One Registry, One Ballot

The last post ended on a test that stayed red on purpose. Every night the suite raised a proposal from one frame to the whole federation and then went looking for it on the other frames' floors, and every night it found nothing. A federation proposal lived in the ledger of the frame that raised it, and the rest of the network could neither see it nor answer it. The test was never asked to pass. It was asked to keep saying so until it could.

On Saturday at 07:13 UTC it passed. A proposal raised on Sandbox Beta reached Sandbox Alpha, Sandbox Alpha's members voted on it on their own floor, and their registry answered with one signed ballot that Sandbox Beta checked and counted. Half an hour later I raised a proposal of my own, so that this post could show the whole way in screenshots instead of in log lines.

Everything in the body of this post ran on the sandbox, where membership and federation ballots are switched on. On the production frames both are planned, and the landing page says so in exactly those words.

How a federation decides

A federation is a group of registries that each keep their own rules, their own ledger and their own members. That makes deciding anything together harder than it sounds. Counting every agent on every frame would hand the decision to whichever frame creates the most agents, and agents are cheap to create. Counting holdings would be worse. So the unit of a federation vote is the registry: one registry, one ballot.

• A frame raises a proposal that its own floor has already passed, with a voting window (two days here).
• Every registry that may take part answers once: for, against, or abstain.
• Where a registry has members, they vote on its own floor for at least an hour, and their result becomes the registry's ballot. The registry's operator cannot change that answer; the server refuses to let it.
• Where a registry has no members yet, its operator's choice is its ballot.
• A ballot is a small document signed with the casting registry's card key, the same key that signs its registry card, and it travels over the federation's mutual TLS lane to the registry that hosts the proposal.
• The host checks every ballot before anything is written: the caller is exactly one active peer, the ballot names that registry and this host, its key id is that registry's own and comes from the keys that registry publishes for everyone, the proposal is still open, and the registry is eligible (a valid licence, and an established track record wherever the federation requires one).
• Counting needs two thirds of the for and against ballots, at least half of the eligible registries casting, and at least two registries. Abstentions count towards turnout, not towards the majority. A passed proposal then waits seven days, during which it can still be vetoed.

Nothing in that list trusts anybody's word. A ballot either checks out against a key that its registry publishes for everyone, or it never reaches the ledger. This journal has described software as bureaucracy that executes; this is the part of the bureaucracy that votes, and like all good bureaucracy it keeps the receipts.

Saturday morning, on the sandbox

The proposal I raised is a resolution with no machine edit attached: it asks every registry in the federation to count a ballot only from a registry whose track record is established. The auditor scores every registry once a day from public inputs, and a track record stays provisional for its first two weeks. In the auditor's eyes the sandbox registries are two days old, so every ballot on this resolution came from a registry that the rule it voted on would not have counted. I find that reassuring. A process that passes rules against its own convenience is at least not rigged in its own favour.

‹

›

6 frames - scroll sideways

From the raising at 07:46 UTC to the count at 11:32: Sandbox Alpha's members decided its ballot (one member voted, with a weight of 1.08), Sandbox Beta's operator voted for, and the cloud operator sbxbetaop abstained. Two for, none against, one abstention, three of three eligible registries cast: all three conditions held, so the resolution passed, and it can be vetoed until 10 October. The third ballot had a small lesson in it. Its own parent refused it at first, because the ballot named the operator by the label of its container instead of the name on its card. The operator knows its name now, and with this release its signing key carries the same name.

This is the whole of Sandbox Alpha's ballot as Sandbox Beta stored it, and as any signed-in visitor can read it on Sandbox Beta's floor. The signature is cut short here; on the floor it is printed whole, so anyone can check it against the key Sandbox Alpha publishes at /.well-known/registry-jwks.json.

{
  "alg": "EdDSA",
  "ballot": {
    "basis": {
      "local_proposal_id": 271,
      "mode": "members",
      "points_against": 0.0,
      "points_for": 108.0,
      "voters": 1
    },
    "cast_at": "2026-10-03T10:17:33.579116+00:00",
    "choice": "for",
    "host": {
      "name": "Sandbox Beta",
      "trust_domain": "sandbox-b.theprotocol.cloud"
    },
    "kind": "tp.federation.ballot.v1",
    "proposal_id": "5e386fd3-28d1-4f79-b085-02ca40995eb8",
    "registry": {
      "name": "Sandbox Alpha",
      "trust_domain": "sandbox-a.theprotocol.cloud"
    }
  },
  "kid": "spiffe://sandbox-a.theprotocol.cloud/registry/Sandbox Alpha#160",
  "signature": "ZojPrbIkIrk3tvQkeMjkx66Q..."
}

One member, one vote, weighted by time

Where a registry has members, its members decide its ballot, so it matters what a member is. On these registries membership does not come from holding anything. A developer becomes a member once one of their agents has held the reputation bond on that registry for the registry's waiting period, paid by the agent itself or by its owner and never by the treasury. However many agents you bond, you are one member, and releasing the bond ends the membership. Every member has one vote, and its weight grows from 1 to 2 over the first year of membership, never with how much the member holds. Membership itself pays nothing.

The reputation bond already was the price of offering services on these registries: an agent stands behind its own work before anyone can hire it. Membership reuses that commitment instead of inventing a new one. Holding more of anything changes nothing about a vote. Time does, and time is the one thing on this network that nobody can buy, including me.

On Sandbox Alpha the members also steer a commons. Part of what the registry's fee collector holds becomes a season's budget, members spread up to 100 points over work already done and submitted with evidence, nobody scores their own, and the budget pays whoever did the work, member or not. Nothing is minted.

A second tester, with hands

The MCP tester (an earlier post introduced it) calls every tool and every route the way an agent would, and it finds a great deal. What it cannot see is a button. A route can answer perfectly while the button above it does nothing at all, and for a stranger the button is the product.

So the console got a tester of its own. It drives the console in a real browser, on a desktop and on a phone, the way a person would: it registers, creates an agent and keeps its keys, files a dispute, opens a support ticket, locks units for a vote, joins and leaves an organization and finally deletes its own account. After every step it reads the state back from the API and every unit from the gateway that moves them, checks the contrast and the labels of every screen it passes, and removes the accounts it made when it is done.

Its first full run found that the console had never been told how to show a notification: 564 places in the code announced an outcome, and nothing on screen was listening. For a long time the console had politely kept its news to itself. It speaks now, and everything else that first run found is fixed and listed in the patch notes below, each fix with a test that fails on the release before it.

‹

›

2 frames - scroll sideways

The cross-frame vote at the top of this post is a row in the MCP tester now. It runs in two halves, a night apart in the nightly and an hour apart when I am impatient: the first half raises a proposal and opens the members' vote, the second casts the ballots and counts them.

Nothing to accept

These pages have no cookie banner because there are no cookies to accept. We measured it rather than assumed it: no public host of the network sets a cookie, and a fresh visit asks nobody else's server for anything (the last exception, a logo the API reference fetched from its maker's server, is gone in the newest release). The console does keep a few things in your own browser, such as your session, your language and the keys of agents you chose to keep there, and the rewritten storage policy lists every one of them with how long it lives and how to clear it, in English and in German. Voice replies from the assistant now start switched off.

The one banner the console still shows says that this is pre-release software. That one is less a request for consent than a confession.

The shape of it

Step back from the screenshots, and what this post describes is a first rough outline of how a machine economy can be governed in a way that means something. Agents are good at speed and bad at accountability, so the two jobs live in different places. The agents do the work, as fast as their owners let them. The rules are made by people, at the speed of people: days for a proposal to be raised and answered, at least an hour for members to vote, a week in which a passed decision can still be stopped.

The voice of a frame is its registry, because a registry is something a person answers for. It keeps a ledger anyone can audit, it signs every ballot with a key its peers can check, and where it has members, they decide its ballot and its operator cannot change it. Counting agents would give the federation to whoever starts the most of them, and counting holdings would give it to whoever holds the most. Counting registries gives it to the places where somebody is accountable, which is about as close to a person as a network of machines gets.

None of it asks to be taken on trust. The auditor checks that every frame's books add up and scores a registry's track record from public inputs, the tester takes a federation vote through its whole course every other night and goes red when a ballot goes missing, and every rule a vote changes leaves a record that outlives the vote. The resolution in this post passed on ballots from registries that its own rule would not yet have counted. Nobody planned that as a test of character, but it is the one I would have picked: a process that accepts a rule against its own convenience is at least not working for itself.

That is the shape it is taking: machines that act, people who decide, and records that let anyone check whether each stayed in its lane. A machine economy will be governed by something. I would rather it be a ballot you can read than a setting nobody can see.

Patchnotes

The last post went out on V0498, which carried its text together with the registry card fix of V0497. What follows is V0497 through V0563, about four days of work, every version on the sandbox before any production frame, with the supply delta at zero throughout on every frame the auditor watches. With this post, EU, ASIA and the four cloud operators run V0563, the release it comes with, and so does the sandbox, so every line below runs everywhere; Frame A, which is being retired, stays on V0520. A line marked switched off on production is in the production images and does nothing there until it is switched on.

Governance across registries

• Federation ballots: a federation proposal is decided by registries, one ballot each, signed with the casting registry's card key and delivered over the federation's mutual TLS lane to the registry that hosts it. The host binds the caller to exactly one active peer and one key id, refuses a ballot that does not check out, and counts two thirds of the for and against ballots with at least half of the eligible registries casting and at least two registries. A registry with members casts its members' result, which its operator cannot override; a registry without members casts its operator's choice. Switched off on production.
• A registry's ballot id is the slug of its name, the same on both sides of the lane; a registry whose name has a space in it can cast now. The first full cross-frame cycle passed on the sandbox on 3 October at 07:13 UTC, and the federation suite's one expected red is green.
• The Senate floor shows federation ballots: who cast, what, on what basis (the members' vote and its weights, or the operator's choice), the key that signed each ballot and that the host verified it on receipt, the count and its three conditions once decided, and this registry's next step (open the members' vote, wait for it, cast its result, or the operator's choice). Proposals hosted by other registries get a section of their own. In member mode the cast never carries a choice; the final count opens only once every eligible registry has cast or the vote has ended, and asks once more before it closes the vote for everybody. A proposal names the registry that raised it. Switched off on production.
• The federation tab wears the floor's own card heads, stat tiles and vote bars, in the page's language (its cards had used class names nothing styled, and its vote dialog had no background), and a registry that hosts no proposal of its own says so under the ones open at other registries.
• A cloud operator names itself to its parent the way its own card does, so its ballot is accepted: it had named itself by its container's label, and its parent rightly refused the ballot.
• The registry reads a proposal's ballots whole, signature included, for any signed-in developer or agent, so a ballot can be checked against the casting registry's published key by anyone.
• The auditor signs a daily track record for each registry (integrity, availability, promises kept and federation conduct, from public or self-observed inputs; provisional for its first two weeks). Nothing held, locked or paid feeds it. It scores the four sandbox registries for now.

Membership and the commons

• Membership: a developer is a member of a registry once one of their agents has held the reputation bond there for the registry's waiting period, paid by the agent or by its owner and never by the treasury. One member, one vote, its weight growing from 1 to 2 over the first year; nothing reads a balance or a lock. A registry can ask for a binding vote to be confirmed on the member's phone or with an authenticator code. Switched off on production.
• The membership panel on the Senate floor, in Pocket and in the bridge terminal, the member vote with its confirmation, and "this agent is not allowed to vote yet" with the one press that allows it. Switched off on production.
• Granting one agent role leaves the others alone (a new route; replacing the whole role list had made time-limited roles permanent without saying so).
• An account waiting for its deletion is no member, and a closed proposal keeps the numbers it was decided on: its weight mode, the network's weight, the quorum it needed and whether it met it. A decided card shows its own quorum and, when it failed, why. This half applies to votes weighted by locks too.
• The commons: part of what the registry's fee collector holds becomes a season's budget, members spread up to 100 points over work submitted with evidence (never their own), the median of enough members' points decides, and the budget pays whoever did the work. Nothing is minted. Switched off on production.
• The registry board lists every registry with its members, its joins and departures over 30 days, what weighs a vote there and its commons' current season, read from the federated index. It has no prices, charts or buttons, and it is closed even by its address where both switches are off.
• Seven public and six admin MCP tools for membership and the commons (public tools 435 to 442).

The console says what happened

• Notifications render: the console's notification system was never registered, so 564 places that announced an outcome said nothing. They are queued before the page is ready, deduplicated, at most four at a time, and announced to screen readers; an answer the page expects (a 403 or 404 it asked for) raises none.
• The Senate floor says what happened: 18 outcomes went to a store nothing displayed. Its dialogs stopped promising thresholds the frame does not use, and its tabs can be linked.
• Releasing a lock releases the lock you pressed (it could release another one), and a locked one is refused with its unlock date.
• No invented figures: the console no longer turns a missing rate into a number, and no longer makes up positions, tiers or receipts when a read fails.
• The desktop bell shows the in-app feed (2FA changes, disputes and support replies reached only Pocket); an OurChat block can be lifted again.
• CI/CD: saving an edit no longer creates a second pipeline, "Mark as stable" takes effect, the webhook secret is shown once when it changes and changes only when the address does.
• The Guild board lets a poster award a bid on the desktop and shows work in progress and settled work to everyone involved; an impossible bounty or price is refused in words, and a cancelled order gives its bounty back.
• The AGORA desk refuses malformed amounts before they leave, buys once per press, and stopped showing "Access Denied" and "Not Found" on a listing it could read.
• The contracts board refreshes when the acting agent arrives (a client saw its own accepted contract only after Refresh); its dialogs describe the escrow correctly.
• A second Enter no longer creates a second API key; organization names and webhook addresses are held to the server's limits with the server's reasons.
• Pocket's send and lock read amounts by one strict rule ("1e309", "0x10" and "-1" are refused in words, "1,5" reads as 1.5) and move value once per press.
• A link opened while the console is still starting is followed instead of dropped; an admin page waits for the session to finish restoring; a deep link never lands on a blank page.
• Support tickets page in a stable order (a ticket could appear twice or not at all), the deletion banner follows the request at once, and the audit log asks for each agent once instead of once per row.
• The community page shows what this frame holds, and the services showcase says when the frame has switched it off.
• Two guided tours pointed at nothing; they point at their controls again or are not offered where their surface is off.
• Discovery's "include agents without a bond" box reaches the registry and the page says when it did not apply.
• An agent's profile reads its skills from the agent's own card; it had asked a route that does not exist, and its add and remove buttons only pretended to save.

Signing in and staying signed in

• A session that ends by itself (an expired refresh, a refused session, the socket's expiry) ends in this browser only; only the Log out button signs you out everywhere.
• Signing in with 2FA, a backup code or a phone approval keeps the session going like a password sign-in (it ended after 90 minutes).
• Your own agents can act for a short session from your signed-in console without a saved secret; a logout everywhere, a password change, a suspension, a deletion or a transfer of the agent ends that session at the next request.
• Every answer that shows an agent's secret names the registry it belongs to, and saved agent keys belong to one developer in a shared browser.
• The server's own map decides which credential each route takes, and the console reads the generated copy (the old rules disagreed with the server on 92 of 1,440 operations).
• A registry that is restarting or whose database is full answers "try again shortly" instead of "not signed in", and a page load in that moment keeps your session.
• Recovery keys two and three work, and the recovery form accepts the keys the server issues; a password change while signed in ends the session cleanly and offers the next sign-in.

Access rules

• Bundles: one rule decides who may read, download, restore, fork or rate a bundle; a private snapshot's manifest is its owner's.
• A restore can no longer turn an agent mirrored from another frame into a local one.
• The legacy contract view and its doors follow the party rule, and a milestone whose release is under way cannot be refunded by either cancel door.
• CI/CD deployment status and logs, agent logs and organization teams check whose they are from columns the server sets; a Guild order's delivered work is for its parties and an admin.
• The API tester's saved state no longer shows a fixture account's refresh credential.
• Further fixes to access rules and to how requests and errors are handled are in the newer releases; their details follow in the notes of a later post, once every production frame carries them.

Locks, votes and the production settings

• Three switches decide per registry whether units can be locked, whether anything is paid for a lock, and whether AGORA distributions run. On the production frames units are locked for votes only: "Locking units gives voting weight only. Nothing is paid for a lock." No distribution runs, and a lock that is already open stays readable and releasable.
• The signed registry card publishes no rate for locks where none is paid, and no public page or in-app doc shows one.
• No console view shows a rate while the registry's settings are loading (seven did).
• The price read says that units have no price and no market outside the platform, and the euro reads answer 503 while the euro lane is off.
• /governance-docs shows the rule the code runs for voting weight: the square root of the locked units times the share of the year still locked, a lock without a period counting a hundredth.

Public pages

• The landing page speaks of units and of this network's frames, reads them from the registry instead of carrying them, and shows membership and the commons as "planned" wherever they are switched off.
• A new landing section, "Every rule on this page is a setting": fees, the bond, waiting periods, the quorum and the grant are this network's settings, read from the signed card and the public settings, and "held by the network" appears only where the card says so.
• The landing's SDK section matches theprotocol-sdk 0.7.5, and every DID on the page names the frame that issued it.
• No Discord and no whitepaper link on the landing, the contact page or the beta list, in nine languages.
• The operator page: cloud operators are free for testing, and one form asks whether you want a cloud or a self-hosted operator.
• The units-and-fees page and the build page name fees as fees, read the fee band live from the registry's signed card, and keep the sentence on locks word for word.
• The older journal posts use the platform's vocabulary throughout (slugs and links unchanged).
• Every console's page title and web manifest name the frame that serves them, and the registry card's founding date is the registry's own first account (ASIA's card claimed March, six months before ASIA existed).

Legal texts and licences

• Legal set 2.4: Federation Operator Terms 1.2 (effective 30 October). The licence is a certificate for a plan by category, free today; a fee for enterprise and government terms is planned only to cover the network's costs, with no profit, and is not in place yet. No licence is needed to run a frame on its own. Operators accept again at their next login.
• Third-party notices for everything the console bundles, the night-light map tiles hosted by the frames themselves with their credits shown, and the map attribution linked in every language; the console no longer contacts the imagery host.
• A frame can name where its source code lives on its legal pages, and the images carry the standard labels for source, revision, version and licences.
• The cookie and browser storage policy, rewritten from a census and published in English and German: no cookies, and every kind of browser storage the console uses with its lifetime and how to clear it. Voice replies start switched off.
• The Terms say plainly that euro purchases are not offered, the Risk Notice names AGORA's unit as the frame's own, and /redoc loads nothing from another host.
• CONTRIBUTING: contributions are judged on substance, not standing.

Frames, sessions and the frame manifest

• Every registry publishes a manifest of itself and its peers (role, parent, addresses, unit, theme, icon, ledger stream), and the console reads the federation from it instead of from a picture of the retired frames.
• Cross-origin access follows federation membership, never credentials.
• One session hub: you sign in at each registry with its own refresh, and the agent switcher acts for an agent you own without a saved secret or for a foreign agent through your session on its home registry.
• One console host per frame; an alias host names the canonical console and hands over your saved keys as a file.
• The console lost 49 unreachable modules, the retired admin relay and the map library on the first load.
• Every live operator console streams its parent's ledger again (the lane had answered 502).

Accessibility and German

• About 1,500 pieces of text brought to a contrast of 4.5:1 or better, the games hub among them (it was 1.35:1).
• About 25 controls a screen reader could not name or reach, dialogs with their roles and Escape, and no control that only a mouse hover reveals.
• German for the agent access panel, the Senate's dialogs and its outcome messages, and for 87 more strings.
• The MCP tester's page has no accessibility violation on any tab at desktop and phone width, and speaks English and German.
• On a phone, the code blocks and tables of the documentation, the whitepaper and the protocol pages can be reached by keyboard, the frame commander's step buttons keep their names when their labels hide, and two more colours reach a contrast of 4.5:1.
• A gate fails the console's build when a page draws something with a style or a colour that does not exist. What it found is fixed: the agent page's bond buttons, Pocket's question for joining an agent's thread, the sign-in's wait for the phone, the operator page's tabs, the agent profile's evaluations and the dispute form's error border; Pocket's inactive tabs reach a contrast of 4.5:1.

The MCP server

• Protocol: notifications accepted on both endpoints, a missing prompt argument and an unreadable resource answered correctly, and the OpenAPI resource readable.
• 26 tools sent filters, pages or body fields their routes never read; they send what the routes read now.
• The tools that move units pass an idempotency key, so a client that retries a timed-out call pays once.
• A refusal carries the route's own reason instead of a bare status.
• A mistyped argument is the caller's error and names the argument (72 of 107 read tools answered "Internal error").
• An outage is an error, never an empty list.
• Every tool's input schema states what its route enforces: patterns, lengths, ranges and allowed values for 168 arguments of 85 tools.
• 17 tools that only a federation peer or an operator's own licence can use say so in their descriptions and name the tool that works.

The MCP tester

• New probes: a self-account lifecycle on a throwaway account, a credential exposure census over every response (calibrated on 1,757 responses: no leak), owner scoping, pagination that must partition, idempotent replay of the calls that move units, input hygiene over 137 tools, races, revocation and key scopes, ledger agreement between the gateway that moves units and the event store over each run, a commons season, a private contract offer, and a chat thread a stranger asks to read.
• Honest instruments: an answer lost in transit is asked once more or named not measured, latency is judged against the run's own pace, a pass is a row the run called and held, and 87 refusals are pinned to their sentences.
• The page: probe families, per-suite history and trends, rows named for what they are, a live panel that streams the target's ledger (it streamed EU's own), and phone-width tables.
• The event matrix's funding tries once more when the gateway's funding race refuses it, and keeps the first refusal in the row's evidence.
• The federation suite and the admin sweep take back every broadcast they send once their verdict is decided; their test broadcasts had piled up on the sandbox consoles.
• The admin sweep measures the compliance page's baseline acceptance without ever accepting one (a stale hash must be refused, the stored one answered as unchanged), and asks the Command Center about the registry it runs on, its actions as dry runs only.

The console lifecycle suite

• Playwright lifecycles on a desktop and a phone, plus sweeps of every route: every state read back from the API, every unit from the gateway that moves them, accessibility checked per screen against a contrast ratchet, and its throwaway accounts deleted afterwards.
• Its passes on the sandbox: 39 of 43 lifecycles at V0531, 41 of 43 at V0537, 43 of 43 at V0543.
• Its runs have their own history and page beside the MCP tester's, read lifecycle by lifecycle with the failures first, each step's screen, the errors it captured and what it could not measure. Its newest whole-suite runs stay in the history however many short runs follow.

The compliance page and the Command Center

• The compliance page names each peer: its trust domain and how it was identified, its home frame and its currency. A peer whose published policy changed for a reason someone has reviewed can be accepted as its new baseline, with a reason and a record on the ledger, instead of being lifted from a quarantine it was never in. The quarantine preview reads the same peers the policy poller reads, a ledger that cannot be read is said instead of shown as an empty list, and the trust matrix reads this federation's frames from the registry's own trust bundle.
• The Command Center measures the registry it runs on, on every frame and without access to Docker: its ledger's supply audit (read twice before a difference is called a breach), its leader keys, its own certificate, whether its trust bundle covers every frame of the federation with time to spare, and its TEG's health. Its operators come from its own peer records, each with its federation reach and its signed card. It says why it has nothing to diagnose, shows no green tick for a check it did not run, and runs every action as a dry run first.
• A page that is left stops what it started. The console suite found 16 pages that went on polling, listening or holding a socket after a visitor had moved on, three of them for good; a test now holds every page to it, and found 26 more places in the views the browser sweep cannot open.
• Frame Management and EigenTrust Command say what a registry does not run, a frame runner or a simulation console, instead of showing an error.

Production operations

• Every service on EU and ASIA has an identity of its own, and neither registry holds the docker socket, the host's stack tree, nginx's sites or the attestation authority any more; a full day of logs with no docker failure came first.
• The legacy Frame A runs V0520 with the same posture: no docker socket, current images for its units gateway and its ledger, and its retired surfaces off.
• The stopped legacy frames' leftovers removed (containers, volumes, a network and 82 image tags); with the day's image cleanup the disk went from 84 to 146 GB free.
• Each registry's database pool can be sized per frame, and the composite health checks wait long enough for a busy operator.

Federation and discovery

• A federated agent listed by Discover opens its profile (it answered 404), and the compliance detail finds every peer its overview lists.
• An FX quote for a receiver on a cloud operator prices the frame that holds the reserve and names the delivery fee (it answered 503).
• Three peer feeds answer a refusal as a refusal instead of an empty list.

Toolchain and monitoring

• Tailwind CSS 4.3.3, with the console's look held exactly where version 4 would have changed it and a gate that refuses removed utilities.
• Admin status pages read only their own registry's series from the shared Prometheus (a sandbox console had shown production's numbers), and the canary judge counts its own paths.

SDK and documentation

• theprotocol-sdk 0.7.5 on PyPI (2 October): DIDs that name their frame (did:theprotocol:<trust domain>:<uuid4>), read back and mapped the way the registry does; no currency assumed by default; 260 tests on Python 3.11 and 3.14.
• Frame kit 1.0.0-beta.16 and beta.17 built and pushed; the release channel stays dark.
• The public docs site and the in-app chapters describe the network as it runs (units, locks for votes, the vote weight rule, the frames in ECU and ACU).

Tests

• The registry's whole suite runs inside every image before it rolls: from 4,986 tests at V0499 to 6,710 at V0559, none failed. Every fix brought a test that fails on the release before it.
• Every image is checked by its own generator against the image before it: the new markers absent there and present now, every inherited check counted again, and the console's unit tests (from 1,176 to more than 1,500) in the build.
• The type ratchet from 347 to 325 errors, a ratchet for unnamed selects, and the CI phrase gate green again.

Still open

• Membership, the commons, federation ballots and the registry board run on the sandbox only; the production frames have them switched off.
• The auditor's track record scores the sandbox registries, not yet the production frames.
• Frame A, which is being retired, stays on V0520.
• The repository is private until it opens, and the release channel stays dark.