Roles and permissionsLink to this section

TL;DRLink to this section

Counting work, authorizing settlement, paying gas, and displaying results are separate permissions.
An emergency pause stops settlement and new reward funding, not every owner action.
Upgrade administrators can change the work and reward contracts, so their decisions matter to owners.
Only the current NFT owner can claim its rewards; approving an NFT operator isn't enough.

What can an owner control?Link to this section

If you own a Miner NFT, you can transfer it and request eligible claims or merges. Ownership doesn't let you change sensor measurements, authorize settlement, or change reward rules. Giving an operator permission to manage an NFT doesn't give that operator permission to claim its SQK rewards.

Other roles handle those parts of the system. The Pi records accepted sensor passages, the Oracle checks signed records, and the Reporter signs permission to settle eligible work. A relayer submits that signed transaction and pays gas; it can't change what was authorized.

Who can stop or change the contracts?Link to this section

The Guardian can pause Core, stopping settlement and new reward funding through checkpoints. Already funded claims can still work because they don't call Core or mint SQK. Transfers, mint registration, and merges aren't blocked by the pause alone, though their other checks still apply.

Upgrade administrators have broader powers: through Timelock governance, they can change Core and Mining code. A malicious Mining upgrade could mint the remaining SQK supply without work or misuse funds held for rewards. The supply cap and governance delay don't prevent those outcomes.

Technical detail: roles and authorityLink to this section

Actor	Responsibility
Pico and Pi	Pass sensor readings to the Pi, which counts and saves accepted work
Oracle	Check signed records, approve eligible rounds, and track settlement
Reporter	Sign permission to settle an exact batch under `Core`'s rules
Relayer	Submit the signed transaction and pay Ethereum gas
Guardian	Pause `Core` and change the Reporter while `Core` is paused
`Timelock` proposer/canceller	Schedule or cancel governance operations
`Timelock` executor	Execute a ready operation after its delay
`Core` and `Mining` ProxyAdmins	Apply authorized contract-code upgrades
NFT owner	Transfer NFTs and request eligible claims or merges
Indexer, API, and browser	Display public data

PermissionsLink to this section

Authority	Can do	Cannot do
Oracle	Accept, reject, quarantine, and audit telemetry; approve counter epochs through a recorded action	Invent passages or settle work
Reporter	Authorize an exact batch that advances settlement	Change difficulty or bypass limits, nonce, deadline, or implementation checks
Relayer	Submit a valid signed batch	Change signed fields or authorize work
Guardian	Pause/unpause `Core`; change the Reporter while paused	Set difficulty, mint SQK, or directly upgrade contracts through this role
`Timelock` governance	Authorize upgrades through the relevant `ProxyAdmin`	Skip its delay through normal scheduling and execution
`Mining`	Check work, request SQK, record NFT rewards, pay funded claims, and burn merge donors	Exceed `Token`'s lifetime cap
NFT owner	Claim for 1–32 sorted, unique, live owned NFT IDs; merge eligible same-Level owned NFTs	Claim using operator approval alone or skip activation and cooldown checks
Public observer	Read APIs, events, and contracts	Change measurements or authorize settlement

Anyone can submit a valid Core signature. That does not give them permission to authorize work.

GuaranteesLink to this section

Core administrative changes invalidate pending settlement signatures, and Core rejects previously used Reporter addresses. A settlement signature applies only to its exact batch, chain, proxy, and implementation.

Only Mining can call Token to mint SQK, and minted SQK goes only to Mining. Token has no owner, administrator roles, transfer pause, or upgrade mechanism.

AssumptionsLink to this section

Core and Mining upgrade administrators remain trusted despite the Timelock delay. A malicious Mining upgrade could mint the remaining SQK supply without work or misuse funds held for rewards; Token cannot enforce Mining's reward rules.

Measurement-host and hosted-service administrators remain trusted within their roles. Their credentials and recovery procedures are not public developer features.

Failure behaviorLink to this section

Paused Core rejects settlement, and Mining checkpoint reverts CorePaused.
Core pause alone does not stop claims, NFT transfers, mint registration, or merges.
Claims do not read Core or mint SQK, but still require NFT ownership and working Token payments.
Minting and merging check Core without processing rewards. If a required dependency fails, the transaction fails.
Unauthorized calls and invalid signatures fail without granting any permissions.

Records verified work and tracks settled rounds and Squeek blocks on Ethereum. Calculates rewards from settled work, holds funded SQK, and pays eligible NFT owners. The Miner ERC-721 contract. Tracks NFT ownership and coordinates minting and merges with Mining. Applies Core or Mining upgrades authorized by its governing Timelock. Generates Miner NFT artwork from fixed onchain visual data. Queues governance operations and enforces a delay before they can be executed. The SQK ERC-20 contract. Enforces the lifetime supply cap; only Mining can mint SQK. Checks that visual data conforms to the required DotGrid format. When new mining power starts earning. Minting and merging schedule it for a later round, and a checkpoint must process the change. A reward update that processes settled work and scheduled mining-power changes. It can make rewards available but doesn't pay them to an owner's wallet. The Miner NFT permanently burned in a merge. Its unclaimed rewards move to the survivor, but its image is not combined or kept. SQK issued under the mining reward rules. You can direct a share of your Miner's rewards to fund SqueekFi projects. The physical mining device that records accepted wheel-magnet passages as work. It is separate from the virtual Miner NFTs. Squeekchain's record of accepted wheel-magnet passages. It doesn't prove animal identity and isn't how Ethereum reaches consensus. Combining two eligible same-level Miners you own into one higher-level Miner. One NFT is permanently burned; the survivor keeps both Miners' unclaimed rewards. The completed Squeek blocks a Miner must wait through before merging. It measures completed work, not elapsed time or Ethereum blocks; transfers don't reset it. The power used to calculate a Miner's share of rewards when eligible and active. A larger share of total power can mean a larger share of rewards. A ten-minute period used to group measured work. The device saves a completed round's work total when measurement remained uninterrupted. The transferable token used for mining rewards. It has a lifetime supply cap and is separate from the Miner NFT and the device's work count. A completed amount of settled work. Enough recorded work completes one Squeek block; it is not an Ethereum block. Squeek Miner NFTs earn SQK linked to recorded wheel activity. Owners can direct a share of those rewards to fund SqueekFi projects. Squeekchain's ecosystem for hamster-powered onchain finance. Miner owners can choose to fund projects with a share of their SQK rewards. The Miner NFT you keep in a merge. It gains a level, keeps its ID and image, and receives both Miners' unclaimed rewards. A Miner's recorded reward balance that hasn't been paid to a wallet. It stays with the NFT when ownership changes. One wheel-magnet passage that met the device's counting rules and was saved. It records work, not an amount of SQK.