# Orb Council > Current status reviewed October 10, 2026. See [the release index](README.md) for shipped versus planned features, network, wallet signing and deployment boundaries. Older dated experiments below are retained as history. Monad testnet roadmap governance at /?view=council and /council. The deployed contract and the founding team administrator are in /token/council.deployment.monad-testnet.json. The contract is immutable, with no treasury access, arbitrary call, upgrade or admin withdrawal. **Version 2 (October 10, 2026).** The first Council (`0xDA0FC8B2…fbc7`) was replaced before a single proposal had been made, because its tally had a hole: it capped the largest wallet at the *sum of everyone else's stake*, which still let a large wallet plus one 1-ORB friend outvote an entire opposition. The replacement changes how a voice is counted, closes the last-block advantage, lets an author take back a mistake and gives the team a way to mark spam. The old address and its deployment hash stay in the manifest under `replaces`. ## The decision path 1. Publish a public title, problem, solution and acceptance criteria, and pick a topic (general, trade channel, assistant, arena, council, bots and apps, wallet and ORB, other). A proposal escrows a refundable 10 ORB anti-spam bond. The contract accepts a voting window from **10 minutes** (so a demo can see a whole cycle) to 7 days; the screen offers 10 minutes, 1 hour, 1 day, 3 days and 7 days. 2. Each wallet votes once, for or against, with at least **5 ORB**. The exact amount is escrowed until the vote closes; the vote cannot be changed. 3. **Quorum** needs at least 3 wallets and 100 ORB of raw stake. A proposal passes when the voice for strictly exceeds the voice against; a tie fails. 4. An authorized team wallet assesses feasibility, security, scope and product fit after the vote closes. Approval requires a passed vote. Approval or rejection stores a public reason of 10-600 bytes and the reviewer address; the decision cannot be overwritten. 5. A team member may record one public HTTPS delivery/release link on an approved item. Approval itself does not deploy or execute code and is not a delivery guarantee. ## How a voice is counted A wallet's **voice is the square root of the ORB it locks**: 25 ORB is a voice of 5, 100 ORB is 10, 400 ORB is 20. Four times the ORB buys twice the voice. The tally keeps two numbers per side, the raw stake and the summed voice, and the contract decides with the voice. Why not the old rule: with a cap at the sum of everyone else's stake, 1,000 ORB plus a 5 ORB ally beat any opposition worth less than about 1,005 ORB in total, however many people it was spread across. Under square-root voice the same two wallets are worth about 33.9, and seven wallets locking 50 ORB each are worth about 49.5, so the broad opposition wins. The contract test (`scripts/test-orb-council.mjs`) replays exactly that vote. What it does **not** do: it is per wallet, not per person. A holder who splits tokens across wallets adds voice (ten wallets of 10 ORB are worth 31.6, one wallet of 100 ORB is worth 10), and an unopposed proposal can still meet quorum with three wallets. That is why team review stays mandatory and why this is described as advisory roadmap voting, not as a DAO. ## Anti-sniping A vote that **flips which side is ahead** while fewer than ten minutes remain moves the deadline to ten minutes after that vote. This can happen at most three times per proposal. A vote inside the window that does not change the result changes nothing. The effect: nobody wins on the last block with no time left for a reply, and a proposal can run at most 30 minutes past its original deadline. ## Withdrawing and flagging - The **author can withdraw** a proposal nobody has voted on yet and gets the bond back at once. Once anyone has voted it is no longer withdrawable. - The **team can flag** a proposal as spam or unsafe, and lift the flag. A flag is a public marker the screen honours (the text stays readable behind a warning). It moves no funds, erases nothing and does not change the vote. ## Getting ORB back After the vote closes, voters reclaim their own stake and authors reclaim their bond, whether the vote passed, failed, was rejected or is still waiting for the team. Withdrawals are pull payments protected against reentrancy. There is no fee on the stake/bond; network gas remains payable in test MON. Withdrawal does not change the finalized tally. ## From idea to funded work An approved proposal links to the mission form with its title written in (`/?view=missions&brief=…&source=council-`). A sponsor reviews the brief, sets the reward and signs the mission from their own wallet; nothing is created or sent by the link itself. Missions carry their own disclosed 5% service fee on approved work, which is how an approved idea becomes paid work without the Council holding any funds. ## Authority and wallet safety The founding team administrator is the existing testnet operator. Only that address can add/revoke other reviewer addresses; it cannot revoke itself. Reviewer authority is limited to Council decisions, delivery links and spam flags, not funds or account administration. This is single-operator testnet administration, not a multisig DAO. The client verifies chain, exact token/Council runtime and contract bindings before actions (the runtime check blanks the bytes of `immutable` values and then reads those values back through the contract's getters). Proposal/vote funding uses an exact allowance; a mismatched old allowance is revoked before replacement. Requests are prechecked, then simulated again before signing, with a 0.05 test MON fee ceiling per transaction. Reviewed embedded-wallet calls hide the duplicate Privy popup; they do not bypass login, recovery or MFA. A Web Lock holds the full approval/action sequence for a wallet; uncertain submissions survive reload and block retries until reconciled. Text, addresses, votes and decisions are public and permanent. The composer explicitly asks for consent; it never copies private chat text. Do not publish personal information or secrets. Malicious/spam proposals still need moderation; the refundable bond is friction, not complete prevention. ## Speed A screen needs the proposals, the viewer's vote on each, the tallies, the chain's clock and the viewer's ORB balance and allowance. `snapshot(address, offset)` returns all of it in **one call**, and the deployment is verified once per page instead of once per refresh, so a refresh is a single read (it used to be about ten reads over four sequential round trips). The screen shows a skeleton while that first read is in flight rather than an empty state, refreshes every eight seconds while visible, and measures deadlines against the chain's own clock. ## Validation and deployment Run npm run council:compile, npm run council:test and npm run council:test:ui. Contract tests exercise the voice math, the whale-plus-friend case, ties, quorum, anti-sniping (flip, no flip, the cap), cancel, flag, team authority and revocation, delivery, refunds, pagination and the snapshot. Browser tests use real local-EVM transactions with distinct simulated Privy wallets; they do not certify real Privy authentication or mainnet safety. Deployment defaults to npm run council:deploy:check; npm run council:deploy:testnet publishes only on chain 10143. It verifies ORB, persists the signed intent privately under ignored work/ before broadcast, resumes the same hash and publishes only public manifest fields. Never ship the deployer key or signed pending intent. Contract source: contracts/OrbCouncil.sol. Standard compiler input: /token/OrbCouncil.standard-input.json.