The Charter

A Perpetual Compute Right (PCR) is a transferable ERC-721 deedto a fixed quantum of normalized network capacity, denominated in Compute Units (CU). It is pool-backed: the deed binds to the network’s live capacity, not to any single accelerator. Perpetual denotes a right, not silicon — the entitlement outlives the machine that first serves it.

Acquisition is one-time. Capacity is purchased once, in tokenized USD, at mint. There is no subscription and no recurring protocol charge for holding the deed.

The instrument coordinates three parties. (a) The holder pays once and holds capacity — usable directly, leasable on the spot market, or sellable as a deed. (b) The providerpledges hardware and staked $LOXLEY; the holder’s payment streams to it only for served uptime. (c) The network guarantees the two never diverge: sold capacity may not exceed what providers actually run, and failed hardware is reassigned with its remaining bond.

Cashflow follows title. Whoever holds the deed at the moment of settlement receives spot-lease income and slash compensation. Selling the deed transfers every future entitlement with it.

Heterogeneous accelerators are normalized to a single integer unit — the Compute Unit (CU) — so that one deed can be served by any qualifying hardware in the pool. CU is always an integer; there are no fractional units.

Normalization is governed. The mapping below is the v1 normalization curve; $LOXLEY governance may revise it as hardware generations change. Existing deeds retain their CU count — revisions affect how new capacity is counted, never the size of rights already sold.

A provider’s capacity in CU is the sum over its fleet. Allocation is local: assignedCU ≤ capacityCU, counted against live hosts only.

Every mint enforces the honesty invariant. A mint of cu units reverts unless sold capacity, including the new units, stays within the live-capacity safety bound. It is contract-enforced and fuzz-tested — an invariant, not a policy — so a perpetual right can never degrade into a queue.

The mint price (pricePerCU × cu, in USD) is split atomically on settlement:

The deed is an ERC-721 with fully on-chain SVG/JSON metadata— no external URI, no server that can revoke or rewrite it.

Secondary sales carry a 2.5% ERC-2981 royalty routed to the FeeVault, where it fuels the $LOXLEY buyback. The royalty funds the protocol, not a treasury multisig.

The bond streams linearly against provider online-seconds, not wall-clock time. Vesting is measured across 1095 days of attested uptime.

Online-seconds accumulator. onlineSecondsOf(p) is a monotonic counter that advances only while the oracle attests the provider online. Each stream stores a snapshot; one oracle flip meters allof a provider’s streams at once — O(1) status updates regardless of stream count. Payment halts the same block a provider goes dark.

Migration.On reassignment, amounts already accrued stay with the departing provider; only the unvested remainder follows the deed to its replacement. The holder’s entitlement is uninterrupted across the handover.

Retirement. Retiring a deed returns its unvested bond to the Rollover Reserve. Retirement is blocked while the deed is encumbered by an active spot rental.

These are the adverse conditions, stated plainly. When a provider breaches its SLA, staked $LOXLEY is slashed and the proceeds are routed largely to the holders it failed.

Compensation reaches holders through a per-CU accumulator (compPerCUAcc). A deed snapshots the accumulator on mint and reassignment and claims the delta × its CU — no loops, O(1) per claim, regardless of how many deeds exist.

Jailed providers, whose stake has fallen below the required collateral, are removed from allocation until they top up. The 14-day unbonding queue is slashable for its entire duration, so a provider cannot exit ahead of a pending breach.

We state the limits honestly: the oracle committee is permissioned in v1. Permissionless challenge windows and on-chain dispute are on the roadmap — not yet live. Slashing is capped per incident and is not a full indemnity against loss.

Holders list idle CU on the SpotMarket at a price per CU-hour. Renters prepay for a bounded term (minHours … maxHours); capacity is reserved for the duration of the rental.

A 5% protocol fee is split between the FeeVault and the Rollover Reserve; the net accrues to the current PCR owner. Cashflow follows title — selling the deed transfers accrued and future lease income with it.

Settlement is permissionless. Anyone may settle an expired rental; released capacity returns to the holder or is re-listed. No privileged operator sits between a lease and its payout.

Inflows. 15% of every primary sale, a share of protocol fees and royalties, and the unvested bond of any retired deed.

Purpose. The Reserve finances hardware refresh — the replacement of aged accelerators — so perpetual rights outlive the silicon that first served them. Disbursement is timelock-gated and governed by $LOXLEY.

Every disbursement is an on-chain, event-logged transaction. The Reserve is a program, not a promise; its balance and every outflow are public.

$LOXLEY is an ERC-20 with Permit and Votes (timestamp clock) and a fixed supply of 1,000,000,000. There is no mint function beyond genesis; supply cannot inflate.

Utility is threefold: provider collateral (staked and slashable), governance (protocol parameters and the Reserve), and buyback target (protocol fees purchase LOXLEY, distributed to provider stakes via the RewardsDistributor).

The full token page — supply, staking, buyback trail and governance thresholds — is at /token.

Proof-of-compute honesty in v1 rests on oracle-attested heartbeats and challenge sampling, with TEE attestation where the hardware supports it. Fully verifiable execution is on the roadmap, and named as such here rather than implied.

Online-seconds are metered against block timestamps. On Arbitrum-stack chains (Nitro), block.timestamp tracks the sequencer clock and advances monotonically; the accumulator is written to tolerate this by only ever moving forward, never rewinding on a timestamp anomaly.

The oracle holds ORACLE_ROLE: it records online/offline transitions and files SLA breaches. It cannot mint deeds, move bonds, or seize collateral outside the slashing rules in §5.

Every address is read live from the deployment artifact for the active chain. Switching testnet → mainnet is config-only; no chain constant is hardcoded in this document.

The indexer’s REST API is the single source of truth for every figure the frontend shows — landing, registry and dashboard read the same numbers.

A PCR is a utility right to compute capacity. It is not a security, not a deposit, and not a guaranteed-income product. Spot income depends on demand and served uptime and may be zero.

Hardware obsolescence is handled by the Rollover Reserve program, not by magic. Refresh depends on the Reserve balance and on governance executing disbursements; it is a best-effort treasury, not an insurance guarantee.

Slashing protects holders but is capped per incident(§5) and depends on the oracle committee, permissioned in v1. Compensation may not cover the full value of a prolonged outage.

Regulatory positioning. Locksley is infrastructure for purchasing and transferring rights to compute. Nothing in this Charter is an offer of securities or investment advice; deed holders are responsible for their own legal and tax compliance in their jurisdiction.