decisions: Orgchain v1.14, soulbound belts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh

docs/decisions.md

@@ -73,3 +73,4 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 - 2026-10-15 · **Orgchain v1.11: charters, a ladder of legal forms, and agents graduate.** After the v1.10 ship the operator talked through lineage as a business (the toy as scaffolding for a real one, themselves as the first customer, Bitcoin as the source of truth with bridges to Ethereum and Solana) and liked the master LLC with series children; they added that nodes needn't be LLCs to start (freelancers), so legal form belongs in the graduation flow. A new `lineage/v0` op, `charter`, records a node's legal form as an attribute (sole proprietor, LLC, series LLC, series, corporation) with an ISO jurisdiction, a legal name, the provider and a SHA-256 of the filings, never the documents; Charter can hash a file in the tab. A node charters itself; a series is chartered by its master, an ancestor chartered as a series LLC. Whether a charter stands is derived from the tree (a series lapses if it graduates or its master closes or drops series), never stored, so charters commute with graduations in any block order. Agents can now graduate: a seat goes independent as a holding with its own root, keys and money, and can birth, award and incorporate. The sample charters yolopreneur as a Wyoming series LLC with its ventures as series, and lineage graduates into Lineage LLC. No signing changed, so the regtest fixture stands. `lineage/orgchain` main `4ad75f0`, time's `gh-pages` `ada3979`; 85 unit tests and Playwright 18/18. Token 67 (`orgchain-charter-20261015`, `write:repository`) did the pushes and is deleted by id right after; the table is checked. Next, from the same conversation: acquire with both sides of the PSBT (bids and asks, for items and orgs), then pledge with timelocks. Why: the operator's ladder, from a freelancer's first gig to an incorporated holding, on one continuous record.
 - 2026-10-15 · **Orgchain v1.12: both sides of a deal, and orgs change hands.** The operator asked for offers on orgs to sell as well as to buy: the other side of the PSBT. Deals now go both ways on a lot, an item or an org inside a holding (which its parent sells). Buy makes an offer, the buy order the lab already had; Sell makes an ask, the sell order, signed SIGHASH_SINGLE|ANYONECANPAY on the lot's input alone, so any node can take it behind a 600-sat dummy of its own. An org sells cash-free: its money, gas tank and items go home to its parent first, and it is frozen while listed. Two new `lineage/v0` ops move it into its buyer's tree, `join` (signed by whoever holds the org's inscription) and `adopt` (signed by the buyer), in either order; it takes the buyer's next index and derives its keys there, and its old parent keeps the old index unused. Rehearsed on Bitcoin Core regtest from height 131, beside the earlier rehearsal (twelve beats and 104 transactions: an org on an ask, another on an offer, an item on an ask), and ord tells the same story. The first comparison caught the miner putting a join and its adoption the other way round within a block, so a move now records both halves and each half belongs to both holdings. The sample ends with both sides standing: lineage's offer for the launch kit, and well-known's ask for mailr. `lineage/orgchain` main `adca270`, time's `gh-pages` `83eac0c`; 90 unit tests and Playwright 22/22. Token 68 (`orgchain-acquire-20261015`, `write:repository`) pushed `gh-pages`, but the push to main was refused because the script named the wrong local branch; the script was stopped and 68 deleted by id (the table checked). Token 69 (`orgchain-acquire2-20261015`, `write:repository`) pushed main and this line and is deleted right after; the table is checked. Next: pledge, a lien with a timelock. Why: a sale has two sides, and an org that changes hands should keep its history and leave with keys only its new owner holds.
 - 2026-10-15 · **Orgchain v1.13: whole trees change hands.** The operator asked for full holdings transfer next. An org now changes hands with its tree (the derived orgs and agents below it, and the items they hold), and a holding changes hands whole, sold by its owner, whom the lab wallet plays; the price goes there, and the holding becomes its buyer's next org. Sales stay cash-free: the money in the tree, every gas tank included, goes to the seller first, and the items go with the tree. An ask signs one input, so listing a tree bundles every inscription in it into one output at the lot's key; an offer spends every output the tree sits in and merges them. After the `join` and `adopt` the buyer splits the output back, one inscription to an output at its new key, each item with the node that held it, by the layout the deal recorded. A listed or sold tree is frozen whole, and a listed holding mines nothing (the default mining rule would otherwise have paid keys it was about to leave). Transactions take up to 64 inputs and outputs. Rehearsed on Bitcoin Core regtest from height 144, beside the earlier rehearsals (sixteen beats and 131 transactions: time with its six below it on an offer, then acme whole on an ask, eleven inscriptions in one output, each split back), and ord puts every inscription in the same output as the lab. `lineage/orgchain` main `74ed801`, time's `gh-pages` `07c3810`; 95 unit tests and Playwright 24/24. v1.12's commit went out under the Mac's default author by mistake; v1.13 is teahubxyz's again. Token 70 (`orgchain-holdings-20261015`, `write:repository`) did the pushes and is deleted by id right after; the table is checked. Next: pledge, a lien with a timelock. Why: a business is sold with what it runs and what it made, an owner can sell a holding whole, and the buyer should leave the deal holding every key.
+- 2026-10-15 · **Orgchain v1.14: soulbound belts.** The operator said belts shouldn't trade: they are soulbound, tied to an agent and moving with it, and pointed at ord's charms. A belt is now inscribed on its seat's own sat, as a reinscription: one reveal spends the seat's coin (the seat's own key co-signs, accepting the belt), the issuer's coin (the parent) and a commit that pays the fee, returns both coins unchanged, and points the belt at the seat's sat. ord gives it two charms, ♻️ reinscription and ❤️‍🔥 vindicated (a pointer and an envelope past the first input would have cursed it before the jubilee). So a belt travels with its seat through every act, graduation and sale, a tree splits back one inscribed sat to an output, and a belt is never a lot. An award costs two fees (1,000 sats) and no postage. The reducer is unchanged, since a belt was already bound to the seat it names; belts from before v1.14 stay with their issuers. The engine's sixth local change is that three-input reveal, and nothing looser. Rehearsed on Bitcoin Core regtest from height 161 (sixteen beats, 131 transactions): ord charms the three belts as the lab does, and after two whole-tree sales each belt still shares its seat's satpoint; the compare now checks satpoints and charms, and the v1.13 recording passes it too. `lineage/orgchain` main `c8c18b0`, time's `gh-pages` `7fa9f05`; 98 unit tests and Playwright 24/24. Token 71 (`orgchain-belts-20261015`, `write:repository`) did the pushes and is deleted by id right after; the table is checked. Next: pledge, a lien with a timelock (v1.15). Why: a belt certifies a seat, so it must never be sold apart from it, and keeping it on the seat's sat makes ord's account of where a belt is match the reducer's.

docs/lineage.md

@@ -22,32 +22,33 @@ this tree is a drawing, and nothing derived from it may be presented as a real k
 
 **Operate it:** [lineage.yolopreneur.lol/orgchain/](https://lineage.yolopreneur.lol/orgchain/) is Orgchain, lineage's
 app ([`lineage/orgchain`](https://teahub.xyz/lineage/orgchain)). Found a holding, then birth orgs and agents, award
-belts (across holdings too), record decisions, make items, buy and sell items, orgs and whole holdings, publish keyrings, charter legal forms, send test BTC, graduate orgs and agents (into a holding of its
-own) and close. Each act is a `lineage/v0` inscription whose parent is the
-node that authorizes it, on a private toy chain in the browser with pretend money. Time is a tempo (each act its own
-beat, or acts cued and landed together every 10, 30 or 60 s, or by hand), and a slider replays any holding beat by
-beat. Holdings mine each beat's 50 test BTC, split by a hashrate dial on each (equal by default), or, under *Last act*,
-all to the holding that acts; under *Mainnet* none mine, and holdings are funded from the lab wallet, as from a wallet
-you already have. Any node can send test BTC to any other, across holdings too, signed by its BIP-84 key,
-and every act pays its own gas from the actor's keys, topped up from its money, so an unfunded node can't act; a
-graduation takes each re-keyed node's money along. Any node can make an item (an inscription it holds). Deals go both
-ways, on items, on orgs with their trees and on whole holdings: an offer, where the buyer signs the whole deal up front
-and the holder countersigns, or an ask, where the holder signs the lot's input alone (SIGHASH_SINGLE|ANYONECANPAY) and
-any node takes it. An org or a holding sells cash-free, with the orgs, agents and items below it, and its buyer adopts
-it into its own tree, where its keys and its tree's derive from the buyer's seed. Any node can publish
-its keyring: one inscription listing its Taproot,
+belts (across holdings too; each is soulbound, riding its seat's own sat), record decisions, make items, buy and sell
+items, orgs and whole holdings, publish keyrings, charter legal forms, send test BTC, graduate orgs and agents (into a
+holding of its own) and close. Each act is a `lineage/v0` inscription whose parent is the node that authorizes it, on
+a private toy chain in the browser with pretend money. Time is a tempo (each act its own beat, or acts cued and landed
+together every 10, 30 or 60 s, or by hand), and a slider replays any holding beat by beat. Holdings mine each beat's
+50 test BTC, split by a hashrate dial on each (equal by default), or, under *Last act*, all to the holding that acts;
+under *Mainnet* none mine, and holdings are funded from the lab wallet, as from a wallet you already have. Any node
+can send test BTC to any other, across holdings too, signed by its BIP-84 key, and every act pays its own gas from the
+actor's keys, topped up from its money, so an unfunded node can't act; a graduation takes each re-keyed node's money
+along. Any node can make an item (an inscription it holds). Deals go both ways, on items, on orgs with their trees and
+on whole holdings: an offer, where the buyer signs the whole deal up front and the holder countersigns, or an ask,
+where the holder signs the lot's input alone (SIGHASH_SINGLE|ANYONECANPAY) and any node takes it. An org or a holding
+sells cash-free, with the orgs, agents and items below it, and its buyer adopts it into its own tree, where its keys
+and its tree's derive from the buyer's seed. Any node can publish its keyring: one inscription listing its Taproot,
 SegWit, nostr and Ethereum keys, each signing the same statement the way its own wallets sign a message (BIP-322, a
 nostr note, EIP-191), so registries like well-known and other chains can find them; a graduation retires it. Every
 node holds its inscription at its Taproot address (BIP-86 at its account: a lab root per holding, BIP-85 org seeds,
-the org as account 0 and seats as accounts 1..n), keeps its money at its SegWit address, lists its tapkey (the npub as a Taproot address),
-its npub and its Ethereum address (an org's, at account 0, is its legal-control key) beside it, shows its leaves as [the key tree](https://lineage.yolopreneur.lol/) derives them (ssh, git,
-dkim and wg for agents; ssh-ca, mtls and noise for orgs), and keeps every secret behind a Reveal, as the key tree does.
-Each act is signed by whichever key holds the authorizing inscription, and graduation is a claim by the org's fresh
-root, countersigned by its derived key, with the derived subtree re-keying under it. Closing is still a recorded event.
-`lineage/v0` is written down as an ordinals metaprotocol ([`SPEC.md`](https://teahub.xyz/lineage/orgchain/src/branch/main/SPEC.md)),
-and the sample has been rehearsed on Bitcoin Core regtest: the lab's own transactions confirmed byte for byte, and real
-`ord` indexed them into the same trees, keyrings and sales, whole trees changing hands included, every proof checked
-from ord's copy.
+the org as account 0 and seats as accounts 1..n), keeps its money at its SegWit address, lists its tapkey (the npub as
+a Taproot address), its npub and its Ethereum address (an org's, at account 0, is its legal-control key) beside it,
+shows its leaves as [the key tree](https://lineage.yolopreneur.lol/) derives them (ssh, git, dkim and wg for agents;
+ssh-ca, mtls and noise for orgs), and keeps every secret behind a Reveal, as the key tree does. Each act is signed by
+whichever key holds the authorizing inscription, and graduation is a claim by the org's fresh root, countersigned by
+its derived key, with the derived subtree re-keying under it. Closing is still a recorded event. `lineage/v0` is
+written down as an ordinals metaprotocol ([`SPEC.md`](https://teahub.xyz/lineage/orgchain/src/branch/main/SPEC.md)),
+and the sample has been rehearsed on Bitcoin Core regtest: the lab's own transactions confirmed byte for byte, and
+real `ord` indexed them into the same trees, keyrings and sales, whole trees changing hands included, every proof
+checked from ord's copy and every belt on its seat's sat.
 
 ## Rules
 1. **One template, every depth.** An org is legal key · treasury · identity · agents · orgs. The factory's own org and
@@ -67,7 +68,7 @@ from ord's copy.
 7. **Clocks nest.** Each org runs its own Time, seats and spend cap; a child's cap is carved out of its parent's.
 8. **Belts are badges.** A belt is a badge awarded to one seat for one skill — per seat × skill, never per seat alone.
    Kata belts and the `.well-known.online` badge are the same mechanism, and an org can award one to a seat in any
-   holding: well-known certifies agents it doesn't hold.
+   holding: well-known certifies agents it doesn't hold. A belt is soulbound: it moves with its seat and never trades.
 
 ## Proposed for lineage spec v0.1
 - `org seed` — BIP-85, BIP-39 application, from the parent root: `m/83696968'/39'/0'/24'/<j>'`, j = the child org's
@@ -101,6 +102,10 @@ from ord's copy.
   Sales are OpenOrdex's PSBTs both ways, offers and SIGHASH_SINGLE|ANYONECANPAY asks, and an org sells cash-free.
   Since v1.13 an org moves with its derived tree and the items in it, and a holding moves whole, sold by its owner and
   becoming its buyer's org: the tree travels as one output and splits back at its new keys.
+- `award` on chain — Orgchain v1.14 (`SPEC.md`, section 7): a belt is inscribed on its seat's own sat, a reinscription
+  whose reveal spends the seat's coin (the seat co-signs, accepting it), the issuer's and a commit, and returns both
+  coins unchanged. It travels with the seat through every handoff and sale and is never sold alone; ord charms it ♻️
+  reinscription and ❤️‍🔥 vindicated. The NIP-58 badge above is its relay form.
 
 ## Not built yet
 - The root (operator's decision).