10 / 14IN DEVELOPMENTLive parts and proposed parts, each tagged
Governance and security
Today TAONIC is a website, four endpoints and a database, so its security is web security. A financial layer would add custody and contracts, and none of that exists yet.
| Control | What it does | State |
|---|---|---|
| Strict request schema | Unknown keys are refused; no URL, host, model or header reaches a provider. | VERIFIED |
| Fixed provider hosts | Every route’s host is fixed in the registry and must be https. | VERIFIED |
| Body and response caps | Request bodies and provider responses are read up to a byte limit, then abandoned. | VERIFIED |
| Deadlines | Each provider call is aborted at its deadline; the whole request has a budget. | VERIFIED |
| Rate limits | Per client and per server instance, before any provider call. In memory, so best effort. | VERIFIED |
| Spending guard | A daily ceiling in D1, booked before each paid call; fails closed. | VERIFIED |
| Error sanitizing | Readers see TAONIC’s own fixed sentences, never an upstream message or a secret. | VERIFIED |
| Same-origin writes | POSTs from other sites are refused; no CORS headers are sent. | VERIFIED |
| Secrets | Held as Cloudflare secrets; each goes only into its own route’s request header. | VERIFIED |
Response headers
Every page is served with a content security policy limited to this origin, HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a strict referrer policy and a permissions policy that turns off camera, microphone, location and payment. The API answers with cache-control: no-store where a response is personal or per-request.
No wallets
Nothing on TAONIC asks for a wallet signature or sends a transaction. Status can read a connected wallet’s chain id and address, read only, and nothing else.
| Requirement | State |
|---|---|
| A 3-of-5 multisig for parameters and allocations (no signer set exists) | PROPOSED |
| A 7-day timelock on every change | PROPOSED |
| An immutable fee maximum in the hook (2%) | PROPOSED |
| An emergency pause that may stop fee collection and reserve spending, and never blocks swaps, transfers or withdrawals | PROPOSED |
| Hook-bypass analysis | NOT DEPLOYED |
| Contracts written and fork-tested | NOT DEPLOYED |
| An independent audit | UNAVAILABLE |
No audit has been performed or commissioned, and no audit badge appears anywhere on TAONIC.
- Rate limits live in each server instance’s memory, so they are a best-effort ceiling.
- Preview deployments record to their own database, separate from production, and carry a lower daily provider limit of their own.
- Route health is per server instance; the durable last-answered time is in the records.
- A 3-of-5 multisig behind a 7-day timelock for every parameter and allocation change.
- Immutable: the 2% fee ceiling and the core safety invariants.
- A pause may stop fee collection and reserve spending, and may never block swaps, transfers or withdrawals, raise the fee, or move funds.
- Version one is reserve growth. Not in version one: staking, claims, holder yield or distributions, automated TAO purchasing.
- A provider is a supplier TAONIC pays. Provider costs are costs, never reserve contributions. A provider-growth allocation exists only under a written agreement.
Unresolved: legal treatment, tax treatment, signer set, auditor, free-allowance size. Legal and tax review are external requirements before anything is deployed.
Every state on this page matches Status. Where they ever differ, Status is right and this page is a defect.