Updated 2026-10-19: the operator’s name.
In August 2026, we ran the first end-to-end test of the protocol on an internal testnet. The test deployed the chain and the verifier service on Conectia’s infrastructure. On the same day, after the re-freeze of the specifications that answered our own audit, the token design for a possible public network became a register of closed questions. Each closed question has a normative source you can hold us to.
An internal testnet you can rebuild from zero in minutes
This internal testnet ran a chain node and the verifier service on infrastructure we operate for our own testing. It had no third-party validator accounts, no join kit and no published endpoints.
The network is reproducible. The whole network came from a bring-up package. We could tear it down, rebuild it from zero, and get the same network in minutes. MintID treats its written specifications as the source of truth. Because of this, we wanted our first deployment to be a derived artifact rebuilt from a package.
Every reading proved itself against finalised state
The first test passed everything that stage could prove. The chain finalised continuously. And the readings that matter were not taken on trust:
- Reads that prove themselves. The test read the verifier’s on-chain registration and its exact HTTPS origin from outside. It verified them through authenticated store proofs checked against a light-client-verified header. This is the same fail-closed path the verifier uses, and it does not trust an unverified RPC answer. An answer that cannot prove itself against finalised state does not count.
- Live challenges, correctly bound. The verifier issued live ten-second presentation challenges. Each challenge was bound to the registered verifier identity, the exact audience origin and a finalised chain height. The challenges expired on schedule.
- A rejection that leaves almost nothing behind. The verifier rejected a deliberately invalid presentation with a reason code from the closed vocabulary. The verifier retained only the minimal decision record, which holds the outcome, the reason and the session it belonged to. It retained no proof bytes and no attributes.
- The agent surface, driven end to end. We ran a complete live session through the verifier’s MCP server, using the same three tools any agent framework would call. The contract boundary held. A rejection returns a successful tool result with a reason code, and only transport failures return errors.
In our own bring-up, every failure traced to deployment tooling, which we fixed on the spot. None traced to protocol code. The proof engine was not part of that bring-up. It followed with the cryptographic-core milestone. The proof core now runs in production on the single-node production chain, which Conectia has operated in production since 20 September 2026.
Every answer proved itself against finalised state, on a running network.
The token design for a possible public network, as frozen in August 2026
Everything below describes the token of a possible public network. No such token exists today, because MintID runs on a permissioned single-node production chain and needs none. The August 2026 re-freeze of the specifications turned that design into a register of closed questions. Each item below has normative text in the frozen specifications, and changing any of them requires a formal procedure. Across all of them, we commit to the mechanism and ratify the allowed ranges, called bands. We commission an independent economic simulation to set the exact values inside those bands, called points. We never choose the points ourselves.
| Fixed | What the policy says |
|---|---|
| The money supply | A hard cap of 108,000,000, immutable, counted against everything ever minted. Emission is strictly decreasing and there is no re-mint, ever. |
| The genesis split | The ratified bands allocate 15% to development and team, 20–25% to the public tranche, and at least 60% reserved exclusively for validator emission. The development and team band has native on-chain vesting over four years with a one-year cliff, plus a twelve-month lock-up. The independent economic simulation sets the final points inside those bands. We never set them ourselves. Insider genesis accounts do not delegate, do not vote, and do not count toward the launch-gate arithmetic. |
| The launch gate | The gate is denominated in measurable, price-independent units: bonded stake as a share of the max supply, the number of independent validator operators, a Nakamoto-coefficient floor, and an estimated attack cost in fiat under a published, price-independent methodology. The simulation produces the concrete thresholds, which are frozen with the genesis parameters. No threshold depends on a market price. |
| Validator bootstrap | We recruit professional operators through service contracts, which are instruments an operator can sign. These contracts run for twelve to twenty-four months and are paid in fiat or stablecoin from the operating budget. Discretionary retroactive grants remain a possibility, and they are not the recruitment mechanism. |
| The flows that scale | Per-agent mint/lease and consented disclosure grow with the agent population. Both flows carry normative, non-zero protocol cuts, and they may not ship parameterless. The cuts and their allocation are governed parameters under review. Once decided, they follow the same governance and versioning discipline as every other value. |
| The security budget after emission | When the reward pool is exhausted, the fee market funds the validator budget. This fee market consists of transaction fees plus whatever share of the protocol cuts governance directs to validators, once their allocation is decided. The simulation must model this budget under published scenarios. If the budget falls short, there is a written, ordered list of successor options. A post-cap mint is not on that list at any position. The reward pool is used only for validator emission. No other drain exists or can be created. |
| The registry’s microeconomics | We size the minimum issuer bond against a published deterrence target in fiat, using the same price-independent methodology as the gate. We review it annually. Bond exhaustion auto-suspends the issuer deterministically, with no discretion and no grace period. The body that adjudicates slashes can never profit from unclaimed remediation. |
| Who sets the numbers | The economic simulation is an external engagement under a published statement of work. Its deliverables cover every open point: allocation, gate thresholds, the protocol cuts and their allocation, the post-emission fee-market model, the minimum bond and participant break-evens. Internal tooling may assist the simulation, and may never substitute for it. If the review objects to any frozen value, genesis does not proceed on that value. The finding goes on record, and the value is re-decided before we build the genesis file. |
In this table, the cap counts everything ever minted. The insiders hold the smallest band, which is vested, locked and without votes. Every launch-gate unit is independent of market price. The end of emission has a written plan that never prints more tokens. The allocation of each protocol cut is under review. Every number a reader could distrust goes to an external owner, and must land inside a published band.
The tokenomics page covers the bands, vesting, gate, cuts and post-emission plan. It derives from this same frozen register.
Verification carries no fee and stays outside consensus
The consensus firewall stayed unchanged through all of this. Verification carries no fee by construction. Presentations never touch the chain, and off-chain service revenue never influences consensus rewards. The testnet exercised that separation live. The chain finalised while the verifier decided, and neither needed the other’s economics. The frozen specifications keep this separation normative, and the rest of the design leans on it.
Everything a reader can hold us to is now written, frozen and marked. Every open number has a named, independent owner and a published band it must land inside. Since August 2026, part of what is written also runs. Since 20 September 2026, it runs in production on the single-node production chain.