearsal](orb-hackathon-rehearsal.md): real-account
  checklist for mission, event, approval, withdrawal and independent verification.
- [Independent communities and capsules](orb-independent-communities.md): public
  owner-signed blueprints, IPFS export, current onchain verification, independent
  client ZIP and RPC choice. New local changes; hosted chats are not migrated.

- [Product claims and acceptance](orb-product-claims.md): honest submission wording,
  local journey improvements and the real-account evidence still needed.
- [Product loop and pilot](orb-product-loop.md): concrete reasons to return, revenue hypotheses and flagship demo.
- [Community sessions](orb-community-sessions.md): member-only schedules, RSVP, calendar and mission links.
- [Social receipts and follows](orb-social-receipts.md): owned onchain Spot receipts and a Following feed.
- [Tips on feed posts](orb-tips.md): opt-in MON tips, wallet to wallet, counted only after the chain confirms them.
- [Bringing a Discord community into Orb](orb-discord-import.md): DiscordChatExporter JSON becomes read-only channels, then can be saved on Monad.
- [Open Ledger](orb-ledger.md) and [judge mode](orb-judge-guide.md): a community's history on Monad, readable by anyone, and a five-minute path through Orb.

- [Independence audit and result](orb-independence.md): what survives losing the domain, API, database and VPS, and what does not.
- [Archive protocol v2](orb-archive-protocol.md): the format another client is meant to be written against.
- [Self-hosting](orb-self-hosting.md): host the client, host a replica, and where live-community continuity stops.

- [Product and deployment](orb-hackathon.md): current architecture and setup.
- [Whitepaper v0.6](orb-whitepaper.en.md): product, business, token allocation, vesting, Council and the metered assistant. `npm run whitepaper:build` regenerates the published PDF from this Markdown, one page per section.
- [Wallet](orb-wallet.md): Privy account binding, reviewed signing and recovery.
- [NFT avatars](orb-nft-avatars.md): ownership checks, profile binding and listing limits.
- [Token / Holder Pro](orb-token-testnet.md): deployed supply, utilities and treasury limits.
- [Council](orb-council.md): proposal, weighted vote, team decision and refundable stakes.
- [Build an Orb bot](orb-bot-developer-guide.md): the five-minute path, events by fetching or webhook, commands, limits and how to share an app; the same guide is at `/developers`.
- [Orb applications (bots)](orb-bots.md): the design record - the two gates, roles, voice, the passport and verification.
- [The Orb Bot Registry](orb-bot-registry.md): a public record on Monad testnet of who wrote an app, what a community accepted and an optional one-time price.
- [Missions](orb-community-missions.md): prefunded contributions and sponsor review.
- [Assistant](orb-assistant.md) and [testnet venues](orb-testnet.md): Perpl, Kuru Spot and alert-only monitoring.
- [Security release gate](orb-security-release.md), [chat encryption](orb-e2ee.md) and [Passport](orb-attestation-passport.md): explicit trust boundaries.
- [Two-person rehearsal](orb-two-person-demo.md) and [Arena demo](arena-demo-readiness.md): acceptance evidence still needed with real accounts.

## Implementation status

| Area | Current behavior | Limit |
| --- | --- | --- |
| Login / Orb Wallet | Privy creates or links a non-imported embedded wallet; external login identity remains optional | Wallet recovery/MFA may require interaction; never use the external wallet as an automatic spending fallback |
| Reviewed wallet actions | Orb presents the action; Privy signs supported embedded-wallet calls without a duplicate transaction popup | No unrestricted background/server signer; uncertain submissions block retries |
| ORB | Fixed 100M testnet ERC-20, allocation vaults, 100 ORB faucet and Holder Pro | Faucet is bounded, not Sybil-proof; no trading pool or mainnet asset |
| Holder Pro | Owner locks 100 ORB for 30 days; organizer metrics/report export | Customization, managed-bot quotas and paid subscriptions are proposals |
| Council (v2) | Escrowed votes whose voice is the square root of the ORB locked, quorum, anti-sniping, withdraw-before-the-first-vote, a spam flag and a mandatory public team decision | Not one-person-one-vote (splitting ORB across wallets adds voice); cannot execute code or spend treasury funds |
| Sessions / social | Accessible voice-room schedules, RSVP, calendar, follows and verified Spot receipt posts | Schedules and discovery remain hosted; related mission links are organizer suggestions |
| Missions | ORB-funded tasks, sponsor review, inline participant withdrawal, event links and independent public payout verification; 5% testnet service fee | Approval is subjective; mission results do not automatically raise Passport scores; new journey changes are local |
| Assistant | OpenRouter inference, market reads, alert-only watchers and reviewed Perpl/Spot drafts; five free conversations per wallet per day (a review covers up to 12 messages), then an active Holder Pro licence | Provider availability varies; a licence that cannot be read onchain counts as absent, so the review is refused with 402 rather than served free |
| Trading | Perpl perpetuals and Kuru MON/USDC Spot on testnet | Acknowledgement is not a fill; liquidity, venue availability and initial Perpl authorization remain dependencies |
| Alerts | Installed Oracle monitor batches public Perpl prices; no signing key | Alerts notify only; they do not execute an order |
| Arena | New practice Control v4; legacy deployed Community League and Trading Sprint | Separate onchain v4 artifacts tested locally, not deployed in this review; game gas/receipt timings are not TPS measurements |
| Passport | Commitments, Merkle proofs and verified evidence gates | Attestor chooses events; metadata can be public; plaintext messages are not placed onchain |
| Communication | Backend chat and configured LiveKit media server | New community messages are plaintext; new DM text uses E2EE; attachments/media are outside that chat encryption |
| New portable chat | Separate encrypted onchain inbox and opt-in personal text archive; chain-stored sealed key backup; independent reader and scoped keeper | Historical copies do not migrate live rights or prove others' authorship; six-hour preparation needs the visible unlocked client; new UI is local; Privy acceptance and cryptographic audit pending |
| Bots / music | Scoped application API (messages, voice, the room player, the passport), commands, webhooks or a fetched event queue, a JavaScript SDK, private/unlisted/public listings with invite links, a conditional LiveKit grant, a synchronized room player | No user-wallet permissions, hosted-code execution or YouTube audio extraction; events for apps that fetch are kept for a day (at most 500) |
| Bot Registry | Optional public record on Monad testnet: who signed an app, a hash of its manifest, the scopes a community accepted and a one-time price (95% to the developer, 5% fee) that Orb requires before it installs a priced app | Testnet token with no value; a record is not a review; the contract cannot pause, upgrade or take back an app |
| Revenue | Private pilot-interest requests and testnet mission fee | No active fiat checkout, AI execution fee, buyback or token-holder revenue share |
| Independent verification | Static contract/Passport viewers and export tools | RPC availability is still necessary; permanent IPFS pinning is not configured |
| New local independent tools | Signed community capsule JSON/CAR, normal-profile identity association with dual-owner checks, current owner/CID checks, ORB contribution/withdrawal verifier, static client ZIP, offline signature checks and RPC selection | Separate public registry; public templates only. Operators must pin files; hosted chats/media remain hosted. Withdrawal can combine mission credits and refunds |
| New local journey | Community-first Home, account-scoped private draft continuity, My activity and `/proofs` | Local changes in this review; tab memory is not full venue history or durable chat storage |
| Open Ledger | Private (sealed) or public text history of a community on Monad; reader with integrity checks; shareable link and a "Saved on Monad" chip | The operator's keeper reads text before sealing it; deletion does not erase earlier entries; a long history reaches the chain at a daily allowance |
| Tips | Opt-in MON tips on feed posts, wallet to wallet, counted after the server reads the transfer back from the chain | Testnet tokens; no custody, subscriptions or refunds |
| Discord import | DiscordChatExporter JSON becomes read-only channels, with authors, times and replies; the ledger can then save it | The chain proves what was saved, not that it was said on Discord; one platform only |
| NFT avatars | ERC-721 manual selection, profile-bound Privy checks, ownership at application, bounded metadata/image reads | Automatic listing needs an indexer; avatar images are not continuous ownership proofs |

## Public evidence

- [ORB contracts](https://joinorb.online/token/deployment.monad-testnet.json)
- [Council contract](https://joinorb.online/token/council.deployment.monad-testnet.json)
- [Mission contract](https://joinorb.online/token/missions.deployment.monad-testnet.json)
- [Bot Registry contract](https://joinorb.online/bots/registry.deployment.monad-testnet.json)
- [English PDF](https://joinorb.online/whitepaper/Orb-Whitepaper.pdf) — the live origin serves the same file this repository builds (verified by hash on October 13, 2026)

The release publishes contract artifacts and standard compiler inputs. Exact-runtime checks and local tests are not an independent audit or proof that a real Privy two-device journey passed. Some documents retain clearly labeled historical/design sections; they are not current deployment instructions. No source of truth for operator secrets belongs in this documentation.