# ORB testnet release

> Current status reviewed September 29, 2026. See [the release index](README.md) for shipped versus planned features, network, wallet signing and deployment boundaries. Older dated experiments below are retained as history.

Network: Monad testnet (10143). Root token: `0x439D1DA1a1A1cf438EcDABbb29c1412E7250a9F0`.
The public deployment manifest is `/token/deployment.monad-testnet.json`. Compilation input, artifacts and source are published with the release. Runtime checks compare exact compiled bytecode; this does not mean an independent audit or explorer source verification was completed.

## Uses shipped

- Orb Wallet includes ORB balance and outgoing transfers, using the existing reviewed transfer flow. It does not invent a trading price or Kuru pool.
- Faucet: 100 ORB once per wallet, funded with 100,000 ORB from the contributor allocation. No further minting. Wallets are not unique humans; the public test faucet is deliberately bounded.
- Holder Pro: 100 ORB locked for 30 days per community. Organizer metrics and JSON reports are available only to the current community owner and their verified, account-bound Orb Wallet. An active licence also covers assistant AI reviews past the free daily allowance — for the licence holder and for members of that community — and the server fails closed when the licence cannot be read. It also quadruples the daily write allowance of the community's Open Ledger (see [Open Ledger](orb-ledger.md)); a licence the keeper cannot read leaves the base allowance. The server reads the exact license contract and fails closed on RPC failure, expiry or ownership changes. Holdings cannot grant moderation or improve Passport scores.
- Recovery: the original wallet can retrieve an expired lock using its public community key even if community ownership changes. A lock cannot withdraw someone else's stake. Additional users are not required to buy tokens to chat or play.
- Missions: ORB-prefunded contribution tasks, sponsor review, participant-owned reward credits, disclosed 5% fee, and unused-budget refund after the review window. Approval is for the exact reviewed budget and consumed by funding. Native MON mode remains tested for existing deployments; this release configures ORB mode.

- Council (v2): token-weighted public roadmap proposals whose voice grows with the square root of the ORB locked, quorum and mandatory Orb-team approval. Bonds and stakes are refundable after voting closes, independent of the team response. It has no treasury execution power; see orb-council.md.

## Allocation controls

100M fixed supply: 30M contributors, 20M ecosystem, 20M founder/team, 20M treasury, 10M liquidity reserve. The liquidity reserve is not a deployed trading pool. The team receives no spendable allocation before the vesting schedule: twelve months without release, then 36 complete monthly installments. A contract month is 365 days / 12; the rounding remainder releases by month 48.

Contributor vault: 1M available per quarter during year one, up to 4M; 100,000 of the initial budget funds the faucet. Ecosystem and treasury: 2M each available in year one. After year one, these remaining non-team budgets become operator-controlled. Allocations remain in separately identified vaults, but this testnet pilot has one operator/beneficiary controlled by the existing testnet deployer, not independent treasury signers. No mainnet token, revenue share, buyback or price promise is created.

## Wallet boundaries

Spending uses the non-imported Privy embedded Orb Wallet only. Chain and runtime are checked; holder approvals are exactly 100 ORB, old mismatched allowances are revoked before replacement. Calls are simulated, test MON gas is checked, and the gas ceiling is 0.05 MON for token actions. The reviewed action in Orb remains explicit. Privy signs supported embedded-wallet calls without a duplicate transaction popup; authentication/MFA/recovery may still require interaction. Holder Pro activation completes exact allowance replacement and locking from one reviewed action. Per-wallet browser locks prevent simultaneous token actions; submitted and uncertain confirmations persist across reloads and must be resolved before another action.

Community authorization is separate from the public lock: locking for someone else's community produces no entitlement. Server metrics contain counts only, with no message content, personal data or signing keys. Account isolation, current ownership, bound-wallet checks, expiry and wrong-chain/runtime failures have dedicated tests.

## Verification

`npm run token:test`, `npm run token:test:ui`, `npm run missions:test`, `npm run missions:test:ui`, `npm run business:test`, existing wallet transfer tests, TypeScript and production build. UI tests use simulated Privy callbacks and real local EVM transactions; they do not substitute for a rehearsal with two real Privy accounts.

Deployment scripts default to a dry run and publish only with `--publish`. Signed deployment intents are private files under ignored `work/`, persisted before broadcast to resume the same transaction after a timeout. No deployer key belongs in a website release or Git.

The Oracle release was built and checked before switching the active symlink. A consistent SQLite backup and the previous private environment were retained for rollback. `esbuild` is a runtime dependency because the separate price monitor compiles its entrypoint on startup; production pruning must retain it. Shared dependency builds can set the private `ORB_BUILD_ROOT` build variable to their common absolute parent. Public HTTP, exact contract runtimes, the published PDF checksum and desktop/mobile browser checks passed after activation; Orb, its monitor, Orbita and LiveKit were all running.