Unlimited-budget next steps, the test matrix, the brainstorms · content/testing_roadmap_and_strategy.md
Unlimited Tokens: My Next Steps & What We Should Be Testing
Date: 2026-09-09 · The question: "Imagine you have unlimited tokens. What would be your steps on this project, what should you be testing?" — plus the brainstorm you asked for (release models, points integration, login/claim, hardening). This doc is the map; the sibling docs (SECURE_OPS, release_and_points, deploy/) are the executions.
1. The honest gap analysis (where the project actually is)
Built & green: chain, money rails, chat+files+invites, market+bazaar+redemption+claims (in flight), wallet, docs, law, brand, 540+ tests. Not yet proven: multi-machine operation (all services on one box today), adversarial resilience under real attack, value-at-rest (keys are still files, not enclaves), the reserve as a real bank product, and anything at load.
2. The steps I'd take with unlimited budget (ranked by risk-killed-per-dollar)
- Federate the Fleet — get services onto minirig + bb-mini + a cloud VM (deploy bundle ready; machines were offline today). First goal: relay#2 + provider#2 live, so "decentralised" is topology, not a doc.
- Multi-validator devnet — 4 validators across machines; chaos drills: kill one mid-transaction (Starfish liveness proof in practice), partition Tailscale, corrupt a DB, recover from genesis.
- Adversary red team (the fun one): hire/agent a dedicated attacker persona with one rule — steal value or corrupt truth. Attack book: prompt-injected agents (must die at caps), relay key-substitution (must exit-4), replayed receipts (must 402/409), malicious provider (must slash), qalsh whitelist escapes (must refuse+anchor), escrow race conditions, replayed claims, vault brute force (lockouts), DNS/port attacks on the gateway. Every finding → hardening commit + regression test. This is what "540 assertions" grows into: a suite that fails loudly when attacked.
- Key hierarchy v2 — today: files. Target: every secret in Stronghold-backed stores, machine-specific, with the seedkit mnemonic as the ONLY recovery; signing keys never on the wire; validator keys isolated from service keys; rotate-everything drill with zero downtime.
- qal_reserve on-chain — the backed-Qals invariant as a Move package (B-QALS, the AU$1 credit: issued only against a deposit, enforced by the chain, not by our discipline; the on-chain twin is being redesigned from mint-gated to genesis-preminted + transfer-gated at the cap-raise checklist). Then loopd becomes a cache, and the paper phase ends.
- Load & soak — 10k envelopes/day relay soak, 1k concurrent job settles, market jitter tests; measure where it bends (it will: the python services — that's fine, they're rails, not the chain; note when Rust rewrites pay for themselves).
- The legal gate — lawyer engagement with the playbook; VASP application drafted; Terms of Use written; then external transferability.
- Audit ladder — internal → cargo audit + Move formal checks → paid Move audit → infra pen-test. Budgeted in the business review.
3. The test matrix (what "tested" must mean here)
| Layer | Tests that exist | Tests to add next |
|---|---|---|
| Chain | lifecycle, cap refusal | multi-validator consensus tests, epoch transitions, upgrade drills |
| Money | hold/settle/cap/transfer/program-cap/rounding/dust | concurrent-hold races, partial-failure settle, epoch-boundary caps, reconciliation fuzzing (random op streams → invariant checker) |
| Comms | 38 chat + 36 invites + 49 files | relay-failure failover (automated), key-rotation mid-conversation, 10k-msg soak, forward-secrecy upgrade tests (MLS) |
| Markets | 30 market + 43 pub + 52 bazaar + 58 redeem | challenge-with-second-provider sampling, flash-auction economics, wash-trading/reputation-farming detectors |
| Claims | (qalclaim suite landing) | brute-force lockout proof, issuer-key compromise drill + revocation cascade |
| Security | findings table | the red-team attack book as automated regression (attack-of-the-week) |
| Ops | smoke suites | chaos drills (kill -9 storms, disk-full, clock-skew), restore-from-backup race |
The rule I'd institutionalise: every incident, attack, or weird failure anywhere in the ecosystem becomes a permanent automated test before the day ends.
4. Brainstorm — releasing & selling the tokens yourself (top ideas, ranked)
- Sell credit, not tokens (chosen): payment platforms → top-up → credit Qals (B-QALS) at AU$1 with the enforced 500M stop. You're selling prepaid service credit: cleanest law, no price-management burden, real revenue.
- Earn-drops over discounts: instead of discounting services, award claimable QALS points (qalclaim) — marketing spend becomes reserve-backed credit that mostly converts to usage (and breakage funds nothing — no expiry games, keep it clean).
- Creator/provider rebates: compute sellers earn multiplier bonuses during bootstrapping (paid from the ecosystem bucket, bought at AU$1 like everyone else — the reserve invariant survives).
- Campaign staking in public channels: lock X credit to sponsor a #channel week — sells usage, not yield (careful: never frame as returns — MIS trap).
- What NOT to do (yet): public sale, price discovery, secondary markets, yield — all wait behind the VASP gate (law playbook §7).
5. Brainstorm — points across platforms + login/claim (chosen architecture)
- Unified points = QALS cents — every platform awards via qalclaim issuers (HMAC'd), every user claims into ONE wallet identity (handle + qoll-code). No per-app point silos ever again.
- Login tiers: (a) apps keep their OAuth — points bind to a handle the user proves via loopd challenge (today); (b) passkeys/WebAuthn as the human-facing login on the wallet (next — hardware-backed, phishing-proof, no passwords to steal); (c) agent login = DID keys (Qal ID phase). Passcode systems principle: passkeys > PIN+biometric vault > passwords. Never passwords.
- Claim security: single-use registry + handle binding + expiry + anchored receipts (qalclaim) — a stolen link is worthless; a stolen handle needs the loopd secret; both are capped and auditable.
6. What "done enough to sell" looks like (the gate list)
- Fleet federated (≥2 machines) ✓-ready 2. Adversary suite v1 passing 3. Keys in Stronghold+vault everywhere 4. qal_reserve live on-chain 5. Terms of Use + lawyer memo 6. Claim flow in the wallet UI 7. Landing → live demo path (explorer → wallet → one real claim). Items 1,3,4,6 are engineering (this week's work); 5 is external; the rest is already true.