# Independent communities and public capsules October 2, 2026 — new capsule, RPC picker and downloadable kit changes are local, not a new Oracle release. All wallet actions remain on Monad testnet 10143. The useful promise is an exit path: a community can keep its public description, onchain authority and independent tools outside Orb's web host. This is not a migration of the hosted chat database or a claim that all of Orb is decentralized. ## What works Open a normal community's **Community profile** → **Your community, beyond this site** to create or connect its independent public identity. Linking requires both current hosted ownership and a verified, account-bound Orb Wallet that currently owns the onchain identity. Members can inspect the capsule and download the client. This association changes no chat permissions or memberships. See [community portability](orb-community-portability.md) for failure/recovery cases. Alternatively open `/proofs` → **Create or verify a capsule**, or `/independent` directly. The independent registry already supports wallet-controlled communities, entry policies, two-step ownership transfer, scoped game sessions and native-MON mission escrow. Its public registry is separate from hosted Orb community IDs and the ORB mission product. Normal settings now associate those two identity records after owner checks; private channel rights are not copied or enforced by the capsule. The new **ORB contributions** tab reads the regular ORB mission product without Orb API or login. It checks exact mission/token runtimes and sponsor decisions at a displayed block. Optional withdrawal hashes must match the selected wallet, successful receipt, exact `withdraw()` call and `Withdrawn` event. Deep links bind the expected contract; a numeric mission ID alone is not a global identity. Withdrawals can combine credits/refunds from multiple missions. **MON escrow** is the older, separate native-token product, not a duplicate name for ORB missions. For an independent community owner: 1. Connect its EOA wallet on testnet 10143 and select the community. 2. Choose only a public description, public HTTPS links and channel templates. Sign the explicit `Orb public community capsule v1` document. It is not a transaction or spending authorization. The registered name cannot be changed through this document. 3. Download its canonical JSON and IPFS CAR. Import/pin the CAR with independently operated nodes or a provider you choose. Keep the JSON as a local backup. 4. Review `setMetadata(communityId, ipfs://CID)` with your wallet. The contract allows only the current owner to update this reference. Pinning acknowledgement in the UI is the owner's declaration, not a remote availability guarantee. Kubo node commands, with the generated CID/filename: ```sh ipfs dag import .car ipfs pin add ``` Readers can load the onchain URI through either offered IPFS gateway or import the saved JSON. The client checks the strict public schema, network/domain, EOA signature and canonical content ID. Gateway responses are bounded to 16 KB and must match the exact committed bytes. React renders text; links must be HTTPS. With a working RPC, it also checks network 10143, exact registry bytecode, the registered name, current owner and metadata URI at a displayed block/hash. A previous owner's signature stays a valid historical signature but fails current ownership verification. A new metadata URI invalidates the previous document's current status. **Recheck onchain** refreshes the result; it is not a live monitor. If RPC verification is unavailable, JSON signatures/CIDs still work, and the UI explicitly says current ownership has not been checked. No wallet/login is needed for reading. This is not a cryptographic Ethereum state-proof/light-client check: the reader still trusts its RPC for chain responses. ## Host the client yourself Download `/independent/orb-independent.zip`. The kit includes allowlisted public client/config/artifact/helper/license files and lazy SDK chunks listed in its manifest. The builder never archives the checkout, environment, database or SSH keys. ```sh node verify-client.mjs node serve.mjs ``` Open `http://127.0.0.1:8080`, or serve the entire extracted folder from any HTTPS static host/path. Use correct JavaScript/WASM MIME types and worker support. `file://` is unsupported. The embedded Orb Wallet is available through the main app; the standalone kit uses a browser wallet. Wallet recovery/export remains the wallet provider's responsibility. No user private key belongs in this archive. The main bundle, deployment, artifacts, XMTP workers and WASM resolve relative to the downloaded client, rather than a hardcoded Orb host or `/independent/` path. No Orb API is used for contract reads/writes, capsule verification or XMTP dev messages. The legacy optional Orb pinning button is not needed for these features. `client.sha256` checks the ZIP, and `verify-client.mjs` checks each file against `bundle-manifest.json`. Checksums detect changes relative to a trusted copy, not publisher identity. Compare against a trusted release/source before wallet use. The provided local server binds to loopback and serves only public manifest files. It is a preview helper, not a production internet server. You can choose another HTTPS RPC in the UI. This setting remains in tab memory, not URL parameters, storage or exported files. Switching clears the editor and checks chain/bytecode again. Never enter a credential meant to remain server-only. Local HTTP RPCs are allowed only for a localhost-hosted client/test fixture. ## Honest remaining dependencies | Part | Who remains necessary | | --- | --- | | Contract state and execution | Monad validators, RPC availability and the connected wallet | | Capsule availability | IPFS nodes/operators that actually retain the file | | Wallet messages | Separate XMTP dev network; explicit wallet identity signing | | Existing community chats/feed/voice/media | Orb's hosted services and configured LiveKit transport | | Main-app login and embedded-wallet recovery | Privy | | Passport events | Orb attestor for original event selection, then independent commitment checks | The XMTP browser database is not encrypted at rest; it is separate from Orb DM history. Production XMTP requires gateway/fee configuration. No automatic group chat migration or onchain-message publication was added. Channel blueprints are public descriptive templates, not enforced permission rules or a ready restored chat server. EOA signatures are supported here, not ERC-1271 smart-wallet signatures. ## Verification - `node scripts/test-community-capsule.mjs`: real local Solidity registry, signature/domain tampering, privacy/schema projection, complete CAR, bounded gateways, current-owner anchoring and ownership-change invalidation. - `node scripts/test-independent-kit.mjs`: independent ZIP/CRC extraction, exact public allowlist, checksums, altered-file refusal, safe assets/RPC URLs and arbitrary-folder hosting. This test uses Python's standard `zipfile` decoder. - `node scripts/test-community-capsule-ui.mjs`: actual relocated static bundle, Orb API unavailable, owner wallet fixture, metadata transaction, independent reader without login/wallet, EN/PT/mobile, offline signature verification, wrong-chain RPC refusal and relocated XMTP worker loading. - `node scripts/test-community-portability.mjs`: actual authenticated routes, dual-owner checks, foreign wallets, duplicate identities, invalidation after ownership changes and no hosted permission changes. The `--ui` variant exercises the ordinary community profile with simulated Privy signing, EN/PT and mobile. - `node scripts/test-missions-orb-ui.mjs`: sponsor/contributor local EVM journey, inline withdrawal and the actual independent client with Orb API blocked; forged receipts and the wrong wallet are refused. These tests do not prove IPFS replication, production XMTP delivery, actual public wallet signing or a new public deployment. No real user funds are spent. Local verification on October 2 passed the three new capsule/kit/browser tests, existing open-community and portable-content tests, proof-center EN/PT/responsive browser checks, production security/header checks, the app responsive check, TypeScript and the Next production build. The isolated HTTP runner now retries a short SQLite lock during its disposable rate-limit reset; application limits were not changed. This is targeted evidence, not a claim that every integration was retested with real accounts or that the new build is live. References: [IPFS persistence](https://docs.ipfs.tech/concepts/persistence/), [Kubo CAR import](https://docs.ipfs.tech/reference/kubo/cli/#ipfs-dag-import), [XMTP client and browser storage](https://docs.xmtp.org/chat-apps/core-messaging/create-a-client). ## October 3: encrypted archive addendum The local **Portable chat** tab adds a separate wallet-bound encrypted history archive and inbox on Monad testnet. Confirmed personal copies of readable text and community/channel names can be recovered with the same wallet in another client, without the Orb API. They do not migrate live permissions or certify copied authorship. The original hosted history and keys are preserved. The static client includes optional lazy Privy login using the original app on an authorized origin; Privy provider dependencies and signing/MFA remain. See [portable chat](orb-portable-chat.md) for actual testnet receipts, six-hour scope, the keeper, privacy and real-account acceptance still pending. The new Oracle UI has not been deployed by this iteration.