Juno Voice

A public market for work the Juno community wants to fund.

Juno Voice combines social bounties with stake-weighted Hack Juno incentives:

request → fund → deliver → ratify → graduate → incentivize

Anyone can publish a bounded bounty and other accounts can contribute. Bounty contributors control settlement. Graduated projects and registered projects can participate in recurring gauge epochs in which Juno stakers direct a fixed budget using historical voting power.

Security and release status

Juno Voice v2 is an active security-remediation candidate. It is not deployed or authorized for funded use. The Program Vault must remain unfunded and no production epoch may be opened. An explicitly authorized, tightly capped canary is the only funded epoch permitted after the pre-canary gates in GOAL.md have passed.

The v2 release will be a fresh deployment at new deterministic addresses. No v1 state or funds will be imported. Deployment must prove that the new bounty and project sets are empty, the counters are initial, there is no open epoch, and the old system remains empty immediately before client cutover.

The previously deployed v1 contracts are historical, unfunded, and quarantined by the current security review. Their existence is not evidence that v2 is ready, and they must not be funded or used to open an epoch.

Historical v1 identities — do not fund or reuse for v2

Status recorded on 2026-08-11:

Component	Code ID	Historical contract address
Juno Voice bounty	5150	juno1jmngxh7kdelch3v5xu02ze2gup887v55csqns4qmxeskgy2ldl5qj494qw
Hack Juno registry adapter	5151	juno1pg3vxw74jdwyp9w8kzsjec87lkdfyrztvqnuyp3anyevyette7cq0p377n
Program Vault	5152	juno19uup47y5refnvl3qvq6kygcmuh2urgs40ty6kg32v9pgkpqsadasegg9jg
Juno-staked voting module	5153	juno1r6z5a6xggxsxgycv747e36td50pcpjf6vf9mpqrgnx4yeqnvzrtqwsjel2
Epoch-snapshot gauge	5154	juno1sz0m458ym24lzl3xga7j698jqq2x2mpvrjvleafzkkkxevf5x3dslwfdqn

The historical transaction and checksum record remains in repository history and in the captured frontend fixtures. Those values are test/history inputs, not production defaults for the v2 client.

What v2 changes

• Partial ballots spend only their actually allocated project share. They are never renormalized to exhaust the epoch budget.
• do-not-distribute, unallocated ballot power, exclusions, cap overflow, and rounding dust are retained in the Program Vault and reported separately.
• Epoch opening requires the full fixed budget. Every opened epoch has a bounded terminal path, including insufficient funds, public expiry, and reasoned governor abort.
• Project IDs are monotonically assigned numeric u64 values. Canonical gauge options use project:<id>.
• Bounty graduation receives the assigned ID through an atomic reply handshake, and replay protection is scoped to (source contract, bounty ID).
• Every project status change is checked against the shared bond invariant.

The normative sources are:

• Security remediation goal
• Security audit
• Backend architecture
• Security remediation ADR
• UX contract interface freeze
• Incentives and governance

Governance model

• Juno Network governance (x/gov) controls funding, upgrades, recovery, and the outer authority boundary.
• Program Vault is the treasury and execution shell administered by Juno governance. It does not create a second policy electorate.
• Agent Operations DAO performs bounded curation, project admission, nomination, suspension, and stop-only safety actions. It cannot release a multi-contributor bounty, increase a budget, resume a stopped system, or upgrade contracts.
• Bounty contributors decide whether pooled bounty escrow is paid.
• Juno stakers direct only the fixed Hack Juno allocation for an epoch.

Backend composition

Juno x/gov
  └─ externally administers Program Vault
       ├─ funds bounded Hack Juno epochs
       └─ authorizes upgrades, aborts, and emergency recovery

Juno Voice bounty contract
  └─ escrows contributions and atomically graduates candidates

Agent Operations DAO
  ├─ curates bounties and project applications
  ├─ graduates delivered projects
  └─ can stop or suspend, but cannot pay or resume

Project registry adapter
  └─ assigns numeric IDs and exposes bounded gauge options/payout messages

dao-voting-juno-staked + epoch-snapshot gauge
  └─ snapshots Juno stake and allocates a fully funded fixed epoch budget

The protocol accepts only native ujuno. It avoids arbitrary execution messages, per-bounty DAOs, transferable bounty shares, and unbounded option sets.

Repository shape

app/                    v2 browser client; production identity injected at build
contracts/              Juno Voice-owned CosmWasm contracts
deps/dao-contracts/     exact upstream DAO DAO source pin (submodule)
schema/                 preserved prototype/legacy schemas
docs/                   architecture, decisions, design, and runbooks
deployment/             guarded fresh-v2 planning and verification
integration/            exact-artifact scenario capture and validation
release/                release evidence, readiness, and decision gates
scripts/                deterministic build and Wasm validation

deps/dao-contracts is an independent Git submodule and is intentionally not a member of the root Cargo workspace. The repositories use different CosmWasm dependency generations and produce independent artifacts. Gauge changes must be accepted upstream before the root gitlink advances to the reviewed commit.

Clone with dependencies:

git clone --recurse-submodules https://github.com/juno-ai-dev/juno-voice.git
git submodule update --init --recursive

Browser client and cutover

The checked-in app implements the v2 wire surface, but it has no production contract defaults. Startup and production builds fail closed unless all five v2 address/code-ID/checksum triples, VITE_PROTOCOL_VERSION=v2, and an exact release commit are supplied. Transaction construction and the central signing allowlist use the same injected bounty, registry, and gauge addresses.

The manually dispatched Pages packaging job reads the public deployment identities from repository variables named V2_<COMPONENT>_CONTRACT_ADDRESS, V2_<COMPONENT>_CODE_ID, and V2_<COMPONENT>_CODE_CHECKSUM, where component is BOUNTY, REGISTRY, VAULT, VOTING, or GAUGE. Missing, malformed, duplicate, or non-v2 configuration stops the build before an artifact is uploaded. There is no automatic push-to- main deployment during remediation. Pull-request gates build only a clearly labelled, never-published historical test fixture.

The current GitHub Pages URL may still serve an earlier v1 artifact until an authorized v2 cutover is completed. Do not treat that URL as a v2 deployment or use it for funded actions.

Local verification

Use Node.js 22 and the frozen lockfile:

cd app
npm ci
npm run lint
npm run typecheck
npm test
npm run audit:all
npm run audit:production
npm run test:e2e

npm run build and npm run verify additionally require a complete v2 build environment. Use identities exported from a reviewed deployment verification; never substitute the historical v1 identities for a production build. Browser smoke tests use deterministic intercepted RPC responses and a test-only identity fixture, so they do not prove that a live RPC or deployment is healthy.

The Rust and release gates are described in release/README.md and deployment/README.md. Deterministic v2 artifacts are written below artifacts/v2/ and validated by scripts/validate-v2-wasm.sh.

License

MIT. See LICENSE.