Live systems inventory, apps, build-wave summaries, feasibility status, gates · 10_roadmap/README.md
QALS Roadmap — Systems, Apps & Feasibility Status
Updated: 2026-09-13 (post hardening + tokenomics build wave) · Full plan detail: content/implementation_plan.md (PDF in dist/) · Tokenomics engineering position: ../05_defi_trading/TOKENOMICS_INTEGRATION_ROADMAP.md
1 · Project overview
QALS is qalarc's private, closed-loop value network: an AU$1-reserve-backed credit token (B-QALS, burned on use) + finite rewards token (G-QALS), running on Qalnet — a private chain that is a pristine shallow clone of iotaledger/iota (all qalarc logic lives in three qal_* Move packages; upstream stays untouched). Every qalarc app, AI agent, user and GPU hour settles in one unit on this stack. The thesis: fork the free infrastructure, not the failed tokenomics. Supply: 1,000,000 QALS max, 500,000 sellable (50M¢ cap), 10¹² doofs (1 QALS = 10⁶ doofs). Redemption is services-only in Phase 1–2 (prepaid carve-out); cash-out is deferred until the AUSTRAC/licensing gate (../06_bank_exchange/AU_TOKEN_LAW_PLAYBOOK.md).
2 · Systems inventory — what is RUNNING (12 services + chain, hub = superlocal)
| # | System | Port | What it does | Proof status |
|---|---|---|---|---|
| 1 | Qalnet chain (qalnet-dev-1) | 9000 | IOTA-fork devnet; qal_data anchors, qal_credit accounts, qal_reserve cap gate (on-chain twin being redesigned genesis-preminted + transfer-gated) |
11/11 Move tests + live lifecycle tests |
| 2 | loopd (money rails) | 8823 | Paper B-QALS ledger: agents, holds/escrow, settle, transfer; issuer wallet qals:issuer — pre-endowed supply, sales transfer out (fail-closed) |
demo + all money suites green |
| 3 | qmarket (compute market) | 8824 | Provider registry, escrowed jobs, disputes, slash/delist; 0% fee policy | v2 suite 30/30 incl. adversarial provider |
| 4 | provider adapter | 8850 | Remote execution for providers | in v2 suite |
| 5 | relay1 qalchat (E2EE messaging) | 8830 | Ciphertext-blind relay, X25519+HKDF+AES-GCM+Ed25519, Merkle anchoring; PoP mailbox auth (strict) | 38+49+36+53 assertions |
| 6 | qalpub (public layer) | 8832 | Public channels, paid unlocks (ECIES), workspaces; private invite-gated channels | 42+54+10 assertions |
| 7 | qalbazaar (agent market) | 8834 | Offers, escrowed agent-to-agent trade, ratings | 51 assertions |
| 8 | qalredeem (redemption) | 8835 | Services-only redemption, exact accounting (fee+dust splits) | 62 assertions |
| 9 | qalclaim (points→credit) | 8836 | Issuer escrow, handle-proof claims | 28 assertions |
| 10 | qalbridge (phone/transcripts) | 8837 | Bearer-auth transcripts/files for the phone UI | 6 assertions + traversal-refused |
| 11 | qalid (digital identity) | 8838 | did:qal: docs, challenge-proofs, chain anchoring, devices/agents |
42 assertions + negatives |
| 12 | qalpay (fiat on-ramp) | 8839 | PSP webhooks→credit, escrow per platform, refunds; per-buyer purchase caps | 34 + 64 assertions |
| 13 | qalx (gateway + EXCHANGE) | 8843 | Gateway + paper AMM (QALS/qAUD), qalid login, deposits/withdrawals | 72 assertions, oracle-verified math |
| — | relay2 (fleet, cachyos-x8664) | 8840 | Second relay, tailnet-reachable, PoP-hardened | cross-machine 401 verified |
| — | gmux-bridge | 8842 | gmux panes ↔ capped wallets, alerts→phone | 13/14 (display backlog) |
3 · Apps layer
- Qal Wallet (wallet-app) — Tauri 2 desktop app unifying wallet + messenger + compute + public layer + passkeys (WebAuthn verifier in Rust). Smoke 37/37. v7.
- Phone UI —
qalbridge/phone.html: chat, balance, catalog, send from the phone over the tailnet. - Control-room web suite —
website/ui-codex/: The Vault (ledger visual), The Loom (live chain view), Qalx floor, Ask-QALS assistant, hub directory, showcase, comparisons. - Public site —
website/site/landing.html+ llms.txt + buy page; deployed wiki mirror atqalarc.com/projects/qals/.
4 · The 2026-09-12/13 build wave (all test-proven, on qalarc/qal-network private GitHub)
Security hardening
- Relay proof-of-possession mailbox auth fleet-wide (hub + relay2): unauthenticated GET/DELETE of messages/files now 401; ±120s window, single-use nonces, fail-closed modes (strict/transition/off). 12/12 dedicated suite.
- loopd issuance fail-closed (admin key required; paper mode explicit opt-in; 2026-09-15: sales transfer from the pre-endowed issuer wallet qals:issuer) + state files 0600 + true HTTP status codes. Redteam C1 closed.
- keys/ledger perms, identity-restore tooling (scripts/restore_service_identities.sh), path-traversal already refused.
Money & tokenomics
- Per-buyer purchase caps in qalpay: lifetime (default 1,000 QALS) + rolling windows, live-patchable per platform, replay-safe, admin tables. 64 assertions. (Anti-domination policy: caps issuance per person, not usage — spend caps now default UNCAPPED, owner-settable.)
- qalx EXCHANGE seed (paper): constant-product AMM QALS/qAUD, 0.3% fee, slippage guard, LP shares, qalid challenge-proof login, receipt-polling deposits, conservation invariant proven. 72 assertions.
- Program cap era-reset: sold counter now tracks real issuance only (test era archived); MAIN WALLET qalarc-main (seed-backed, mnemonic off-repo 0600, runbook MAIN_WALLET.md).
- 0% marketplace fee policy aligned across code/tests/docs (token spread is the margin).
Durability & messaging
- Anchor era checkpoints: regenesis no longer orphans audit history (era-1 sealed over 1,283 anchors; tamper-detection never weakens). 7/7.
- GROUP DMs (phase b): sender-fanout pairwise E2EE groups in qalchat (group-new/gsend/grecv/group-invite/group-leave/groups), TOFU adoption, leave enforced. 36 assertions + 38 regression.
- Private invite-gated channels (phase c) on qalpub: channel-key ECIES wraps, member-only reads, revoke+rotate with era separation. 10 assertions incl. cryptographic era proof.
- Fleet relay2 hardened + deployed over SSH with rollback record (relay2_upgrade_20260912/DEPLOYED.md).
5 · Technical feasibility status
| Capability | Status | Evidence |
|---|---|---|
| Private chain + Move packages | ✅ proven | 11/11 Move tests; live anchor/credit lifecycle on devnet |
| Tamper-evident data anchoring | ✅ proven (+era-sealed across regenesis) | qalpipe suites; 1,253+ anchors |
| E2EE messaging (DMs, files ≤8MB) | ✅ proven | 176 assertions across 4 suites; ciphertext-blind relay byte-proven |
| Group messaging (private) | ✅ built (fanout + invite-channels) | 36 + 10 assertions; MLS is the convergence upgrade |
| Digital identity (DIDs + proofs) | ✅ proven | 42 + 39 assertions; replay/tamper/impostor all fail-closed |
| Paper money rails (escrow/settle/caps) | ✅ proven | 1,100+ receipts reconcile; adversarial compute suite |
| Fiat on-ramp (PSP webhooks) | ✅ mechanism proven, not connected (no real PSP configured) | qalpay suites; platforms.json empty |
| On-chain credit/reserve | 🟡 written+tested, not authoritative | migration importer is the gap; loopd JSON is ledger-of-record today |
| AMM exchange (paper qAUD) | ✅ seed proven | oracle-verified math; custodial v1 (admin withdrawals) |
| On-chain AMM + renunciation | 🔵 designed | qal_amm Move package next; committee key ceremony |
| Multi-fiat stables (USD/CNY) | 🔵 deferred by design | one reserve/jurisdiction first (qAUD) |
| Compute marketplace | ✅ economics proven, supply thin (1 real provider) | bb-mini installer ready; minirig offline |
| Real-money issuance | 🔒 gated | Gate A: PSP + caps active + proof-of-reserves page + playbook sign-off |
6 · Phase plan (gates, not dates)
- Gate A — before any real AUD: PSP platform configured · per-buyer caps ACTIVE · proof-of-reserves dashboard · legal playbook sign-off.
- Gate B — cap raise / qAUD growth:
qal_reserverepublished (corrected 50M¢ cap + on-chain deposit registry) · loopd→qal_creditmigration importer · accountant AUP cadence. - Gate C — decentralization:
qal_ammMove package · 3-of-5 committee keys · admin removal (renunciation). - Continuous: fleet compute supply (bb-mini, minirig repair), fact-display surfaces for reserves/AMM, red-team rounds on new money surfaces (qalx first), MLS group upgrade when scale justifies.
7 · Known open items (ranked)
- 🔴 qalx is money-adjacent and new — needs a dedicated red-team round before any real flow.
- 🟠 On-chain
qal_reservestill carries the stale 50B¢ cap + events-only replay defense (Gate B). - 🟠 Buyer-key Sybil reality (email-based) — qalid binding at purchase is the fix (designed).
- 🟠 Compute supply: 1 real provider; fleet onboarding is the cheapest capacity win.
- 🟡 gmux-bridge per-wallet display assertion; qalsh pre-era audit rows now ERA-SEALED (fixed).
- 🟡 Chain RPC binds 0.0.0.0 (fleet-only surface) — bind 127.0.0.1 at next regenesis (queued).
Everything on this page is backed by a test suite in this repo; every claim has a testlogs/ run. The public-facing rationale (deflation debate, cap policy, stable-coin strategy) lives in the papers section of the wiki.