v0.7.0

v0.7.0 - Dōjō hold snapshot and its verifier, site documentation, a committed Ukemi stratum

This release follows v0.6.0 and the README updates published after it. It adds to this repository the reader's verifier of the MONARK Dōjō, whose host now serves a first daily hold snapshot, signed and chained; it adds a documentation section to the site; and it carries the committed calibration of one stratum of Ukemi's gate class.

What is served

• A new host, https://dojo.monarkgate.tech, publishes the MONARK Dōjō hold snapshot: a dated, public record of the MONARK token balances held by each address, read from the chain through two distinct operators, with a hold score per address. Each line of its timeline is signed with Ed25519 and carries the hash of the line before it; a day's lines file is bound to its signed line by its SHA-256, its count and its Merkle root. The copy committed with this release holds the first daily snapshot (day 2026-10-02, counted, four of four scheduled readings) and a history file that rebuilds the earlier days from the token's creation. The hold snapshot stays upcoming in the Dōjō register, and its page shows that status.
• The reader's verifier is exported to this repository with the public keyring it takes as its trust root: node apps/dojo/scripts/dojo-verify-cli.mjs --url https://dojo.monarkgate.tech --keyring apps/dojo/keys/dojo-keyring.json (a local copy of the served tree can replace --url). From the served files alone it recomputes the signed chain of the timeline (Ed25519 signatures under the supplied keyring, the chaining, the key windows), every unit version, the history file, the lines of every snapshot and their Merkle root, and, on request, the inclusion proof of one address (--address) and a past day (--day). It does not replay the collection: the readings are what two operators reported, and a signature attests origin, never the truth of the readings. It does not read the chain, does not check the BLS signature of the public randomness beacon (its report says so), and does not replay the conformity check of the host's deployment; the collector, the publisher and that check stay out of this export.
• The served gate class liquidation-eligible-coverage holds a committed calibration for one stratum of one recorded episode, as read from the served harness: for a caller-carried liquidable amount in that stratum it returns a conformal upper bound, whose lower edge is 0 by construction, and the three other strata abstain (under_calib). The bound holds only if the amount was produced by the frozen close-factor rule, which the gate does not check, and no coverage is claimed on any other event; the served description says both. The cascade tool stays transitional and abstains by construction.
• Beside the Narabi tracker, https://monarkgate.tech/narabi/instrument.json is a diagnostic file written once from a closed block of days, never by the daily job: tracker replays at alternative parameters, and a one-sided CUSUM on the static misses assessed by a permutation test of exchangeability. It is not the official tracker, it claims no bound, and no page reads it.
• MONARK Bell's published records have their own anchors register, beside the register of the counter-verification run: line 2 of the Bell timeline, the latest publication in the committed copy, has a manifest (the line's hash, the hash of the timeline up to that line, the digests of the state and provenance files it names) and an OpenTimestamps proof, both served under /bell/anchors/. Read with the site's own reader, the proof records Bitcoin blocks. An anchor shows that the line and every line before it existed before that block; it does not show that the facts are true, nor when the data was collected.

What changed in the code

• Site, documentation: a new section at /docs, in eleven sections (overview, the gate, the pieces, MONARK Bell, Ukemi, Narabi, integrators, use cases, DeFi research, verify it yourself, glossary), with one page for each of the eleven pieces of the register. Names, statuses and counts are read from the register and figures from committed, hashed data; the research page states literature results in words, attributed to a committed bibliography that gives the reading level reached for each work.
• Site, applications and navigation: /applications replaces /products, which redirects to it permanently. MONARK Bell, the built application, has a card with its served note, its latest signed record and links to its page and to its signed timeline; the upcoming applications stay placeholders. The header reads Applications, Fleet, How it works, Building (the /roadmap page, now titled MONARK Building), Token, Integrators, Docs and Dōjō snapshot; the footer follows. The home page and MONARK Building derive the count of frozen contracts from the schemas and name the one not served yet.
• Site, Dōjō: /dojo renders the hold snapshot from a committed, hashed copy of the served files, with the register's status beside the program's name. A browser that can check Ed25519 signatures rereads the published timeline and lines file and replaces the committed figures only when every check holds; the table of lines and the address look-up run in the browser, and the address entered is not sent anywhere. The token page links to it.
• Site, Narabi: /narabi opens on a committed capture of the two published files, which replaces the former snapshot module, with its checks recomputed at build; it then rereads the files as served and recomputes each line's hash, the chain, and that the timeline served now extends the captured one byte for byte. Each line's list of endpoint URLs is kept as a count only. The home page and /fleet carry a freshness line for Narabi: the day of the last published window, the tracker step and whether a window is late, judged against the committed publication schedule and the external probe's deadline.
• Site, Ukemi: /ukemi shows the figures of the committed stratum (calibration points, bound margin, calibration digest, the day the served verdict was read), read from two committed, hashed files that must agree, or the build fails; the committed course report adds the digests of its inputs, and the fleet panels describe the gate's bound as delivered only once a calibration is committed.
• Site, Bell: /bell is rebuilt around what the host serves (the host, the key, the first record, the latest publication and its per-session rows, read from the files bound to the signed line) and states the latest record's timestamp state as read from its proof file. The hero scene is a native component that pauses out of view; the framed scene file it replaces is removed. A section to request a symbol or early access carries a copyable template. /bell/method states the served schema, and /bell/terms reads its last-updated date from committed data.
• Site, served facts and wording: /integrators and /console read the committed, hashed facts of the served harness, and the site's data manifest pins every new committed file by its SHA-256, the build failing on a mismatch. B_t is described as the served gate treats it: carried by the caller, sent with each call and returned unchanged, with an abstention when it is below the caller's floor; the gate simulation says that it spends B_t only inside the simulation. How it works adds the narrower statement the gate serves for its one class calibrated on measured flow. Shōgen's served scope reads the same on three surfaces: the attest tool and its one committed witness, while the full sensor is under test and not served. The site's description reads two sides, one engine. Source comments drop internal record references, and the component provenance file records the new components.
• Harness: the liquidation-eligible-coverage registry gains its committed stratum, written by an emitter from the output of a frozen generator, never by hand, and checked against its pinned digest at load; strata under one hundred calibration points are not committed. The gate tests now expect the committed clause and the abstention on the other strata. The harness README documents the optional caller-carried attestation of the gate envelope and the committed calibrations. The episode's input series are not in this export; the export manifest names them.
• Sentinel: a separate instrument-replay entry rebuilds instrument.json offline with its own digest. It refolds every window through the attest and step engine of the daily job, fails closed on the first defect, never writes state.json, and refuses an output under a public directory without --publish. The daily job reads an optional host exclusion list, MONARK_SENTINEL_EXCLUDE_HOSTS, for the archive gap draw only: an excluded host leaves the read pool and the published provenance, and a name that is not a host of the pool stops the run at start-up. Test stubs route by exact hostname.
• rpc-guard: ledger format 2 adds a settled line, the signed difference between the cost reserved before a call and the cost billed on the response, for a method metered on the results it returns (a received failed response costs nothing), and a course_reconciled line: reconcile can close the window of one course (--course-end, the hash of that course's unlocked line) and prints a per-method table. The first append of a new ledger writes its genesis head before its first line. The transport gains an opt-in bounded body read (one deadline for head and body, a byte cap); a closed list of exact hosts for the URL of the operator that carries a key, any other host being refused with a fixed reason, never the URL, before any request; and two keyless relays of the public randomness beacon named in the Dōjō anchor, one host and one closed path each, with an optional per-cycle attempt cap for keyless operators. The package index exposes only the relay labels. Six new test files come with these changes.
• Bell: the deployment check of the host accepts, in import mode, a closed set of two web-server configuration lines, Bell's own and the Dōjō's, each at most once. The publisher's comment on bare labels now names the cash-leg labels; its code is unchanged.
• Repository: the CI workflow grants every job read access to the repository contents and nothing more, and one job checks out the full history. The export script names the ten exported Dōjō files one by one. The language gate now scans the site's documentation route and skips a local tool folder at the repository root. The storefront vocabulary gate adds operator and venue names and a word of assurance in any form to its bans, and the harness scope retires one exemption. The post-build page check also asserts /dojo against the committed record and the Bell timestamp state on the built pages. The site framework packages move to 16.3.8, with two transitive patch updates in the lockfile. The pinned end-to-end trace is re-pinned on two fields: its tools listing carries the committed-state gate description, and the attest step's note names the Shōgen verifier; every served decision and digest in it is unchanged. The test command and the type-check list also name the Dōjō's sources and tests, which stay out of this export. The export manifest lists 516 files and names the tests and data files left out.
• README: the Ukemi row and bullet state the committed stratum and its conditions; the Narabi row says the reading is stated after the fact, never ahead of it; the served-surfaces table and the Narabi bullet add instrument.json; the served-surfaces table adds a row for the Dōjō host, and Verify it yourself adds a bullet with the verifier command.

Reading rules (unchanged): facts witnessed, not investment advice; a signature attests origin, not truth; no endorsement of or by any venue, issuer or data source; never a probability of being right.