Selling credit, points across platforms, login/claim, 30-day plan · content/release_and_points.md

Release & Sell — tokens, points across platforms, login/claim, security

Date: 2026-09-09 · Companions: content/testing_roadmap_and_strategy.md (brainstorm), qalclaim/ (the built system), 03_qals_architecture/SECURE_OPS.md, 06_bank_exchange/AU_TOKEN_LAW_PLAYBOOK.md.

1. How you release and sell the tokens yourself (the operating model)

The one-sentence version: you don't sell tokens — you sell prepaid service credit, and the credit IS the product.

your payment platforms ──top-up──► program ledger (loopd)
                                     │  enforced: 500K Qals hard cap (402 past it)
                                     │  every sale tracked to the cent
                                     ▼
                               user credit balance
                                     │  spend on: compute · inference · renders ·
                                     │  locked content · channels · qalarc services
                                     ▼
                               redemption (qalredeem)
                                      service value + redemption fee + Church dust
                                      — every cent auditable, records anchored

Your checklist to go live with real money (in order):

1. Terms of Use (prepaid credit framing, no secondary market, fees disclosed) — lawyer-reviewed.
2. Payment platform integration. The platform's webhook hits loopd /topup (HMAC), and the program ledger records the sale. Your platforms already handle card rails; loopd is the system of record. Reconcile daily — the script exists (see the redemption report).
3. The cap is already law in code — nothing to configure. Re-evaluation is a deliberate act: change program.json and write a governance note.
4. Price — AU$1.00 flat. Discount SERVICES, never the money — that keeps the parity clean and the lawyers happy.
5. What stays off until VASP: external transferability, third-party listings, cash-out. All are approved-by-you Phase 3 destinations, sequenced behind registration.

2. Points across your platforms — the architecture that's now built

Unified points = QALS cents via qalclaim (:8836). Every platform is an issuer; every user has ONE wallet handle; points flow to the handle and are claimed by the user.

Why this beats per-app point silos: users get one balance they can actually spend — on real services. The system gets one identity and one audit trail, so no five databases drift apart. And marketing spend becomes reserve-backed credit that converts to usage — not a liability game.

3. Login / claim — how it actually works and stays secure

Login (tiered, by design): - Apps keep their existing auth (OAuth etc.) — points bind to a Qal handle at award time. - The wallet proves handle ownership via a loopd challenge (the same ensure/claim handshake qalchat uses) — that's the "sign in with Qal ID" v1. - Next tier: passkeys/WebAuthn for the wallet (hardware-backed; nothing phishable) — SECURE_OPS §1. - Agents: HMAC keys today → DIDs.

Claim (built & tested):

platform issues points (HMAC-signed) → qalclaim stores issue
        → user gets claim link/QR: qalclaim://claim?t=…&exp=7d
        → claim in wallet: proves handle ownership
        → single-use registry check → expiry check → binding check
           (only the awarded handle can claim — stolen links are worthless)
        → credit transfers to user's account → claim record ANCHORED
        → replay attempt → 409 with the original receipt id

Security properties (all tested): single-use, handle-bound, expiring, issuer-HMAC'd, rate-limited (5 fails/hour → lockout), anchored. One trust root remains: issuer keys. The compromise drill and rotation path are documented in qalclaim/README.

4. The brainstorm picks that shaped this (from the strategy doc)

Ranked ideas that won: (1) sell credit not tokens; (2) earn-drops over discounts; (3) provider/creator rebates during bootstrapping (reserve-safe); (4) channel sponsorship locks. Rejected-for-now: public sale, yield on holdings (MIS trap), secondary markets pre-VASP, expiring credit (breakage games — we keep clean hands).

5. The 30-day release plan (if you said go)

• Week 1: Terms of Use draft + lawyer engagement; payment-platform sandbox webhook → loopd topup; wallet passkeys build starts.
• Week 2: qalclaim live on ONE platform (qalarc.ai) with real awards; claim flow in the wallet UI; reconciliation dashboard.
• Week 3: second platform + provider rebates; chaos drill (cap/lockout/revocation on stage); audit the claim issuer keys ceremony.
• Week 4: small live cohort (≤100 users, capped AU$100 each), watch redemption mix + support load; then scale decisions. Real money only after the lawyer sign-off gate — non-negotiable.