Mainnet services

Status: the network services run on Base Mainnet. The jobs escrows (nonces 23 and 25) work with the v4 verified evaluators (nonces 29 and 30, 2026-11-12); the compute payment contract and the staking contract followed (nonces 31 and 32). The ARL app at arlcoin.io/app runs on Base Mainnet. The ARL token, its Safes, vesting wallets and timelock are on Base Mainnet since 2026-10-24 (mainnet-plan.md).

Step 1: jobs escrow and verified evaluator

Transactions from the deployer 0xe033104AE32fc7e13263B7AED577Ab20d6E47eAA, signed on the app's Deploy screen (arlcoin.io/app/deploy/?plan=…):

8453-verified-jobs-usdc and 8453-verified-jobs-arl are invalid, do not use: they hold pre-audit bytecode (before the audit fixes of 2026-10-28) and the deploy screen refuses them. Their -v2 replacements are built from the fixed code at the same nonces, so they create contracts at the same addresses. Both -v2 pairs were signed on 2026-10-31 and jobs-record-cli.ts passed all nine checks for each on Base Mainnet; the record is contracts/deploy/base-mainnet-jobs.json. Rehearsal of the -v2 plans (Base Mainnet fork, deployer impersonated at nonce 23, nothing sent): every contract was created at the address above and jobs-record-cli.ts passed all nine checks for each pair. Every address follows from the deployer and its nonce: any other transaction from the deployer before them shifts the addresses, and the Deploy screen then refuses the plan.

Compute payment and staking

8453-services (DeployMainnetServices, nonces 31 and 32, after the v4 evaluators) creates ComputePayment (per-second streams in ARL) and ARLStakingRewards (stake ARL, rewards in ARL, 180-day periods). Neither has an owner. Only the Community & Staking Safe 0xfF12597A671ebAF0cAe37999EE659e03c4f444B5 (2 of 3) can fund a reward period; the first period is 300,000 ARL (owner decision of 2026-11-01), funded by the Safe afterwards with approve and notifyRewardAmount. Signed on 2026-11-12; services-record-cli.ts passed all ten checks on Base Mainnet (record contracts/deploy/base-mainnet-services.json). The reward period is not funded yet. Rehearsal (Base Mainnet fork, v4 evaluators applied first, deployer impersonated, nothing sent): both contracts were created at the addresses above, services-record-cli.ts passed all ten checks, and the Safe funded 300,000 ARL (reward rate 0.01929 ARL per second for 180 days). After signing:

node packages/deploy/src/services-record-cli.ts <run.json> https://mainnet.base.org   contracts/deploy/deployments/8453-services.json

Evaluator v4

8453-verified-evaluator-arl-v4 (nonce 29) and 8453-verified-evaluator-usdc-v4 (nonce 30) replace the evaluators at nonces 27 and 28 for the escrows already on chain, with the same parameters. Rehearsal (Base Mainnet fork, deployer impersonated at nonce 29, nothing sent): both evaluators were created at the addresses above and jobs-record-cli.ts passed all nine checks for each. Sign the ARL plan first, then the USDC plan; any other transaction from the deployer before them shifts the addresses, and the Deploy screen then refuses the plans. Both were signed on 2026-11-12 and jobs-record-cli.ts passed all nine checks for each on Base Mainnet; the evaluators at nonces 27 and 28 are retired.

Acceptance fix (security report 2026-10-31)

The -v3 evaluators were signed on 2026-11-01 at nonces 27 and 28, jobs-record-cli.ts passed all nine checks for each on Base Mainnet, and both are source-verified on Basescan. The record is contracts/deploy/base-mainnet-jobs.json.

The -v2 plans were signed and executed: the escrows at nonces 23 and 25 carry the audit fixes and stay in service. Their evaluators (nonces 24 and 26) closed acceptance as soon as voting started, and anyone can start it once a job is submitted (startVoting, or the first vote). With fewer than threshold members accepted by then, no decision could be reached: the client was refunded after one vote window and the provider, who had delivered, was not paid. Read on 2026-10-31 from https://mainnet.base.org: both escrows have jobCounter() == 0 and no token balance, and both evaluators hold no stake, so nothing is at risk and nothing has to migrate.

• ARLVerifiedEvaluator: a member can accept until the vote window ends (and before a decision); before the vote starts the deadline check still applies. A member who accepts late and does not vote is slashed like any absent member.
• Validators (packages/verifier): the watch pass also accepts a job that is already Submitted, and a reverted transaction is never logged as accepted or voted.
• SDK: submitDeliverable refuses until threshold members have accepted (waitForAcceptance, acceptedCount); BASE_MAINNET_VERIFIED points to the new evaluator at nonce 27.

Escrows are independent of evaluators (each job names its own), so only the two evaluators are replaced, for the escrows already on chain (DeployMainnetVerifiedJobs with ARL_JOBS). Sign 8453-verified-evaluator-arl-v3 (nonce 27) first, then 8453-verified-evaluator-usdc-v3 (nonce 28); any other transaction from the deployer before them shifts the addresses, and the Deploy screen then refuses the plans. Rehearsal (Base Mainnet fork at block 53,323,835, deployer impersonated, nothing sent): both evaluators were created at the addresses above with the same parameters as the ones they replace, and jobs-record-cli.ts passed all nine checks for each. Then run jobs-record-cli.ts for each plan as below (record files 8453-jobs.json and 8453-jobs-usdc.json) and verify the source on Basescan.

Deadline fix (security report 2026-10-25)

The pair at nonces 21 and 22 was built before two reports on the job deadline. Contracts cannot be upgraded, so the fix ships as new contracts; the retired pair holds no jobs and no app, SDK or document points to it any more.

• ARLJobs: from expiredAt on the evaluator can no longer complete or reject a funded job, so after the deadline the escrow can only go back to the client (claimRefund). The outcome no longer depends on which transaction lands first.
• ARLVerifiedEvaluator: members can only accept, and voting can only start, while the vote window and two challenge windows still end before the deadline. A decision therefore always ends its challenge window at least one challenge window before the deadline, and anyone can finalize it in that time; a client who funds late cannot void an approved job. An undecided vote can be closed after the deadline too, and absent members are still slashed.
• SDK: fundVerifiedJob and checkFundedJob refuse a job whose evaluation no longer fits before its deadline (checkEvaluationFits).

Rehearsal (Base Mainnet fork at block 53,295,431, deployer impersonated, nothing sent): both plans created their contracts at the addresses above, the code matches the plan files byte for byte, and jobs-record-cli.ts passed all nine checks for each pair.

Jobs are paid in ARL or in USDC, one escrow each; validators stake and bond in ARL for both. The evaluator for the escrow paid in USDC is deployed with ARL as its stake token: a budget in dollars cannot be compared with a bond in ARL, so there the bond is the floor the job sets (at least 100 ARL) rather than a tenth of the budget. The runs are recorded in contracts/deploy/deployments/8453-jobs-usdc.json and 8453-jobs.json.

Fixed parameters (no owner can change them later):

• Payment tokens: ARL 0xde91E6f39D50bBd875f831dcc1134A3D7f3aaDb4 and USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913. Stake token: ARL.
• Shortest challenge window a job may set: 24 hours.
• Smallest validator bond per job: 100 ARL. For the escrow paid in ARL a job's bond is the larger of the job's floor and a tenth of its budget; for the escrow paid in USDC it is the job's floor.
• Disputes: the arbiter Safe above (three separate signers, two must sign). Slashed bonds go to 0x000000000000000000000000000000000000dEaD.
• ERC-8004 v2.0.0 registries on Base: identity 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432, reputation 0x8004BAa17C55a88189AE136b182e5fdA19dE9b63.

After signing, for each plan:

node packages/deploy/src/jobs-record-cli.ts <run.json> https://mainnet.base.org \
  contracts/deploy/deployments/8453-jobs-usdc.json   # 8453-jobs.json for the ARL pair

then source verification of both contracts on Basescan. Like every deployment record, these files stay out of git (contracts/deploy/deployments/ is ignored).