Governance and Agora

ROKO governance is available on the configured testnet at two deliberate entry points:

• governance.roko.network is the wallet-free, read-only evidence view. Use it when you only want to inspect.
• agora.roko.network is the participant experience. It can connect an injected browser wallet for supported actions, but it never receives a recovery phrase or private key.

Both sites identify the network as chain ID 52370 (0xcc92) with genesis 0x0a2296f8f036f71437e8f6f2028ccbf0dc3dd6b3de9120fc15e43789c794e8bb. Runtime spec 286 activated at finalized block 839462 on 2026-08-28.

The fastest safe path

1. Open the read-only proposal list without a wallet.
2. Select a proposal and review its lifecycle, exact call or runtime payload, disclosure metadata, source-code reference, signed conversation ledger, provenance, voters, vote direction, and committed stake. Missing or unverified evidence is shown as unavailable rather than guessed.
3. Resolve a public account through its verified .roko name when one exists. The canonical address remains visible and authoritative.
4. Check public governance status. Require the expected genesis, runtime spec 286 or later, matching finalized and indexed heights, fresh: true, and executionAuthorized: false.
5. Only when you intend to act, open Agora, connect your own wallet, confirm the network and account, review the exact call and fees, and sign that one action in the wallet.

An empty proposal list is a valid chain state, not a loading failure. The configured-testnet projection began from a verified empty governance boundary and follows finalized state from there.

What is public now

• finalized-first proposal, referendum, participant, validator, vote, stake, disclosure, deliberation, and provenance views;
• stable detail URLs that can be bookmarked or shared;
• machine-readable, bounded governance and validator APIs;
• wallet-free inspection through governance.roko.network;
• browser-wallet participation surfaces in Agora, including staking, nomination, and permissionless validator candidacy; and
• bounded, read-only retrieval of independently pinned IPFS evidence through Agora; and
• explicit unavailable, stale, gap, and integrity-failure states.

The public support API is deliberately read-only and has no signer, transaction constructor, Sudo authority, unsafe RPC, or chain-mutation credential. executionAuthorized: false describes that service boundary; it does not make a user-signed wallet transaction read-only.

Configured-testnet support boundary

Proposal disclosure/conversation publication and the finite participant faucet are active configured-testnet services. Check them before acting:

• GET https://agora.roko.network/api/v1/governance/publication/status
• GET https://agora.roko.network/api/v1/governance/faucet/status

Both return HTTP 200 only while their exact genesis, spec-286 metadata, state, capacity, and dependencies are ready. The UI fails closed on a typed HTTP 503, runtime drift, replica disagreement, stale/gapped governance history, exhausted faucet capacity, or failed restart reconciliation. Publication verifies a participant signature and identical IPFS readback; it does not submit a chain transaction. The faucet signs only its finite 1,000,000-ROKO transfer after a wallet-possession challenge. Neither service can vote, approve a validator, author a runtime upgrade, use Sudo/treasury, or act on mainnet.

Content-addressed evidence

Agora serves exact CIDv1/raw/sha2-256 objects at https://agora.roko.network/ipfs/<CID>. Responses are forced downloads with nosniff and CSP sandboxing. The primary and verifier repositories pin the same operator-approved bytes independently; neither exposes an administrative API, swarm listener, or public upload path. Both replicas currently share one testnet host, so this is availability and byte-equality evidence, not a claim of multi-operator production durability.

The fixed public availability probe is:

bafkreidsfg624r66x6bcy3ljkqyez6xm73ddbyvdxkwobdxp4ltoznl7bq

The dedicated ipfs.roko.network origin is staged but is not yet a public DNS contract. Use the Agora path until the dedicated hostname passes DNS and HTTPS verification.

Signed proposal metadata

A proposal disclosure can include public author-supplied contacts (such as an email address or project contact URL), supporting HTTPS resources, and one immutable source reference. The source reference is either a Git repository URL containing an exact 40-hex commit or a tar/gzip/zstd source archive with an exact SHA-256 digest and, for IPFS, an exact CID. These fields are part of the author's canonical signed disclosure; they are not endorsements by ROKO.

Moving branch/tag links, credential-bearing URLs, active media, duplicate contacts, unsafe schemes, digest/CID mismatch, and oversized metadata are rejected before signing. A material metadata correction creates a new signed lineage version; it does not replace bytes already published.

Public HTTP API

The finalized read API is wallet-free and read-only:

Route	Result
GET /api/v1/governance/status	finalized RPC identity, indexed cursor/hash, lag, freshness, gap status, and executionAuthorized: false
GET /api/v1/governance/records	bounded finalized records with cursor pagination and lowercase filters
GET /api/v1/governance/records/{recordKey}	one exact finalized record
GET /api/v1/governance/gaps	bounded projection diagnostics
GET /api/v1/governance/referenda/{index}/status	direct finalized Referenda state
GET /api/v1/governance/referenda/{index}/sponsorship-pools	bounded live custody plus finalized sponsorship history
GET /api/v1/governance/proposals/{recordKey}/review	digest-verified disclosure, conversation, moderation, and provenance
GET /api/v1/validators/{account}/economics	finalized rewards, payout/claim state, fees, and slash evidence
GET /api/v1/validators/{account}/economics.csv	the same economics rows as quoted UTF-8 CSV

Record page limits are 1–100. Invalid identifiers return a value-free 400; absent records return 404; unavailable/stale history returns a typed 503 rather than partial current truth. Validator economics never infer profit, APY, fiat value, private operating cost, or future rewards.

Agora-origin mutation support uses bounded JSON requests:

Route	Purpose
POST /api/v1/publications	publish an allowed signed disclosure, deliberation entry, or receipt-metadata envelope
POST /api/v1/formal-disclosures/prepare and /finalize	preview, sign, and pin exact proposal disclosure
POST /api/v1/initial-conversations/prepare and /finalize	preview, sign, and pin the opening conversation
GET /api/v1/formal-disclosures/{cid}/status	inspect exact publication state
GET /api/v1/formal-disclosures/{cid}/sponsorship	retrieve submission-sponsorship material
GET /api/v1/faucet/status?address=0x…	inspect claim eligibility/capacity
POST /api/v1/faucet/challenges and /claims	prove wallet possession and request one finalized transfer

Publication bodies are at most 64 KiB; faucet bodies are at most 4 KiB. Wrong origin/content type returns 403, rate exhaustion returns 429, malformed input returns 400, and unavailable dependencies return 503.

Validator self-enrollment uses direct, separately reviewed wallet calls and a short-lived public enrollment package generated on the operator's node. Follow Prepare a validator for the exact journey and evidence required at each state.

Accessibility, reliability, and recovery

• You can inspect public governance without a wallet, account, or extension.
• Use the page headings, landmarks, skip link, and ordinary links with a keyboard or screen reader. Status, errors, and unavailable evidence must be conveyed in text and never by color alone.
• Canonical addresses, transaction hashes, block numbers, proposal identifiers, content digests, and source links remain selectable and copyable.
• Refresh from the canonical URL after a transient failure. A proposal detail URL should remain stable; return to the proposal list if an identifier does not exist.
• If the status API reports a gap, stale projection, wrong genesis/runtime, or unequal indexed/finalized boundary, pause participation and use the read-only explorer or RPC to verify finalized chain state.
• Never enter a seed phrase, private key, keystore, reusable signature, or OpenBao credential into a site, support request, chat, or AI agent.

Human review before a consequential action

Deterministic checks cover network identity, payload and digest equality, metadata shape, signatures, balances, lifecycle state, finalized receipts, projection freshness, and accessibility automation. A person should still decide whether the proposal's intent, tradeoffs, risks, real-world references, source changes, social consequences, and requested authority are acceptable. The wallet confirmation is the final authorization for that exact transaction.