Status: a checklist, not a decision. Prepared 13 September 2026. It executes the token record (decided by the product owner, 12 September 2026, Robinhood Chain included) by the deployment plan and the operator policy, both still proposed. Nothing in it has been done: no token exists, no signer is named, no reviewer has reported, no key is held, nothing is deployed. Every row says who does it, what it needs, the command, what the tool refuses when the row is not met, and what the site shows once it is. The tools are in contracts/scripts/ and run from contracts/; every one reads Robinhood Chain (chain id 4663, the robinhood-mainnet profile) through CURB_RPC_URL when it is set in the shell and the public node https://rpc.mainnet.chain.robinhood.com otherwise — the deployment tool included, which says on its first line which node it is reading (the host only; a keyed URL is never printed and never written into a record). The tools read state — except the deployment tool's check of priceSource.fromBlock (row 12), which reads the pool's logs before that block: one query on the public node, which serves any width with fewer than 10,000 matches; on an endpoint that caps a query's width it walks down in pages, at most sixty-four, and says how far it read. Measured 13 September 2026: dRPC with a key (lb.drpc.live) serves full archive state and eth_getLogs up to 100,000 blocks with no cap on results, and is what the site's tick reads through (CURB_RPC_URL on Vercel); dRPC without a key serves about 200 blocks a query and Alchemy's free tier ten — enough for the tools, not for the tick. The site's readers halve a query the node refuses for width, for matching too much, or for taking too long.
Who
- —The product owner decides: the signers, the launch, the pool. Decisions are written into the records by name and date; the site never upgrades one on its own.
- —The signers — three people, each with a wallet of their own on Robinhood Chain — are the owners of the operator's Safe, 2-of-3 as the policy proposes. The Safe is the treasury every top-up goes to.
- —The reviewer — a named person who is not the author of the record — reads what the tool wrote against the chain and signs the record with their name and the date. Without that name the deployment tool refuses.
- —The operator holds the shell the tools run in, the deployer key (funded with ETH on Robinhood Chain for gas, never in this repository, never in a chat) and the Vercel project's environment.
One person may hold more than one of these; the records still say which.
Where it stands
Done, and visible: the services and the gate (/services, /api/credits, the paid endpoints), the indexer, the rate reader with its guard, the credit desk contract with its unit tests, the deployment tools, the Safe tools, the CI rehearsal on a local chain, two adversarial reviews of the site code with the confirmed findings closed (commits 54ab36e and fc3df1d). The build the site verifies a deployed desk against is contracts/evidence/CreditDesk.build.json, from the source at commit 06623ed.
Not done: every row below. The site says so — NOT_CONFIGURED on /services and /api/credits, *not done* in the order of work — until the rows are.
The rows
| № | Who | What | Needs first | Command or action | Refused when | Done shows as |
|---|---|---|---|---|---|---|
| 1 | Product owner, signers | Name the owners of the operator's Safe — at least three — and the threshold (2, as the policy proposes) | Three or more people with their own wallets on Robinhood Chain, none of them a signer for any issuer or custodian of a series' components; their addresses, written into the operator policy by name and date and published on the site (the register's A4) | A decision, not a command | plan-safe.ts refuses fewer than three owners, an owner listed twice, an address that is not 20 bytes of hex or fails its EIP-55 checksum, a threshold under 2 or over the count | The policy names them; the register's A4 closes |
| 2 | Operator | Create the Safe | Row 1; a funded wallet to send one transaction | node scripts/plan-safe.ts <owner> <owner> <owner> --threshold 2 |
What is refused by design, and stays refused
- —A record nobody reviewed by name; a public chain without
--reviewed; a key from anywhere but the operator's shell. - —An address copied from a documentation example: every address in a record is read from the chain by a tool or from the explorer by the reviewer, and the reviewer's name says so.
- —A second deployment over an existing evidence file; the file is moved aside on purpose, by a person, or it is not.
- —An edit to
contracts/src/CreditDesk.solor to the compiler settings after the deployment: the site verifies the desk against the committed build record, CI refuses the edit until the record is re-recorded (check:build: the record is not this source's bytecode), and re-recording it turns a correct desk into a MISMATCH on/servicesand/api/state. A change is a new desk, a new record and a new deployment. - —A price typed in: the rate is read from a pool at a block or it is not stated. Until row 13 the price list is in dollars and nothing is quoted; a top-up meanwhile is indexed and waits.
- —A promise the code does not keep: the eight claims the mechanism refuses for the position are refused for the token, and the services page says what the desk does, not what a launch might.
What this checklist does not do
It decides nothing. The signers (A4), the reviewer (A2), the launch and the pool are people's decisions, recorded when made. It does not launch the token or choose where; it does not cover the position product's own deployment (rows 1–6 of the deployment plan), which waits on a gate decision of its own. It does not hold, make or ask for a key.