WALLET is the per-USER economic identity. Every USER has one. Every COIN lives in one.
| Event | Direction | Description |
|---|---|---|
| MINT:WORK | credit | Validated work creates COIN — amount = gradient (delta only) |
| MINT:SIGNUP | credit | 500 COIN bonus on principal promotion |
| MINT:PYRAMID | credit | 500 COIN to referrer when new principal joins |
| DEBIT:DRIFT | debit | Governance regression — amount = abs(negative gradient) |
| TRANSFER | debit/credit | USER sends COIN to USER (5% TREASURY fee deducted) |
| SPEND | debit/credit | USER pays COIN for SHOP product (cost_basis required) |
| SETTLE | debit | COIN exits to fiat via Stripe |
| CLOSE | snapshot | Epoch close — balance snapshot, reconcile, rotate (monthly 1st) |
id — content address (SHA256 of body + prev)
prev — chain pointer (previous event hash)
ts — nanosecond timestamp
event — MINT:WORK | MINT:SIGNUP | MINT:PYRAMID | DEBIT:DRIFT | TRANSFER | SPEND | SETTLE | CLOSE
from — source USER principal (SYSTEM for MINT events)
to — destination USER principal (STRIPE for SETTLE)
amount — unsigned COIN units
work_ref — evidence pointer (commit hash, IDF id, product slug, promotion commit)
referred_by — referrer USER principal (PYRAMID events only)
scope — governed scope where event originated
meta — { product, service, channel, note }
SIGNUP_BONUS = 500 COIN
PYRAMID_BONUS = 500 COIN
TRANSFER_FEE = 5% to TREASURY
SUPPLY_CEILING = unique_scopes × 255
SIGNATURE_CUTOFF = 2026-03-01
CLOSE_CADENCE = monthly (1st of each month)
MUST be append-only (no in-place edits). MUST be chain-verifiable (hash includes prev). MUST dual-write — USER TIMELINE + ORG TIMELINE + LEDGER. MUST support derived views (balance, history, aggregates). Balance = SUM(credits) - SUM(debits) from TIMELINE. Never cached independently. MUST Ed25519-sign all events after SIGNATURE_CUTOFF — reject unsigned events. MUST CLOSE monthly — reconcile LEDGER-to-WALLET, snapshot balance, rotate. MUST enforce SUPPLY_CEILING — reject MINT:WORK if cumulative exceeds ceiling.
Triggered monthly on the 1st (or vault close –reconcile).
For each USER: derive balance from TIMELINE, compare to WALLET.json. Flag MISMATCH. Walk LEDGER: verify each .idf has corresponding WALLET event. Report unreconciled. Append CLOSE event to each USER TIMELINE. Update last_close in each USER WALLET.json.
Before every MINT:WORK:
Count unique scope keys in LEDGER chain. ceiling = unique_scopes × 255. Sum all MINT:WORK amounts from ORG TIMELINE. Reject if cumulative + new_amount > ceiling.
After SIGNATURE_CUTOFF (from COIN.v1.json contract):
Every circulation event MUST carry signature.
No key-pair → reject (run vault keygen –user
~/.canonic/VAULT/USERS/{USER}/
├── WALLET.json — derived balance + totals
└── TIMELINE.jsonl — append-only event stream
| *WALLET | SPEC | SERVICES* |