The operator pool
A funded recovery that completes settlement reserves 10% of recovered value for eligible operators. This is an operator pool, not an unconditional payment to one device. The exact division is part of the signed case manifest, so the coordinator cannot silently change it after work begins.
The currently supported policies are:
| Signed policy | Division of the operator pool |
|---|---|
| Proportional, the current default | 50% to the finding operator; the remaining 50% divided among eligible non-finding operators by signed, verified work units |
| Winner-takes-all | The finding operator receives the whole operator pool |
If the finder is the only eligible participant in a proportional case, the finder receives the whole pool. If an operator is disqualified, its proposed share is removed and the pool is recomputed under the signed policy.
Password correctness is not payment
The protocol separates four events that should not be conflated:
- An operator tool reports a possible match.
- The result is verified against the strongest wallet evidence available.
- The decrypted wallet is shown to contain spendable value.
- Recovery and settlement complete.
An operator reward exists only after the fourth event. A correct password can satisfy the first two events without producing a funded recovery.
Why the wallet may be empty
Many encrypted wallet formats do not reliably expose their usable public addresses before the correct password decrypts the wallet. Distribrute may therefore be unable to independently check the wallet’s current spendable balance before operators commit compute.
After decryption, the wallet’s derived addresses may have a zero balance, the funds may already have been spent, or the remaining value may be insufficient to complete a policy-compliant settlement. In any of those cases, a machine can find the correct password and still receive no reward.
This is an unavoidable success-funding risk: operator rewards depend on recovered value, not on password correctness alone.
Verification and settlement dependencies
A possible match can also fail to become a payable recovery when:
- the minimal safe-test-piece check was a false positive;
- a non-custodial probable match is not confirmed against the owner’s full wallet;
- the wallet is damaged, incomplete, or lacks spendable keys despite accepting the password;
- the owner-controlled non-custodial recovery or final settlement does not complete;
- an audit hold, disqualification, legal restriction, or invalid payout destination blocks an operator’s eligibility.
Custodial recovery gives Distribrute the encrypted wallet and more control over wallet-side verification. Non-custodial recovery leaves the wallet and final authorization with the owner, so it adds owner-host and completion risk. Neither mode can create value in an empty wallet.
Work accounting and audits
The agent receives signed work units with each assignment. Completed, accepted coverage is recorded as contribution evidence. Under proportional policy, qualifying work from operators other than the finder determines the division of the non-finder half of the pool.
Proportional payout finalization is gated by the implemented audit-standing system. Signed audit work, holds, and adjudication are used to prevent fabricated coverage from sharing in a successful case. An open hold can delay finalization; a disqualified operator is excluded and the remaining shares are recomputed.
Current settlement reality
The signed policy, contribution ledger, proportional-share computation, audit controls, and payout breakdown are implemented. Absolute amounts and operator payments are still coordinated manually. Automated on-chain settlement and a self-service operator payout dashboard remain planned.
Operators should treat every estimate as conditional until the wallet is decrypted, spendable value is confirmed, eligibility checks are complete, and settlement has finished. See Implementation status, End-to-end recovery, and Trust model for the surrounding boundaries.