0xprogrammable · 0xprogrammable · Jul 30, 2026 · Jul 29, 2026 · Jul 29, 2026
@@ -8,6 +8,7 @@ accounted for. [`models/registry.json`](models/registry.json) is the canonical m
 | Model | Lifecycle | Ethereum release | Documentation |
 | --- | --- | --- | --- |
 | Classic | **Available** | [`classic-v3`](releases/classic-v3/RELEASE.md) | [Open model](models/classic/README.md) |
+| Stock-Paired | **Candidate** | Deployed candidate | [Open candidate](models/stock-paired/README.md) |
 | Deep | **Design** | None | [Open design](models/deep/README.md) |
 
 `Available` means the exact source, parameters, deployment, runtime hashes and security status are public. It does not
@@ -34,6 +35,31 @@ buy and sell fees, direct native ETH rewards to as many as five wallets and may
 [Ethereum deployment](deployments/ethereum.json) ·
 [Security properties](docs/security/CLASSIC_PROPERTIES.md)
 
+## Stock-Paired
+
+<p>
+  <a href="models/stock-paired/README.md">
+    <img
+      src="assets/programmable-model-stock-paired.webp"
+      alt="A watercolor flower arch reflected in a quiet pool representing the Stock-Paired launch model"
+      width="100%"
+    />
+  </a>
+</p>
+
+**Production interface active. Repository release record pending.** Stock-Paired creates a fixed-supply token with one
+reviewed Ondo tokenized stock or ETF asset as the quote side of a permanently locked Uniswap v4 pool. Its 1.00% swap
+fee is accounted in the selected quote asset: 0.90% for the creator configuration and 0.10% for Programmable.
+
+The launched token is not a share and has no claim on the selected quote asset. The deployed release passed its
+Mainnet lifecycle canary and production interface checks. Its public registry remains `candidate` until the
+version-bound source and release records are on the default branch, the release verifier records the mixed explorer
+state and the routing review is complete. Sourcify reports exact matches for all seven contracts; Etherscan shows one
+Exact Match and six Similar Matches.
+
+[Behavior, assets and deployment state](models/stock-paired/README.md) ·
+[Security properties](docs/security/STOCK_PAIRED_PROPERTIES.md)
+
 ## Deep
 
 <p>
@@ -54,7 +80,8 @@ is reached. It has no deployed contracts and is not available for launch.
 ## Adding a model
 
 New models start at `design`. They become `candidate` only after source, tests, fixed parameters and security properties
-exist. They become `available` only after the exact Ethereum deployment and runtime evidence are published.
+exist. They become `available` only after the exact Ethereum deployment, runtime evidence and public activation checks
+are published.
 
 [Read the release process](RELEASING.md) ·
 [Create a model record](templates/model/README.md.template) ·

@@ -93,8 +93,9 @@ flowchart LR
     candidate --> design
 ```
 
-Only `available` models appear as production launch options. `design` and `candidate` records are public so incomplete
-work cannot be mistaken for a deployed product. The complete gate is documented in [`RELEASING.md`](RELEASING.md).
+`available` is the repository's final publication state. Production activation does not replace the required source,
+deployment and security records. Any model activated before those records reach `available` is identified in its model
+documentation. The complete gate is documented in [`RELEASING.md`](RELEASING.md).
 
 ## Build a launch model
 
@@ -132,6 +133,7 @@ contest.
 | --- | --- |
 | Current security status | [`SECURITY.md`](SECURITY.md) |
 | Classic trust boundaries and invariants | [`docs/security/CLASSIC_PROPERTIES.md`](docs/security/CLASSIC_PROPERTIES.md) |
+| Stock-Paired properties and publication gates | [`docs/security/STOCK_PAIRED_PROPERTIES.md`](docs/security/STOCK_PAIRED_PROPERTIES.md) |
 | Automated checks and incident process | [`docs/OPERATIONS.md`](docs/OPERATIONS.md) |
 | Independent review archive | [`audits/`](audits/) |
 

@@ -6,13 +6,20 @@ Classic is the only available launch model. Its current Ethereum release has uni
 regression and Mainnet-fork coverage. All seven release contracts are Etherscan exact matches and Sourcify matches.
 Classic has not received an independent smart-contract audit or public security contest.
 
+Stock-Paired is active in the production interface, while its public model registry remains `candidate` until the
+version-bound source and release records are on the default branch, the release verifier records the mixed explorer
+state and the routing review is complete. Its lifecycle canary passed on Mainnet and all seven contracts have exact
+Sourcify matches. Etherscan shows one Exact Match and six Similar Matches. Stock-Paired has no independent audit or
+public security contest.
+
 These records are evidence, not a safety guarantee.
 
 | Record | Scope |
 | --- | --- |
 | [Classic security properties](docs/security/CLASSIC_PROPERTIES.md) | Trust boundaries, permissions, accounting and invariant evidence |
 | [Classic Slither review](docs/security/SLITHER_CLASSIC_V3.md) | Static-analysis findings and manual dispositions |
 | [Classic release](releases/classic-v3/RELEASE.md) | Version-bound source, tests and Mainnet lifecycle evidence |
+| [Stock-Paired candidate properties](docs/security/STOCK_PAIRED_PROPERTIES.md) | Quote-asset accounting, issuer controls and remaining release gates |
 | [Operations](docs/OPERATIONS.md) | Automated checks, monitoring status and incident response |
 | [Independent reviews](audits/README.md) | Published external reports, currently none |
 | [Ethereum deployment](deployments/ethereum.json) | Addresses, transactions, runtime hashes and verification status |

@@ -5,6 +5,7 @@
 | `programmable-repository-cover-animated.gif` | Motion cover for GitHub surfaces that support animated images |
 | `programmable-repository-cover.jpg` | Static cover and reduced-motion fallback |
 | `programmable-model-classic.jpg` | Classic model artwork |
+| `programmable-model-stock-paired.webp` | Stock-Paired candidate artwork |
 | `programmable-model-deep.jpg` | Deep design artwork |
 | `programmable-builder-ecosystem.jpg` | Hook Builder Program artwork |
 

@@ -7,6 +7,7 @@
 | [Release process](../RELEASING.md) | Candidate and Ethereum availability gates |
 | [Security](../SECURITY.md) | Reporting policy, trust assumptions and current status |
 | [Classic security properties](security/CLASSIC_PROPERTIES.md) | Permissions, accounting, invariants and MEV boundaries |
+| [Stock-Paired security properties](security/STOCK_PAIRED_PROPERTIES.md) | Quote-asset accounting, issuer controls and release gates |
 | [Operations](OPERATIONS.md) | Automated evidence, monitoring status and incident response |
 | [Hook Builder Program](../BUILDER_PROGRAM.md) | External model submission and acceptance terms |
 | [Community conduct](../CODE_OF_CONDUCT.md) | Participation and moderation boundaries |

@@ -0,0 +1,119 @@
+# Stock-Paired security properties
+
+This document maps the intended Stock-Paired candidate properties to its deployed contracts and evidence. It is a
+review aid, not an audit report.
+
+## Trust boundaries
+
+```mermaid
+flowchart LR
+    creator["Token creator"] -->|"ETH launch"| coordinator["ETH coordinator"]
+    coordinator -->|"WETH / USDC / quote route"| v3["Uniswap v3"]
+    coordinator --> launcher["Stock-Paired launcher"]
+    launcher --> manager["Uniswap v4 PoolManager"]
+    launcher --> position["Permanent position custody"]
+    manager -->|"v4 callbacks only"| hook["Quote-asset fee hook"]
+    hook --> vault["Creator reward vault"]
+    hook --> treasury["Programmable treasury"]
+    issuer["Quote-asset issuer"] -->|"manager and token controls"| quote["Tokenized quote asset"]
+    quote --> coordinator
+    quote --> manager
+```
+
+The registry, planner, factories, hook, launcher and coordinator are non-upgradeable Programmable contracts. The V2
+registry is ownerless and fixes exactly eleven accepted quote-asset addresses at construction.
+
+The tokenized quote assets are external contracts. Their issuer can retain pause, transfer, upgrade, eligibility,
+custody or jurisdiction controls outside Programmable. Passing the registry checks does not remove those dependencies.
+
+## State and authorization
+
+| Action | Authorized caller | Effect |
+| --- | --- | --- |
+| Launch | Any wallet satisfying the launch parameters | Creates one token, reward vault, v4 pool and locked position |
+| Register a pool | Its recorded launcher | Binds the pool to its quote asset and reward vault |
+| Enter hook callbacks | Uniswap v4 `PoolManager` | Applies the fixed quote-asset fee |
+| Claim creator rewards | An immutable beneficiary | Pays only that beneficiary's quote-asset entitlement |
+| Change a payout address | The beneficiary for that allocation | Changes only its own claim destination |
+| Claim Programmable rewards | Immutable treasury | Pays the treasury or its selected destination |
+| Change quote assets or routes | No configured actor | Requires a new deployment |
+| Remove or transfer launch liquidity | No configured actor | Position custody has no operator and a maximum timelock |
+
+Creator reward beneficiaries and shares are fixed at launch. Each beneficiary controls its own payout address. A reward
+claim transfers the selected quote asset; an interface conversion to ETH is a separate transaction with a fresh quote,
+deadline and minimum output.
+
+## Fee accounting
+
+For gross quote-asset amount `x`:
+
+```text
+totalFee       = floor(x × 100 / 10,000)
+programmable   = floor(x × 10 / 10,000)
+creatorRewards = totalFee - programmable
+```
+
+The fixed total is 1.00%. The creator configuration receives 0.90% and Programmable receives 0.10%. The Programmable
+share is deducted from the total. It is not added on top.
+
+The launched token has no transfer tax and the v4 pool's LP fee is zero. Unsupported partial fills revert rather than
+leaving fee accounting ambiguous.
+
+## Quote-asset admission
+
+Before deployment, the candidate checked each quote asset against:
+
+1. acceptance by the issuer's token manager;
+2. pinned token, beacon, implementation and manager runtime hashes;
+3. the expected symbol and 18 decimals;
+4. the exact Uniswap v3 USDC pool, fee tier and pool runtime;
+5. a `0.01 ETH` WETH to USDC to quote asset and back route returning at least 90% of input; and
+6. agreement between two Ethereum RPCs at one block.
+
+Before each new launch, the ownerless registry repeats the manager-acceptance, shared-runtime, token-runtime, decimals
+and symbol checks. A failed check stops new launches for the affected asset. It cannot freeze an existing pool or
+override issuer controls.
+
+The round-trip floor is an admission rule, not a promise of future route depth, price or execution.
+
+## Position and coordinator boundaries
+
+Token creation, pool initialization, reward-vault deployment, complete launch-position custody and the initial buy
+execute as one launch flow. The ETH coordinator converts the caller's ETH through immutable v3 route definitions,
+approves only the amount passed to the launcher and clears the approval after launch. It retains no user balance after
+a successful call.
+
+A launch transaction remains exposed to normal public-mempool ordering, delay and censorship. Every conversion still
+needs an unexpired deadline and explicit output floor.
+
+## Current evidence
+
+The deployed candidate passed:
+
+- deterministic registry, launch, fee-accounting and reward-vault tests;
+- fuzz and invariant coverage for quote-asset accounting;
+- pinned Mainnet-fork deployment and lifecycle tests;
+- a two-RPC route audit across all eleven included assets;
+- an ETH-first Mainnet canary with buy, sell, creator claim and Programmable claim; and
+- permanent launch-position custody checks.
+
+The production interface activated the exact deployed release on 30 July 2026. Health, the public launch gate,
+Explore, Profile, receipt lookup and wrong-chain preflight rejection passed production checks.
+
+The exact candidate source and test tree is fixed at
+[`stock-paired-v2`](https://github.com/0xprogrammable/programmable/tree/stock-paired-v2/contracts).
+The Mainnet evidence is linked from the [model record](../../models/stock-paired/README.md).
+
+## Manual review boundaries
+
+- The launched token is not a share and does not grant a claim on the quote asset.
+- Quote-asset holders depend on the external issuer, custodian, transfer rules and eligible jurisdictions.
+- A registry check can block future launches after issuer or runtime drift, but cannot repair an existing pool.
+- Pinned v3 routes can become illiquid or economically unusable after deployment.
+- A broken router, RPC, indexer or metadata service can affect access and visibility without changing pool state.
+- Sourcify reports exact matches for all seven contracts; Etherscan shows one Exact Match and six Similar Matches.
+- The Uniswap routing review is pending.
+- No independent audit or public security contest has been completed.
+
+Stock-Paired remains a `candidate` until every release gate in
+[`models/stock-paired/model.json`](../../models/stock-paired/model.json) is complete.
@@ -1,7 +1,7 @@
 {
   "$schema": "./schema/registry.schema.json",
   "schemaVersion": 1,
-  "updatedAt": "2026-07-29",
+  "updatedAt": "2026-07-30",
   "statuses": [
     "design",
     "candidate",
@@ -17,6 +17,14 @@
       "manifest": "models/classic/model.json",
       "documentation": "models/classic/README.md"
     },
+    {
+      "id": "stock-paired",
+      "name": "Stock-Paired",
+      "status": "candidate",
+      "summary": "A fixed-supply token paired with one reviewed tokenized stock or ETF quote asset, with quote-asset rewards and permanently locked Uniswap v4 launch liquidity.",
+      "manifest": "models/stock-paired/model.json",
+      "documentation": "models/stock-paired/README.md"
+    },
     {
       "id": "deep",
       "name": "Deep",

@@ -0,0 +1,104 @@
+# Stock-Paired
+
+**Status:** Candidate<br>
+**Deployment:** Ethereum Mainnet<br>
+**Public interface:** Active since 30 July 2026
+
+Stock-Paired creates a new fixed-supply token and pairs it with one reviewed Ondo tokenized stock or ETF asset in a
+Uniswap v4 pool. The complete launch position is placed in permanent custody.
+
+The token created by Programmable is not a share, is not redeemable for the selected quote asset and carries no rights
+in the underlying company, fund or security. The tokenized quote asset remains subject to its issuer's terms and
+controls.
+
+[Model manifest](model.json) ·
+[Security properties](../../docs/security/STOCK_PAIRED_PROPERTIES.md) ·
+[Immutable deployed source](https://github.com/0xprogrammable/programmable/tree/stock-paired-v2/contracts) ·
+[Launch Stock-Paired](https://programmable.family/launch)
+
+## Fixed behavior
+
+- Supply is fixed at 1,000,000,000 tokens.
+- The launch pool uses one approved quote asset and the Stock-Paired v4 hook.
+- The total swap fee is 1.00% of the quote-asset side.
+- Creator rewards receive 0.90%; Programmable receives 0.10%.
+- Creator rewards may be split across up to eight immutable beneficiaries.
+- Rewards accrue in the quote asset. Converting a claim to ETH is a separate routed transaction.
+- The launch token has no transfer tax. The v4 pool's LP fee is zero.
+- The one-sided launch position cannot be removed, transferred or approved by a configured operator.
+- The ETH coordinator converts the initial ETH through pinned Uniswap v3 routes before calling the launcher.
+
+## Reviewed quote assets
+
+The current candidate fixes eleven quote assets:
+
+| Asset | Token |
+| --- | --- |
+| NVIDIA | `NVDAon` |
+| S&P 500 | `SPYon` |
+| Alphabet | `GOOGLon` |
+| Silver | `SLVon` |
+| Tesla | `TSLAon` |
+| Apple | `AAPLon` |
+| Alibaba | `BABAon` |
+| Copper Miners | `COPXon` |
+| Circle | `CRCLon` |
+| 20+ Year Treasuries | `TLTon` |
+| Oil | `USOon` |
+
+Admission checks pin the issuer manager, token runtime, implementation runtime, route pool and minimum round-trip
+result on two Ethereum RPCs at the review block. These checks do not guarantee future liquidity or execution.
+
+`GMEon` and `RDDTon` were excluded because no reviewed ETH route was available. `SPCXon` was excluded because its
+reviewed route did not satisfy the candidate's 90% round-trip floor.
+
+[Open the pinned asset and route configuration](https://github.com/0xprogrammable/programmable/blob/cdd102bed3d7556ab276ad381f54cbf6de8b2eab/config/stock-paired-assets.v2.json)
+
+## Mainnet evidence
+
+The candidate lifecycle was exercised against the deployed contracts on two independent Mainnet RPCs:
+
+- ETH-first launch through the reviewed Silver route;
+- fixed-supply token and v4 pool creation;
+- permanent position custody;
+- buy and sell execution;
+- creator claim in the quote asset; and
+- Programmable claim in the quote asset.
+
+[Launch transaction](https://etherscan.io/tx/0xc45d348083c53afaf79f056f1ea5529e9410ac3faa954a5c8ef7272a6371ec83) ·
+[Canary token](https://etherscan.io/address/0x369f5fa21942560c42Ba9FDb8a156F5C962BD2eC) ·
+[Pinned deployment evidence](https://github.com/0xprogrammable/programmable/blob/cdd102bed3d7556ab276ad381f54cbf6de8b2eab/contracts/deployments/mainnet-stock-paired-v2.json)
+
+The production interface was activated on 30 July 2026 in Vercel deployment
+`dpl_AiPs87jtBK71mY3obSoq8tRCQirb` at
+[app commit `d384e76`](https://github.com/0xprogrammable/programmable/commit/d384e76db1b52d9ae6e4c4143f57b0c92efd7d1b).
+Health, the public launch gate, Explore, Profile, receipt lookup and wrong-chain preflight rejection were checked on
+`programmable.family`. The Mainnet canary above remains the onchain lifecycle evidence.
+
+## Verification state
+
+Checked on 30 July 2026:
+
+| Contract | Address | Etherscan |
+| --- | --- | --- |
+| Quote registry | [`0xd38F…9239`](https://etherscan.io/address/0xd38Fbc171C1a842dc3F6d10cf5642BAe097D9239#code) | Exact Match |
+| Position planner | [`0x9372…4A3D`](https://etherscan.io/address/0x93728dF8288fC250294855F6D9dd28F8089E4A3D#code) | Similar Match |
+| Reward-vault factory | [`0x52d7…52d4`](https://etherscan.io/address/0x52d70971D6653a754c29385a2a6f241A481952d4#code) | Similar Match |
+| Hook factory | [`0x5C27…fBcB`](https://etherscan.io/address/0x5C2704C6eEaA2063d7a969BA7E557c87AEb1fBcB#code) | Similar Match |
+| Fee hook | [`0x90c6…A0cc`](https://etherscan.io/address/0x90c67C1E866f86526F0e338459cD435E1F23A0cc#code) | Similar Match |
+| Launcher | [`0x5eA6…0Daf`](https://etherscan.io/address/0x5eA6Be24838061bA45dbE8D82DE1b267DC240Daf#code) | Similar Match |
+| ETH coordinator | [`0xFb9E…0fD2`](https://etherscan.io/address/0xFb9E1034df6161088E8F358502B19E7515c30fD2#code) | Similar Match |
+
+Sourcify reports exact source matches for all seven contracts. Etherscan shows one Exact Match and six Similar Matches.
+An Uniswap routing review was submitted on 29 July 2026 and is pending. The contracts have not received an independent
+audit or public security contest.
+
+## Remaining gates
+
+The production interface is active. The public registry remains `candidate` until:
+
+1. the exact deployed source, version-bound specification, release manifest and deployment record are on the default
+   branch;
+2. the release evidence and validator record all seven exact Sourcify matches alongside the one Etherscan Exact Match
+   and six Similar Matches; and
+3. the Uniswap routing review is complete and the supported routes are checked again.