- Phase 12026-08-23OPEN
$CHARLIE, and the watcher that proved the thesis on it
Before there was a protocol there was one coin and one question: can a fee stream be routed somewhere no key can spend, and can a stranger confirm it. $CHARLIE answered it by construction. Its sharing config is admin_revoked with a single shareholder at 10000 bps, so its split is permanent and its creator cannot move it. Mint and freeze authority are both revoked, so nothing it destroys can be reissued. The burn watcher has run against it since this date, reconciling opening plus recorded inflows against the balance on every pass and refusing to post when that identity breaks. The silence rule was running in production before it was written down.
Done meansThe two checks that can be answered from the coin alone, with no evidence walk and no protocol, return a verdict on $CHARLIE: that its burn destination cannot be spent, and that what it destroys cannot be reissued.
- SOL_BURN_UNSPENDABLEUNCHECKED
- BURN_IRREVERSIBLEUNCHECKED
8FhAXv2tfXUpyMbJsHDHX9zfiEb9PERzFWSY9sgLpump$CHARLIE mint - Phase 22026-08-29OPEN
The spec, and an indexer that reads any coin
The specification was published on the day the code that implements it did not exist, which is the ratio the project wanted: the invariants can be argued with before anything depends on them. The indexer landed the same day, reading a pump sharing config, attributing every shareholder to a leg, and appending the result to an append-only log. It consults no allowlist, no enrollment flag and no consent table, so it reads any pump coin whether or not that coin has ever heard of this protocol. The first check it ran failed, on $CHARLIE, and that entry is still in the build log with its retraction attached.
Done meansThe two checks that need only a config, not an evidence walk, return a verdict on any coin submitted: that the config read belongs to the coin asked about, and that its split accounts for the whole fee stream.
- CONFIG_MINTUNCHECKED
- SPLIT_SUMUNCHECKED
- Phase 32026-09-05OPEN
The evidence walk, the public surface, and the crank
Fee inflows reconciled per destination, SPL burn and boost decoders, and initial supply derived from the coin's own CreateEvent. Then the surface that publishes it: the coin page, its raw JSON record, /verify taking a pasted address with no wallet and no signup, and the index. Then the parts that make it run for someone else: enrollment front to back in one signature, the BURN leg on both venues, and a crank paying every enrolled coin hourly through pump's own permissionless instruction. Built deliberately ahead of the deploy gate rather than behind it.
Done meansEvery check that needs recorded evidence stops reading UNCHECKED and returns a verdict, and whether a coin is enrolled is read off the chain rather than asserted by this project about its own membership list.
- SOL_BURN_BALANCEUNCHECKED
- BURN_SUPPLYUNCHECKED
- OPS_ROUTEDUNCHECKED
- PROTOCOL_SHAREUNCHECKED
- Phase 42026-09-12DEVNET
The program
Four instructions: init_charlie_pool, init_route, set_route, distribute. The guarantee is the absence of code. Nothing debits a coin's collector except distribute, and no instruction anywhere sends to an address its caller supplied. Deployed to DEVNET at the id below; mainnet gets its own keypair and is not this.
Done meansNo check gates this one, and it is the phase where saying so matters most: a program existing is not a check passing. The checks it will eventually turn on are phase 5's, because they need a mainnet program id and this is not one.
GFA3nG9geMhpPXaExVLGYBtj6aJX7S125dLzv4EcXGiGdevnet program id - Phase 5no dateGATED
Mainnet deploy, and revoking upgrade authority
Mainnet operations began on 2026-09-18: /launch and /enroll are live, coins enrol by spending pump's one sharing-config change on the protocol's destinations, and the BURN leg has bought and burned $CHARLIE in a landed transaction. None of that is this phase. Enrolment routes fees through pump's own config and needs no program of ours -- the SOL burn leg pays Solana's incinerator directly, as 419 sharing configs on mainnet already do. This phase is the protocol program itself on mainnet, and then the door that makes its absences permanent. The absence-of-code guarantee only means anything once the program is immutable, and revoking upgrade authority is a one-way door that freezes every bug permanently. So the order is: deploy upgradeable, run the whole pipeline in production against one live coin including a graduated one, then revoke and publish a reproducible build.
Done meansThe two checks that have no mainnet program to measure stop reading UNCHECKED and return a verdict. Until then the indexer holds PROGRAM_ID = None rather than guessing, so no mainnet address derives as a SOL-burn or token-burn vault.
- BURN_SPENDUNCHECKED
- BURN_ATOMICUNCHECKED
Blocked on funding. The deploy is priced in the build log and has not been paid for. The final figure will be lower than the one published there -- the allocation can be fitted to the program rather than doubled -- but it is not known yet, because it depends on the compiled size and crank_burn and crank_charlie_burn are not written.
The build log dates what landed. The repository is where every criterion above is enforced.