XChain-Platform · jdogresorg · Sep 7, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,23 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.14.0] - 2026-09-02
-
-### Added
-- Documented the attestation responsible-set widening flag day and its activation heights.
-
-### Activation
-- Attestation responsible-set widening activates on Bitcoin testnet at block 150780 and on regtest from genesis. Mainnet is unratified and the rule is inert there. Below the height, and on an unratified network, behaviour is byte-for-byte unchanged.
-- This train changes state derived from existing bytes, so nodes on either side of the height disagree once a widened response lands. Upgrade every indexer and hub before the height.
-
-## [Unreleased]
+## [0.15.0] - 2026-09-07
 
 ### Added
+- The ATTEST response-mirror activation height, its two hub overrides, the attestation batch publisher settings, the round cadence knobs and the indexer's three hub-mirror grace windows are documented, with the `attestation_responses` mirror table.
+- A two-chain regtest venue can opt in to roll-call activation, and the roll-call, frozen-tip and config-oracle variables are documented for the hub and indexer.
+- Flag-day gates parked on the unarmed testnet sentinel are reported.
+- The v0.14.0 release train is recorded on the releases page.
 - ROLLCALL, a validator liveness action published on Dogecoin, is documented: wire format, EQUIV canonical, the rules each chain judges, the accept window and its cut, and the eviction rule.
 - Eight frozen ROLLCALL consensus constants are declared in `protocol/constants.js`, with mainnet shipping inert at `null`.
 - `XROLLCALL` joins `ENGINE_TAGS` with header vectors; it is namespacing only and deliberately not a SLASH family.
 - `rollcall_canonical.json` freezes the canonical and wire bytes with real Ed25519 signatures, including negative cases for a wrong ledger hash, network or epoch.
 - The indexer configuration page states that the existing DOGE wiring becomes required a second time from `ROLLCALL_ACTIVATION`, and that a BTC indexer without it defers every block.
+- ATTEST's hub-mirror response path is documented: the mirror-era signed canonical, deterministic callback timing with no broadcast transaction, the v5/v6 batch format, and the escrow-split change once broadcasting stops.
 
 ### Changed
 - The white paper is bumped to version 1.4, dated 2026-08-31, for the announcement.
@@ -60,6 +56,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Removed
 - The operator-dashboard pages and every listing of it (components index, README table, platform map, test counts); it is internal operator tooling, not part of the public platform.
 
+### Activation
+- The ATTEST response mirror activates on Bitcoin testnet at block 151324 and on regtest from genesis. Mainnet is unratified and the legacy on-chain response path runs there byte for byte.
+- ROLLCALL activates on Bitcoin testnet at block 151200, which the chain has already passed, so it is live from the moment a node updates. Mainnet is unratified.
+- Both change state derived from existing bytes on testnet, so an updated node and one still on 0.14.0 judge a mirrored response differently once one lands. Update every indexer and hub together.
+
+## [0.14.0] - 2026-09-02
+
+### Added
+- Documented the attestation responsible-set widening flag day and its activation heights.
+
+### Activation
+- Attestation responsible-set widening activates on Bitcoin testnet at block 150780 and on regtest from genesis. Mainnet is unratified and the rule is inert there. Below the height, and on an unratified network, behaviour is byte-for-byte unchanged.
+- This train changes state derived from existing bytes, so nodes on either side of the height disagree once a widened response lands. Upgrade every indexer and hub before the height.
+
 ## [0.12.1] - 2026-08-13
 
 ### Added

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -30,9 +30,9 @@ xchain-documentation/
 ├── protocol/             37 ACTION definitions, Token Information Standard, schemas
 ├── operations/           deployment, Docker, monitoring, upgrades, troubleshooting
 ├── legal/                licensing, commercial license, trademark, contributor agreement
-├── BLOCKCHAINS.md        supported chains, adding new blockchains
-├── OVERVIEW.md           platform overview
-├── WHITEPAPER.md         technical whitepaper
+├── blockchains.md        supported chains, adding new blockchains
+├── overview.md           platform overview
+├── whitepaper.md         technical whitepaper
 ├── CHANGELOG.md          authoritative version history
 └── README.md             entry point and section map
 ```
@@ -53,13 +53,24 @@ git clone https://github.com/XChain-Platform/xchain-documentation.git
 cd xchain-documentation
 ```
 
-There is no `npm install` or build step needed for editorial contributions.
+There is no build step. There is a check suite, and it gates your PR, so install
+once before you run it:
+
+```bash
+npm install
+```
+
+That pulls a single devDependency (`mathjs`), used by the arithmetic gates.
 
 ---
 
 ## Making changes
 
-This repository contains Markdown files only. There is no source code to compile and no test suite to run.
+This repository is almost entirely Markdown, with `protocol/constants.js` and a `lib/` helper alongside it. There is nothing to compile, but there is a suite of gates under `test/` that check the prose against the platform's real behavior: internal links and heading anchors, documented environment variables, ACTION counts, protocol constants, and the arithmetic of the genesis allocation table. They decide whether a PR can merge, so run them before you open one:
+
+```bash
+npm test
+```
 
 ### Types of contribution
 
@@ -80,7 +91,7 @@ Before writing the PR:
 3. **Describe the consensus impact.** Explain whether the change is additive (no existing behavior changes), clarifying (no behavior changes, but removes ambiguity), or consensus-breaking (a compliant implementation would behave differently after the change).
 4. **Consensus-breaking changes need sign-off from implementing service maintainers** before the PR merges. This means the teams responsible for `xchain-decoder`, `xchain-indexer`, and any other service the spec governs. Tag them in the issue.
 
-Once the issue has consensus, open the PR against `master`. Keep one logical change per PR; don't batch unrelated spec edits.
+Once the issue has consensus, open the PR against `develop`. GitHub preselects `master` as the base, so change it before you submit. Keep one logical change per PR; don't batch unrelated spec edits.
 
 ---
 
@@ -126,7 +137,7 @@ All byte-level encoding examples and on-chain data samples in the spec must matc
 
 Match the existing log style: a concise subject line, then a short body explaining what changed and why.
 
-- Branch off `master` and keep history linear (rebase, don't merge).
+- Branch off `develop` and keep history linear (rebase, don't merge). `develop` is where work lands; `master` only ever receives release merges (see [`operations/release-process.md`](./operations/release-process.md)).
 - One logical change per commit; don't batch unrelated edits.
 - **No `Co-Authored-By` trailers.** This is a project policy.
 - **Never `--no-verify`.** If a hook fails, fix the cause; don't bypass it.
@@ -137,9 +148,10 @@ Match the existing log style: a concise subject line, then a short body explaini
 
 Before opening a PR:
 
-1. Confirm `git status` is clean apart from intended changes (no editor backup files, no `.env`).
-2. Update `CHANGELOG.md` with a terse entry for your change.
-3. Open the PR with a clear title and a description of what changed and why. For spec changes, link to the issue where maintainer sign-off was obtained.
+1. Run `npm test` and confirm it is green. These are the same gates that run on the PR.
+2. Confirm `git status` is clean apart from intended changes (no editor backup files, no `.env`).
+3. Update `CHANGELOG.md` with a terse entry for your change.
+4. Open the PR with a clear title and a description of what changed and why. For spec changes, link to the issue where maintainer sign-off was obtained.
 
 For non-security bugs or editorial issues, open an issue at <https://github.com/XChain-Platform/xchain-documentation/issues/new>. For security bugs, see [`SECURITY.md`](./SECURITY.md).
 

diff --git a/MAINTAINERS.md b/MAINTAINERS.md
@@ -27,15 +27,15 @@ Until additional maintainers join, the lead owns every area below. The table is
 | Area | What it covers |
 |---|---|
 | Protocol spec | `protocol/` ACTION definitions, encoding formats, DB naming conventions, Token Information Standard, error codes, URI scheme, and JSON schemas |
-| Component docs | `components/` documentation for each of the 15 documented xchain-* components |
+| Component docs | `components/` documentation for each of the 14 documented xchain-* components |
 | Developer guide | `developer-guide/` tutorials, integration examples, and query references |
 | Getting started | `getting-started/` platform intro, quickstarts, and glossary |
 | Concepts | `concepts/` metalayer model, tokens, ACTIONs, encoding, cross-chain, gas, and security overviews |
 | Architecture | `architecture/` data pipeline, component map, and database design |
 | User guide | `user-guide/` capabilities, use cases, and FAQ for non-technical readers |
 | AI and agents | `ai-agents/` guides for building AI agents on the platform |
 | Operations | `operations/` deployment, monitoring, upgrades, and troubleshooting |
-| Overview and whitepaper | `OVERVIEW.md`, `WHITEPAPER.md`, `BLOCKCHAINS.md` |
+| Overview and whitepaper | `overview.md`, `whitepaper.md`, `blockchains.md` |
 | Legal and project files | `legal/`, `LICENSE.md`, `NOTICE.md`, `CHANGELOG.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, `MAINTAINERS.md` |
 
 ---
@@ -63,7 +63,7 @@ If you cannot reach the relevant area maintainer within a reasonable window:
 | Situation | Escalate to |
 |---|---|
 | Active security incident | `security@dankest.llc` (per `SECURITY.md`) |
-| A documented consensus rule, encoding, or validation requirement that is unsafe or ambiguous | Open a public issue tagged `security` AND email `security@dankest.llc` |
+| A documented consensus rule, encoding, or validation requirement that is unsafe or ambiguous | GitHub Private Vulnerability Reporting, or `security@dankest.llc`; do not open a public issue (per `SECURITY.md`) |
 | Code-of-conduct concern | `conduct@dankest.llc` (per `CODE_OF_CONDUCT.md`) |
 | PR has been open without review for 14+ days | Comment `@J-Dog` on the PR; if no response within 7 more days, open an issue tagged `governance` with the PR link |
 

diff --git a/NOTICE.md b/NOTICE.md
@@ -17,6 +17,12 @@ XChain Platform is dual-licensed:
 - **A commercial license** from Dankest, LLC, for use without the AGPL's
   source-disclosure requirements.
 
+One first-party component is carved out of that dual license: the
+`xchain-contracts` template library is licensed under the **MIT License**,
+because it exists to be copied into user contracts. Its terms are in that
+repository's own `LICENSE` file and are not affected by the AGPL's
+source-disclosure requirements.
+
 For commercial licensing, contact **legal@dankest.llc**.
 
 ## Attribution
@@ -30,7 +36,7 @@ attribution, per the AGPL and the project's trademark policy:
 
 "XChain" and the XChain logo are trademarks of Dankest, LLC. The software
 license does not grant any rights to these marks. See the Trademark Policy:
-<https://docs.xchain.io/legal/TRADEMARK.html>
+<https://docs.xchain.io/legal/trademark>
 
 ## Third-Party Components
 

diff --git a/README.md b/README.md
@@ -38,7 +38,7 @@ A blockchain-agnostic token protocol currently running on Bitcoin, Litecoin, and
 | [**xchain-vm**](https://github.com/XChain-Platform/xchain-vm/) | Sandboxed JavaScript virtual machine for on-chain smart contracts with gas metering, deterministic execution, and reorg-safe state |
 | [**xchain-contracts**](https://github.com/XChain-Platform/xchain-contracts/) | MIT-licensed template library: audited example smart contracts, reusable patterns, a no-code policy generator, and a CLI, deployed via the ordinary `DEPLOY` action |
 | [**xchain-sdk**](https://github.com/XChain-Platform/xchain-sdk/) | Developer SDK: builders for all 31 developer-invocable actions, 100+ explorer query methods, smart contract support, live WebSocket events, batch builder, PSBT generation |
-| [**xchain-wallet**](https://github.com/XChain-Platform/xchain-wallet/) | Reference self-custodial multi-chain wallet: browser, Chrome extension, and Electron desktop from a single codebase; software + Trezor + Ledger + remote + multisig signers; full DEX, messaging, contracts, staking, and `window.xchain` dApp bridge |
+| [**xchain-wallet**](https://github.com/XChain-Platform/xchain-wallet/) | Reference self-custodial multi-chain wallet: browser, Chrome extension, Electron desktop, and Capacitor mobile (Android shipped, iOS later) from a single codebase; software + Trezor + Ledger + remote + multisig signers; full DEX, messaging, contracts, staking, and `window.xchain` dApp bridge |
 | [**xchain-regtest-miner**](https://github.com/XChain-Platform/xchain-regtest-miner/) | Auto-mines blocks for regtest development environments |
 | [**xchain-e2e-test**](https://github.com/XChain-Platform/xchain-e2e-test/) | Full-stack Mocha test suite running against a live regtest deployment |
 ## Legal
@@ -56,7 +56,7 @@ Any redistribution or modification must include the attribution notice specified
 
 **Copyright &copy; 2025-2026 Dankest, LLC**
 
-**Based on XChain Platform by Dankest, LLC &ndash; https://dankest.llc**
+**Based on XChain Platform by Dankest, LLC - https://dankest.llc**
 
 Licensed under the **GNU Affero General Public License v3.0** (AGPL-3.0-or-later)
 with a commercial license available for proprietary use.

diff --git a/SECURITY.md b/SECURITY.md
@@ -82,7 +82,7 @@ If you are unsure, send the report anyway and we will tell you whether it falls
 
 ## Versions covered
 
-We ship security fixes against the latest revision on `master`. The current version is recorded in `CHANGELOG.md` and the badge in `README.md`.
+We ship security fixes against the latest revision on `master`. The current version is recorded in `CHANGELOG.md` and in `package.json`.
 
 ---
 

diff --git a/architecture/component-map.md b/architecture/component-map.md
@@ -85,10 +85,10 @@ See [`../components/indexer/`](../components/indexer/) for full documentation.
 
 Key technical details:
 
-- 299 REST endpoint patterns across the `/api` and `/explorer` namespaces, covering tokens, balances, holders, orders, dispensers, transactions, events, market data, contracts, staking, attestations, cross-chain calls, betting feeds and bets, governance polls and ballots, contract emissions, vote delegations, validator capabilities and slashing, chain reorgs, anchor reward attestations, per-block commitments, and more. The breakdown, re-derived from `xchain-explorer/src/XChainExplorer.js` on 2026-08-28:
-  - 171 `/{COIN}/api/...` and 112 `/{COIN}/explorer/...` patterns in the dispatch table built by `setupUrls()`, matched by the catch-all handler rather than registered with Express individually.
+- 302 REST endpoint patterns across the `/api` and `/explorer` namespaces, covering tokens, balances, holders, orders, dispensers, transactions, events, market data, contracts, staking, attestations, cross-chain calls, betting feeds and bets, governance polls and ballots, contract emissions, vote delegations, validator capabilities and slashing, chain reorgs, anchor reward attestations, per-block commitments, and more. The breakdown, re-derived from `xchain-explorer/src/XChainExplorer.js` on 2026-08-28:
+  - 174 `/{COIN}/api/...` and 112 `/{COIN}/explorer/...` patterns in the dispatch table built by `setupUrls()`, matched by the catch-all handler rather than registered with Express individually.
   - 16 hand-registered `/{COIN}/api/...` routes that bypass the dispatch table: raw file download, fee quote, oracle fee quote, preflight (registered twice, GET and POST, because the largest legal action does not fit a query string), fee schedule, checkpoint list, checkpoint range, checkpoint verify, hub-mirror status, the five Merkle proof endpoints (balance, locked balance, action, validator set, contract state), and the POST contract-call query endpoint.
-  - Outside those two namespaces the same server also registers 114 HTML page routes plus `/openapi.json`, `/icon`, `/relay`, and the static asset mounts.
+  - Outside those two namespaces the same server also registers 117 HTML page routes plus `/openapi.json`, `/icon`, `/relay`, and the static asset mounts.
 - JSON-RPC 2.0 interface compatible with Counterparty-style tooling.
 - Bootstrap-based web UI with Highcharts for order book and market price visualization.
 - Reads configuration from xchain-hub every 60 seconds (fee schedules, supported parameters, fiat pricing).
@@ -218,7 +218,7 @@ Key technical details:
 
 - Operates in two modes: standalone (simple config oracle) and validator mode (full PBFT consensus, P2P gossip, oracle, cross-chain attestation, governance).
 - Supports multi-instance deployment, multiple hub instances against shared MariaDB, with consumer fallback via `HUB_VALIDATORS`.
-- Config writes go through PBFT consensus in validator mode (PRE_PREPARE → PREPARE → COMMIT with a `max(2f+1, ceil((N+1)/2))` quorum).
+- Config writes go through PBFT consensus in validator mode (PRE_PREPARE → PREPARE → COMMIT, reaching a federation quorum that is stake-weighted and source-deduped at/above `STAKE_WEIGHTED_QUORUM_ACTIVATION` and the legacy `max(2f+1, ceil((N+1)/2))` signer count below it).
 - Decentralized price oracle: validators fetch from CoinGecko and Kraken (CoinMarketCap optional, requires API key), aggregate via trimmed median (discard top/bottom 15%), finalize via PBFT.
 - Cross-chain attestation engine with per-chain-pair validator subsets and confirmation thresholds (BTC: 6, LTC: 12, DOGE: 60; env-tunable via `XCHAIN_CONFIRMATIONS_<COIN>`).
 - SWAP lifecycle tracking: initiated → attested → executed → settled.
@@ -326,7 +326,7 @@ See [`../components/vm/`](../components/vm/) for full documentation.
 
 | | |
 |---|---|
-| **Purpose** | Self-custodial multi-chain reference wallet; browser SPA, Chrome MV3 extension, and Electron desktop app |
+| **Purpose** | Self-custodial multi-chain reference wallet; browser SPA, Chrome MV3 extension, Electron desktop app, and Capacitor mobile app (Android shipped, iOS later) |
 | **Inputs** | User interaction; xchain-sdk for action construction; xchain-explorer for balance and history queries; xchain-hub for config and fee data |
 | **Outputs** | Signed transactions broadcast to coin nodes via the encoder; read-only views of balances, tokens, actions, and markets |
 | **Storage** | Client-side only (browser localStorage / extension storage / Electron local store); no server-side state |
@@ -336,7 +336,7 @@ Key technical details:
 
 - Built on xchain-sdk; all action construction goes through the SDK's 31 developer-invocable ACTION methods.
 - Supports every chain the platform runs on, today Bitcoin, Litecoin, and Dogecoin (mainnet, testnet, regtest), from the same codebase.
-- Deployed as a web SPA (served from a static docroot), a Chrome MV3 extension (packaged from the same source), and an Electron desktop application.
+- Deployed as a web SPA (served from a static docroot), a Chrome MV3 extension (packaged from the same source), an Electron desktop application, and a Capacitor mobile app wrapping the same web build (Android shipped, iOS later).
 - Private keys never leave the client; signing happens locally before broadcast.
 - Targets non-technical end users; UI language is intentionally plain (e.g., "About" not "Token Spec").
-Original file line number
+Diff line change
@@ Expand Up @@
     ## Versions covered
-    We ship security fixes against the latest revision on `master`. The current version is recorded in `CHANGELOG.md` and the badge in `README.md`.
+    We ship security fixes against the latest revision on `master`. The current version is recorded in `CHANGELOG.md` and in `package.json`.
     ---
@@ Expand Down @@