B39 · Mainnet survey signing — 3-of-5 native script #50

Checklist item: B39 — scope + DoD per workspace CHECKLIST.md (source of truth; never enters the repo)
Milestone: Phase 6 — Verification and launch
Criteria: criteria:SUR
Blocked by: #33 (B28)

The Big Idea

Freeze and sign the mainnet question set under the 3-of-5 multisig with keys never touching a build machine — only after B28's preview-pilot sign-off and named signers.

Details

SUR-8..SUR-15, SUR-20/SUR-31: the mainnet definition signs once, correctly, forever (until epoch 2000). Ownership is a 3-of-5 native script (eligible_roles = [Keyholder]); keys stay with their humans — custody rules in the B48 runbook note. Prerequisites hard-gated: B28's pilot sign-off recorded, and the five signers named via B48.

After signing, the survey stands; evolution is additive only (B27's manifest edges), never amendment.

Source: CHECKLIST.md, item B39; blocked by B28.

Recommend tests

• Multisig policy verified on-chain (3-of-5, Keyholder roles) before value freeze.
• Signing ceremony rehearsal completed on preview with equivalent script.
• Signed payload matches B28-signed-off question set byte-for-byte (indices and copy).

Potential code references, but use your judgement

• CIP-179.md

Definition of Done

• Formatted (prettier / fourmolu)
• Static analysis clean (tsc --noEmit · eslint · hlint), no new warnings
• Unit tested; coverage does not regress
• Cited criteria verified — by test or recorded measurement, not inspection
• CI green end to end
• No previously-satisfied criterion broken; generated artifacts still regenerate byte-identical
• Hard prerequisites: B28 sign-off recorded + five signers named