# The Internet Monetization Index (IMX) — Methodology **Rulebook v1.4** (amended 2026-09-15) · Administrator: Radius Technology Systems · Base: June 2026 average = 1000 · Series begins 1 May 2026 > **STATUS: SUSPENDED since 2026-09-15.** No current IMX determination is published. > Prints from 2026-07-13 are invalid; the index resumes under Rulebook v1.5 with a > restatement under §8. See the [suspension notice](/notices/2026-09-15-imx-suspension.md) > and the [archive of every print](/imx-archive.json). The Internet Monetization Index (IMX) measures the growth of *per-use* payment on the internet — value paid per request, as opposed to advertising- or subscription-funded access. It is a level relative to a fixed base period, not a count of anything. ## 1. Definition ``` IMX(t) = Numerator(t) / Divisor Numerator(t) = 7-day trailing average of x402 facilitator transactions per day Divisor = mean( Numerator(d) for d in 2026-06-01 … 2026-06-30 ) / 1000 = 104.91 (fixed at genesis) ``` - **Numerator(t) — x402 only.** The number of on-chain transactions sent per UTC day by the facilitator registry (§3) on **Base and Polygon**, read directly from archive RPC as nonce deltas across UTC-day boundaries, then averaged over the 7 calendar days ending on `t`. Point-in-time: computed only from data available as of the strike, with no look-ahead. - **Unit: transactions, not transfer events.** The strict quantity of interest is settled, USD-valued payment transfers. The numerator counts facilitator *transactions* instead, because that is readable from chain with no third-party query. Facilitators emit roughly one payment transfer per transaction; after the v1.1.0 registry fix the two counts agree within about 20%. Failed and approval transactions overcount; batching would undercount. A near-constant offset is divided out by the divisor and does not move the level, which measures growth from the base. This is a disclosed approximation, not an equivalence. - **MPP is not in the numerator.** Rulebooks v1.1–v1.3 summed x402 and MPP (Machine Payments Protocol, Stripe × Tempo). The v1.4 re-genesis (§8) rebuilt the numerator on owned on-chain data for x402 only. MPP is shown on the dashboard as context and does not enter the calculation. Re-integrating it is a methodology change and will be chain-linked (§1.1) in a later revision. - **The divisor** is set once so that the *average* level across the base window (June 2026) is exactly 1000. The first day of the series is **not** the base: 1 May 2026 printed 1144.03. Any day, inside or outside the window, reads above or below 1000 on its merits. ### 1.1 Chain-linking When a rail or a facilitator is added to the basket, the numerator rises mechanically. To keep that from reading as organic growth the index **chain-links**: the divisor is rescaled at the link date so the level is continuous, and the new basket drives every movement thereafter. Prior prints keep their original divisor and are never recomputed. ### 1.2 The underlying rate Reported beside the level, for readability: `Rate(t) = Numerator(t) / DenominatorPerDay × 10⁹`, expressed as payments per billion internet requests. `DenominatorPerDay` is a disclosed, sourced estimate (§6). It cancels from the level; it affects only this displayed rate. ## 2. Data sources | Input | Source | Role | |---|---|---| | **Numerator — x402** | Archive RPC (QuickNode) on Base + Polygon, over the facilitator registry | **The calculation.** The only inputs are the versioned registry and raw chain data; no third-party query definition can change coverage. | | Constituent registry | `src/ingest/facilitators.ts` v1.1.0 (imported from Dune 6054244, reconciled against the x402scan facilitators API) | Defines which addresses count (§3). | | Display — x402 transaction flow | Dune 6094619 "[x402] volume by token" (Hashed) | Dashboard panel: facilitator-submitted, USD-valued transfer events on EVM chains. Also read by the liveness comparison (§4). **Not in the calculation.** | | Display — x402 all-chain cross-reference | x402scan | Context only. Includes Solana (§2.1). | | Display — MPP payments | Dune 7977487, administrator-owned | Context only (§1). Settled `TransferWithMemo` payments on Tempo by payee, net of §4.1 exclusions. | | Display — MPP agents / servers | Dune 7208448 | Context. Distinct counts, shown raw (including excluded payees) and flagged as such. | | Display — MPP share of Tempo | Dune 7209665 | Context. | | Denominator | Cloudflare's published network scale | Displayed rate only (§6). | ### 2.1 Three x402 figures, deliberately not merged The dashboard shows three measures of x402 activity. They count different things over different coverage and are **not reconciled into one another**: 1. **The IMX numerator** — facilitator *transactions* on Base + Polygon (owned). 2. **The transaction-flow panel** — facilitator-submitted, USD-valued *transfer events* on EVM chains (Dune · Hashed). 3. **The cross-reference** — x402scan's all-chain *transaction* total, including Solana, which neither of the others covers. The cross-reference routinely reports several times the transaction-flow panel. Solana coverage explains an unquantified part of that gap. The remainder has not been explained, and it is not assumed away: the dashboard prints the ratio beside both figures rather than presenting either as the whole market. ## 3. Constituents — the facilitator registry The numerator counts transactions sent by a fixed, published list of **facilitator addresses**. That list is the index's constituent set. It is versioned in the repository (`src/ingest/facilitators.ts`), imported initially from Dune query 6054244, and governed by S&P-style constituent rules: - **Every change is dated and reasoned** in the registry changelog. No silent additions or removals. - **Adding a facilitator raises the numerator mechanically**, so a registry change **chain-links** the index (§1.1). No published print is rewritten. - Addresses are lowercased; `(blockchain, address)` is the unique key (one address may operate on several chains). - The initial registry (v1.0.0) held 96 facilitators from Dune 6054244. v1.1.0 reconciled it against the x402scan facilitators API, adding 71 EVM addresses the community query was missing (incl. 30 rotated Coinbase addresses) — 167 entries across 11 chains. The upstream source misspelled one chain (`polgyon`); this is normalized to `polygon` on import and disclosed. - **Coverage today: Base and Polygon.** The v1.4 numerator reads the registry's Base and Polygon addresses. Entries on the other nine chains are published but do not currently contribute. Extending coverage to them is a basket change and will chain-link. Owning the list — rather than depending on a third party's query definition — is what makes the numerator auditable and drift-proof. ## 4. Numerator integrity — liveness comparison Each cycle the index compares two independent views of facilitator activity: the Dune transfer series (the display panel) and facilitator transaction counts read directly from chain over the last ~24 hours. The index is flagged **stale / held** on the dashboard when either: - *Dormant* — the Dune series reports volume but no facilitator transacted on-chain in the window; or - *Diverging* — the Dune series drops more than 50% while on-chain activity holds steady (the signature of a silent upstream coverage gap; see §8). Since v1.4 the numerator itself is read from chain, so this comparison guards the display series more than the calculation. A Dune-only outage can therefore flag the index as held even though the numerator is unaffected. That is disclosed in §10 rather than silently accepted. **Deferred:** exact USD-valued transfer counting (transaction receipts or a streaming indexer), which would replace the §1 transaction approximation. ### 4.1 Circular-flow exclusions The index measures **settled payments** — value moving from a party that wants a service to a party that provides one. A *circular flow* moves no value: a funding address issues stablecoin to disposable wallets, those wallets pay a payee, and the payee remits back to the funding address. The same float cycles indefinitely, manufacturing transaction count at near-zero cost. This rule governs the MPP figures shown on the dashboard, and MPP's contribution to the numerator when the rail is re-integrated (§1). It applies to any rail. - **The test** is structural, not a volume heuristic — volume is precisely what the operator controls. For a payee `P`, let `sinks(P)` be the addresses `P` pays out to and `payers(P)` the addresses that pay `P`. Then `circularity(P) = |payers(P) funded by some address in sinks(P)| / |payers(P)|`. A payee whose customers are overwhelmingly the creations of its own payout counterparty is not selling anything. - **Thresholds.** Flagged at `circularity ≥ 0.90` over a sampled window, and only with at least 20 distinct payers — an honest business can coincidentally share a funder with a customer, and a small sample proves nothing. - **Detection is automated; exclusion is not.** The monitor samples chain each cycle and **flags** candidates. It never excludes on its own: a false positive would erase real volume permanently. A flag is confirmed by the administrator and landed in the exclusion registry with its evidence, as an auditable change. - **Disclosure, always.** Excluded payees are **published, not hidden** — address, reason, effective date, counterparty, and the evidence — together with both the raw and the clean figures, so any reader can reconstruct the raw series. **Disclosed exclusion — MPP, effective 2026-04-09.** Payee `0x10c140022927429afb5f7779f4bc5495da8c1e24`, counterparty `0x385193793fe875cd9f2341409563932023fb4fab`. Verified on Tempo 2026-07-14: the payee is an EOA with nonce 0 (receives only) that sweeps ~$200/hr to the counterparty, which funds the wallets that pay it — across five windows sampled over 24 hours, **288 of 289 distinct payers (99.7%)** were funded by that same address. Neither wallet accumulates (~$137 and ~$476 held against 430,491 transactions). Over the trailing 30 days this single loop was **36% of MPP payments and 40% of MPP dollars**, while moving **0.47%** of the dollars actually transferred on Tempo. ## 5. Point-in-time integrity (the benchmark guarantee) - Each daily value is **struck once** on settled data and is **immutable**. Published history never changes, even if a source restates prior days. - The series is **append-only**. New complete days are appended using the fixed genesis divisor (or the current chain-linked divisor); existing prints are never recomputed. - **Settlement lag: prints are T-2.** A day is struck only once it is at least two calendar days behind the latest available data. Sources do not finalize their most recent one to two days, and because prints are immutable, freezing a partial day would bake a wrong (usually low) value into history permanently. So prints struck on 15 September carry data through 13 September. (Dashboard text labelled this "T-1" until 2026-09-15; that was wrong.) - **One strike at a time.** Concurrent refreshes (the hourly cron and a manual trigger) are serialized, so two strikes can never both append the same day and overwrite one another. - **Completeness and reconciliation (from 2026-09-15).** A day is struck only when (a) every registry address was read at both of the day's boundaries on every chain in coverage, (b) all seven days of its trailing window are complete, and (c) its 7-day average is within 0.5× to 2× of the Dune display series' 7-day average over settled days. Otherwise the day is **held** and retried on the next run, and every later day is held with it, so a missing day can never be skipped over. This rule exists because prints from 2026-07-13 were struck from incomplete reads (§8). - **Trailing average.** Backfilled prints divided the 7-day sum by the days that had data. For new strikes the full window must be complete (above), so no print is averaged across a missing day. - **Backfill disclosure.** 1 May 2026 through 12 July 2026 was backfilled at the v1.4 re-genesis (§8) and is flagged `backfilled = true`. Prints from 13 July 2026 forward were struck live. `backfilledThrough` and `liveFrom` are published with every snapshot. ## 6. The denominator ``` DenominatorPerDay = 115,000,000 requests/s × 86,400 s ÷ 0.20 ≈ 4.97 × 10¹³ (≈ 49.7 trillion requests/day) ``` - **115 million requests per second** — Cloudflare's stated average, from its "About us" page (cloudflare.com/about-overview), read 2026-09-15. - **0.20** — Cloudflare's statement that it proxies "~20% of the web". That is a share of *websites*, not a measured share of *requests*, so dividing by it is an order-of-magnitude extrapolation, not a measurement. - It cancels from the index level and affects only the displayed rate (§1.2). - It is revised when Cloudflare's published figure moves materially, and every revision is dated here. **Prior value:** 2.6 × 10¹³ until 2026-09-15. That figure had not kept pace with Cloudflare's published scale and roughly doubled the displayed rate. ## 7. Base value & re-anchoring - **How the base is chosen.** A base value is a display convention that carries no information — rescaling the whole series by a constant changes no return and no relationship. It should be chosen for *readability and representativeness*, never to flatter the level. The standard is a **representative base period** (an averaged window of clean, complete data past any launch anomaly), set to a round number, with the divisor then fixed forever. - **Current anchor (v1.4): the June 2026 average = 1000.** June 2026 is a complete month well past the x402 launch spike and, on the owned numerator, free of the June coverage gap (§8). Divisor 104.91, fixed. The series begins on 1 May 2026 so that the base window has a month of lead-in history. - **Prior anchor (v1.0–v1.3):** 1 January 2026 = 100. It sat on the tail of the x402 launch spike, so the index read below 100 through 2026 H1. Superseded at the v1.4 re-genesis. - **Re-anchoring is a restatement** under §8, permitted only while the index is pre-public. ## 8. Restatement policy & disclosed events - **Restatements are public, never silent.** Once the index is public, a struck print is never edited in place. A correction is published as a dated restatement note describing what changed and why; the immutable series is preserved. - **Performed — the v1.4 re-genesis, 2026-07-14.** The single permitted pre-public rewrite. The series was re-struck from 1 May 2026 on the owned on-chain numerator and re-based per §7. Every v1.0–v1.3 print is superseded; none carries over into the current series. - **Resolved — the June 2026 coverage gap.** Between roughly 27 and 30 June 2026 the upstream community query silently lost coverage of a major facilitator, producing an artificial collapse-and-recovery ("the V") in the v1.3 numerator. The owned numerator does not depend on that query, and the re-struck series shows no collapse over those dates. - **Amended 2026-09-15 — pre-public restatement.** The rule above allowed a single pre-public rewrite, and the v1.4 re-genesis used it. It is amended: while the index is pre-public, the administrator may restate a range of prints found to be invalid, and only if (a) a dated public notice identifies the affected dates and the cause; (b) the original prints remain published in a public archive, labelled with their standing, and are never deleted; (c) the restated series is struck under a new rulebook version; and (d) this amendment and every use of it are recorded in the changelog. Once the index is public, corrections follow the first rule of this section. - **Disclosed — suspension, 2026-09-15.** The 63 prints struck live from 2026-07-13 through 2026-09-13 are **invalid**: rate-limited chain reads failed undetected, merging days or dropping facilitators, and were struck. Separately, the v1.4 numerator is dominated by activity it cannot exclude — about 78% is a single Polygon fleet the administrator's monitoring identifies as a closed wash loop, and on Base facilitator transactions exceed USD-valued x402 payments roughly 45-fold. IMX is suspended; the last valid print is 2026-07-12 (reference only). Every print remains in the public archive (`/imx-archive.json`). The affected period will be restated under v1.5 by the amended rule above. Notice: `/notices/2026-09-15-imx-suspension.md`. - **Disclosed — methodology publication lag, 2026-07-14 to 2026-09-15.** v1.4 took effect at the re-genesis, but this document continued to describe v1.3 until 2026-09-15. No print was affected; the published description was wrong. See the changelog. ## 9. Calculation & publication - **Strike cadence:** recalculated hourly; a new official daily print is committed once the day clears the settlement lag (§5). - **Smoothing:** 7-day trailing average of the numerator. - **Rounding:** level to 2 decimals. - **Publication:** this document at `/methodology`; the live snapshot at `/snapshot.json`, whose `imx.rulebook` must equal this document's version. ## 10. Known limitations (disclosed) - **Coverage is Base + Polygon.** Other registry chains and Solana are not in the numerator (§3). The all-chain cross-reference is shown for context (§2.1). - **Transactions approximate payments** (§1). Exact transfer counting is deferred. - **The liveness comparison reads the Dune display series** (§4), so a Dune-only outage can flag the index as held while the numerator is sound. - **The denominator is an extrapolation** from Cloudflare's scale (§6). - **MPP is outside the basket** until re-integrated (§1). - **Single numerator source.** Owned and auditable, but not yet corroborated by a second independent volume source. ## 11. Roadmap (future rulebook versions) - Re-integrate MPP, chain-linked (§1.1). - Extend the numerator to the registry's remaining chains, chain-linked. - Exact USD-valued transfer counting (receipts or a streaming indexer). - A live-sourced denominator (Cloudflare Radar) with its own specification. - Evaluate a multi-factor composite (transactions, USD volume, active participants, service breadth), chain-linked via the divisor. ## Changelog - **v1.4, amended 2026-09-15** — governance and controls; no change to the numerator's definition, the base, or the divisor, so the rulebook version is deliberately not bumped (a version bump alone would alter the method signature and rescale the divisor). IMX **suspended**, with the affected prints and their cause disclosed (§8). §8 amended to permit a disclosed, archived pre-public restatement. §5 adds the completeness and reconciliation rule under which a day is struck or held. - **v1.4** — took effect 2026-07-14; documented 2026-09-15. **Owned numerator and re-base.** (a) The x402 numerator is computed directly from chain — facilitator transaction counts over the registry via archive RPC on Base + Polygon — and Dune leaves the calculation (§1, §2). (b) MPP leaves the calculation pending re-integration (§1). (c) The base moves to the June 2026 average = 1000, series beginning 1 May 2026 (§7). Performed as a pre-public **re-genesis**, not a chain-link (§8). **This document was not updated when v1.4 took effect**, and for two months described v1.3 while the index ran on v1.4. Corrected 2026-09-15, together with a test that fails the build when this document's version and the code's rulebook version disagree. Same revision: denominator re-sourced (§6), settlement lag correctly stated as T-2 (§5), the three x402 figures documented as unreconciled (§2.1). - **v1.3** — **Numerator integrity.** (a) The MPP rail measured in **settled payments** (`TransferWithMemo` events) rather than `mpp_tx_count`, a *protocol* signal. (b) **Circular-flow payees excluded** and disclosed (§4.1); the first exclusion removed a loop that was ~36% of MPP payments. (c) The administrator owns the MPP query (Dune 7977487). Chain-linked forward. Also corrected a drift in which this document was published as v1.2 while the code still read `1.1`. - **v1.2** — Governance and integrity hardening: the **facilitator registry** as a versioned constituent set (§3); an **on-chain liveness gate** (§4); the **settlement lag** and gap-robust averaging (§5); a **base-selection principle** (§7); a **restatement policy** (§8). - **v1.1** — Added the **MPP rail** (Stripe × Tempo), making IMX a two-rail index. Chain-linked forward. - **v1.0** — Initial rulebook. Single-source numerator (Dune · Hashed), constant denominator, point-in-time frozen series, divisor established. --- # The Plumbing Stress Index (PSI) — Methodology > A **separate index** from IMX, published alongside it. IMX measures how much > value crosses the payment rails. PSI measures how sound the rails are underneath. > Different questions, different drivers, separate rulebooks, separate immutable > series. A change to one never restates the other. **Higher PSI is worse.** ## P1. Definition PSI is a 0–100 **stress** score for the stablecoin settlement layer — the collateral beneath both the x402 and pay-per-crawl economies. It is not indexed to 100 at a base date the way IMX is: a stress reading needs an absolute, interpretable scale ("35 out of 100"), not a level relative to an arbitrary genesis day. The frame is Zoltan Pozsar's: **money is a hierarchy of promises, not a thing.** Reserves sit on top with true settlement finality. Below them sit claims that promise par convertibility into the layer above. Plumbing is the machinery that keeps those promises, and a crisis is the moment one breaks. Stablecoins rebuild that hierarchy: ``` T-bills & bank deposits ← issuer reserve assets └ issuer reserve pool └ USDC / USDT at par ← first-order claim (CANONICAL) └ bridged copies ← claim on a claim (the eurodollar layer) └ DeFi receipts └ agent balances & channel float ← NOT OBSERVABLE (see P7) ``` Bridged stablecoins are the **eurodollar market of crypto**: offshore dollars minted by intermediaries, par promised but not guaranteed, with no lender of last resort behind them. That is the risk PSI prices. ## P2. The constituent universe (eligibility) PSI does not score every "stablecoin". Like any real index (S&P, MSCI), it applies eligibility criteria before it computes anything. Three gates, in order: 1. **Non-algorithmic.** Algorithmic stablecoins hold their peg by reflexive market mechanics rather than reserves — Terra's design. They are a different risk object, they fail differently, and averaging them with reserve-backed claims measures nothing coherent. Excluded outright. (Matched loosely: DeFiLlama's mechanism field carries a real typo, `crytpo-backed`, so the test normalizes and looks for "algo".) 2. **Reserve floor — $100M.** An asset backing fewer dollars than this is not systemically load-bearing, and the long tail is full of corpses and experiments. Circulating supply is the reserve proxy: a fiat-backed token is 1:1, a crypto-backed one is overcollateralized, so supply is a conservative floor on reserves. 3. **Top N by size (N = 2).** Of what survives, the two largest are the constituents. All four components are computed over exactly this set, and it is named in every print. Today's constituents (~89% of the whole USD-stablecoin market): **USDC and USDT** — the two systemic dollar stablecoins, and the only two with reserve disclosure deep enough to model the infrastructure/SVB layer (P2.1). Because USDC and USDT are reliably the two largest by a wide margin, "top 2 by size" is USDC + USDT. This replaces an earlier per-component "$1B materiality floor": with a gated universe, every constituent is already large, real and reserve-backed, so no component needs its own size cliff. *Why 2, not 10.* v1.0 scored the top 10. Narrowing to USDC + USDT is a deliberate segment break (P6): at two constituents, token-level issuer concentration is pinned at 100% and stops carrying signal, so it is replaced by **reserve risk** — the concentration that still varies and still matters (P2.1). The two names still anchor ~89% of all USD stablecoin supply, so coverage barely moves while the reserve layer becomes modelable. ## P2.1 Components & weights (rulebook v1.2) | Component | Weight | Measures | Reads 100 at | |---|---|---|---| | **Collateral layering** | 30% | eurodollar multiplier = bridged / canonical supply | 0.50× | | **Peg integrity** | 30% | worst deviation from $1.00 among constituents | 100 bp | | **Bridge opacity** | 20% | share of bridged supply with no identifiable bridge | 50% | | **Reserve risk** | 20% | concentration & opacity of the banks/custodians behind the reserves (the SVB channel) | see below | **Why layering and opacity carry half.** They are the conditions that *precede* a break — leverage accumulating in a layer nobody is watching. Peg carries 30% despite being the loudest number because a depeg is the fire, not the fuel: by the time it prints, the plumbing has already failed. An index dominated by peg would be a lagging indicator dressed as a leading one. **Why issuer concentration became reserve risk (v1.1).** Under the two-constituent universe, token-level issuer concentration is pinned at 100% (two of two) and carries no signal. It is replaced by the concentration that still varies: the off-chain **infrastructure** behind the reserves — the banks, custodians and broker-dealers a stablecoin's par promise actually depends on. This is the SVB channel: in March 2023 USDC broke not because its token was concentrated but because its *cash reserves* clustered in a failing bank. Reserve risk blends three sub-measures over a versioned reserve registry (P3): - **SPOF** — the largest severity-weighted single-provider exposure as a share of registered reserve supply ("one provider failing impairs this much"), scaled so 60% reads 100. Severity by provider layer: **cash bank 1.0, wire rail 0.6, custody/fund 0.3** — a reserve dollar sitting as cash at one bank is more fragile than the same dollar in segregated custody. **v1.2:** these discounts apply only to a provider a *primary source* names for that role. Custody that no primary source names is unverified and scores at **full severity (1.0)**, the same as cash — the standard an auditor applies to a 2a-7 government money market fund. Unnamed custody of eligible assets and of ineligible assets are kept as separate unknowns. - **Dark cash** — the share of reserves sitting as cash at an *undisclosed* bank, scaled so 20% reads 100. You cannot manage the exposure you cannot see, and a modest undisclosed cash layer is exactly what broke USDC. No credit is given for an unnamed tier ("primarily GSIBs"): an unnamed bank is dark whatever class it is said to belong to. - **Asset quality (v1.2)** — the share of reserves in assets a SEC Rule 2a-7 government money market fund could not hold (gold, bitcoin, equities, secured loans, corporate bonds, "other investments", non-US bills), scaled so 25% reads 100. Cash, US Treasuries and Treasury-collateralized repo are eligible. Scored `0.5 × SPOF + 0.3 × dark-cash + 0.2 × asset quality`, plus a **+15 surcharge** when one disclosed provider serves more than one issuer *on the same infrastructure layer* — the cross-issuer configuration that actually transmitted contagion in 2023. Coverage (the share of constituent supply the registry models) is disclosed on every print; unmodeled supply contributes nothing rather than a guess. Bands: **calm** < 25 · **watch** < 50 · **strained** < 75 · **critical** ≥ 75. ## P3. Data source DeFiLlama stablecoins API (free, public). Per-asset chain balances carry `circulating` and `bridgedTo`, which is what makes the canonical/bridged split computable. Bridge-level attribution is present but **incomplete** — a material share of bridged supply reports its bridge as `not-found`. That gap is not smoothed over; it is measured and published as the opacity component. Detail is pulled for exactly the constituents (the top-2 eligible assets, P2), covering ~89% of USD stablecoin supply; the covered share is disclosed on every print. **Reserve registry (second source).** The reserve-risk component (P2.1) is not on-chain. It reads a **versioned, hand-maintained registry** mapping each constituent issuer to the banks, custodians and broker-dealers behind its reserves, with every provider's layer, credit rating and disclosure status. Live constituent supply flows in; the SVB-channel metrics come out. From v1.2 every reserve share is an **attested line item** from the issuer's latest independent attestation (USDC: Deloitte examination as of 2026-07-31; USDT: BDO ISAE 3000R as of 2026-06-30), cited on each registry edge. Changing the registry's structure is a methodology change (P6). Supply a registry does not cover is disclosed as uncovered, never assumed safe. ## P4. The peg measure The peg component takes the **worst** deviation among the constituents, because a hierarchy fails at its weakest promise — and because every constituent is systemic by construction (P2), a break in any of them must count. `price >= 0` keeps a genuine zero-price failure, the loudest signal there is; only a *missing* price is dropped. One filter applies: **yield-bearing tokens are excluded.** USYC trades at ~$1.13 because its price accrues Treasury yield by design. That is a coupon, not a depeg; left in, it pins the component at 100 forever. Excluded by DeFiLlama **id** (not symbol — five distinct assets ship as "USDS"), human-curated with evidence, never heuristic. A rule like "price > 1.02 must be yield" would silently swallow a genuine upward depeg. Only USDY and USYC qualify — the two whose *price* is designed to leave par; of those, only USYC is currently a constituent. Assets that pay yield some other way (BUIDL via dividend, Sky Dollar via the sUSDS wrapper) hold par and **stay in** the measure. The old per-component "$1B materiality floor" is gone: the constituent universe (P2) already guarantees every scored asset is large, real and reserve-backed. **Distress watchlist.** A quality-eligible asset (non-algorithmic, above the $100M reserve floor) that did **not** make the top-2 cut but is more than 200 bp off par is a real break *outside* the scored universe. It is **disclosed beside the index**, never folded into it and never dropped. Outside the scored set, too large to leave unsaid. The reserve floor and the algorithmic exclusion keep corpses and Terra-style experiments off the list. apxUSD (~$307M at 87¢) and reUSD (~$159M at $1.09) sit here. ## P5. Point-in-time integrity (the benchmark guarantee) Every daily value is **struck once and is immutable**, even if DeFiLlama restates its history. Inherited invariants: - A store read failure or corrupt value **never** re-genesises the series. - Appends strike strictly **forward**; a day that arrives late never rewrites history. - An out-of-band composite (outside 0–100) is refused, not struck. - **First writer wins**: concurrent cron and manual refreshes reconcile read-after-write, so a race cannot overwrite an official print. - A methodology change moves metadata **only** alongside a new print, never on a no-op day. - A future-dated clock skew beyond 30 days is refused rather than freezing the series. **No backfill.** The per-chain bridged/canonical split is only available as a live snapshot. PSI does not fabricate history it never observed: the series starts the day it starts, and says so. **One print per UTC day**, taken from the first complete observation on or after 00:00 UTC. First-of-day, not last, so the value does not depend on when the cron happened to run. Unlike the IMX numerator there is no settlement lag to wait out — PSI reads a live snapshot of supply and prices. ## P6. Methodology changes — segmentation, not chain-linking IMX is a ratio, so a methodology change **chain-links**: rescale the divisor, the level stays continuous. PSI is a bounded score with no divisor. There is nothing to rescale, and if the weights change the level genuinely means something different. So PSI **segments**. A rulebook change closes the current segment and opens a new one; every print records the rulebook that produced it. History is never rewritten and never silently reinterpreted. A reader sees exactly where the definition changed and is warned not to compare across the break. **An index that cannot chain-link should say so rather than fake continuity.** ## P7. The agent tier — declared not observable PSI prices the stablecoin hierarchy down to the bridged layer. The layer agentic commerce actually runs on sits below that and is **not on any public chain**: - **Agent float** — value parked in prefunded balances and payment channels so agents can transact. The "currency in circulation" of the machine economy. Nobody measures it. - **Finality spread** — the price gap between instant-but-revocable and final-but-slow settlement. Pozsar's four prices of money are par, interest, FX and finality; at machine speed, finality acquires a *time*-price humans never paid. Arguably a fifth price of money. - **Agent credit** — agents transacting against a promise rather than a balance. The moment this exists, inside money is being created at the agent layer, and there is a thing that can break. These are **not proxied from settled volume.** A proxy would be a confident number nobody could check — the exact failure a benchmark must avoid. The gap is published with what it would take to close it. The absence of the data is itself the finding: an agent economy whose float nobody can see is running the eurodollar market's opening act. ## P8. Known limitations (disclosed) - **The top-2 cutoff is a hard boundary.** The #3 asset is not scored, however close. A break just outside the constituent set moves the distress watchlist, not the index. This is the standard behaviour of a fixed-membership index; it is disclosed, not hidden. - **Reserves are proxied by circulating supply.** DeFiLlama does not expose reserve attestations, so the $100M floor and the reserve-quality view rest on on-chain supply, not on audited reserves. For fiat-backed constituents these are ~1:1; for crypto-backed ones supply understates reserves (overcollateralized), so the floor is conservative. - **Reserve risk rests on a hand-maintained registry.** The banks and custodians behind each issuer's reserves are curated from public disclosures, not a live feed, so the SVB-channel view is only as current as the latest attestation (USDT's is quarterly, so its figures can be up to ~4 months old). Undisclosed providers are scored at full severity (worst-reasonable), never assumed benign, and registry coverage is published on every print. - **Bridge opacity is source-limited.** DeFiLlama's `not-found` attribution is a floor on true opacity, not a measurement of it; real unattributable supply may be higher. - **The agent tier is empty by construction** (P7), which is the point, but it means PSI today measures only the stablecoin layer of a hierarchy that will eventually run deeper. ## P-Changelog - **v1.2** (2026-10-16) — Reserves scored to the **2a-7 government MMF standard** (administrator decision 2026-09-15). The reserve registry is rebuilt from attested line items; custody no primary source names scores at full severity; the USDT "Cantor Fitzgerald · reported" edge is removed as unsupported (Tether names Cantor only for USA₮); a new **asset-quality** channel scores reserves outside 2a-7 eligible assets; the reserve blend becomes 0.5 SPOF / 0.3 dark cash / 0.2 asset quality. The layering, opacity and peg scales are added to the method signature. On the day of adoption this moved reserve risk from 40.7 to 65.4 and PSI from about 17.9 to about 22.9 (still *calm*). Applies from the 17 October 2026 print. A **segment break, not a chain-link** (P6): no v1.1 print is restated. Notice: /notices/2026-10-16-psi-v1.2.md. - **v1.1** (2026-07-16) — Constituent universe narrowed to **USDC + USDT** (top 2 by size; ~89% of USD stablecoin supply). Token-level **issuer concentration**, now pinned at 100% and signal-free at two constituents, is **replaced by reserve risk** — the SVB-channel concentration and opacity of the banks, custodians and broker-dealers behind the reserves (SPOF + dark-cash, over a versioned reserve registry), at the same 20% weight. A **segment break, not a chain-link** (P6): the new rulebook signature opens a fresh PSI segment and no v1.0 print is restated. - **v1.0** (2026-07-15) — Genesis. Constituent universe: non-algorithmic, ≥$100M reserves (supply-proxied), top 10 by size. Four components (layering, peg, opacity, concentration) computed over the constituents; yield-bearing tokens excluded from the peg test by id; distress watchlist for eligible breaks outside the top 10; agent tier declared not observable. Segmented series (no chain-link). The constituent rules are encoded in the method signature, so changing them forces a segment break.