Status and limits

An honest inventory, so nothing on this site has to be read charitably. Where something has not happened, this page says so.

The short answer

Public contributions are not open, and there is nothing to contribute to today. No contract is deployed to a public network, no governance multisig has been created, no member has contributed, and the review of the pool's code was internal.

Where the code and the published policy differ

This is the most important thing on this page, and it is a real gap rather than a wording issue.

Area	Deployed contract	Operating policy v1
Distribution	Eligible profit creates a target, which is funded, then collected; half is retained	Everything a retirement brings in is paid to every member in proportion to units, without redeeming them
Fee base	10% of the net realised result	Same 10%, and explicitly no fee on capital returning up to a charter's cost
Unit value	Report-driven NAV with a mark cap and rate-drift bound	The pool's $STANDARD, undeployed ETH, and the charter balance at what a retirement would release; burned licences carry no value
Acquisition	A contract path that buys a charter into its own custody	Branches on a founder-custodied charter, because charters cannot be bought or transferred

The policy is published; the contract change it needs has not been reviewed. Accounting describes the code as it stands and marks each difference.

What is implemented

• The continuing pool contracts: intake and activation, later rounds, variable ownership, capital and cost and loss recovery before profit, the net-result fee with epoch vesting and clawback, protected claims, native distributions, and proportional weekly withdrawal rounds. Economic constants are fixed, with no upgrade mechanism.
• An exact-integer accounting engine keeping refundable money, pool cash, custody cash, holdings, paid capital, profit, obligations and reserves separate, with reserve stress scenarios and explicit missing-evidence states.
• The consumer application over five screens, rebuilt on a card layer, with estimates that state their assumptions.
• Member transaction review and recovery: explicit review before sending, nonce-pinned submission, receipt reconciliation, and recovery of a lost or replaced transaction.
• Block-pinned read-only observation of the Reserve and of charter #729, rejected when older than 120 seconds.

What has been reviewed, and by whom

An internal adversarial audit was performed on 16 September 2026 with executable proof-of-concepts against the real contracts. Three High, four Medium and four Low findings were fixed in the same revision, each replayed by a rescreen suite. It found no path for an unprivileged member or outsider to steal or freeze funds; the material risk was concentrated in the governor's valuation authority and the pool's dependence on the governor staying live. The bounds and fallbacks in Accounting are the fixes.

A subsequent independent review raised further findings, and the responses were applied and pinned on 17 September 2026.

Neither of these is an independent audit of a deployment. The first was carried out by an AI agent on the owner's instruction. Both are prior findings for an external reviewer to confirm or dispute, and neither says anything about the Reserve's own contracts, which this project has not reviewed.

What has not happened

Not done	Detail
Independent audit of the deployment	Not commissioned. The reviews above do not replace it, and nothing is deployed to review.
Public deployment	No contract on a public network. No address to verify.
Governance multisig	The selected configuration is recorded as an input. No Safe has been created.
Real-wallet acceptance	Local browser review used an explicit loopback test wallet, not a real extension or mobile wallet. Mobile pairing is configured but the domain allowlist and device acceptance are unverified.
The payout contract change	Policy v1's distribution model is not built and not reviewed.
Published valuation policy	How recent auction prices are averaged, and how a charter bought in ETH is carried, is still to be published — and it sets both admission and withdrawal prices.
Charter purchase terms	Deferred with no payment and no liability in version 1. The eventual price needs a market that does not yet exist, because charters cannot be transferred.
Upstream review	The Reserve's own contracts have not been reviewed or authenticated by this project.
Demonstrated economics	No observed operating period. No evidence that earnings exceed costs.

The risks worth stating plainly

• The custodian is a wallet, not a contract. The keeper's limits are onchain and real, and the founder's key can override them. Contributing means trusting the founder not to. See Custody and the founder.
• Liveness is a hard requirement. Thirty days of inactivity forfeits 70% of the bank's balance under the Reserve's rules.
• Capacity is not liquid. A licence is burned, a branch cannot be sold, and a balance is released only by destroying the branch holding it. Positive assessed value and no withdrawal cash is a normal state, not a failure.
• Dilution is outside our control. Every branch opened anywhere in the Reserve reduces what ours earn.
• Growth depends on charters existing. The Reserve is not selling them. Until it does, the pool is one charter, and one charter's year is lumpy by construction.

What evidence exists, and what it is worth

Integration with the deployed contract code has been exercised on disposable local forks: acquisition, expansion, partial retirement, receipt accounting, distribution, later rounds and withdrawal. A recorded browser review captured successful member sends including a withdrawal request, a cancellation with lost-response recovery, a contribution, a full refund and a funded collection, plus rejection handling, reload and narrow-screen checks.

These show the code executes as described under their recorded assumptions, several of which are counterfactual by necessity — locally enabled auctions, fixture funding, simulated time. Fixture capital and absent competing bidders are not holdings and not evidence of profitability.

Before contributions could open

The app's final public origin settled, with the launch profile and the wallet-pairing allowlist updated to match it — documentation is served from a subdomain the profile does not pin, and enabling the app there would fail the build until that is reconciled. An independent review bound to the actual intended deployment. A created and verified governance multisig with confirmed signer availability and recovery. A verified public deployment with runtime and configuration pinned. The published valuation policy. The reviewed payout contract change, or published documentation that the deployed model is what members get. Real desktop and mobile wallet acceptance. Durable production history and RPC operations.

None of this is scheduled here, and no date is promised.