> ## Documentation Index > Fetch the complete documentation index at: https://docs.giwa.tokscale.ai/llms.txt > Use this file to discover all available pages before exploring further. # Design Principles > Learn the constraints the repository actually enforces, from network identity rules to labels that are allowed to say not yet. Eight principles govern how Tokscale is built, documented, and kept honest. Each one is a constraint the repository enforces, not a value statement. ## 1. Availability, not aspiration Every claim in the repository and in this documentation is labeled by what it actually is: public GIWA Sepolia, local localnet, or Phase 2. The repository refuses to claim public availability it does not have, distinguishes `no_snapshot` from `unavailable` from zero, keeps local evidence unlinked from Sepolia explorers, and preserves a historical REVISE verdict next to its resolutions rather than deleting it. The discipline is the point: a work-history product whose own history is sloppy has no product. The current state of every layer is on [Live Evidence](/overview/live-evidence). ## 2. Attestations, not tokens Identity lives as attestations about an address, never as tokens owned by an address. This is Dojang's design idiom, and it fixes by construction the ERC-8004 gap: an ERC-721 identity can be sold, and reputation that can be sold is not a work credential. A Dojang-bound EAS attestation is non-transferable for free. There is no Tokscale token in the MVP. Revenue is the gateway take rate on real inference. See [Builder Passport](/builder-passport/overview) and [Dojang: On-Chain Attestations](/builder-passport/dojang). ## 3. Privacy by design Prompts, code, and responses never touch the chain. Neither do individual receipts. What anchors on GIWA is one EAS attestation per builder subject per epoch, carrying a merkle `receiptRoot` and a salted `summaryCommitment` over that epoch's totals. The salt stays server-side, so the anchor publishes the root and the receipt count but not the numbers. Membership leaves stay off-chain and a holder discloses one only to prove inclusion; a leaf commits a receipt digest to a wallet and a subject epoch, and a digest reveals nothing by itself. A builder can prove their usage against the public Usage Root without revealing anyone else's usage, and without revealing any content. The pattern is borrowed from Dojang's own Balance Root / Verified Balance pair, so the privacy idiom is the chain's own. Mechanics: [UsageReceiptV1](/gateway/usage-receipt-v1). ## 4. Network identity, not chain ID Local Anvil fixtures and public GIWA Sepolia share chain ID 91342, so chain ID cannot be the safety boundary. Deployment identity is. Migration 0062 binds a database once and immutably to one deployment network, and `GIWA_NETWORK` selects it. A local artifact is never presented next to a Sepolia explorer link. The full separation model is on [Network Separation](/gateway/network-separation). ## 5. Organic by construction Every Tokscale payment maps 1:1 to a real inference request. This matters because the category has a wash-volume problem: independent analysis (Artemis/CoinDesk, Mar 2026) found much of x402's headline volume was wash or memecoin churn, roughly \$28K of real daily volume, with wallet retention falling from 87% to 5%. The fix is in the construction, not the messaging: the only way to pay through Tokscale is to consume inference, so our volume is the organic demand the rails are waiting for. Payment flow: [x402 Payments on GIWA](/gateway/x402-payments). ## 6. Issued evidence is never reinterpreted Once a receipt is signed and an epoch root anchored, the schema that produced them is fixed. A changed field, meaning, or domain ships as a new, separately versioned schema that verifies alongside V1, never as an in-place edit, because retained signatures and the cross-language protocol vectors commit to the exact bytes they were issued under. A verifier selects the schema from the receipt's persisted version rather than assuming the current one. The V1 identifiers are listed in [UsageReceiptV1](/gateway/usage-receipt-v1). ## 7. Two-layer cost discipline Per-request receipts are signed off-chain: EIP-712, zero gas, zero latency, instantly verifiable. Per epoch, one merkle root anchors on-chain in a single attestation. Per-request on-chain writes would scale cost linearly with traffic (1M requests per day is hundreds of dollars daily in gas even on an L2) and would put a chain write in the request path. The two-layer design keeps both guarantees: the signature proves issuance and integrity immediately; the epoch root proves non-retroactive tampering after anchoring. 1M or 100M requests. Same on-chain cost. The pipeline runs end to end on the hermetic localnet under one harness target: ```sh theme={null} BUILDX_BUILDER=desktop-linux bun run local:e2e # pass marker: GIWA_LOCAL_E2E_OK ``` Protocol vectors are verified three independent ways (Rust Alloy, TS viem, Solidity forge); commands are collected in [Verification Log](/gateway/verification-log). ## 8. Tier honesty The five verification tiers each carry an availability label, and some of those labels say "not yet." We keep it that way on purpose: a tier that overclaims is worse than a tier that is missing. Migrating usage up the tiers is how the product grows, and the growth only counts if the labels are true. ## Next steps * For the tier vocabulary these principles keep honest, see [Verified Usage and the Evidence Ladder](/builder-passport/evidence-ladder). * For the current label on every claim, see [Live Evidence](/overview/live-evidence). * For the reasoning behind the commitments, see [Manifesto: Proof of Actual Work](/overview/manifesto).