CHR-GOV: retire the challenge system

AFI_Full_Architecture.md

@@ -120,7 +120,7 @@ AFI is organized by responsibility, not by repository alone. The planes below de
 - **evidence-v3-provider-provenance-v0.1** — the Evidence V3 and provider-invocation provenance record (EV3-GOV): `afi.scored-signal-evidence.v3` as the **sole current canonical scored-signal evidence contract** (the prior record shape carried forward plus exactly three required additions — `providerInvocations`, `recordHash`, `replayHash`); exactly five closed, credential-safe, deterministically ordered per-lane provider invocation proofs (`afi.provider-invocation-proof.v1`, carried, never consumed) with the nested Tiny Brains aiMl invocation proof (`afi.aiml-invocation-proof.v1`); the registered `afi.d2.*` hash-domain assignments with an explicit canonical/replay projection separation; the all-five evaluation-completeness law (every category lane fail-fast — a failed lane yields no scored evaluation and no evidence record); capture in the one live graph pass with a fail-closed sole evidence builder in District 2 that never invokes a provider; V3-only hash-verified admission at the sole canonical writer; and the forward-only replacement of the prior evidence surfaces.
 - **district-api-atlas-foundation-v0.1** — the District / API Atlas foundation record (ATLAS-GOV): designates AFI's **canonical discoverability and relationship layer** (`afi.protocol-atlas.v1`, delegated to afi-config) over Districts, structures, capabilities, interfaces, typed routes, contracts, repositories, participant roles, and onboarding descriptors; separates maturity from visibility; forbids invented APIs and secret-capable fields; and establishes that the Atlas **describes** protocol truth and does not replace runtime, schema, contract, or governance authority (it fills the reserved ATLAS-GOV slot). It creates no District, changes no District scope, and builds no endpoint or Protocol City surface.
 
-The lifecycle state machine is governed as `INGESTED → VALIDATED → SCORED → CERTIFIED → QUALIFIED → CHALLENGE_OPEN → [CONTESTED →] FINALIZED → EPOCH_ELIGIBLE`. **The implemented lifecycle currently reaches `SCORED`.**
+The lifecycle state machine is governed as `INGESTED → VALIDATED → SCORED → CERTIFIED → QUALIFIED → FINALIZED → EPOCH_ELIGIBLE`. **The implemented lifecycle currently reaches `SCORED`.**
 
 ### 2. Contract and registry plane **(Governed)**
 
@@ -215,7 +215,7 @@ The economic plane separates governed design from implementation from deployment
 
 - **afi-token (Implemented; Deployed on testnet).** `AFIToken` is an xERC20-based ERC-20 with an on-chain hard cap of **86,000,000,000 AFI**, enforced in its sole mint entrypoint (`mintEmissions`, gated by an emissions role granted to explicit addresses, never the deployer). The contract suite passes its Foundry tests. It is deployed on **Base Sepolia testnet** (chain 84532, symbol `tAFI`), with roles held by a Treasury Safe. **There is no Base mainnet deployment.**
 - **afi-xerc20 (Reference).** The vendored defi-wonderland xERC20 standard (`XERC20`, `XERC20Lockbox`, `XERC20Factory`), consumed by afi-token as a pinned submodule. Its multichain deploy artifacts are inherited upstream boilerplate, not AFI deployments.
-- **afi-mint (Implemented off-chain; on-chain not wired).** The off-chain orchestration is implemented in TypeScript — signal-state management, a challenge-window/appeal model, dispute resolution, a mint executor, a validator daemon, and a governance client — and the per-signal emission math is implemented and parity-tested against the afi-math 86B schedule. The link to a live on-chain mint is **not wired**: the mint executor targets an abstract contract interface with no concrete binding, the Solidity contracts are stubs, and reputation-weighted emission logic is a placeholder awaiting governed values.
+- **afi-mint (Implemented off-chain; on-chain not wired).** The off-chain orchestration is implemented in TypeScript — signal-state management, a mint executor, a validator daemon, and a generic Snapshot DAO client — and the per-signal emission math is implemented and parity-tested against the afi-math 86B schedule. The challenge/appeal model and dispute resolution were removed with the challenge layer (CHR-GOV). The link to a live on-chain mint is **not wired**: the mint executor targets an abstract contract interface with no concrete binding, the Solidity stubs were deleted, and reputation-weighted emission logic is a placeholder awaiting governed values.
 - **Settlement (Governed doctrine; not implemented).** AFI Settlement v1 is accepted doctrine — epoch-settled rewards through a custodial rewards vault with Merkle claims, funded from an epoch settlement manifest, with provenance decoupled from payout and concrete address+chainId as source of truth. It **implements no contracts**: no rewards-vault, receipt, Merkle-claim, or settlement-manifest contract exists in any repository.
 - **Participant claim roles (Governed doctrine; closure in draft).** Accepted Settlement v1 doctrine mandates at least three participant reward tracks — **Provider**, **Analyst/Scorer**, and **Validator** — as distinct allocation tracks. The tighter closure to *exactly* these three (barring public goods and governance as claimants) currently lives in draft specs and schema and is not yet accepted governance. Operational overhead and the DAO operations vault are treasury policy administered by governance, not a claim role.
 - **Live mint is governance-blocked.** The v1 mint-settlement skeleton is governed (epoch budget → role pools → pro-rata verified credits), but the numeric baseline role weights are not yet governed and are a required decision before any live mint. Mainnet settlement is not yet governed.
@@ -269,7 +269,7 @@ The lifecycle is governed beyond `SCORED`, but the following are **not** impleme
 
 ```mermaid
 flowchart LR
-    S(["SCORED<br/>implemented"]) -. "not implemented" .-> X["CERTIFIED · QUALIFIED · CHALLENGE · FINALIZED"]
+    S(["SCORED<br/>implemented"]) -. "not implemented" .-> X["CERTIFIED · QUALIFIED · FINALIZED"]
     X -. "not implemented" .-> Y["epoch accounting · rewards · claims"]
     Y -. "not implemented" .-> Z["live mint · mainnet settlement"]
     style S fill:#1f6f43,stroke:#0d3b24,color:#ffffff
@@ -278,8 +278,8 @@ flowchart LR
     style Z fill:#5b3a00,stroke:#3a2500,color:#ffffff
 ```
 
-- **Post-`SCORED` transitions** (`CERTIFIED`, `QUALIFIED`, challenge, `FINALIZED`) — the single finality writer is defined in law but intentionally unimplemented pending new authorization.
-- **Market-outcome observation and challenge windows** in the live path.
+- **Post-`SCORED` transitions** (`CERTIFIED`, `QUALIFIED`, `FINALIZED`) — the single finality writer is defined in law but intentionally unimplemented pending new authorization.
+- **Market-outcome observation** in the live path.
 - **Live PoInsight from finalized receipts** — the benchmark computes PoInsight from fixtures only.
 - **Participant reputation updates** in the protocol.
 - **Epoch accounting, incentive allocation, reward claims, and claim-root production** — no implemented owner.

adrs/ADR-005-ens-aliases-addresses-source-of-truth.md

@@ -26,7 +26,7 @@ AFI's v0 prototype and its supporting documents made identity and authorization
 
 2. **A single 1-of-1 Safe holds admin + emissions authority.** The real AFI Treasury Safe on **Base** — `0x1Dd6705ff84Ecd5eaDc51A913Ad8e2c6C9E79aC4` — holds `DEFAULT_ADMIN_ROLE` + `EMISSIONS_ROLE`, is **threshold 1**, and is signed by the single operator key `0xb87C647a1a0857a4f96271F1d9846fd470e4ad62`. That same key is the **sole 1-of-1 signer** of the two Ethereum-mainnet `afidao.eth` Safes as well. One hot key controls the entire ENS namespace **and** the Base treasury/emissions authority. This is a single point of failure, not a custody architecture.
 
-3. **The repo's only ENS reference (the legacy non-canonical three-letter ENS alias) is stale and mis-pointed.** Repo configs hard-code `snapshotSpaceId: 'afidao.eth'` (e.g. `afi-config/schemas/validatorConfig.schema.json`, `afi-mint/src/orchestrator/types.ts` `DEFAULT_VALIDATOR_CONFIG`, `afi-governance/schemas/SignalChallengeProposal.schema.json`). But **no Snapshot space under the legacy three-letter ENS alias exists**, and that legacy ENS name is owned by an **unrelated third party** (`smilefox.eth`, `0x057302a5…a20d`). The **live** AFI DAO Snapshot/governance space is **`afidao.eth`** (network `1`), which the repo never references.
+3. **The repo's only ENS reference (the legacy non-canonical three-letter ENS alias) is stale and mis-pointed.** Repo configs hard-code `snapshotSpaceId: 'afidao.eth'` (`afi-config/schemas/validatorConfig.schema.json`; the afi-mint and afi-governance copies were removed with the challenge layer, CHR-GOV). But **no Snapshot space under the legacy three-letter ENS alias exists**, and that legacy ENS name is owned by an **unrelated third party** (`smilefox.eth`, `0x057302a5…a20d`). The **live** AFI DAO Snapshot/governance space is **`afidao.eth`** (network `1`), which the repo never references.
 
 4. **`treasury.afidao.eth` is a placeholder, not the real treasury.** `treasury.afidao.eth` resolves to an **empty, never-used Ethereum-mainnet Safe `0x7408d8e97280e391A38DffE3AE8dF7E5c553438f`** (0 ETH, 0 value tokens, zero executed transactions). The same empty L1 Safe also backs `grants.afidao.eth`, `ops.afidao.eth`, and `liq.afidao.eth`. Meanwhile the **real** authority Safe (`0x1Dd6705…`) on **Base** has **no ENS name resolving to it at all**. Anyone who trusted ENS as canonical would route treasury, grants, ops, and liquidity to one empty placeholder on the wrong chain.
 

atlas/PROVENANCE.txt

@@ -1 +1 @@
-24c7b46865ee38e3cf68630babf394f8359b1f51df8b6ca93bfed7b62d6bd042  d6f2504805059ffa09d8c1bfcecb67cd47abcea2
+c754841f6df1fac9d61e9bca6c79a8d06fba97786d55f20ca943e5b16eb45ff7  666b2475a72153416ef2262b84089d11f395a1de

atlas/afi-protocol-atlas.v1.json

@@ -394,7 +394,7 @@
       "structureId": "afi-mint",
       "name": "afi-mint off-chain orchestration",
       "kind": "service",
-      "purpose": "The off-chain TypeScript mint/emissions orchestration (signal-state, challenge-window, mint executor) parity-tested against the afi-math 86B schedule. On-chain execution is not wired (the executor targets an abstract interface; the Solidity contracts are empty stubs). Serves the reserved settlement domain; reserved to CHAIN-GOV.",
+      "purpose": "The off-chain TypeScript mint/emissions orchestration (signal-state, mint executor) parity-tested against the afi-math 86B schedule. On-chain execution is not wired (the executor targets an abstract interface; the Solidity stubs were deleted). Serves the reserved settlement domain; reserved to CHAIN-GOV.",
       "maturity": "underConstruction",
       "visibility": "internal",
       "capabilityRefs": [],

specs/AFI_ANALYST_SHOP_MVP.md

@@ -27,7 +27,7 @@ AFI accelerates the **back office** (ingest → score → commit). Ably accelera
 | **Ingest** | Webhook or bot posts signals into AFI | USS v1.1 or CPJ v0.1 conformant payload |
 | **Processing** | Enrichment + UWR score + qualify/reject | `afi-reactor` (reference) or any conforming orchestrator |
 | **Commitment** | Mint to beneficiary when qualified | `afi-mint` → Base Sepolia |
-| **Audit trail** | Immutable history for challenge/replay | Mongo TSSD scored signal record |
+| **Audit trail** | Immutable history for replay/verification | Mongo TSSD scored signal record |
 | ***(Optional)* Proof feed** | Subscribers see SCORED/MINTED live | Ably (or polling, Telegram mirror, etc.) |
 
 **Shop is “open” when rows 1–5 work.** Row 6 is marketing and trust, not protocol membership.
@@ -63,7 +63,7 @@ flowchart TB
 | Ingest API | `afi-gateway` webhook | **Yes** | Getting signals into protocol |
 | Orchestration | **afi-reactor** (not Ably) | **Yes** | Reliable score → mint handoff |
 | Scoring | `afi-reactor` + UWR | **Yes** | Deterministic qualify/mint path |
-| Evidence | Mongo TSSD vault | **Yes** | Replay, challenge, audit |
+| Evidence | Mongo TSSD vault | **Yes** | Replay, verification, audit |
 | Commitment | `afi-token` / `afi-mint` on Base Sepolia | **Yes** | Rewards attribution |
 | Live proof | **Ably** | No | Subscriber trust, dashboard UX |
 | Distribution | Telegram/Discord (analyst’s own) | No* | Reach (*analyst usually already has this) |

specs/AFI_PORTABLE_PROTOCOL_SURFACE.v0.1.md

@@ -32,7 +32,7 @@ Building AFI required concreteness. You cannot protocol-ize in the abstract fore
 ingest (gateway/webhooks) → enrich + score (afi-reactor DAG) → persist (TSSD vault) → commit (BASE mint/receipt)
 ```
 
-That spine is valuable. The trap is **narrative drift**: when collaborators (or future-you) read the spine as the spec. Rabbit holes amplified this—vault design, enrichment APIs, emissions math, mint FSM, econ simulation, doctrine docs—each layer has gravity. Over time “AFI” started to mean “this repo layout” instead of “these rules for proposing, enriching, scoring, committing, and challenging signal intelligence.”
+That spine is valuable. The trap is **narrative drift**: when collaborators (or future-you) read the spine as the spec. Rabbit holes amplified this—vault design, enrichment APIs, emissions math, mint FSM, econ simulation, doctrine docs—each layer has gravity. Over time “AFI” started to mean “this repo layout” instead of “these rules for proposing, enriching, scoring, committing, and independently verifying signal intelligence.”
 
 **This document recenters the portable protocol** and charters work to solidify it.
 
@@ -42,7 +42,7 @@ That spine is valuable. The trap is **narrative drift**: when collaborators (or
 
 ### 3.1 One-Sentence North Star
 
-> **AFI is the rules for how signal intelligence is proposed, enriched, scored, committed, and challenged—not the database or DAG framework used to build the first working example.**
+> **AFI is the rules for how signal intelligence is proposed, enriched, scored, committed, and independently verified—not the database or DAG framework used to build the first working example.**
 
 ### 3.2 Layer Model
 
@@ -51,7 +51,7 @@ AFI is best understood as **separated planes**, not one monolithic stack:
 | Plane | Role | What strangers must agree on | Typical implementations (non-normative) |
 |-------|------|------------------------------|-------------------------------------------|
 | **Commitment** | Immutable attestation of what the network accepted | BASE: mint events, receipts, emissions caps, epoch linkage, content anchors/hashes (present + future) | `afi-token`, `afi-mint` |
-| **Evidence** | Dense per-signal lifecycle for replay and challenge | Full RAW → ENRICHED → ANALYZED → SCORED → MINTED → REPLAYED record; public vs proprietary surface | Mongo, PostgreSQL, TimescaleDB, InfluxDB (per `vault.schema.json`) |
+| **Evidence** | Dense per-signal lifecycle for replay and verification | Full RAW → ENRICHED → ANALYZED → SCORED → MINTED → REPLAYED record; public vs proprietary surface | Mongo, PostgreSQL, TimescaleDB, InfluxDB (per `vault.schema.json`) |
 | **Scoring DAG** | Deterministic transforms on declared inputs | Pinned topology, plugin/analyst/validator versions; conforming outputs | `afi-reactor`, custom DAG, any conforming orchestrator (if outputs conform) |
 | **Market / analytics** | Continuous context at scale (not per-signal canon) | Published feature schemas, snapshot refs for replay | warehouses/streams chosen per operator — non-normative, never AFI's evidence store |
 | **Ingest boundary** | Valid entry dialect into the protocol | USS v1.1, CPJ v0.1, lens extensions | `afi-gateway`, webhooks, SDKs |
@@ -80,7 +80,7 @@ Any validator or operator may erect their own database and DAG pipeline if:
 2. **Pinned transforms** — Pipeline/DAG identity and versions are recorded so replay is possible.
 3. **Determinism** — Same inputs + same pinned rules ⇒ same scored outputs (modulo explicitly snapshotted external API data).
 4. **Commitment linkage** — On-chain artifacts link to off-chain evidence via `signalId`, epoch, and (where specified) content hashes.
-5. **Challenge-ready evidence** — Enough dense lifecycle data exists for an independent party on a different stack to reproduce or dispute.
+5. **Verification-ready evidence** — Enough dense lifecycle data exists for an independent party on a different stack to reproduce the result exactly.
 
 Reputation, registries, and governance influence **selection and allocation**—they must not override deterministic scoring or protocol finality (`afi-config/docs/REGISTRIES_AND_REPUTATION.v0.1.md`).
 
@@ -148,7 +148,7 @@ The investigation and follow-on work should move AFI toward:
 1. **Published Protocol Surface** — Single doc (successor to this one) listing normative schemas, invariants, and on-chain/off-chain division of responsibility.
 2. **Reference Implementation Index** — Which repos implement which spine segment; explicitly non-mandatory for external validators.
 3. **Contradiction Register** — Every place code, docs, or comments imply Mongo-only, reactor-only, or full payload on-chain.
-4. **Anchor Specification** — Minimum on-chain commitments + required off-chain evidence for replay/challenge (the “HTTP headers” of AFI).
+4. **Anchor Specification** — Minimum on-chain commitments + required off-chain evidence for replay/verification (the “HTTP headers” of AFI).
 5. **Replay Contract** — Cross-repo checklist: what a third-party validator needs to reproduce a mint decision without org infra.
 6. **Doc hygiene** — Stale docs tagged; architecture maps updated or archived.