From dda2764424cad8c27f003dd127928d9a6d98fc2d Mon Sep 17 00:00:00 2001 From: Max Date: Tue, 28 Jul 2026 14:51:49 +0100 Subject: [PATCH 01/10] Add T9 network upgrade docs page --- src/pages/docs/protocol/upgrades/t9.mdx | 137 ++++++++++++++++++++++++ 1 file changed, 137 insertions(+) create mode 100644 src/pages/docs/protocol/upgrades/t9.mdx diff --git a/src/pages/docs/protocol/upgrades/t9.mdx b/src/pages/docs/protocol/upgrades/t9.mdx new file mode 100644 index 00000000..8ae88a38 --- /dev/null +++ b/src/pages/docs/protocol/upgrades/t9.mdx @@ -0,0 +1,137 @@ +--- +title: T9 Network Upgrade +description: T9 prepares Tempo for protocol-managed Zones with native zone creation and TIP-403 token policy bindings. +--- + +# T9 Network Upgrade + +T9 prepares Tempo for protocol-managed Zones. It adds the native ZoneFactory used to create zones, and gives zones a registry-backed way to check which transfer policy applies to a TIP-20 token. + +:::info[T9 status] +T9 is not scheduled yet. The T9-compatible release, testnet activation time, and mainnet activation time are TBD. +::: + +## Timeline + +| Milestone | Date | Timestamp | +|-----------|------|-----------| +| Testnet activation | TBD | TBD | +| Mainnet activation | TBD | TBD | + +Node operators should run the T9-compatible release before the activation timestamp on each network. Nodes that are not updated before activation will fall out of sync. + +## Overview + +T9 focuses on two changes that are needed for the first zone rollout: + +- **Protocol-managed zone creation.** Tempo gets one native ZoneFactory for creating zones and recording their portal accounts. +- **Token policies that zones can rely on.** TIP-403 stores the active transfer policy for tokens that are used by zones and other provable flows. + +For most developers, the practical effect is that zones become easier to reason about. A zone is created through one protocol entry point, gets a predictable portal account, and can check token transfer rules from one registry. + +## Features + +### ZoneFactory for zone creation + +T9 adds the native ZoneFactory. This is the protocol entry point for creating a zone. + +When a zone is created, the factory assigns a zone ID, creates the zone's portal account, records the zone metadata, and emits the creation event. This gives Tempo one canonical zone registry instead of relying on a separately deployed factory contract. + +For the first T9 launch, zone creation is permissioned. Only the configured factory owner can create zones. This keeps the initial rollout controlled while the Zones stack is being introduced. A future network upgrade can make zone creation open. + +Read the specification [here](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1091.md). + +### Predictable portal accounts + +Every zone gets a predictable ZonePortal account. The portal is the zone's Tempo-side entry point for deposits, withdrawals, settlements, and other zone operations. + +The address is derived from the zone ID, so developers and tools do not need to track an ordinary deployment address. Zone ID `1` maps to: + +```text +0x5AD0000000000000000000000000000000000001 +``` + +Contracts and offchain tools should use `isZonePortal(address)` when they need to check whether an address is a valid zone portal. + +Portal accounts keep stable addresses and independent state. The shared portal logic is installed by the network upgrade, and future logic changes must also go through a network upgrade. + +### Zone setup inputs + +Each zone starts with a small set of configuration choices: + +- the initial token +- the zone admin +- the sequencer set and settlement threshold +- account-access settings +- callback-gateway settings +- an RPC URL + +The sequencer set can contain up to 8 addresses. The threshold says how many sequencers must sign a settlement for it to be accepted. For example, a threshold of 3 with 5 sequencers means any 3 of those 5 sequencers can approve the settlement. + +The initial token must already have a TIP-403 transfer-policy binding. This gives the zone a clear registry-backed answer for which transfer policy applies to that token. + +Zone admins also choose whether account access and callback gateways start open or restricted. If a restricted setting starts with an empty role list, that access is denied until the admin adds roles or changes the setting. + +### TIP-20 policy IDs in TIP-403 + +TIP-403 already stores the contents of transfer policies. T9 also lets TIP-403 store which transfer policy a TIP-20 token is currently using. + +This matters for zones because zones need a policy answer that can be checked from TIP-403 state. Without this, a zone would need to inspect each token contract to know which transfer policy applies. + +New TIP-20 tokens write their TIP-403 policy binding during token creation. + +Existing TIP-20 tokens do not all need to migrate at T9 activation. Unmigrated tokens keep working by falling back to their old token-local policy ID. Zone and provable-contract flows must require an explicit TIP-403 binding and cannot rely on that fallback. + +Read the specification [here](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1092.md). + +### Targeted token-policy migration + +T9 adds a targeted migration path for existing TIP-20 tokens that need a TIP-403 policy binding. + +The migration copies the token's current local policy ID into TIP-403. It is permissionless because it cannot choose a new policy; it can only register the policy the token is already using. + +Full automatic migration is not required. As of July 10, 2026, scans found 4,355 TIP-20 tokens on Presto mainnet and 15,291,992 TIP-20 tokens on Moderato testnet. Migrating every historical token during the network upgrade would create unnecessary registry state, especially on testnet. + +Operators and zone tooling should migrate only the tokens that are enabled on, or about to be enabled on, a zone. + +## Compatible releases + +The T9-compatible release is not published yet. + +| Ecosystem | T9-compatible releases | +|-----------|------------------------| +| Node operators | TBD | +| Rust SDK crates | TBD | + +Release notes and binaries will be linked here when the T9-compatible release is published. + +## Integration impact + +### For node operators + +- Upgrade to the T9-compatible node release before activation. +- T9 installs the native ZoneFactory and shared zone runtimes at activation. +- Nodes that do not include T9 support will fall out of sync after activation. + +### For zone operators and zone tooling + +- Create zones through the native ZoneFactory. +- Use `isZonePortal(address)` when checking whether an address is a valid zone portal. +- Keep sequencer sets to at most 8 addresses. +- Make sure every token enabled on a zone has an explicit TIP-403 policy binding. +- Choose account-access and callback-gateway settings carefully at zone creation, because empty restricted role lists deny access. + +### For TIP-20 issuers and token admins + +- New TIP-20 tokens get a TIP-403 policy binding during creation. +- Existing tokens keep working if they are not migrated. +- Tokens used by zones or provable-contract flows need a TIP-403 binding. +- `transferPolicyId()` continues to return the effective policy ID. +- After activation, `changeTransferPolicyId(uint64 newPolicyId)` writes the new active policy to TIP-403. + +### For SDKs, indexers, and low-level tooling + +- SDKs and indexers that read `transferPolicyId()` from TIP-20 can keep using that API for the effective policy ID. +- Tools that need a provable token-to-policy binding should read TIP-403 and require the binding to be set. +- Migration tooling should batch token migrations and verify that every zone-enabled token has a TIP-403 binding. +- Event consumers can keep using the existing TIP-20 `TransferPolicyUpdate` event for active policy changes. From f0192073a65f21a9b24f825a6c1555775e5bc1d1 Mon Sep 17 00:00:00 2001 From: Max Date: Tue, 28 Jul 2026 14:54:38 +0100 Subject: [PATCH 02/10] Make T9 upgrade docs more partner-facing --- src/pages/docs/protocol/upgrades/t9.mdx | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/src/pages/docs/protocol/upgrades/t9.mdx b/src/pages/docs/protocol/upgrades/t9.mdx index 8ae88a38..1d2f485d 100644 --- a/src/pages/docs/protocol/upgrades/t9.mdx +++ b/src/pages/docs/protocol/upgrades/t9.mdx @@ -7,6 +7,8 @@ description: T9 prepares Tempo for protocol-managed Zones with native zone creat T9 prepares Tempo for protocol-managed Zones. It adds the native ZoneFactory used to create zones, and gives zones a registry-backed way to check which transfer policy applies to a TIP-20 token. +For ecosystem partners, T9 matters most if you plan to operate a zone, support zone deposits or withdrawals, issue tokens that may be enabled on a zone, or index zone activity. + :::info[T9 status] T9 is not scheduled yet. The T9-compatible release, testnet activation time, and mainnet activation time are TBD. ::: @@ -27,7 +29,17 @@ T9 focuses on two changes that are needed for the first zone rollout: - **Protocol-managed zone creation.** Tempo gets one native ZoneFactory for creating zones and recording their portal accounts. - **Token policies that zones can rely on.** TIP-403 stores the active transfer policy for tokens that are used by zones and other provable flows. -For most developers, the practical effect is that zones become easier to reason about. A zone is created through one protocol entry point, gets a predictable portal account, and can check token transfer rules from one registry. +The practical effect is that zones become easier to reason about. A zone is created through one protocol entry point, gets a predictable portal account, and can check token transfer rules from one registry. + +## Who T9 affects + +| Partner type | What changes | +|--------------|--------------| +| Zone builders and operators | Create zones through the native ZoneFactory. Each zone gets a predictable portal account for Tempo-side zone activity. | +| Token issuers and token admins | Tokens used by zones need an explicit TIP-403 policy binding. Tokens that are not used by zones keep working without immediate migration. | +| Wallets, explorers, and indexers | Existing TIP-20 policy reads continue to work, but zone-aware tooling should recognize ZonePortal accounts and TIP-403 token-policy bindings. | +| Apps not using zones | No immediate integration change unless the app's tokens, users, or workflows are enabled on a zone. | +| Node operators | Upgrade before activation so nodes stay in sync. | ## Features @@ -45,7 +57,7 @@ Read the specification [here](https://github.com/tempoxyz/tempo/blob/main/tips/t Every zone gets a predictable ZonePortal account. The portal is the zone's Tempo-side entry point for deposits, withdrawals, settlements, and other zone operations. -The address is derived from the zone ID, so developers and tools do not need to track an ordinary deployment address. Zone ID `1` maps to: +The address is derived from the zone ID, so developers and partner tools do not need to track an ordinary deployment address. Zone ID `1` maps to: ```text 0x5AD0000000000000000000000000000000000001 @@ -92,7 +104,7 @@ The migration copies the token's current local policy ID into TIP-403. It is per Full automatic migration is not required. As of July 10, 2026, scans found 4,355 TIP-20 tokens on Presto mainnet and 15,291,992 TIP-20 tokens on Moderato testnet. Migrating every historical token during the network upgrade would create unnecessary registry state, especially on testnet. -Operators and zone tooling should migrate only the tokens that are enabled on, or about to be enabled on, a zone. +Operators and zone tooling should migrate only the tokens that are enabled on, or about to be enabled on, a zone. Token issuers do not need to migrate every historical token unless those tokens are part of a zone or another provable flow. ## Compatible releases From 42ab762ec188251169eefe36d67197b56954df8e Mon Sep 17 00:00:00 2001 From: Max Date: Tue, 28 Jul 2026 14:58:03 +0100 Subject: [PATCH 03/10] Remove standalone T9 audience table --- src/pages/docs/protocol/upgrades/t9.mdx | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/src/pages/docs/protocol/upgrades/t9.mdx b/src/pages/docs/protocol/upgrades/t9.mdx index 1d2f485d..54a1ea90 100644 --- a/src/pages/docs/protocol/upgrades/t9.mdx +++ b/src/pages/docs/protocol/upgrades/t9.mdx @@ -31,16 +31,6 @@ T9 focuses on two changes that are needed for the first zone rollout: The practical effect is that zones become easier to reason about. A zone is created through one protocol entry point, gets a predictable portal account, and can check token transfer rules from one registry. -## Who T9 affects - -| Partner type | What changes | -|--------------|--------------| -| Zone builders and operators | Create zones through the native ZoneFactory. Each zone gets a predictable portal account for Tempo-side zone activity. | -| Token issuers and token admins | Tokens used by zones need an explicit TIP-403 policy binding. Tokens that are not used by zones keep working without immediate migration. | -| Wallets, explorers, and indexers | Existing TIP-20 policy reads continue to work, but zone-aware tooling should recognize ZonePortal accounts and TIP-403 token-policy bindings. | -| Apps not using zones | No immediate integration change unless the app's tokens, users, or workflows are enabled on a zone. | -| Node operators | Upgrade before activation so nodes stay in sync. | - ## Features ### ZoneFactory for zone creation From 1f9c56e111cdde173ce24cce8cff6f790dba30da Mon Sep 17 00:00:00 2001 From: Max Date: Tue, 28 Jul 2026 15:01:55 +0100 Subject: [PATCH 04/10] Remove extra T9 overview sentence --- src/pages/docs/protocol/upgrades/t9.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pages/docs/protocol/upgrades/t9.mdx b/src/pages/docs/protocol/upgrades/t9.mdx index 54a1ea90..8fda3da1 100644 --- a/src/pages/docs/protocol/upgrades/t9.mdx +++ b/src/pages/docs/protocol/upgrades/t9.mdx @@ -29,7 +29,7 @@ T9 focuses on two changes that are needed for the first zone rollout: - **Protocol-managed zone creation.** Tempo gets one native ZoneFactory for creating zones and recording their portal accounts. - **Token policies that zones can rely on.** TIP-403 stores the active transfer policy for tokens that are used by zones and other provable flows. -The practical effect is that zones become easier to reason about. A zone is created through one protocol entry point, gets a predictable portal account, and can check token transfer rules from one registry. +A zone is created through one protocol entry point, gets a predictable portal account, and can check token transfer rules from one registry. ## Features From 9b39fe665c7095ceecf19b6bc0966263d674f855 Mon Sep 17 00:00:00 2001 From: Max Date: Wed, 29 Jul 2026 18:33:20 +0100 Subject: [PATCH 05/10] Update T9 page for TIP-1091 scope --- src/pages/docs/protocol/upgrades/t9.mdx | 53 +++++-------------------- 1 file changed, 11 insertions(+), 42 deletions(-) diff --git a/src/pages/docs/protocol/upgrades/t9.mdx b/src/pages/docs/protocol/upgrades/t9.mdx index 8fda3da1..252cd8f5 100644 --- a/src/pages/docs/protocol/upgrades/t9.mdx +++ b/src/pages/docs/protocol/upgrades/t9.mdx @@ -1,13 +1,13 @@ --- title: T9 Network Upgrade -description: T9 prepares Tempo for protocol-managed Zones with native zone creation and TIP-403 token policy bindings. +description: T9 prepares Tempo for protocol-managed Zones with native ZoneFactory creation and predictable zone portals. --- # T9 Network Upgrade -T9 prepares Tempo for protocol-managed Zones. It adds the native ZoneFactory used to create zones, and gives zones a registry-backed way to check which transfer policy applies to a TIP-20 token. +T9 prepares Tempo for protocol-managed Zones. It adds the native ZoneFactory used to create zones and gives every zone a predictable Tempo-side portal account. -For ecosystem partners, T9 matters most if you plan to operate a zone, support zone deposits or withdrawals, issue tokens that may be enabled on a zone, or index zone activity. +For ecosystem partners, T9 matters most if you plan to operate a zone, support zone deposits or withdrawals, or index zone activity. :::info[T9 status] T9 is not scheduled yet. The T9-compatible release, testnet activation time, and mainnet activation time are TBD. @@ -24,12 +24,11 @@ Node operators should run the T9-compatible release before the activation timest ## Overview -T9 focuses on two changes that are needed for the first zone rollout: +T9 focuses on one protocol change needed for the first zone rollout: - **Protocol-managed zone creation.** Tempo gets one native ZoneFactory for creating zones and recording their portal accounts. -- **Token policies that zones can rely on.** TIP-403 stores the active transfer policy for tokens that are used by zones and other provable flows. -A zone is created through one protocol entry point, gets a predictable portal account, and can check token transfer rules from one registry. +A zone is created through one protocol entry point, gets a predictable portal account, and appears in one canonical registry. ## Features @@ -70,32 +69,10 @@ Each zone starts with a small set of configuration choices: The sequencer set can contain up to 8 addresses. The threshold says how many sequencers must sign a settlement for it to be accepted. For example, a threshold of 3 with 5 sequencers means any 3 of those 5 sequencers can approve the settlement. -The initial token must already have a TIP-403 transfer-policy binding. This gives the zone a clear registry-backed answer for which transfer policy applies to that token. +The initial token has to satisfy the policy requirements enforced by the factory. This keeps zone creation from succeeding with a token the zone cannot safely use. Zone admins also choose whether account access and callback gateways start open or restricted. If a restricted setting starts with an empty role list, that access is denied until the admin adds roles or changes the setting. -### TIP-20 policy IDs in TIP-403 - -TIP-403 already stores the contents of transfer policies. T9 also lets TIP-403 store which transfer policy a TIP-20 token is currently using. - -This matters for zones because zones need a policy answer that can be checked from TIP-403 state. Without this, a zone would need to inspect each token contract to know which transfer policy applies. - -New TIP-20 tokens write their TIP-403 policy binding during token creation. - -Existing TIP-20 tokens do not all need to migrate at T9 activation. Unmigrated tokens keep working by falling back to their old token-local policy ID. Zone and provable-contract flows must require an explicit TIP-403 binding and cannot rely on that fallback. - -Read the specification [here](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1092.md). - -### Targeted token-policy migration - -T9 adds a targeted migration path for existing TIP-20 tokens that need a TIP-403 policy binding. - -The migration copies the token's current local policy ID into TIP-403. It is permissionless because it cannot choose a new policy; it can only register the policy the token is already using. - -Full automatic migration is not required. As of July 10, 2026, scans found 4,355 TIP-20 tokens on Presto mainnet and 15,291,992 TIP-20 tokens on Moderato testnet. Migrating every historical token during the network upgrade would create unnecessary registry state, especially on testnet. - -Operators and zone tooling should migrate only the tokens that are enabled on, or about to be enabled on, a zone. Token issuers do not need to migrate every historical token unless those tokens are part of a zone or another provable flow. - ## Compatible releases The T9-compatible release is not published yet. @@ -120,20 +97,12 @@ Release notes and binaries will be linked here when the T9-compatible release is - Create zones through the native ZoneFactory. - Use `isZonePortal(address)` when checking whether an address is a valid zone portal. - Keep sequencer sets to at most 8 addresses. -- Make sure every token enabled on a zone has an explicit TIP-403 policy binding. +- Confirm the initial token meets the factory's policy requirements before creating the zone. - Choose account-access and callback-gateway settings carefully at zone creation, because empty restricted role lists deny access. -### For TIP-20 issuers and token admins - -- New TIP-20 tokens get a TIP-403 policy binding during creation. -- Existing tokens keep working if they are not migrated. -- Tokens used by zones or provable-contract flows need a TIP-403 binding. -- `transferPolicyId()` continues to return the effective policy ID. -- After activation, `changeTransferPolicyId(uint64 newPolicyId)` writes the new active policy to TIP-403. - ### For SDKs, indexers, and low-level tooling -- SDKs and indexers that read `transferPolicyId()` from TIP-20 can keep using that API for the effective policy ID. -- Tools that need a provable token-to-policy binding should read TIP-403 and require the binding to be set. -- Migration tooling should batch token migrations and verify that every zone-enabled token has a TIP-403 binding. -- Event consumers can keep using the existing TIP-20 `TransferPolicyUpdate` event for active policy changes. +- Track zones through the native ZoneFactory registry and `ZoneCreated` events. +- Use `isZonePortal(address)` instead of reproducing the portal address check. +- Treat ZonePortal addresses as stable. Future portal logic changes must go through a network upgrade without changing portal addresses. +- Apps that do not create zones or interact with zone portals do not need an immediate integration change for T9. From 86b3699226bba04c081c99739b737d4db947901e Mon Sep 17 00:00:00 2001 From: Max Date: Wed, 29 Jul 2026 18:40:14 +0100 Subject: [PATCH 06/10] Add T9 to network upgrades table --- src/pages/docs/guide/node/network-upgrades.mdx | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/pages/docs/guide/node/network-upgrades.mdx b/src/pages/docs/guide/node/network-upgrades.mdx index 9e4c84d8..9cceff8e 100644 --- a/src/pages/docs/guide/node/network-upgrades.mdx +++ b/src/pages/docs/guide/node/network-upgrades.mdx @@ -15,6 +15,7 @@ For detailed release notes and binaries, see the [Changelog](/docs/changelog). | Release | Date | Network | Description | Priority | |---------|------|---------|-------------|----------| +| TBD | TBD | Testnet + Mainnet | Required for T9; adds the native ZoneFactory for protocol-managed zone creation and predictable ZonePortal accounts. Release details and activation timing are TBD. | Required | | [v1.11.0](https://github.com/tempoxyz/tempo/releases/tag/v1.11.0) | Jul 22, 2026 | Testnet + Mainnet | Required for T8; active on testnet and scheduled for mainnet activation on July 30. Includes current committee state, FeeAMM policy changes, versioned Stablecoin DEX order storage, DEX V2Order support, and final TIP-20 rewards deprecation. | Required | | [v1.10.1](https://github.com/tempoxyz/tempo/releases/tag/v1.10.1) | Jun 29, 2026 | Testnet + Mainnet | Required for T7; includes storage credits for DEX order storage and TIP-20 channel storage, dynamic base fee behavior, and TIP-20 rewards deprecation. | Required | | [v1.9.1](https://github.com/tempoxyz/tempo/releases/tag/v1.9.1) | Jun 19, 2026 | Testnet + Mainnet | Patch release with follow-mode stability fixes, payload-builder latency fixes, Reth/Rust dependency updates, and transaction-pool/RPC improvements. | Recommended | @@ -36,6 +37,22 @@ For detailed release notes and binaries, see the [Changelog](/docs/changelog). | [v1.3.1](https://github.com/tempoxyz/tempo/releases/tag/v1.3.1) | Feb 22, 2026 | Testnet + Mainnet | Fixes high-load issues and finalizes T1A/T1B hardening for expiring nonce replay protection and keychain precompile gas handling | Required | | [v1.2.0](https://github.com/tempoxyz/tempo/releases/tag/v1.2.0) | Feb 13, 2026 | Mainnet only | Fixes validation bug rejecting transactions with gas limits above ~16.7M, blocking large contract deployments | Required | +## T9 + +| | | +|---|---| +| **Scope** | Native ZoneFactory for protocol-managed zone creation and predictable ZonePortal accounts | +| **TIPs** | [Enshrined ZoneFactory](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1091.md) | +| **Details** | [T9 network upgrade](/docs/protocol/upgrades/t9) | +| **Release** | TBD | +| **Testnet** | TBD | +| **Mainnet** | TBD | +| **Priority** | Required | + +T9 is not scheduled yet. The T9-compatible release, testnet activation time, and mainnet activation time are TBD. Node operators should run the T9-compatible release before activation once it is published. + +--- + ## T8 | | | From 53086f4440b9a841383cd12c42623b669fc0ae97 Mon Sep 17 00:00:00 2001 From: Max Date: Wed, 29 Jul 2026 22:12:54 +0100 Subject: [PATCH 07/10] Align T9 page with TIP-1092 scope --- src/pages/docs/protocol/upgrades/t9.mdx | 74 ++++++++++--------------- 1 file changed, 28 insertions(+), 46 deletions(-) diff --git a/src/pages/docs/protocol/upgrades/t9.mdx b/src/pages/docs/protocol/upgrades/t9.mdx index 252cd8f5..4640d4da 100644 --- a/src/pages/docs/protocol/upgrades/t9.mdx +++ b/src/pages/docs/protocol/upgrades/t9.mdx @@ -1,13 +1,13 @@ --- title: T9 Network Upgrade -description: T9 prepares Tempo for protocol-managed Zones with native ZoneFactory creation and predictable zone portals. +description: T9 adds TIP-403 registry support for TIP-20 token policy bindings and targeted migration for existing tokens. --- # T9 Network Upgrade -T9 prepares Tempo for protocol-managed Zones. It adds the native ZoneFactory used to create zones and gives every zone a predictable Tempo-side portal account. +T9 updates how Tempo records the transfer policy used by TIP-20 tokens. It lets TIP-403 store the active policy for a token, so policy-aware tooling can read that answer from the registry when it needs to. -For ecosystem partners, T9 matters most if you plan to operate a zone, support zone deposits or withdrawals, or index zone activity. +For ecosystem partners, T9 matters most if you issue TIP-20 tokens, maintain wallets or indexers that read token policy state, or build flows that need a registry-backed answer for token policy checks. :::info[T9 status] T9 is not scheduled yet. The T9-compatible release, testnet activation time, and mainnet activation time are TBD. @@ -24,54 +24,37 @@ Node operators should run the T9-compatible release before the activation timest ## Overview -T9 focuses on one protocol change needed for the first zone rollout: +T9 focuses on one protocol change: -- **Protocol-managed zone creation.** Tempo gets one native ZoneFactory for creating zones and recording their portal accounts. +- **TIP-20 policy IDs in TIP-403.** TIP-403 can store which transfer policy a TIP-20 token is currently using. -A zone is created through one protocol entry point, gets a predictable portal account, and appears in one canonical registry. +This keeps token policy information in one registry when a flow needs that stronger guarantee. Existing tokens keep working even if they have not been migrated yet. ## Features -### ZoneFactory for zone creation +### Token policy lookup in TIP-403 -T9 adds the native ZoneFactory. This is the protocol entry point for creating a zone. +TIP-403 already stores transfer policy data. T9 also lets TIP-403 store the active transfer policy ID for a TIP-20 token. -When a zone is created, the factory assigns a zone ID, creates the zone's portal account, records the zone metadata, and emits the creation event. This gives Tempo one canonical zone registry instead of relying on a separately deployed factory contract. +In plain terms, this gives contracts and offchain tools a registry-backed way to ask: "Which transfer policy is this token using?" -For the first T9 launch, zone creation is permissioned. Only the configured factory owner can create zones. This keeps the initial rollout controlled while the Zones stack is being introduced. A future network upgrade can make zone creation open. +New TIP-20 tokens write this TIP-403 binding when they are created. After T9, token policy changes also update the TIP-403 binding. -Read the specification [here](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1091.md). +Read the specification [here](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1092.md). -### Predictable portal accounts +### Existing tokens keep working -Every zone gets a predictable ZonePortal account. The portal is the zone's Tempo-side entry point for deposits, withdrawals, settlements, and other zone operations. +Existing TIP-20 tokens do not all need to move at activation. If a token has not been migrated, normal token behavior can still use the token's existing local policy ID. -The address is derived from the zone ID, so developers and partner tools do not need to track an ordinary deployment address. Zone ID `1` maps to: +The difference is for flows that specifically need the policy answer to come from TIP-403. Those flows should require the TIP-403 binding to exist before using that token. -```text -0x5AD0000000000000000000000000000000000001 -``` +### Targeted migration -Contracts and offchain tools should use `isZonePortal(address)` when they need to check whether an address is a valid zone portal. +T9 adds a targeted migration path for existing TIP-20 tokens that need a TIP-403 binding. -Portal accounts keep stable addresses and independent state. The shared portal logic is installed by the network upgrade, and future logic changes must also go through a network upgrade. +The migration copies the token's current local policy ID into TIP-403. It does not choose a new policy or change the token's rules; it only registers the policy the token is already using. -### Zone setup inputs - -Each zone starts with a small set of configuration choices: - -- the initial token -- the zone admin -- the sequencer set and settlement threshold -- account-access settings -- callback-gateway settings -- an RPC URL - -The sequencer set can contain up to 8 addresses. The threshold says how many sequencers must sign a settlement for it to be accepted. For example, a threshold of 3 with 5 sequencers means any 3 of those 5 sequencers can approve the settlement. - -The initial token has to satisfy the policy requirements enforced by the factory. This keeps zone creation from succeeding with a token the zone cannot safely use. - -Zone admins also choose whether account access and callback gateways start open or restricted. If a restricted setting starts with an empty role list, that access is denied until the admin adds roles or changes the setting. +This means teams can migrate the tokens they need instead of forcing every historical token into the registry at once. ## Compatible releases @@ -89,20 +72,19 @@ Release notes and binaries will be linked here when the T9-compatible release is ### For node operators - Upgrade to the T9-compatible node release before activation. -- T9 installs the native ZoneFactory and shared zone runtimes at activation. +- T9 adds TIP-403 registry support for TIP-20 token policy bindings. - Nodes that do not include T9 support will fall out of sync after activation. -### For zone operators and zone tooling +### For TIP-20 issuers and token admins -- Create zones through the native ZoneFactory. -- Use `isZonePortal(address)` when checking whether an address is a valid zone portal. -- Keep sequencer sets to at most 8 addresses. -- Confirm the initial token meets the factory's policy requirements before creating the zone. -- Choose account-access and callback-gateway settings carefully at zone creation, because empty restricted role lists deny access. +- New TIP-20 tokens write their TIP-403 policy binding during creation. +- Existing tokens keep working if they are not migrated. +- Existing tokens should be migrated when a flow needs their policy ID to be available from TIP-403. +- After activation, policy changes update the active policy in TIP-403. ### For SDKs, indexers, and low-level tooling -- Track zones through the native ZoneFactory registry and `ZoneCreated` events. -- Use `isZonePortal(address)` instead of reproducing the portal address check. -- Treat ZonePortal addresses as stable. Future portal logic changes must go through a network upgrade without changing portal addresses. -- Apps that do not create zones or interact with zone portals do not need an immediate integration change for T9. +- Existing token policy reads can keep using the current TIP-20 API when they only need the effective policy ID. +- Tooling that needs a registry-backed token-to-policy answer should read TIP-403. +- Migration tooling should migrate only the tokens that need a TIP-403 binding. +- Apps that do not read or enforce TIP-20 policy state do not need an immediate integration change for T9. From f38d7ac94f71d502d05ad29057a529fcdc93a4c6 Mon Sep 17 00:00:00 2001 From: Max Date: Wed, 29 Jul 2026 22:14:05 +0100 Subject: [PATCH 08/10] Align T9 release table with TIP-1092 scope --- src/pages/docs/guide/node/network-upgrades.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/pages/docs/guide/node/network-upgrades.mdx b/src/pages/docs/guide/node/network-upgrades.mdx index 9cceff8e..36edc3ac 100644 --- a/src/pages/docs/guide/node/network-upgrades.mdx +++ b/src/pages/docs/guide/node/network-upgrades.mdx @@ -15,7 +15,7 @@ For detailed release notes and binaries, see the [Changelog](/docs/changelog). | Release | Date | Network | Description | Priority | |---------|------|---------|-------------|----------| -| TBD | TBD | Testnet + Mainnet | Required for T9; adds the native ZoneFactory for protocol-managed zone creation and predictable ZonePortal accounts. Release details and activation timing are TBD. | Required | +| TBD | TBD | Testnet + Mainnet | Required for T9; adds TIP-403 registry support for TIP-20 token policy bindings and targeted migration for existing tokens. Release details and activation timing are TBD. | Required | | [v1.11.0](https://github.com/tempoxyz/tempo/releases/tag/v1.11.0) | Jul 22, 2026 | Testnet + Mainnet | Required for T8; active on testnet and scheduled for mainnet activation on July 30. Includes current committee state, FeeAMM policy changes, versioned Stablecoin DEX order storage, DEX V2Order support, and final TIP-20 rewards deprecation. | Required | | [v1.10.1](https://github.com/tempoxyz/tempo/releases/tag/v1.10.1) | Jun 29, 2026 | Testnet + Mainnet | Required for T7; includes storage credits for DEX order storage and TIP-20 channel storage, dynamic base fee behavior, and TIP-20 rewards deprecation. | Required | | [v1.9.1](https://github.com/tempoxyz/tempo/releases/tag/v1.9.1) | Jun 19, 2026 | Testnet + Mainnet | Patch release with follow-mode stability fixes, payload-builder latency fixes, Reth/Rust dependency updates, and transaction-pool/RPC improvements. | Recommended | @@ -41,8 +41,8 @@ For detailed release notes and binaries, see the [Changelog](/docs/changelog). | | | |---|---| -| **Scope** | Native ZoneFactory for protocol-managed zone creation and predictable ZonePortal accounts | -| **TIPs** | [Enshrined ZoneFactory](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1091.md) | +| **Scope** | TIP-20 policy IDs in TIP-403 and targeted migration for existing tokens that need a registry-backed policy binding | +| **TIPs** | [TIP-20 Policy IDs in TIP-403](https://github.com/tempoxyz/tempo/blob/main/tips/tip-1092.md) | | **Details** | [T9 network upgrade](/docs/protocol/upgrades/t9) | | **Release** | TBD | | **Testnet** | TBD | From 7c17da2c938567e9c4f27faa04bc58ad1937cb92 Mon Sep 17 00:00:00 2001 From: Max Date: Thu, 30 Jul 2026 00:19:25 +0200 Subject: [PATCH 09/10] Add T9 to protocol upgrades sidebar --- vocs.config.ts | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/vocs.config.ts b/vocs.config.ts index 822784e1..be20feff 100644 --- a/vocs.config.ts +++ b/vocs.config.ts @@ -882,6 +882,11 @@ export default defineConfig({ text: 'Network Upgrades', collapsed: false, items: [ + { + text: 'T9', + badge: { text: 'Planned', variant: 'note' as const }, + link: '/docs/protocol/upgrades/t9', + }, { text: 'T8', badge: { text: 'Planned', variant: 'note' as const }, From 12c5b3949d5d4c63720d978940777f3325602e87 Mon Sep 17 00:00:00 2001 From: Max Date: Thu, 30 Jul 2026 00:20:42 +0200 Subject: [PATCH 10/10] Remove node operator impact from T9 page --- src/pages/docs/protocol/upgrades/t9.mdx | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/pages/docs/protocol/upgrades/t9.mdx b/src/pages/docs/protocol/upgrades/t9.mdx index 4640d4da..de78b66e 100644 --- a/src/pages/docs/protocol/upgrades/t9.mdx +++ b/src/pages/docs/protocol/upgrades/t9.mdx @@ -69,12 +69,6 @@ Release notes and binaries will be linked here when the T9-compatible release is ## Integration impact -### For node operators - -- Upgrade to the T9-compatible node release before activation. -- T9 adds TIP-403 registry support for TIP-20 token policy bindings. -- Nodes that do not include T9 support will fall out of sync after activation. - ### For TIP-20 issuers and token admins - New TIP-20 tokens write their TIP-403 policy binding during creation.