[PROPOSAL] RFP-017 - Covenant: Privacy-Preserving Token Vesting

[aegonmyy]

RFP ID

RFP-017

Your Project Name

Covenant: Privacy-Preserving Token Vesting

Team or Organization Name

aegonmyy

Primary Contact

aegonmyy (GitHub); reachable through the contact details on this account

Team Members

I am a solo builder working with an AI-assisted workflow. I won Lambda Prize
LP-0017 (PR #100, a
censorship-resistant document upload and indexing Basecamp app), and my
LP-0008 submission
(aegonmyy/logos-agent, PR #130) is
pending review with a complete evidence kit: live public-testnet settlements,
per-instruction cycle tables, an IDL, integration tests against the
sequencer's own state machine, and a narrated walkthrough video. Everything
linked in this proposal is built, runnable, and public today.

Solo is a real risk and I price it structurally: every milestone below
carries an explicit "done" gate that Logos can check without trusting me,
and the audit is inside the number.

Project Summary

Covenant is a vesting program for the Logos Execution Zone: schedules with
cliff, linear, and milestone shapes, an escrow the program itself holds,
public and private claim paths, cancellation that returns unvested tokens and
freezes the vested remainder, and a creator-facing and recipient-facing
mini-app. The RFP scopes privacy to the claim layer, and that is where this
build puts it: schedule parameters stay public, the beneficiary link stays
public, and the destination of a private claim is chosen at claim time and
never recorded on the schedule.

The core claim of this proposal is narrower than "we will build this": most of
it is already built and on chain. The math core with formal proofs, the guest
program, the host SDK, per-instruction cycle tables, a public-testnet
deployment of the full lifecycle with on-chain evidence, and a narrated video
all exist in
aegonmyy/lez-vesting at the time of
filing. CI is green on the default branch. The milestones below are for
finishing, hardening, shipping the SDK and mini-app, auditing, and walking the
program through testnet 0.3 and mainnet.

The open dependency question (LP-0013) is resolved by measurement: the
dependency-measurement report pins the
token program at its current ref, enumerates its actual instruction set, and
shows transfer gating covers sender signatures only. The consequence for this
RFP is exact: native-collateral vesting needs no transfer authority and ships
today; token-denominated schedules need an upstream extension and are carried
as a gated milestone that the core never depends on.

Technical Approach

Escrow model. The schedule account is a program-derived account whose
native balance is the escrow. Funding chains the platform's authenticated
transfer program to move collateral into the PDA. Claims and cancellations
debit the PDA and credit the beneficiary, creator, or claim-time destination
directly. This relies on the documented LEZ state-machine rule that a program
may increase any balance and debit accounts it owns, which the integration
tests verify against the sequencer's own state machine (the same validation
the chain runs, so a Rule-5 misreading fails the test suite).

Privacy at the claim layer. claim_public credits the beneficiary account
on the schedule. claim_private takes a destination at claim time, validates
it is shielded, and credits it; the destination is an instruction argument,
never schedule state. Anyone reading the schedule learns the beneficiary and
the terms, and learns nothing about where private claims landed. The mini-app
shows a pre-claim disclosure stating exactly that, in the shape the RFP's
privacy requirement describes.

Integer-only math. All accrual is u128 with 256-bit intermediate multiply
divide, rounded down, monotone, bounded to [0, total]. Four invariants are
under Kani harnesses; three are proven and one
(milestone_signal_idempotent_unlocks_once) currently exceeds the 1800s
proof cap and is reported unproven, with the property test suite carrying it
until the harness is split.

Determinism as a cost story. Guest execution is deterministic, so the
published per-instruction cycle table is the same number the chain charges.
Measured operations run at a fraction of a percent of the 32M-cycle session
limit, and the documented worst case (a schedule whose event log is full) is
4.4M cycles, still comfortably inside. The table ships with dev-mode numbers
and proving-enabled (RISC0_DEV_MODE=0) wall-clock measurements, both
published with this proposal at filing time.

What is already on chain. The public LEZ testnet deployment runs the full
lifecycle (create, fund, pre-cliff rejection, partial public claim, cancel
with split, private claim) with negative controls, from the same unmodified
ELF the integration tests run. The four-fact bundle (freeze commit, image id,
deploy transaction, block range) plus an independent re-verification script
that speaks raw JSON-RPC are in
docs/TESTNET_EVIDENCE.md.

Milestones, Payout and Timeline

Each milestone lists a done-gate: the artifact Logos checks to consider it
complete. Any single milestone is a survivable loss on its own.

Milestone 1: Specification, account model, dependency measurement. Payout:
$4,000. Duration: 1.5 weeks.
Deliverables: spec document, account/PDA model, the LP-0013 dependency
measurement report (pin the token program ref, enumerate instructions, verdict
on transfer authority), the accrual and rounding table, Kani harness scaffold.
Done-gate: report merged, table published, harnesses run in CI.
Status at filing: delivered
(dependency-measurement,
CU table);
payout covers review-driven revisions and the milestone-authority writeup.

Milestone 2: Program core. Payout: $8,000. Duration: 2.5 weeks.
Deliverables: cliff+linear, fully linear, and milestone schedule kinds;
cancelable with one-way renunciation; transferability frozen at creation;
batch creation with the documented maximum; event records with a published
schema; SPEL IDL; Kani proofs and property tests.
Done-gate: all instructions green through lee's state machine in CI; IDL
artifact published.
Status at filing: core math proven (3/4 harnesses), all nine instructions
implemented and green in 14 end-to-end tests; payout covers milestone-schedule
edge hardening, batch-limit documentation, and the event schema packet.

Milestone 3: Escrow and claims on public testnet. Payout: $10,000.
Duration: 3 weeks.
Deliverables: program-held escrow verified against the Rule-5 reading on a
standalone sequencer; public and private claim paths; atomic claim and cancel;
idempotent milestone signalling with deterministic double-signal errors;
separate cancellation and milestone authorities; testnet 0.2 deployment with
the four-fact bundle and independent verification script.
Done-gate: verification script passes against public testnet from a clean
checkout, negative controls included.
Status at filing: deployed and verified
(TESTNET_EVIDENCE);
payout covers concurrency hardening (parallel claims, restart safety) and the
authority-separation tests.

Milestone 4: SDK, CLI, and mini-app. Payout: $8,000. Duration: 2.5 weeks.
Deliverables: SDK covering the full lifecycle with shielded-target validation
that rejects public destinations for private claims; CLI; Basecamp mini-app
with recipient and creator views, pre-claim summary, fee and gas check, and
the privacy disclosure.
Done-gate: mini-app verified running in Basecamp: it executes a
create-fund-claim round trip from a clean checkout.
Status at filing: the SDK's wire-format core exists and is the single source
the guest and the testnet driver both parity-check against.

Milestone 5: Measurement, e2e, and documentation. Payout: $6,000.
Duration: 1.5 weeks.
Deliverables: per-op CU table with testnet version stated and
proving-enabled wall-clock; standalone-sequencer e2e green in CI on the
default branch; narrated lifecycle video; README with program addresses; the
two documentation packets for logos-docs; privacy-properties document;
traceability generated from test names.
Done-gate: CI green including the e2e job; video renders the full lifecycle.
Status at filing: CU table, e2e, CI, and the narrated video all exist; payout
covers the doc packets and the proving-enabled measurement pass.

Milestone 6: External audit and remediation. Payout: $5,000.
Duration: 1.5 weeks.
Deliverables: external audit scoped to the escrow, claim, and authority paths;
remediation of findings in-milestone; published report.
Done-gate: report published with every finding closed or risk-accepted in
writing.
The audit is inside the $48,000, answering the question directly.

Milestone 7: Testnet 0.3 verification. Payout: $1,500. Duration: 0.5 weeks.
Gated on the platform's 0.3 date; re-runs the deployment and verification
script against 0.3 and republishes the evidence bundle.

Milestone 8: Mainnet deployment. Payout: $1,500. Duration: 0.5 weeks.
Gated on the platform's mainnet date; deploys, records the four-fact bundle,
hands over program addresses.

Milestone 9 (gated extra): token-denominated schedules. Payout: $4,000.
Duration: 1.5 weeks.
The actual LP-0013 gap. Carried as an upstream transfer-authority extension
PR to lez-programs (design documented in the dependency-measurement report),
then a token-collateral schedule variant on top. Gated on upstream acceptance;
droppable without touching milestones 1 through 8, which stand on
native-collateral escrow.

Total Requested Budget (USD)

$48,000

4000 + 8000 + 10000 + 8000 + 6000 + 5000 + 1500 + 1500 + 4000 = 48000.

Pre-empting the obvious questions:

• Why a solo builder can do this. The evidence section answers it: the
  hard parts of milestones 1 through 3 are already built, proven, and
  deployed by this builder, under this workflow. The dividend from that
  head start is what funds the audit inside the number.
• Bus factor. Mitigated structurally: every milestone has a checkable
  done-gate, so Logos never pre-pays unproven work, and any single milestone
  is a survivable loss. The repo carries the full design rationale in
  CONTEXT.md so a second engineer can take over mid-stream.
• Dependency on other awards. None. This proposal stands alone and its
  pre-build was carried at my own cost.
• After delivery. Six months of maintenance (fixes, dependency bumps,
  platform-version verification) is included in the price.

Relevant Experience

• LP-0017 winner:
  PR #100, a
  censorship-resistant document upload and indexing Basecamp app.
• LP-0008 submission pending:
  logos-agent (PR [MILESTONE] RFP-002 M3 — Tests, documentation, delivery #130), with
  three live public-testnet settlements, CU methodology, and a narrated
  walkthrough.
• A complete token-program authority layer
  (PR #101, closed; the
  prize went to an earlier candidate) with IDL, integration tests, and dual
  licensing. That code and its design rationale are the working background
  for milestone 9's transfer-authority extension.
• This pre-build:
  lez-vesting, whose README links
  every artifact claimed above.

Weak evidence, stated as such: I have no previously accepted logos-co RFP;
this is my first bid. The pre-build is how I ask to be judged instead.

Post-Delivery Plan

Six months of maintenance included: bug fixes, dependency bumps, and
re-verification against each platform release, with the same evidence format
(a four-fact bundle and a re-verification script) published per release. Beyond
that window, maintenance continues on best effort; the program, SDK, and docs are
dual-licensed MIT and Apache 2.0 so the ecosystem is never locked to me.

Permissions and Consent

• I consent to being contacted via the primary contact provided above.
• I consent to the public use of this proposal and any accompanying
  materials, with redactions available on request.

Program Requirements

• I have read and agree to the Logos RFP Terms and Conditions, and I
  understand that no grant is owed absent an executed Grant Agreement.
• I understand that RFPs are proposals, that implementing one is my
  decision, and that legal and regulatory compliance is my responsibility.
• I agree to open-source all grant-funded work under MIT and Apache 2.0
  licenses unless otherwise approved in writing.
• I/We are prepared to deliver milestone-based outcomes as described.