# Slop Points

Slop Points record participation and accepted contributions. Points have no
monetary value and cannot be transferred or redeemed. They confer no payment,
ownership, governance, or access entitlement. Only accepted-work points for a project and payment period determine its reward
shares under the published payment rules. Payout-recognition bonuses never
affect payouts. Points this month and total points are views of
the same history, not separate currencies. Historical score fields encode
accepted-work points at 30 points per score (10 per third); they are not a
second public metric. Preserve historical settlements and funded obligations.

## Discontinued participation awards

From 24 October 2026 (PRD section 11, Participation points; owner decision of
that date), welcome and X connection awards end for everyone. Joining and
connecting X earn no points. Awards recorded before that date stay unchanged.
Never delete, rewrite, or reissue them. They count where they counted before
(profile and community total points) and stay out of earned-point standings
and payouts. The legacy `points_members.welcome` column keeps its fixed value;
the points API reports a welcome award only for a membership whose immutable
`joined_at` is before 2026-10-24T00:00:00.000Z, and 0 otherwise. It reports an
X connection award only when its immutable `awarded_at` is before the same
instant, and 0 otherwise. Descriptions of those awards below are historical.

## Earning and history

Joining with a GitHub user account earned five welcome points once until
24 October 2026; it now earns none. Existing
contributors receive contribution points without joining or registering a
wallet. Joining is dated when it occurs; historical work retains its actual
GitHub occurrence date, with a separate points-recording timestamp. GitHub
sign-in proves account control, not one unique person per account.

Tiered accepted work earns ten points per unweighted score-third: micro 10,
small 30, medium 90, large 240, XL 450, exceptional 750. Eligible standard
reviews earn 30; from 2026-10-01 an ordinary review earns 10 only as the one
outcome review of its pull request; reviewed triage, deep, and specialist reviews earn 10, 90,
and 240. Legacy integer score events earn 30 points per unweighted score.
Verified evaluated contributions follow that same unweighted conversion.
Token usage, cost, model, signed-receipt weight, wallet state, and payment never
multiply points. Required source evidence and project participation rules apply.

Historical merged PRs initially receive 10 provisional points each, including
work before the project's payment program. A Score v2 merge from
2026-10-01T00:00:00Z without a ratified tier is provisional small credit and
receives 30 provisional points in the legacy projection. When source-bound value
assessments are enabled, missing, stale, incomplete, or unresolved assessments
do not create fallback awards or remove prior recorded points. A verified bot
assessment remains provisional until a maintainer decision supersedes it. An
assessed zero creates a zero-amount revision. This is a recognition backfill and
never retroactive cash eligibility. Verified archived and current scoring
records supersede provisional amounts, including exclusions and work grouping
within their complete source windows. Historical review credit is limited to
verified scoring/evaluation records; the history download publishes its actual
coverage. Recorded points do not claim a complete lifetime review census.

A logical accepted work unit earns once. Ordinary reviews do not also earn an
evaluated review award on the same PR. Bots, self-review, unaccepted work and
unreviewed external activity do not earn contribution points. Maintainers retain
work acceptance and correction authority. Automated suspicion is not an award,
ban, or final exclusion. Contest an award through the project's GitHub review
process; never put private security evidence in a public appeal.

## Display

Recorded totals persist between months, subject to explicit corrections.
Monthly earned-point standings use UTC occurrence dates, include verified payout points, and exclude historical welcome and X connection points,
and give equal totals equal ranks. Newcomer standings use the first recorded
earning event within the last 30 days. Badges recognize the first
accepted contribution, first qualifying review, and work in three projects.
They grant no additional points or benefits. Verified finalized payouts also receive a recognition badge. There are no referral commissions,
attendance rewards, multipliers, countdowns, purchase or transfer controls.

Balances have timestamps and explicit coverage. Missing or invalid data is
unavailable, never a fabricated zero. Unknown earning tiers display as points
after acceptance rather than a guaranteed numeric promise.

## Persistence and publication

`data/points/history.json` is the reviewed initial backfill, generated by
`scripts/backfill-points.ts`. The collector enumerates complete GitHub repository
connections and verifies the pre-cutoff immutable PR ID set in a second pass.
`data/points/backfill-report.json` records source counts and coverage. Public
GitHub review bodies are processed in memory and never copied to these files.
Projects and repositories come only from the canonical manifest registry.

`scripts/generate-points.ts` appends verified scoring/evaluation revisions,
retaining earlier revisions and source digests. Source IDs, actor IDs and
categories determine award identity; a rule upgrade cannot mint another copy.
Revisions carry predecessor hashes. A corrected outcome replaces its former
amount in the projection rather than adding another full award. Source-bound
score decisions also record the decision source, effective time, reason, and
exact signed change from the previous amount. A new decision with the same
amount records a zero change; replaying that decision creates no revision.
Distinct assessed review findings retain their separate work-unit identities.

Slopbot penalties use a separate journal identity bound to the original PR,
actor, project and UTC month. Each revision stores the actual applied negative
amount and the published face debit as evidence. The applied amount is capped
by that month's deduplicated accepted-work Points; later changes append a
correction to the same identity. Penalties do not affect payout recognition,
historical participation, badges, project counts or first-contribution dates.
Only an explicit identity-matched Slopbot reversal restores a debit. An absent
row, missing history route or a PR leaving the rolling window does not.

The permanent D1 points tables are logically separate from trace tables in the
existing deployment database. This avoids a new credential or provisioning
boundary; the points handler never constructs trace persistence or reads trace
records. Journal rows reject updates, deletions, changed-row replacement, and
branching successors. Completed batch metadata is immutable. Exact imports and
replays preserve the original bytes. A batch
is publishable only when its full revision count reconciles. Trusted Actions
checkpoints the tested journal into D1 during every protected production
release, including the scheduled ones, under the existing publication lock.
Every online build verifies that the published
journal and D1 checkpoint share the exact same history prefix, then retains the
longer journal; divergent or unavailable history blocks publication. Public journal
reads are bounded, paginated and pinned to one completed batch. A failed import
cannot publish a partial batch.

The `slop-points-web` identity audience is distinct from `private-trace-api`.
Assertions are single use and exchanged for a one-hour HttpOnly, Secure,
SameSite=Strict web session. Mutations require a same-origin JSON request.
Membership is unique by immutable GitHub node and numeric IDs. Sessions cannot
create arbitrary awards, choose another actor, read traces, or ingest history.
Signout invalidates the session and never resets or reissues a historical welcome award.

A member can close the account from Account after typing their GitHub login
(`POST /api/v1/points/account/close`, migration 0063). One atomic change marks
the membership closed and private, ends every session, removes X links and
pending flows and any legacy Telegram links and flows, and turns off optional
activity email. The
membership row, welcome and connection awards, X and Telegram claims, points
history, wallets, unpaid obligations, payment and settlement records, private
cases, inbox rows and public GitHub work stay. The database refuses a session
or public visibility for a closed account. A repeated request that raced
the first closure reports that same closure. An ordinary sign-in to a closed
account returns `account_closed`; only a sign-in that sends `reopen: true`
opens it again, public and without connections under the 26 October 2026 account policy. Support handles only lost
GitHub access and contested recovery.

Owner decision, 26 October 2026: sign-in and explicit reopening publish membership.
Existing private memberships and their already-connected X links become public
on the next authenticated sign-in; new X connections are public. Active accounts
have no separate visibility opt-out. State this before sign-in or connecting X.
Keep closed accounts private and disconnected until explicit reopening, and do
not change visibility from a public read. Public GitHub contribution history
remains public. Identity aliases never move balances between account IDs. A disputed
or reused login must resolve through verified identity rather than name matching.

## Operations and rollback

Generate a fresh complete ledger, then generate points. Scheduled updates must
load the completed D1 checkpoint and published shard journal first; failure blocks publication rather
than falling back to the initial seed. An explicit bootstrap is permitted only
for the initial code release with no completed journal. Offline builds use the
reviewed seed and available ledger and are not production freshness evidence.

Keep the journal on rollback. Disable points mutations or withdraw an affected
projection through a reviewed main release; never delete history or reissue
welcome awards. Re-enable only after exact replay and reward-isolation tests.
Measure first accepted outcomes, returning contributors, reviewer workload,
source duplication, corrections, and publication delay, not points minted.

## X connections and payout recognition

Until 24 October 2026, the first verified X connection earned 10 points once
per GitHub account; connections now earn no points (see Discontinued
participation awards).
The X numeric ID is reserved to its verified GitHub identity to prevent reuse
across accounts. A member can reconnect or switch X accounts. Disconnecting
removes the visible link while preserving historical award uniqueness.
Historical X awards were participation points, not accepted-work score.
Public community cards include public members even without accepted work.

X uses OAuth 2.0 authorization code with S256 PKCE and a confidential client.
The browser flow cookie is separate, HttpOnly/Secure/SameSite=Lax, expires after
ten minutes, and is bound to the initiating GitHub web session. Callback state
is single-use. The application verifies `/2/users/me`, stores only account ID,
handle and verification time, and attempts to revoke the temporary provider
token immediately; provider failure never causes a token to be persisted.
No refresh token, posts, messages, follower lists, or provider token is retained.
The required read scopes are `tweet.read users.read`; posting, follow actions,
and messaging permissions are not requested. X handles are observed snapshots;
reconnect to refresh a changed handle. X control does not confer GitHub project,
organization, wallet, or payment authority.

Membership and X links follow the public-account policy above. Connecting X
still requires its OAuth authorization; disconnecting removes the public link.
Legacy requests to hide an active membership or connection are refused rather
than reported as successful. Signing out cancels session-bound linking;
connecting does not publish any post or DM.

Each recipient earns **25 points per project and finalized monthly payout
cycle** with positive paid principal. Dollar size, fee size, separate reward
lines, and transaction splitting never multiply this award. The immutable key
contains project, cycle and GitHub actor ID, and the occurrence date is the
verified settlement date. Proposed, approved, scheduled, held, unclaimed,
partial, and external-prize projections do not earn payout points. Existing
paid cycles are backfilled from complete validated lifecycle records; trusted
online generation rechecks finalized chain evidence before publishing new
awards. Receiving recognition never changes financial allocations or fees.
A wallet address alone does not identify a GitHub payer, so no payer identity
or organization-to-person relationship is invented.

### Enabling X

Create or use an X confidential Web App with OAuth 2.0. Register each intended
callback exactly (no wildcard):

- `https://slop.cash/api/v1/points/x/callback`
- `https://slop.tech/api/v1/points/x/callback`
- `https://eliza.army/api/v1/points/x/callback` (only if supporting the alias)

Place `X_CLIENT_ID` and `X_CLIENT_SECRET` together in the protected GitHub
production environment. The existing protected main release installs them
as encrypted Pages secrets and applies migration `0009_points_social.sql`.
Unattended schedules do not provision credentials. With neither configured,
the app reports that X connections are not enabled; partial configuration is
rejected. Provider account/API access and a real callback must be verified at
activation; tests with provider doubles are not live OAuth evidence.

Primary references checked during implementation:
[X authorization and PKCE](https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code),
[X token exchange and revocation](https://docs.x.com/fundamentals/authentication/oauth-2-0/user-access-token),
[X endpoint scope mapping](https://docs.x.com/fundamentals/authentication/guides/v2-authentication-mapping).

### Retired Telegram integration

The owner removed Telegram on 25 October 2026. Slop has no Telegram bot,
connection, public profile link, or support route. Existing database migrations
and identity claims remain historical records. Account closure still clears
legacy links and pending flows without changing their reserved identity claims.
No Telegram credential or webhook is required.

### Individual profiles

Every recorded PR author has a discoverable `/contributors/<login>` profile,
including authors with only open or closed unmerged PRs. Joined members and
historical point recipients retain profiles independently of the current score
window. Membership and X links follow the public-account policy above.

`profiles:generate` walks the complete PR connection of each active manifest
repository, deduplicates immutable PR IDs, and reconciles the total record count
before publishing `public/data/profiles.json`. Deleted authors and non-user
actors remain in source counts but are excluded from the human directory.
Merged, open, and closed-without-merge are distinct counts. These are Slop
repository totals, not claims about an account's entire GitHub history. Scan
start/end times and stale data are displayed; failures do not become zeroes.
Trusted releases refresh the census. The reviewed `data/profiles/seed.json`
provides a dated development/PR bootstrap; it is not a live-data claim.

Profiles use GitHub's public avatar with an initials fallback. GitHub and
verified opt-in X links are shown without implying organization authority.
Verified cycle receipts use immutable actor IDs and integer base units of
their asset (micro-units for USDC).
Direct-payment disclosures appear as a separate reported-transfer total with
transaction links; they never become verified settlement records or inflate
the verified receipt total. Estimates and points are not money received.