+
+
+
+
+
+
@@ -54,7 +80,8 @@ is reached. It has no deployed contracts and is not available for launch.
## Adding a model
New models start at `design`. They become `candidate` only after source, tests, fixed parameters and security properties
-exist. They become `available` only after the exact Ethereum deployment and runtime evidence are published.
+exist. They become `available` only after the exact Ethereum deployment, runtime evidence and public activation checks
+are published.
[Read the release process](RELEASING.md) ·
[Create a model record](templates/model/README.md.template) ·
diff --git a/README.md b/README.md
index 9a0eebc9..16a4b3ed 100644
--- a/README.md
+++ b/README.md
@@ -93,8 +93,9 @@ flowchart LR
candidate --> design
```
-Only `available` models appear as production launch options. `design` and `candidate` records are public so incomplete
-work cannot be mistaken for a deployed product. The complete gate is documented in [`RELEASING.md`](RELEASING.md).
+`available` is the repository's final publication state. Production activation does not replace the required source,
+deployment and security records. Any model activated before those records reach `available` is identified in its model
+documentation. The complete gate is documented in [`RELEASING.md`](RELEASING.md).
## Build a launch model
@@ -132,6 +133,7 @@ contest.
| --- | --- |
| Current security status | [`SECURITY.md`](SECURITY.md) |
| Classic trust boundaries and invariants | [`docs/security/CLASSIC_PROPERTIES.md`](docs/security/CLASSIC_PROPERTIES.md) |
+| Stock-Paired properties and publication gates | [`docs/security/STOCK_PAIRED_PROPERTIES.md`](docs/security/STOCK_PAIRED_PROPERTIES.md) |
| Automated checks and incident process | [`docs/OPERATIONS.md`](docs/OPERATIONS.md) |
| Independent review archive | [`audits/`](audits/) |
diff --git a/SECURITY.md b/SECURITY.md
index 6755fa01..c362e0ad 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,6 +6,12 @@ Classic is the only available launch model. Its current Ethereum release has uni
regression and Mainnet-fork coverage. All seven release contracts are Etherscan exact matches and Sourcify matches.
Classic has not received an independent smart-contract audit or public security contest.
+Stock-Paired is active in the production interface, while its public model registry remains `candidate` until the
+version-bound source and release records are on the default branch, the release verifier records the mixed explorer
+state and the routing review is complete. Its lifecycle canary passed on Mainnet and all seven contracts have exact
+Sourcify matches. Etherscan shows one Exact Match and six Similar Matches. Stock-Paired has no independent audit or
+public security contest.
+
These records are evidence, not a safety guarantee.
| Record | Scope |
@@ -13,6 +19,7 @@ These records are evidence, not a safety guarantee.
| [Classic security properties](docs/security/CLASSIC_PROPERTIES.md) | Trust boundaries, permissions, accounting and invariant evidence |
| [Classic Slither review](docs/security/SLITHER_CLASSIC_V3.md) | Static-analysis findings and manual dispositions |
| [Classic release](releases/classic-v3/RELEASE.md) | Version-bound source, tests and Mainnet lifecycle evidence |
+| [Stock-Paired candidate properties](docs/security/STOCK_PAIRED_PROPERTIES.md) | Quote-asset accounting, issuer controls and remaining release gates |
| [Operations](docs/OPERATIONS.md) | Automated checks, monitoring status and incident response |
| [Independent reviews](audits/README.md) | Published external reports, currently none |
| [Ethereum deployment](deployments/ethereum.json) | Addresses, transactions, runtime hashes and verification status |
diff --git a/assets/README.md b/assets/README.md
index 544e6ae6..74640d20 100644
--- a/assets/README.md
+++ b/assets/README.md
@@ -5,6 +5,7 @@
| `programmable-repository-cover-animated.gif` | Motion cover for GitHub surfaces that support animated images |
| `programmable-repository-cover.jpg` | Static cover and reduced-motion fallback |
| `programmable-model-classic.jpg` | Classic model artwork |
+| `programmable-model-stock-paired.webp` | Stock-Paired candidate artwork |
| `programmable-model-deep.jpg` | Deep design artwork |
| `programmable-builder-ecosystem.jpg` | Hook Builder Program artwork |
diff --git a/assets/programmable-model-stock-paired.webp b/assets/programmable-model-stock-paired.webp
new file mode 100644
index 00000000..70af0487
Binary files /dev/null and b/assets/programmable-model-stock-paired.webp differ
diff --git a/docs/README.md b/docs/README.md
index 2a9d3c14..9516a6b4 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -7,6 +7,7 @@
| [Release process](../RELEASING.md) | Candidate and Ethereum availability gates |
| [Security](../SECURITY.md) | Reporting policy, trust assumptions and current status |
| [Classic security properties](security/CLASSIC_PROPERTIES.md) | Permissions, accounting, invariants and MEV boundaries |
+| [Stock-Paired security properties](security/STOCK_PAIRED_PROPERTIES.md) | Quote-asset accounting, issuer controls and release gates |
| [Operations](OPERATIONS.md) | Automated evidence, monitoring status and incident response |
| [Hook Builder Program](../BUILDER_PROGRAM.md) | External model submission and acceptance terms |
| [Community conduct](../CODE_OF_CONDUCT.md) | Participation and moderation boundaries |
diff --git a/docs/security/STOCK_PAIRED_PROPERTIES.md b/docs/security/STOCK_PAIRED_PROPERTIES.md
new file mode 100644
index 00000000..27e8c2ed
--- /dev/null
+++ b/docs/security/STOCK_PAIRED_PROPERTIES.md
@@ -0,0 +1,119 @@
+# Stock-Paired security properties
+
+This document maps the intended Stock-Paired candidate properties to its deployed contracts and evidence. It is a
+review aid, not an audit report.
+
+## Trust boundaries
+
+```mermaid
+flowchart LR
+ creator["Token creator"] -->|"ETH launch"| coordinator["ETH coordinator"]
+ coordinator -->|"WETH / USDC / quote route"| v3["Uniswap v3"]
+ coordinator --> launcher["Stock-Paired launcher"]
+ launcher --> manager["Uniswap v4 PoolManager"]
+ launcher --> position["Permanent position custody"]
+ manager -->|"v4 callbacks only"| hook["Quote-asset fee hook"]
+ hook --> vault["Creator reward vault"]
+ hook --> treasury["Programmable treasury"]
+ issuer["Quote-asset issuer"] -->|"manager and token controls"| quote["Tokenized quote asset"]
+ quote --> coordinator
+ quote --> manager
+```
+
+The registry, planner, factories, hook, launcher and coordinator are non-upgradeable Programmable contracts. The V2
+registry is ownerless and fixes exactly eleven accepted quote-asset addresses at construction.
+
+The tokenized quote assets are external contracts. Their issuer can retain pause, transfer, upgrade, eligibility,
+custody or jurisdiction controls outside Programmable. Passing the registry checks does not remove those dependencies.
+
+## State and authorization
+
+| Action | Authorized caller | Effect |
+| --- | --- | --- |
+| Launch | Any wallet satisfying the launch parameters | Creates one token, reward vault, v4 pool and locked position |
+| Register a pool | Its recorded launcher | Binds the pool to its quote asset and reward vault |
+| Enter hook callbacks | Uniswap v4 `PoolManager` | Applies the fixed quote-asset fee |
+| Claim creator rewards | An immutable beneficiary | Pays only that beneficiary's quote-asset entitlement |
+| Change a payout address | The beneficiary for that allocation | Changes only its own claim destination |
+| Claim Programmable rewards | Immutable treasury | Pays the treasury or its selected destination |
+| Change quote assets or routes | No configured actor | Requires a new deployment |
+| Remove or transfer launch liquidity | No configured actor | Position custody has no operator and a maximum timelock |
+
+Creator reward beneficiaries and shares are fixed at launch. Each beneficiary controls its own payout address. A reward
+claim transfers the selected quote asset; an interface conversion to ETH is a separate transaction with a fresh quote,
+deadline and minimum output.
+
+## Fee accounting
+
+For gross quote-asset amount `x`:
+
+```text
+totalFee = floor(x × 100 / 10,000)
+programmable = floor(x × 10 / 10,000)
+creatorRewards = totalFee - programmable
+```
+
+The fixed total is 1.00%. The creator configuration receives 0.90% and Programmable receives 0.10%. The Programmable
+share is deducted from the total. It is not added on top.
+
+The launched token has no transfer tax and the v4 pool's LP fee is zero. Unsupported partial fills revert rather than
+leaving fee accounting ambiguous.
+
+## Quote-asset admission
+
+Before deployment, the candidate checked each quote asset against:
+
+1. acceptance by the issuer's token manager;
+2. pinned token, beacon, implementation and manager runtime hashes;
+3. the expected symbol and 18 decimals;
+4. the exact Uniswap v3 USDC pool, fee tier and pool runtime;
+5. a `0.01 ETH` WETH to USDC to quote asset and back route returning at least 90% of input; and
+6. agreement between two Ethereum RPCs at one block.
+
+Before each new launch, the ownerless registry repeats the manager-acceptance, shared-runtime, token-runtime, decimals
+and symbol checks. A failed check stops new launches for the affected asset. It cannot freeze an existing pool or
+override issuer controls.
+
+The round-trip floor is an admission rule, not a promise of future route depth, price or execution.
+
+## Position and coordinator boundaries
+
+Token creation, pool initialization, reward-vault deployment, complete launch-position custody and the initial buy
+execute as one launch flow. The ETH coordinator converts the caller's ETH through immutable v3 route definitions,
+approves only the amount passed to the launcher and clears the approval after launch. It retains no user balance after
+a successful call.
+
+A launch transaction remains exposed to normal public-mempool ordering, delay and censorship. Every conversion still
+needs an unexpired deadline and explicit output floor.
+
+## Current evidence
+
+The deployed candidate passed:
+
+- deterministic registry, launch, fee-accounting and reward-vault tests;
+- fuzz and invariant coverage for quote-asset accounting;
+- pinned Mainnet-fork deployment and lifecycle tests;
+- a two-RPC route audit across all eleven included assets;
+- an ETH-first Mainnet canary with buy, sell, creator claim and Programmable claim; and
+- permanent launch-position custody checks.
+
+The production interface activated the exact deployed release on 30 July 2026. Health, the public launch gate,
+Explore, Profile, receipt lookup and wrong-chain preflight rejection passed production checks.
+
+The exact candidate source and test tree is fixed at
+[`stock-paired-v2`](https://github.com/0xprogrammable/programmable/tree/stock-paired-v2/contracts).
+The Mainnet evidence is linked from the [model record](../../models/stock-paired/README.md).
+
+## Manual review boundaries
+
+- The launched token is not a share and does not grant a claim on the quote asset.
+- Quote-asset holders depend on the external issuer, custodian, transfer rules and eligible jurisdictions.
+- A registry check can block future launches after issuer or runtime drift, but cannot repair an existing pool.
+- Pinned v3 routes can become illiquid or economically unusable after deployment.
+- A broken router, RPC, indexer or metadata service can affect access and visibility without changing pool state.
+- Sourcify reports exact matches for all seven contracts; Etherscan shows one Exact Match and six Similar Matches.
+- The Uniswap routing review is pending.
+- No independent audit or public security contest has been completed.
+
+Stock-Paired remains a `candidate` until every release gate in
+[`models/stock-paired/model.json`](../../models/stock-paired/model.json) is complete.
diff --git a/models/registry.json b/models/registry.json
index 641f88e0..a9167cdf 100644
--- a/models/registry.json
+++ b/models/registry.json
@@ -1,7 +1,7 @@
{
"$schema": "./schema/registry.schema.json",
"schemaVersion": 1,
- "updatedAt": "2026-07-29",
+ "updatedAt": "2026-07-30",
"statuses": [
"design",
"candidate",
@@ -17,6 +17,14 @@
"manifest": "models/classic/model.json",
"documentation": "models/classic/README.md"
},
+ {
+ "id": "stock-paired",
+ "name": "Stock-Paired",
+ "status": "candidate",
+ "summary": "A fixed-supply token paired with one reviewed tokenized stock or ETF quote asset, with quote-asset rewards and permanently locked Uniswap v4 launch liquidity.",
+ "manifest": "models/stock-paired/model.json",
+ "documentation": "models/stock-paired/README.md"
+ },
{
"id": "deep",
"name": "Deep",
diff --git a/models/stock-paired/README.md b/models/stock-paired/README.md
new file mode 100644
index 00000000..9f75810d
--- /dev/null
+++ b/models/stock-paired/README.md
@@ -0,0 +1,104 @@
+# Stock-Paired
+
+**Status:** Candidate
+**Deployment:** Ethereum Mainnet
+**Public interface:** Active since 30 July 2026
+
+Stock-Paired creates a new fixed-supply token and pairs it with one reviewed Ondo tokenized stock or ETF asset in a
+Uniswap v4 pool. The complete launch position is placed in permanent custody.
+
+The token created by Programmable is not a share, is not redeemable for the selected quote asset and carries no rights
+in the underlying company, fund or security. The tokenized quote asset remains subject to its issuer's terms and
+controls.
+
+[Model manifest](model.json) ·
+[Security properties](../../docs/security/STOCK_PAIRED_PROPERTIES.md) ·
+[Immutable deployed source](https://github.com/0xprogrammable/programmable/tree/stock-paired-v2/contracts) ·
+[Launch Stock-Paired](https://programmable.family/launch)
+
+## Fixed behavior
+
+- Supply is fixed at 1,000,000,000 tokens.
+- The launch pool uses one approved quote asset and the Stock-Paired v4 hook.
+- The total swap fee is 1.00% of the quote-asset side.
+- Creator rewards receive 0.90%; Programmable receives 0.10%.
+- Creator rewards may be split across up to eight immutable beneficiaries.
+- Rewards accrue in the quote asset. Converting a claim to ETH is a separate routed transaction.
+- The launch token has no transfer tax. The v4 pool's LP fee is zero.
+- The one-sided launch position cannot be removed, transferred or approved by a configured operator.
+- The ETH coordinator converts the initial ETH through pinned Uniswap v3 routes before calling the launcher.
+
+## Reviewed quote assets
+
+The current candidate fixes eleven quote assets:
+
+| Asset | Token |
+| --- | --- |
+| NVIDIA | `NVDAon` |
+| S&P 500 | `SPYon` |
+| Alphabet | `GOOGLon` |
+| Silver | `SLVon` |
+| Tesla | `TSLAon` |
+| Apple | `AAPLon` |
+| Alibaba | `BABAon` |
+| Copper Miners | `COPXon` |
+| Circle | `CRCLon` |
+| 20+ Year Treasuries | `TLTon` |
+| Oil | `USOon` |
+
+Admission checks pin the issuer manager, token runtime, implementation runtime, route pool and minimum round-trip
+result on two Ethereum RPCs at the review block. These checks do not guarantee future liquidity or execution.
+
+`GMEon` and `RDDTon` were excluded because no reviewed ETH route was available. `SPCXon` was excluded because its
+reviewed route did not satisfy the candidate's 90% round-trip floor.
+
+[Open the pinned asset and route configuration](https://github.com/0xprogrammable/programmable/blob/cdd102bed3d7556ab276ad381f54cbf6de8b2eab/config/stock-paired-assets.v2.json)
+
+## Mainnet evidence
+
+The candidate lifecycle was exercised against the deployed contracts on two independent Mainnet RPCs:
+
+- ETH-first launch through the reviewed Silver route;
+- fixed-supply token and v4 pool creation;
+- permanent position custody;
+- buy and sell execution;
+- creator claim in the quote asset; and
+- Programmable claim in the quote asset.
+
+[Launch transaction](https://etherscan.io/tx/0xc45d348083c53afaf79f056f1ea5529e9410ac3faa954a5c8ef7272a6371ec83) ·
+[Canary token](https://etherscan.io/address/0x369f5fa21942560c42Ba9FDb8a156F5C962BD2eC) ·
+[Pinned deployment evidence](https://github.com/0xprogrammable/programmable/blob/cdd102bed3d7556ab276ad381f54cbf6de8b2eab/contracts/deployments/mainnet-stock-paired-v2.json)
+
+The production interface was activated on 30 July 2026 in Vercel deployment
+`dpl_AiPs87jtBK71mY3obSoq8tRCQirb` at
+[app commit `d384e76`](https://github.com/0xprogrammable/programmable/commit/d384e76db1b52d9ae6e4c4143f57b0c92efd7d1b).
+Health, the public launch gate, Explore, Profile, receipt lookup and wrong-chain preflight rejection were checked on
+`programmable.family`. The Mainnet canary above remains the onchain lifecycle evidence.
+
+## Verification state
+
+Checked on 30 July 2026:
+
+| Contract | Address | Etherscan |
+| --- | --- | --- |
+| Quote registry | [`0xd38F…9239`](https://etherscan.io/address/0xd38Fbc171C1a842dc3F6d10cf5642BAe097D9239#code) | Exact Match |
+| Position planner | [`0x9372…4A3D`](https://etherscan.io/address/0x93728dF8288fC250294855F6D9dd28F8089E4A3D#code) | Similar Match |
+| Reward-vault factory | [`0x52d7…52d4`](https://etherscan.io/address/0x52d70971D6653a754c29385a2a6f241A481952d4#code) | Similar Match |
+| Hook factory | [`0x5C27…fBcB`](https://etherscan.io/address/0x5C2704C6eEaA2063d7a969BA7E557c87AEb1fBcB#code) | Similar Match |
+| Fee hook | [`0x90c6…A0cc`](https://etherscan.io/address/0x90c67C1E866f86526F0e338459cD435E1F23A0cc#code) | Similar Match |
+| Launcher | [`0x5eA6…0Daf`](https://etherscan.io/address/0x5eA6Be24838061bA45dbE8D82DE1b267DC240Daf#code) | Similar Match |
+| ETH coordinator | [`0xFb9E…0fD2`](https://etherscan.io/address/0xFb9E1034df6161088E8F358502B19E7515c30fD2#code) | Similar Match |
+
+Sourcify reports exact source matches for all seven contracts. Etherscan shows one Exact Match and six Similar Matches.
+An Uniswap routing review was submitted on 29 July 2026 and is pending. The contracts have not received an independent
+audit or public security contest.
+
+## Remaining gates
+
+The production interface is active. The public registry remains `candidate` until:
+
+1. the exact deployed source, version-bound specification, release manifest and deployment record are on the default
+ branch;
+2. the release evidence and validator record all seven exact Sourcify matches alongside the one Etherscan Exact Match
+ and six Similar Matches; and
+3. the Uniswap routing review is complete and the supported routes are checked again.
diff --git a/models/stock-paired/model.json b/models/stock-paired/model.json
new file mode 100644
index 00000000..9e1e0e6a
--- /dev/null
+++ b/models/stock-paired/model.json
@@ -0,0 +1,64 @@
+{
+ "$schema": "../schema/model.schema.json",
+ "schemaVersion": 1,
+ "id": "stock-paired",
+ "name": "Stock-Paired",
+ "status": "candidate",
+ "summary": "A fixed-supply token paired with one reviewed tokenized stock or ETF quote asset, with quote-asset rewards and permanently locked Uniswap v4 launch liquidity.",
+ "documentation": "models/stock-paired/README.md",
+ "currentRelease": null,
+ "releaseManifest": null,
+ "specification": null,
+ "deployment": null,
+ "security": "docs/security/STOCK_PAIRED_PROPERTIES.md",
+ "network": {
+ "name": "Ethereum",
+ "chainId": 1
+ },
+ "contracts": [
+ {
+ "deploymentKey": "quoteRegistry",
+ "name": "StockQuoteRegistryV2",
+ "address": "0xd38Fbc171C1a842dc3F6d10cf5642BAe097D9239"
+ },
+ {
+ "deploymentKey": "positionPlanner",
+ "name": "StockPairedPositionPlannerV1",
+ "address": "0x93728dF8288fC250294855F6D9dd28F8089E4A3D"
+ },
+ {
+ "deploymentKey": "feeSplitVaultFactory",
+ "name": "QuoteAssetFeeSplitVaultFactoryV1",
+ "address": "0x52d70971D6653a754c29385a2a6f241A481952d4"
+ },
+ {
+ "deploymentKey": "hookFactory",
+ "name": "QuoteAssetCreatorFeeHookFactoryV1",
+ "address": "0x5C2704C6eEaA2063d7a969BA7E557c87AEb1fBcB"
+ },
+ {
+ "deploymentKey": "feeHook",
+ "name": "QuoteAssetCreatorFeeHookV1",
+ "address": "0x90c67C1E866f86526F0e338459cD435E1F23A0cc"
+ },
+ {
+ "deploymentKey": "launcher",
+ "name": "StockPairedLaunchV1",
+ "address": "0x5eA6Be24838061bA45dbE8D82DE1b267DC240Daf"
+ },
+ {
+ "deploymentKey": "ethLaunchCoordinator",
+ "name": "StockPairedEthLaunchCoordinatorV1",
+ "address": "0xFb9E1034df6161088E8F358502B19E7515c30fD2"
+ }
+ ],
+ "review": {
+ "independentAudit": false,
+ "publicContest": false
+ },
+ "releaseGates": [
+ "Publish the exact deployed source, version-bound specification, deployment record and release evidence on the default branch.",
+ "Record all seven exact Sourcify matches and the one Etherscan Exact Match plus six Similar Matches in the available-release evidence and validator.",
+ "Complete the Uniswap routing review and repeat the supported-route checks."
+ ]
+}