kaikisegfault · kaikisegfault · Jul 23, 2026 · Jul 23, 2026
@@ -70,27 +70,39 @@ add_executable(
   protocol_primitive_vectors
   tools/protocol-vectors/verify.cpp
 )
-target_compile_features(protocol_primitive_vectors PRIVATE cxx_std_20)
-target_compile_definitions(
-  protocol_primitive_vectors
-  PRIVATE
-    _GLIBCXX_ASSERTIONS
-)
-target_compile_options(
-  protocol_primitive_vectors
-  PRIVATE
-    -Wall
-    -Wextra
-    -Wpedantic
-    -Werror
-    ${PROTOCOL_STACK_SANITIZER_FLAGS}
+add_executable(
+  ledger_transition_vectors
+  tools/ledger-vectors/verify.cpp
 )
-target_link_options(
-  protocol_primitive_vectors
-  PRIVATE
-    ${PROTOCOL_STACK_SANITIZER_FLAGS}
+
+foreach(
+  protocol_stack_target
+  IN ITEMS
+    protocol_primitive_vectors
+    ledger_transition_vectors
 )
-target_link_libraries(protocol_primitive_vectors PRIVATE protocol_stack_sodium)
+  target_compile_features(${protocol_stack_target} PRIVATE cxx_std_20)
+  target_compile_definitions(
+    ${protocol_stack_target}
+    PRIVATE
+      _GLIBCXX_ASSERTIONS
+  )
+  target_compile_options(
+    ${protocol_stack_target}
+    PRIVATE
+      -Wall
+      -Wextra
+      -Wpedantic
+      -Werror
+      ${PROTOCOL_STACK_SANITIZER_FLAGS}
+  )
+  target_link_options(
+    ${protocol_stack_target}
+    PRIVATE
+      ${PROTOCOL_STACK_SANITIZER_FLAGS}
+  )
+  target_link_libraries(${protocol_stack_target} PRIVATE protocol_stack_sodium)
+endforeach()
 
 add_test(
   NAME protocol-primitives-cpp
@@ -105,8 +117,22 @@ add_test(
     "${PROJECT_SOURCE_DIR}/tools/protocol-vectors/verify.py"
     "${PROJECT_SOURCE_DIR}/test-vectors/protocol-primitives-v1.txt"
 )
+add_test(
+  NAME ledger-transition-cpp
+  COMMAND
+    ledger_transition_vectors
+    "${PROJECT_SOURCE_DIR}/test-vectors/ledger-transition-v1.txt"
+)
+add_test(
+  NAME ledger-transition-python
+  COMMAND
+    "${Python3_EXECUTABLE}"
+    "${PROJECT_SOURCE_DIR}/tools/ledger-vectors/verify.py"
+    "${PROJECT_SOURCE_DIR}/test-vectors/ledger-transition-v1.txt"
+)
 set_tests_properties(
   protocol-primitives-python
+  ledger-transition-python
   PROPERTIES
     ENVIRONMENT
       "PROTOCOL_STACK_LIBSODIUM=${PROTOCOL_STACK_SODIUM_SHARED_LIBRARY}"

@@ -35,3 +35,8 @@ superseded.
 Canonical protocol specifications live in `specifications/` and must define
 consensus-critical behavior before implementation. An accepted version is
 immutable; compatible changes require a new version.
+
+- `specifications/protocol-primitives-v1.md`: canonical version-one encoding,
+  cryptography, identifiers, addresses, transactions, and commitments.
+- `specifications/ledger-transition-v1.md`: M1 genesis, native transfer, fee,
+  receipt, and ordered block semantics.
@@ -0,0 +1,83 @@
+# ADR 0006: M1 devnet ledger and monetary parameters
+
+- Status: Accepted
+- Date: 2026-07-23
+
+## Context
+
+The in-memory M1 kernel needs exact values and failure behavior before
+implementation. These choices must fit `u64`, preserve a single native asset,
+make fees and replay handling auditable, and avoid pretending that early
+devnet constants are production tokenomics.
+
+## Decision
+
+Adopt the state transition and constants in
+[`ledger-transition-v1.md`](../specifications/ledger-transition-v1.md).
+
+Use `PSU` as non-consensus display shorthand, nine decimal places, a
+1,000,000,000-display-unit constitutional cap, and a default 100,000,000-unit
+M1 genesis split equally across four deployment-provided bootstrap accounts.
+There is no post-genesis issuance in M1.
+
+Use a fixed fee of 1,000 atomic units for every successful transfer. Route the
+fee in full to the native fee pool. Failed transfers make no writes and pay no
+fee. The fee limit remains signed so a later transition version can introduce
+a bounded fee schedule without changing the version-one transaction bytes.
+
+Admit only canonical, correct-chain, strictly signed transactions. Commit all
+admitted transaction IDs, including stateful failures, and produce their
+deterministic execution receipts in input order. Malformed, wrong-chain, and
+invalid-signature bytes remain outside application receipts and commitments as
+required by ADR 0004.
+
+## Rationale and alternatives
+
+Nine decimal places provide sub-unit granularity while allowing one billion
+display units to fit comfortably in `u64` (`10^18` atomic units). Six decimals
+would also fit and be simpler to display, while eighteen decimals would make
+even modest display-unit caps exceed `u64`; neither offers an M1 protocol
+advantage.
+
+A fixed fee makes conservation and differential testing explicit. Dynamic
+base fees, byte metering, congestion auctions, validator rewards, and fee
+burning require economic simulation and are deferred. Zero fees would avoid
+early pricing but would fail to exercise the native fee-pool path required by
+the first operational goal.
+
+Charging stateful failures can discourage abuse but adds balance-dependent
+failure paths and makes retry behavior harder to audit. M1 charges only
+successful transfers. A later metered transition can change this with a new
+version.
+
+Pruning zero-balance accounts would reduce state size but would need a separate
+nonce tombstone or replay window. Retaining accounts preserves monotonic replay
+protection with the smallest state machine.
+
+Committing admitted failures makes proposer inputs and deterministic results
+observable at the application boundary. Committing malformed or
+invalid-signature bytes would conflict with the primitive specification and
+unnecessarily give meaningless bytes application identity.
+
+## Security, economic, and compatibility effects
+
+- No public operation can mint, burn, issue another asset, or change the
+  configured supply.
+- Checked arithmetic and full-transition atomicity protect conservation.
+- Chain ID, strict signatures, exact next nonces, and expiry heights bound
+  replay.
+- A successful self-transfer charges the same fixed fee and advances replay
+  state without changing ownership.
+- The unused difference between genesis supply and the supply limit is not
+  circulating and has no issuance path in M1.
+- These values govern an M1 devnet genesis only. Production parameters require
+  M2 simulation and a new accepted genesis/transition decision; changing a
+  live chain's constants is not backward compatible.
+
+## Evidence
+
+Acceptance requires the normative ledger-transition vectors and passing
+independent C++20 and Python harnesses under all compiler and sanitizer
+presets. The first production kernel change must use these vectors unchanged
+and add property and randomized differential sequences rather than replacing
+the decision harness.
@@ -4,13 +4,16 @@ Last updated: 2026-07-23
 
 ## Phase
 
-M1 — Sovereign Devnet Alpha. Protocol primitives are accepted and the
-reproducible build/toolchain slice is verified.
+M1 — Sovereign Devnet Alpha. Protocol primitives and ledger-transition v1 are
+accepted, and the reproducible toolchain executes their cross-language
+vectors.
 
 ## Verified facts
 
 - Repository: `kaikisegfault/protocol-stack`.
 - F0 merged to `main` through PR #3 on 2026-07-23.
+- The reproducible build/toolchain slice merged through PR #7 on 2026-07-23;
+  all four GitHub compiler/sanitizer jobs passed.
 - On 2026-07-23 the owner granted standing authority for autonomous project
   decisions and repository operations. A `proceed` instruction requires no
   follow-up approval.
@@ -27,10 +30,16 @@ reproducible build/toolchain slice is verified.
 - `tools/verify.sh` is the clean-clone entry point. It isolates build tools in
   an ignored virtual environment, builds the pinned libsodium source, and runs
   C++ and standard-library-only Python checks through CTest.
+- ADR 0006 and `ledger-transition-v1.md` define canonical genesis, a
+  single-native-asset transfer, fixed fee-pool routing, exact nonce/expiry and
+  failure rules, receipts, and ordered atomic block execution.
+- The M1 devnet uses nine atomic decimal places, a `10^18` atomic supply limit,
+  a default `10^17` atomic four-account genesis, a 1,000-atomic fixed fee, and
+  no post-genesis issuance.
 - The repository still contains no ledger, networking, persistence, or
   production deployment implementation.
 
-## Protocol-primitives evidence
+## Verification evidence
 
 - The fixed primitive vector suite passes through `tools/verify.sh` with GCC
   12.2.0, Clang 14.0.6, and `-Wall -Wextra -Wpedantic -Werror`.
@@ -43,19 +52,29 @@ reproducible build/toolchain slice is verified.
 - CMake preset JSON, TOML, GitHub workflow and issue-form YAML, Python bytecode
   compilation, shell syntax, internal Markdown links, and `git diff --check`
   pass.
+- The independent C++20 and Python ledger decision harnesses reproduce a
+  canonical genesis, chain ID, 11 admitted transaction results, three
+  admission error classes plus unknown-kind rejection, ordered receipts,
+  recipient creation, fee routing, final accounts, transaction/state roots,
+  application header, and block ID.
+- Ledger vectors cover success, replay, self-transfer, zero amount, low fee
+  limit, expiry, absent sender, nonce mismatch and exhaustion, debit overflow,
+  insufficient balance, malformed bytes, wrong chain, invalid signature, and
+  unauthorized transaction kind.
+- All four local presets pass 4/4 CTest tests: GCC, GCC ASan+UBSan, Clang, and
+  Clang ASan+UBSan.
 
 ## Exact next action
 
-Land the verified GitHub issue #4 build/toolchain slice, then begin issue #6:
+Land the verified GitHub issue #6 specification/vector slice, then begin issue
+#8:
 
-> Specify deterministic M1 ledger state transitions and devnet monetary
-> constants, including exact failure atomicity and normative cross-language
-> vectors.
+> Implement the original in-memory C++20 ledger kernel and differentially
+> verify at least 10,000 seeded ordered transaction sequences against the
+> independent Python model.
 
 ## Open autonomous decisions
 
-- Devnet native unit name, precision, supply limit, genesis allocation, and fee
-  constants under issue #6.
 - Final acceptance of CometBFT as the replaceable M1 consensus/P2P adapter.
 
 ## Blockers