diff --git a/Historical Docs/janus-facing-architecture-amendment-2026-09-22.md b/Historical Docs/janus-facing-architecture-amendment-2026-09-22.md new file mode 100644 index 0000000..7ff0482 --- /dev/null +++ b/Historical Docs/janus-facing-architecture-amendment-2026-09-22.md @@ -0,0 +1,121 @@ +# Amendment to the Official Document of the Janus Facing Architecture + +**Draft · 2026-09-22 · proceeds under P1-001 §9.2** + +Prepared for the delegates. The official document is amended only by a majority vote of the delegates, each federation having decided under §6.5, and the amendment is not adopted until the conformance suite passes against the amended text (§9.2). During bootstrap (§16.1) the founder board exercises the powers of the membership; an adoption so made is recorded in the governance registry (§9.5) as a bootstrap act and stands open to the membership under §2.3. + +**Sequence.** This amendment precedes the P1-001 v1.1 draft. The v1.1 amendment dated the same day was superseded on 2026-09-30 by the consistency-pass v1.1 (bylaws PR #4), which carries the prosumer member's federation election in §3.9; that election rests on the membership path Section 1 names. Adopted in the other order, the bylaws would exceed the official document in the sense of §15.2 for the interval between the two acts. Where both are adopted in a single bootstrap act, this amendment is recorded first. + +**Base.** This amendment is written against the document as it reads with the six editorial revisions of 2026-09-17 applied — pull requests #9 through #14, open at the time of drafting. Section 1 is unaffected by them. Section 2 is: see its own note. + +--- + +## What this amendment does + +1. Names prosumer standing as a path into membership of the stewardship organization, on the terms its bylaws provide. *(Governance layer, orchestrator tier.)* **Revised 2026-10-01:** by decision of the principal, the placement of the prosumer member's vote in the Covenant or Governance federation, and the weight of a federation's vote, are bylaw matters and are no longer carried in the amended text; P1-001 v1.1 §3.4, §3.8 and §3.9 (bylaws PR #4) carry them. +2. Names who adjudicates a dispute between a prosumer and the operator of its own platform: the witness layer, never the operator. *(Covenant layer.)* Severable from Section 1. +3. Instructs the conformance suite and the invariant registry. + +It touches none of the twelve lines. + +--- + +## Section 1 — Governance layer, orchestrator tier + +**Current text.** + +> Membership in the Network Theory Applied Research Institute, obtained by operating a federated instance of JFA software. + +**Amended text.** + +> Membership in the Network Theory Applied Research Institute, obtained by operating a federated instance of JFA software, or by participating as a prosumer on a federated platform as the organization's bylaws provide. + +**Rationale.** + +Institutional Discipline says that where leaving is dear, members get a vote. A prosumer's exit is dear once its credit is sovereign and non-convertible (Lines 2 and 3). The document gave that prosumer standing to challenge — through the Covenant tier's adjudication — but no vote; the only membership it named was the operator's, whose exit is the cheap one (fork the code, keep the record). The bylaws (P1-001 v1.0 §3.8) supplied the vote, but the document did not recognize the membership they created, §15.2 subordinates the bylaws to the document, and the bylaws' own preamble still describes Governance orchestration as the relationships among operator-members. A vote resting on an instrument the architecture can be read to forbid is a paper check. This section moves the vote into the architecture. + +*Revised 2026-10-01: the two paragraphs that follow record reasoning that now lives in the bylaws (P1-001 v1.1 §3.4, §3.8, §3.9, §5.3). The amended text above no longer places the vote or fixes its weight; the architecture names the membership and the bylaws say where it sits.* + +Two federations rather than one, because the two things a prosumer has an interest in are held in two places: the covenant — the social contract that governs how it is treated in trade — and governance — the audit of the stack against the standard. Each prosumer places its vote where its interest lies. The bylaws carry the mechanics (recognition, election, the annual change) and the document carries only the structure. + +One vote per federation however large its roll is Shared Responsibility applied to weight: headcount decides within a federation and never beyond it, so no federation can be bought by recruitment. This last sentence of the amended text is severable; if the membership prefers to keep weight a bylaw matter, strike it and the rest stands. + +**Registry.** + +No registered invariant was anchored to the current sentence — the `GOV-*` identifiers were retired to the bylaws level on 2026-08-27 — so no anchor update under §9.16 is carried and no descendant identifier is issued. Proposed new invariants, bound to *instrument* (P1-001): + +- `GOV-prosumer-membership` — a prosumer of a federated platform may take up membership of the stewardship organization on the terms its bylaws provide. + +*Withdrawn 2026-10-01, before issue:* `GOV-federation-election` and `GOV-one-vote-per-federation`, proposed in the 2026-09-22 draft. The rules they would have bound are bylaw matters (P1-001 v1.1 §3.9, §3.8). Neither identifier was ever issued, so §9.16 does not reserve them. + +--- + +## Section 2 — Covenant layer *(severable)* + +**Current text.** + +> Exit here is dear. Being cast out of the covenant costs a prosumer the one thing that cannot be rebuilt quickly — the count of exchanges at each rating level, earned one witnessed exchange at a time. That price is why expulsion is adjudicated rather than assumed. When apparent breaches of the covenant occur, platform operators adjudicate between their prosumers; disputes that cross platforms are adjudicated at the witness layer. Adjudicators are rated on their conduct by both prosumers/operators involved — the referees stand inside the reputation system they enforce. + +**Amended text.** + +> Exit here is dear. Being cast out of the covenant costs a prosumer the one thing that cannot be rebuilt quickly — the count of exchanges at each rating level, earned one witnessed exchange at a time. That price is why expulsion is adjudicated rather than assumed. When apparent breaches of the covenant occur, platform operators adjudicate between their prosumers; disputes that cross platforms, and disputes between a prosumer and the operator of its own platform, are adjudicated at the witness layer — no operator adjudicates a dispute to which it is a party. Adjudicators are rated on their conduct by both prosumers/operators involved — the referees stand inside the reputation system they enforce. + +**Note on the target.** These sentences stood in the Covenant layer's orchestrator tier until the editorial revision of 2026-09-17, which moved them into the layer's own paragraph, where the exit cost that explains them is stated (PR #9), and wrote out "Economy & Information" in the tier they left (PR #13). The amendment is applied where the sentences now stand. Nothing of its substance turns on the move: the same two sentences are amended in the same way, and the orchestrator tier is left as the editorial revision leaves it. + +**Rationale.** + +The document named who adjudicates two of three cases. The third — a prosumer against its own operator — is the case that arises at the credit limit, at custody, and at the stage change, where the prosumer's exit is dearest; and the operator is not neutral in it by the document's own reasoning for cross-platform disputes. Because the document was silent, the bylaws may fill the gap without overriding it; naming the witness layer here nonetheless protects P1-001 §10.9 under §15.2 and lets the rule be registered as an invariant rather than carried as a bylaw alone. + +**Registry.** + +Proposed `COV-operator-dispute-witnesses` — a dispute between a prosumer and the operator of its own platform is adjudicated at the witness layer, never by that operator. Bound to *instrument* (P1-001 §10.9) and to *implementation* (a platform's dispute routing). Lineage: `COV-operators-adjudicate`, `COV-witness-adjudication`. + +--- + +## Section 3 — Conformance + +Run `python jfa-conformance-suite.py` against the amended text before the delegates' vote closes; the amendment is not adopted until it passes (§9.2). The registry changes above are made in the same act (§9.16); an identifier once issued is never reused. A failing run is entered in `OPEN-QUESTIONS.md` and stands as business in the Governance Federation Channel under §9.18 until resolved by repair of the suite or by amendment of the text. + +--- + +## Not amended, noted + +**Line 10.** The P1-001 v1.1 amendment adds ratification by the deployment's prosumers as a condition of a switch to *full* mutual credit (§11.1(d)). Line 10 states minimum conditions and is not crossed by an added one, so the Line is left as it stands. If the membership later judges that the ratification should bind every conforming implementation and not only the Institute's members, it belongs in Line 10 and comes back under §9.2. + +**Record layer, witness minimum.** Rotation of the standing witnesses, the third witness drawn per dispute, and the definition of independence are instrument-level (P1-001 §3.2(b), §3.10, §10.2, §10.9) and do not change the document's two-witness floor. + +**Structure article, "Between Federations."** The bylaws' appendix sources prosumer membership to this article, which is held in NTARI's document store and not published. Publish it, or fold its operative content into the amended Governance tier; a demand sourced to an unpublished paper is self-attested under §9.6. + +--- + +## Provenance of demands + +*Informative, not operative.* + +| Section | Demand | Source | +| --- | --- | --- | +| §1 | Where leaving is dear, members get a vote; the prosumer's exit is dear under sovereign, non-convertible credit | Official document, Principles (Institutional Discipline); Lines 2, 3 | +| §1 | The community that coordinates is the community that checks | Official document, Principles (Shared Responsibility); P1-001 §2.1 | +| §1 | Bylaws may not override the official document | P1-001 §15.2; §1.5 | +| §1 | Prosumer standing ripens into membership; the vote comes with it | P1-001 §3.8, §4.2; structure article, "Between Federations" (unpublished) | +| §1 | One vote per federation; headcount decides within and never beyond | P1-001 §3.4, §5.3 | +| §2 | No one is neutral in their own case | Official document, Covenant Layer (cross-platform reasoning); P1-001 §10.9 | +| §2 | A power names its check | P1-001 §2.2 | +| §3 | Registry changes are amendments; identifiers never reused; failing suite is business | P1-001 §9.2, §9.16, §9.18 | + +--- + +## Adoption record *(to be completed)* + +- Notice published to the Governance Federation Channel under §6.4: ________ +- Federation decisions under §6.5 — Substrate: ____ Record: ____ Covenant: ____ Governance: ____ E&I: ____ +- Delegates' vote under §9.2: ________ +- Conformance suite result against the amended text: ________ +- Registry changes recorded under §9.16: ________ +- Recorded in the governance registry under §9.5 (bootstrap act, if so): ________ + +--- + +*Network Theory Applied Research Institute, Inc. — EIN 92-3047136 — Louisville, Kentucky — * + +*Specification: CC BY-SA 4.0* diff --git a/OPEN-QUESTIONS.md b/OPEN-QUESTIONS.md index 610c0ae..a9e3484 100644 --- a/OPEN-QUESTIONS.md +++ b/OPEN-QUESTIONS.md @@ -2,7 +2,7 @@ The living open-questions document for the Janus Facing Architecture, per the practice carried forward in the [2026-08-24 concept triage](jfa-concept-triage-2026-08-24.md). A stale document here means the project has stopped describing itself honestly. Each entry carries a status and names the constraints it inherits. -Four entries carry open business: readmission after trust suspension (entry 7, resolved in draft pending adoption of the bylaws amendment), sybil resistance in the governance franchise (entry 8), residential substrate constraints (entry 9, resolved in draft with its confidential-execution part still open), and the pricing of the transport fee (entry 10). The rest were resolved as raised; their record follows. +Ten entries carry open business: readmission after trust suspension (entry 7, resolved in draft pending adoption of the bylaws amendment, with procedural points open), sybil resistance in the governance franchise (entry 8, priced in draft, its identity half open), residential substrate constraints (entry 9, resolved in draft, its confidential-execution part resolved 2026-10-07), the pricing of the transport fee (entry 10, its split and the operator's attestation resolved in draft), record permanence under paid storage (entry 11, resolved in draft), the public chain's construction and funding (entry 12, funding resolved in draft, construction open), witness adjudication against the operator (entry 13, rule and bench resolved in draft, procedure open), covenant exit and members' records (entry 14), line 9 and capacity (entry 15, pending Act 2), and information-reporting duties before counsel (entry 16, C-9). The rest were resolved as raised; their record follows. ## 1. Contestability @@ -58,11 +58,13 @@ Witnesses hold two jobs — record integrity and the neutral bench for cross-pla The dispute-mechanics design lets an adjudicator suspend a member's trust gate — they trade prepaid or collateralized "until the covenant readmits them." Resolved at the instrument level: readmission runs through the governance venue's appeal procedure, drafted as bylaws §2.9 (P1-001 v7.1 draft) — submission to the office of the Vice President with no PII, a one-week rating period in the appropriate Federation Channel where each member of the Vice President's circle may cast one rating on the offense, no readmission on a mode of −1, the Vice President's delegate deciding when no ratings are cast, and resubmission after a one-week cooldown. Banned operators re-enter by the same path. Final resolution follows adoption of the bylaws amendment by the membership. +**Superseded in draft (2026-10-02).** The procedure now stands in bylaws v1.1 §12.5 (draft): submission to the office of the Vice President; a one-week rating period in the concerned federation channel, administered by the office of the President; one rating each, a −1 carrying its comment; ratings, where cast, decide the petition — denied on a mode of −1, granted otherwise — and the federation's delegate decides only where no ratings are cast (principal's decision of 2026-10-02); resubmission after a ten-week cooldown; an appeal of expulsion decided within seven days. Open: (a) a tie for the mode that includes −1; (b) a challenge under §11.4, where the rated offense is the operator's, so that a −1 mode would deny the challenger rather than uphold the challenge; (c) a single rating, even the petitioner's own, now decides; (d) the seven-day limit cannot hold when the decision waits on a one-week rating period; (e) at the end of an expulsion term, no body sets the length of a further term, and the member's vote while the docket is pending is unstated; (f) "the concerned federation channel" is undefined; (g) whether a rating is a vote for §4.5 and §6.5. + **Inherits:** whether-vs-how-much (lines 8-9); trust suspension outcome (jfa-dispute-mechanics.md §4); appeals to governance venue. ## 8. Sybil resistance in the governance franchise -**Status:** open (2026-08-31) +**Status:** open (2026-08-31); priced in draft (2026-10-07), its identity half open Raised by the bylaws draft's extension of the vote in the Governance Federation Channel to prosumers (§4.2, §4.4). Eligibility is at least one sealed exchange committed to the public chain, which prices a manufactured voter at a real witnessed exchange rather than at nothing. It does not price one high enough: an operator can transact with itself at scale and mint eligible prosumers. The weight of that gap is unusual here because the channel's member roll is expected to stay very small — governance hosting has little reason to replicate beyond redundancy and geography — so the prosumer body is where the weight inside that channel sits, including the election and recall of the Vice President and the disposition of expulsion referrals. How far that weight travels beyond the channel is bounded by the delegate channel, below. @@ -74,32 +76,94 @@ Candidate directions, none adopted: witness-attested distinctness at the record What the gap can still reach is the Governance delegate itself, and with it the office of the Vice President and the disposition of expulsion referrals — the powers of Article XII rather than the powers of the membership. The bylaws draft also puts the amendment of the bylaws themselves within prosumer-member reach (bylaws §15.1), which is the one place the gap touches the structure rather than an office; whether that vote is cast directly or channeled through delegates is unsettled in the draft and is the open half of this question. The immediate recall of §6.8 is the standing check, and it is exercised by the same roll a sybil attack would have captured — which is the part that does not resolve itself. +**Priced in draft (2026-10-07).** The Act 1 amendment prices the franchise where the bylaws widen it. Recognition under §3.8 requires sealed exchanges with at least two distinct counterparties, which only doubles the price of a manufactured voter but stops the simplest pairs. §6.5 strikes the Governance federation's operating-member floor and puts a concurrent platform majority in its place for any federation with prosumer members: a matter carries only with a majority of the votes cast and a majority of the platforms whose prosumer members cast votes, each platform's position being the majority of its own prosumer members' votes — one member keeps one vote, operators lose a veto by abstention, and the price of capture moves from accounts to federated instances, each with independent witnesses of its own. §16.3 counts a Covenant or Governance federation toward the end of bootstrap only when its prosumer members come from at least two federated platforms run by different operators. §3.9 holds a member recognized again within a year of its lapse to the federation it held, closing the switch-by-lapse path. Under the federation election the prosumer-elected delegates reach two of five — the Covenant and Governance seats — which is what the platform majority now disciplines; the delegate paragraph above counted one of five before the election was seated. The §15.1 half is settled by its own text: every member of each federation votes within the federation, and the delegates carry the federations' decisions. What stays open is identity itself: the corpus still prices an account, not a person, and witness-attested distinctness remains undecided. + **Inherits:** privacy floor (line 7, entry 2); platform-scoped non-portable identifiers (bylaws §9.10(f)); one member, one vote (bylaws §3.4); recallable delegates, one per federation (bylaws §5.3); witness minimum (entry 4). ## 9. Residential substrate constraints -**Status:** resolved in draft (2026-09-08); part (c) open +**Status:** resolved in draft (2026-09-08); part (c) resolved in draft (2026-10-07) Raised by the Vice President in the board's September 2026 review of the official document: as a governance and system-specification instrument, the document does not address three physical risks of running substrate on consumer broadband — (a) residential connections carry dynamic addresses, sit behind carrier-grade NAT, and come with terms of service that bar inbound servers; (b) home bandwidth is asymmetric and capped, so heavy container layers and large datasets do not move well; (c) a host operator has physical possession of the machine and can read its memory, and consumer hardware carries no confidential-execution feature to prevent it. Decided: carrier constraints are treated as a physical, adversarial environment to be routed around in code, not a legal condition to be negotiated away. Lobbying may proceed as a civic matter but is never a dependency of the architecture. Routed at three levels. (a) Resolved in the document — the Substrate protocol tier now states that nodes join the market over encrypted overlays and outbound polling, without requiring open inbound ports or a static address, as the residential case of line 11; registered as SUB-no-inbound-requirement, implementation-bound. The reference protocol already has this shape: its node-side operations poll for work rather than listen. (b) Resolved by design posture in the substrate whitepaper ([P1-004](P1-004_Substrate-Constraints_v0.1.md)): protocol traffic is small by construction under line 7, work ships as sandboxed WebAssembly modules rather than container images, and jobs are spooled locally so a poor uplink delays work rather than losing it. (c) Open: the whitepaper argues for redundant execution across independent hosts with covenant-rated disagreement, plus data minimization, in place of any hardware-enclave requirement, and for attestation as an optional, rated, market-priced capability. Whether that position becomes a registered invariant (a candidate SUB-redundant-execution) is for the board under bylaws §9.16; until then it is argued, not bound. A residual legal question stands with it: whether compensated participation on a residential line engages the non-commercial prong of typical acceptable-use policies, which counsel should review beside the CHC pilot's business-use insurance question. +**Part (c) resolved in draft (2026-10-07).** The whitepaper's position is now the document's. The Substrate protocol tier states that substrate work is integrity-assured, not confidentiality-assured — a host can read what its node computes — and that work whose result settles a spend or enters the record runs on at least two independent hosts, their disagreement rated, never trusted; registered as SUB-redundant-execution, implementation-bound. The Economy & Information protocol tier now assumes the same of every host. Whoever enrolls a prosumer as a substrate host discloses both facts before enrollment (bylaws v1.1 §10.3, per P1-004 §5). The residual legal question moves to the counsel items of entry 16. + **Inherits:** no-chokepoint (line 11); privacy floor (line 7, entry 2); lean, auditable code (P-lean-code); witnessing as compensated substrate work (REC-witness-work, entry 6); document-amendment procedure (bylaws §9.2, §9.16); bootstrap recording (bylaws §16.1). ## 10. Pricing the transport fee -**Status:** open (2026-09-11) +**Status:** open (2026-09-11); the split resolved in draft (2026-10-01); the operator's attestation resolved in draft (2026-10-07) The Record layer now cites a third sovereign spend — the orchestrator's transport fee — escrowed with the trade and released by the same citation. That much is settled: the fee follows delivery, the orchestrator cannot release its own, and it settles in the home ledger so no value crosses a community boundary. What the fee *is* remains open. Whether it is a fixed offer or may be metered per byte, per hop or per witness. A fixed offer is legible and cheap to verify; metering prices a long carry honestly but gives the orchestrator a quantity it reports about itself, which is the shape the six-fold witnessing exists to avoid. -Whether a trade between prosumers of two communities splits the fee across both home ledgers or charges the initiating side. Splitting spreads the cost the way the benefit falls; charging the initiator keeps one settlement in one ledger and avoids a second escrow that can fail independently. +Whether a trade between prosumers of two communities splits the fee across both home ledgers or charges the initiating side. Splitting spreads the cost the way the benefit falls; charging the initiator keeps one settlement in one ledger and avoids a second escrow that can fail independently. **Resolved in draft (2026-10-01):** both home ledgers split the fee, each prosumer paying their share in their own unit; the official document's Record layer now says so, and stops counting spends: if delivery is not attested, every spend reverts. Whether the paid witnesses earn credit under this same six-fold rule, and if so who witnesses them. Applied naively the rule recurses without bottom. Either witnessing is compensated substrate work already covered by the existing record-layer provision, or it needs a terminating case that has not been written. -Whether the operator's witness slot is mandatory, given operators are insulated from the substrate by design. An operator that must attest to a carry it cannot observe is either rubber-stamping or reaching into a layer the architecture keeps it out of. +Whether the operator's witness slot is mandatory, given operators are insulated from the substrate by design. An operator that must attest to a carry it cannot observe is either rubber-stamping or reaching into a layer the architecture keeps it out of. **Resolved in draft (2026-10-07):** the operator holds no attestation slot — the Record layer now says delivery is attested by the witnesses alone, and the operator keeps its record of a carry and never attests to one. What the default commitment window is before escrow reverts. Too short and prosumer hardware with churn, sleep and relay fails honest carries; too long and capacity sits escrowed against a carry nobody will complete. **Inherits:** value stays home and cross-community exchange as paired sovereign spends (lines 3–5); privacy floor (line 7, entry 2); no chokepoint (line 11); witness minimum (entry 4); witnessing as compensated substrate work (entry 6). + +## 11. Record permanence under paid storage + +**Status:** resolved in draft (2026-10-01) + +Record permanence is bounded by paid storage. The record layer is compensated for its storage, so each holder's copy — prosumer, operator, witness, orchestrator — lasts as long as its bill is paid and ends with that holder's death or insolvency. Automation may extend some copies, but plausibly none lasts more than a few hundred years. The official document says what was committed "stays committed" (Record layer), and the dispute-mechanics design says defaults are "Recorded forever" (§5). Raised by the principal on 2026-09-30 as not necessarily a defect; the wording should match the mechanism. + +**Resolved in draft (2026-10-01):** the official document's Record layer now says that nothing is erased but no single copy is the record, names each copy's lifetime — the orchestrator's with the last paid carry, the witnesses' while the operator pays them, the parties' own until they stop keeping them, the chain's while its storage is funded — and claims for the chain only what its funding supports; the dispute-mechanics design's "Recorded forever" is reworded to match. Who funds the chain, and for how long, is settled under entry 12. + +**Inherits:** append-only record (line 6); positions and history survive any frontend (line 12); six holders (REC-six-holders); record-keeping as compensated substrate work (REC-witness-work, entry 6); defaults annotated, never erased (dispute-mechanics design §5). + +## 12. The public chain: construction, funding and lifetime + +**Status:** funding resolved in draft (2026-10-01); construction open + +The corpus fixes the chain's topology — one append-only sequence of salted hashes, types, timestamps and references, distributed across the substrate, serving everyone who holds no record of their own, and binding cross-community spends (line 5) — but not its construction: how entries are ordered, who may append, how append rights are rationed, and what happens under partition are in none of the official document, the registry, the dispute-mechanics design or this record. The Record curriculum article names the gap and makes the construction decision the Record group's first deliverable. Nor did the corpus say who pays for the chain's storage or how long it lasts: the Record frontend tier makes storage a market, "compensating the prosumers who keep the record", without naming the buyer. + +Decided by the principal on 2026-10-01: the commitments of every exchange carried by an orchestrator are copied to the chain and stored on substrate that the stewardship organization of the Governance layer funds — in NTARI's instance, the Institute, under bylaws §9.19 — so that the record which binds communities to one another is paid for by none of them. The official document's Record layer now says so, and claims for the chain only the lifetime its funding supports. + +Open: (a) construction, within line 11 (no chokepoint), line 7 (no identities) and P-lean-code — the Byzantine-agreement setting the curriculum article lays out; (b) how the Institute buys substrate storage without holding credit (bylaws §9.7) — whether the storage market takes exogenous money for this service, or the Institute funds the buyers; (c) what the funding must look like to satisfy bylaws §13.1 and §13.3 — the entries are also held by the six parties and any other party may fund storage of the same chain, so the Institute's withdrawal must cost the record nothing; (d) resolved (2026-10-02): commitments of exchanges no orchestrator carries are stored by no one, because a frontend that is not federated is not a member; the bylaws draft no longer assigns them. + +**Inherits:** cross-community exchange bound by the chain (line 5); append-only (line 6); privacy floor (line 7, entry 2); no chokepoint (line 11); public-chain record topology (REC-public-chain); lean, auditable code (P-lean-code); the Institute's money is not the federation's (bylaws §9.7); self-binding and succession (bylaws §13.1, §13.3); sybil resistance (entry 8); record permanence (entry 11). + +## 13. Witness adjudication against the operator + +**Status:** rule resolved in draft (2026-10-02); the bench resolved in draft (2026-10-07); procedure open + +Decided by the principal on 2026-10-02: a dispute between a prosumer and the operator of its own platform is ruled on by witnesses, never by the operator. The official document's Covenant layer and bylaws §10.9 now say so, and the dispute-mechanics design's §3 carries the case. An earlier draft's third witness, drawn at random for each dispute so the bench would be odd and partly unknown to the operator in advance, was not carried; it rests on undecided rules for witness independence and the witness draw. + +Raised by the verification of that decision and open: (a) neutrality — the witnesses are paid by the operator they now judge, their copies of the record last while it pays them, and it rates them as a party, so the bench's pay, evidence and part of its reputation sit with the respondent; "independent" is nowhere defined; (b) a split bench — the minimum bench is two and nothing says what a one-to-one split yields; (c) filing — the design gives standing to record holders of an exchange and its filing commitment references an exchange, but custody, the credit limit and Article X duties need not involve one; (d) the dispute window — under bylaws §10.5 the operator's own rules set it for disputes against itself; (e) execution — the operator runs the ledger and executes every remedy, including one against itself, with no stated consequence if it does not; (f) forum — a prosumer contesting its own operator's switch to mutual credit is sent both to the witnesses (§10.9) and to the federation's ratings (§11.4, §12.5); (g) recusal — nothing stops a party from rating or voting on its own referral or petition in a federation; (h) discipline — witnesses are rated, but no text gives those ratings any effect on assignment. + +**The bench resolved in draft (2026-10-07).** The rules the dropped third witness waited on are decided in the Act 1 amendment. Independence is defined (bylaws v1.1 §3.10): not the operator, not under common ownership or control with it, holding no interest in it, and not a prosumer of the platform; a party is ineligible for any draw while the mode of its adjudication-conduct ratings is −1, which also gives the conduct ratings their first effect on assignment — answering (h). The draw is seeded from a public-chain block hash so anyone can verify it, and the operator pays the substrate market, which assigns and pays the witnesses, so the bench's pay no longer sits with the respondent — answering (a); registered as REC-witness-draw (lineage REC-witness-work). Standing seats are staggered two-year terms, one redrawn each March equinox, so a platform always keeps one witness who saw its history. The drawn third seat returns as the only neutral tie-break: a split bench is answered by a witness drawn for the dispute alone, paid only when a dispute arises — a bench of three for a dispute with one's own operator, five across platforms — answering (b). Still open: (c) filing without an exchange, (d) the dispute window where the respondent's own rules set it, (e) execution of a remedy against the operator, (f) the forum overlap between §10.9 and §11.4, and (g) recusal. + +**Inherits:** cross-platform witness adjudication (COV-witness-adjudication, entry 6); witness minimum (REC-witness-minimum, entry 4); witnessing as compensated substrate work (REC-witness-work); witness assignment by verifiable draw (REC-witness-draw); adjudicators rated (COV-adjudicators); escrow custody disclosed (bylaws §10.2 Custody); line 10. + +## 14. Covenant exit and members' records + +**Status:** open (2026-10-07) + +The August correction gave each layer its exit cost, and the document now prices leaving the covenant for a member. What it does not reach: whether a community that leaves the covenant may federate with its members' records. The records survive any operator (line 12) and what crosses communities is recorded truth (line 4), but no text says whether a departed community's instance — no longer conformant, no longer recognized — can carry its members' histories into a new federation, or what a member's standing in that history is when the community that held it has left the covenant behind. + +**Inherits:** exit costs by layer (Principles); value stays home, only truth crosses (line 4); positions and history survive (line 12); conformance and the name (bylaws §9.6). + +## 15. Line 9 and capacity + +**Status:** open (2026-10-07), pending Act 2 of the amendment plan; contested + +Line 9 sizes credit with one community-wide limit, set by the operator and never derived from reputation. The durable mutual credit systems the follow-up research examined size credit by capacity, which a single number cannot: it holds the members who supply the most to the same ceiling as those who supply the least. Act 2 of the amendment plan proposes a community-wide rule in place of the single number — one published formula applied to everyone, reading only record structure on the same platform, capped at a published multiple of a base limit, the extension at the operator's election. Contested: colluding members can trade in a ring to inflate volume, where a single number cannot be gamed at all; the proposal answers with the cap, the trailing window, the fees on every exchange, and the published default rate. Nothing moves until Act 2's deliberation. + +**Inherits:** whether-vs-how-much (lines 8–9, L9); community-wide limit (bylaws §10.2 Credit Setting, §9.10(e)); defaults annotated and the rate published (bylaws §10.2). + +## 16. Information-reporting duties (counsel item C-9) + +**Status:** open (2026-10-07), with counsel + +Line 2 keeps credit unredeemable; it does not put an operator outside information-reporting law. In the United States, a platform on which members trade with one another may be a barter exchange, and barter exchanges report members' transactions on identified forms. Line 7 bars identity from the shared record, not from an operator's own erasable records, so the two can coexist: any such duty is met from the operator's own records, never by placing identity in the shared record. Sent to counsel as C-9, beside C-4 on custody and money transmission, together with the residential acceptable-use question of entry 9 and the heat-and-compute pilot's insurance questions. This is a question for counsel, not a legal finding; the duty is adopted with counsel's reading (amendment plan, Act 2 item 2.3). + +**Inherits:** credit never redeemable (line 2); privacy floor (line 7, entry 2); operator duties (bylaws §10.2); the Institute's money is not the federation's (bylaws §9.7). diff --git a/janus-facing-architecture.md b/janus-facing-architecture.md index ec73c8c..07e31fd 100644 --- a/janus-facing-architecture.md +++ b/janus-facing-architecture.md @@ -2,23 +2,29 @@ ## Introduction -Janus Facing Architecture — named for the Roman god who looks in two directions at once, just as every economic participant faces demands for both production and consumption — allows communities to address the economic reality of prosumership. Every member of an economy is not just a consumer, but a prosumer (Toffler, 1980), simultaneously producing something of value even if all they have to offer is time. It also provides an option to transform the issuance model from exogenous, chartal money (issued by an authority outside the community) to endogenous mutual credit (issued by members to one another as they transact). +Every member of an economy is a **prosumer** — not only a consumer, but at the same time a producer of something of value, even if all they have to offer is time (Toffler, 1980). Nobody stands on only one side of a trade; the two faces are the same person. + +Janus Facing Architecture is named for the Roman god who looks in two directions at once, because that is what every prosumer does: each faces demands for both production and consumption, at the same time. It allows communities to address the economic reality of prosumership, and provides an option to transform the issuance model from exogenous, chartal money — issued by an authority outside the community (Knapp, 1924) — to endogenous mutual credit, issued by members to one another as they transact (Moore, 1988; Greco, 2009). The name's second face is political. Acemoglu and Robinson (2019) show that liberty survives only inside a narrow corridor where a capable state — the Leviathan — is matched by a society equally capable of checking it. Outside the corridor the Leviathan takes its other forms: absent, and coordination fails; despotic, and the coordinator dominates the coordinated; paper, and the checks exist in writing but not in effect. Staying inside the corridor demands what they call the Red Queen effect: state and society running together, each growing capacity because the other does. Every economic platform is a Leviathan in miniature — it coordinates, enforces and records — and today's dominant platforms are despotic by construction, evolving at network speed while the institutions meant to check them move at the speed of meetings. -NTARI's research locates this failure in infrastructure itself. Deliberative systems are material culture: a platform's architecture materializes a theory of who may know and who may decide, and the prevailing broadcast architectures treat participants as passive recipients (NTARI, 2025b). The resulting velocity gap is structural — information moves at network speeds while democratic synthesis stays locked to electoral cycles synched by a postal clock (NTARI, 2025a). JFA is built to close that gap from inside: the community that coordinates is the community that checks, the two capacities exchanged continuously in the same software at the same speed, disciplined layer by layer by the cost of leaving. It is a shackled Leviathan in code. +NTARI's research locates this failure in infrastructure itself. Deliberative systems are material culture: a platform's architecture materializes a theory of who may know and who may decide, and the prevailing broadcast architectures treat participants as passive recipients (NTARI, 2025b). The resulting velocity gap is structural — information moves at network speeds while democratic synthesis stays locked to electoral cycles synched by a postal clock (NTARI, 2025a). JFA is built to close that gap from inside, disciplined layer by layer by the cost of leaving. It is a shackled Leviathan in code. The Janus Facing Architecture (JFA) is organized into five functional layers — Substrate, Record, Covenant, Governance, and Economy & Information (E&I) — each implemented in three tiers: the frontend — for prosumer collaboration; the orchestrator — a backend providing overlapping coordination across geographic communities; and the underlying protocol — the pattern for securely handling data across tiers. -JFA software is designed for release and management in a copyleft environment, generally the GNU Affero General Public License, allowing new frontends, federations, protocols and architectures to evolve in the global market, forming a free software commons. +JFA software is designed for release and management in a copyleft environment, generally the GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later), allowing new frontends, federations, protocols and architectures to evolve in the global market, forming a free software commons. This is the official document, stewarded by Network Theory Applied Research Institute, Inc. Prior instruments are preserved in [Historical Docs](Historical%20Docs/); concepts carried from them are recorded in the [concept triage](jfa-concept-triage-2026-08-24.md); what remains unresolved is named in [OPEN-QUESTIONS.md](OPEN-QUESTIONS.md). +## Why This Matters + +Every system that coordinates people exercises power over them, whether it means to or not. That is not a defect; coordination requires it. But power stays healthy only when something checks it — not a check on paper, but real people with real stake, close enough to act. Most platforms now move at the speed of the network while everything built to hold them accountable moves at the speed of meetings, and a check that arrives late is not a check at all. JFA's answer is to stop treating coordination and accountability as two systems: same software, same people, same speed. + ## Principles **Shared Responsibility.** The community that coordinates the economy is the same community that checks the coordination. The two functions are exchanged continuously — never split into rulers and ruled. -**Institutional Discipline.** Each layer is disciplined by the cost of leaving it: where leaving is cheap, competition disciplines; where leaving is dear, members get a vote; where leaving is impossible, decisions stay open to challenge. +**Institutional Discipline.** Each layer is disciplined by the cost of leaving it — what a member forfeits by walking out, and what a community forfeits by casting someone out. Where leaving is cheap, competition disciplines: the Substrate and Economy & Information layers. Where leaving is dear, members get a vote: the Covenant and Governance layers. Where leaving is catastrophic, decisions stay open to challenge: the Record layer. Each layer names its own cost below, because that cost is what decides how a fight there gets settled. **Lean, auditable code.** Protocol software stays small, depends on nothing but its language's standard library, and is auditable whole. @@ -26,31 +32,37 @@ This is the official document, stewarded by Network Theory Applied Research Inst This is the hardware where everything happens, owned by prosumers of CPUs, GPUs, printers, storage and sensors. +Exit here is cheap, and a carrier's refusal costs a prosumer nothing but a connection. An orchestrator that refuses to carry your capacity has not taken your hardware, your balances or your history, and another orchestrator is one published offer away. Quarrels at this layer are therefore not adjudicated: a carry that goes unattested inside its commitment window simply reverts, nobody rules on it, and a carrier that refuses or fails too freely is undercut rather than appealed to. + ### Protocol Tier Exchanges instructions and orders across a distributed compute/storage market operated on consumer grade computers hosted in homes, offices and storage, as well as repurposed industrial equipment. Nodes join that market over encrypted overlays and outbound polling, without requiring open inbound ports or a static address; the connection as a residential provider ships it is enough. Line 11 depends on this: a substrate that ran only where a provider permits inbound service would carry a chokepoint at every provider. +Substrate work is integrity-assured, not confidentiality-assured: a host can read what its node computes. Work whose result settles a spend or enters the record runs on at least two independent hosts, and their disagreement is rated, never trusted. + ### Orchestrator Tier Federated prosumer compute power creating more options across geography. Orchestrators publish transport offers into the substrate market, each naming a fee, a delivery commitment and a public key; any platform may select any reachable orchestrator, so a dominant carrier is undercut rather than regulated. Transport is delivery, not execution: an orchestrator carries signed spends to the witness set and returns attestations, is never relied upon to determine whether an exchange occurred, and may be lossy and retry-based. ### Frontend Tier -E&I interface for prosuming compute/storage. +Economy & Information interface for prosuming compute/storage. ## Record Layer -A compensated function of the substrate, recording and serving dialog between E&I and Covenant layers for the public. +A compensated function of the substrate, recording and serving dialog between Economy & Information and Covenant layers for the public. + +The record of what happened is held by six parties: the two prosumers to the exchange, the operator, the orchestrator, and two witnesses each keep a record of their own. The hashes are also committed to one public chain, distributed across the substrate — the record for everyone who holds none of their own. The commitments of every exchange carried by an orchestrator are copied to the chain and stored on substrate funded by the stewardship organization of the Governance layer, so the record that binds communities to one another is paid for by none of them. The chain is append-only: harm is forgiven by annotation, never by erasing. A platform must have at least two independent witnesses; with fewer, a deployment must label itself unfederated. Witnesses are assigned by a draw seeded from the public chain, which anyone can verify, and are paid by the substrate market, never by the operator they observe. -The record of what happened is held six ways. Each party to a transaction keeps a record of their own; the operator keeps its own; two witnesses keep their own; and the hashes are committed to one public chain, distributed across the substrate — the record for everyone who was neither transactor, witness, nor operator. The chain is append-only: harm is forgiven by annotation, never by erasing. A platform must have at least two independent witnesses; with fewer, a deployment must label itself unfederated. +Nobody can be deleted from the record, and leaving it is catastrophic. What was committed is never erased, but no single copy is the record, and each copy lasts only as long as it is kept: the orchestrator's with the last paid carry, the witnesses' while their storage is paid, the prosumers' and operator's own until they stop keeping them, and the chain's for as long as its storage is funded. The record survives in whichever copies remain; the chain is stored by the substrate rather than by the operator, so it can outlive the operator, the frontend and the quarrel, and what it carries past every holder is the fact of commitment, not the content. Because nothing can be deleted from the record, no finding here is ever final: a disputed entry is answered by annotation, and the annotation is as permanent as the entry it answers. -A cross-community exchange remains two sovereign spends. The citation that settles it carries a third: the orchestrator's transport fee, escrowed with the trade at initiation and released by that same citation. Release is joint and all-or-nothing — if delivery is not attested within the offer's commitment window, all three spends revert — and the orchestrator's own attestation does not count toward the threshold that releases its own fee. The fee settles in the home ledger of the prosumers whose capacity was carried; it does not cross a community boundary. The credit it earns is held the same six ways, cited by key. +A cross-community exchange remains two sovereign spends. The citation that settles it carries the orchestrator's transport fee as well, escrowed with the trade at initiation and released by that same citation. Release is joint and all-or-nothing — if delivery is not attested within the offer's commitment window, every spend reverts — and the orchestrator's own attestation does not count toward the threshold that releases its own fee. The fee is split between the home ledgers of the two prosumers whose trade was carried, each paying its share in its own unit; nothing crosses a community boundary. The credit it earns is held by the same six parties, cited by key. Delivery is attested by the witnesses alone; the operator keeps its record of a carry and never attests to one. ### Protocol Tier -Captures, categorizes and hashes each transmission within the stack in order to establish reputation through the covenant layer and establishing the basis of an exchange medium through E&I. +Captures, categorizes and hashes each transmission within the stack in order to establish reputation through the covenant layer and establishing the basis of an exchange medium through Economy & Information. ### Orchestrator Tier @@ -58,35 +70,41 @@ Federates records across geography enabling shared reputation and exchange. What ### Frontend Tier -Compensated compute/record service provided by prosumers on the substrate layer E&I. +The buying and selling of record storage across the substrate, compensating the prosumers who keep the record. ## Covenant Layer A social contract enforced in code, informing flexible expectations for prosumer interactions. +Exit here is dear. A prosumer barred from a platform keeps the record of every rating they earned there — six parties hold it — but the standing it carries does not follow them by default: on the next platform, the count of exchanges at each rating level is rebuilt one witnessed exchange at a time. That price is why a bar rests on adjudicated evidence rather than an operator's word. When apparent breaches of the covenant occur, platform operators adjudicate between their prosumers; disputes that cross platforms, and disputes between a prosumer and the operator of its own platform, are adjudicated at the witness layer — no operator adjudicates a dispute to which it is a party. Wherever adjudication occurs, the parties to it rate the adjudicator — the operator between its own prosumers, the witnesses otherwise — so the referees stand inside the reputation system they enforce. + +Because exit is dear, members vote here: the Covenant federation votes on conceptual and programmatic changes to the covenant (the Leveson-Based Trade Assessment Scale, LBTAS), its API and its orchestration, and commissions formal studies of the chosen covenant's effects on its users. + ### Protocol Tier A simple assessment, written in executable code for prosumers to rate interactions with one another across the stack. ### Orchestrator Tier -An API serving compliant assessments across the E&I markets of the stack from substrate prosumers. When apparent breaches of the covenant occur, platform operators adjudicate between their prosumers; disputes that cross platforms are adjudicated at the witness layer. Adjudicators are rated on their conduct by both prosumers/operators involved. +An API serving compliant assessments across the Economy & Information markets of the stack from substrate prosumers. ### Frontend Tier -The E&I interface where the API is served. +The Economy & Information interface where the API is served. ## Governance Layer This is where and how humans assemble to collaboratively act on the stack. +Exit here is dear, and this is the only layer where expulsion reaches the software itself: a member expelled from the Institute loses, for a bounded term, the vote that shapes what everyone else runs. So expulsion is never an operator's decision — it is referred to the Governance federation and decided by its members' vote under the bylaws, on the record. + ### Protocol Tier Nonprofit, copyleft software stewardship organization. ### Orchestrator Tier -Membership in the Network Theory Applied Research Institute, obtained by operating a federated instance of JFA software. +Membership in the Network Theory Applied Research Institute, obtained by operating a federated instance of JFA software or by participating as a prosumer on a federated platform. ### Frontend Tier @@ -94,25 +112,27 @@ The synchronous/asynchronous coordination of members governed by the organizatio ## Economy & Information Layer -The E&I layer is hosted on substrate, syndicated with the record layer, and facilitates covenant compliance. +The Economy & Information layer is hosted on substrate, syndicated with the record layer, and facilitates covenant compliance. + +Exit here is cheap by construction. An operator may bar a prosumer from its platform but not from what they built there: positions and history survive any frontend, so the barred leave with their record intact and their balances still owed. A bar is a loss of market, not a loss of standing — and an operator whose terms or credit limit drive prosumers out loses the trade rather than winning the argument. ### Protocol Tier -Each economic or information platform has a protocol designed for the exchange taking place (i.e. agriculture, a game or research citations). +Each economic or information platform has a protocol designed for the exchange taking place (i.e. agriculture, a game or research citations). Each assumes that any substrate host can read what it computes. ### Orchestrator Tier -E&I must run on revokable hardware obtained and recorded by the substrate layer. A platform needs no orchestrator of its own: it selects one from the substrate market and pays transport out of the trade +Economy & Information must run on revokable hardware obtained and recorded by the substrate layer. A platform needs no orchestrator of its own: it selects one from the substrate market and pays transport out of the trade ### Frontend Tier -Frontend designs for E&I platforms must be customizeable by the user. +Frontend designs for Economy & Information platforms must be customizeable by the user. ## The Lines That Cannot Be Crossed A build that crosses any of these is not a smaller JFA; it is different software wearing the name. -1. Money is created at the moment of exchange — one balance down, one up, always summing to zero. +1. Every credit is an IOU, created at the moment two members trade — one balance down, one up, always summing to zero. That is the only way money comes into being: nothing is minted, nothing is issued from outside, and nothing accrues as interest. 2. Credit is earned, never bought, and never redeemable for fiat. 3. Each community's currency is sovereign — no shared unit, no conversion between communities. 4. Value stays home; only truth crosses. @@ -121,7 +141,7 @@ A build that crosses any of these is not a smaller JFA; it is different software 7. No narratives, no identities in the shared record — hashes, types, timestamps and references only. 8. Reputation is never one number — what others see is the count of exchanges at each rating level. 9. Reputation decides whether a member trades on trust; a community-wide limit, set by the operator and never derived from reputation, decides how much. -10. A deployment begins in escrow — collateralized, no negative balances, no counterparty credit extended — and switches to a hybrid or full mutual credit system only after the operator builds capacity, the prosumer network is notified, and the local authorizations to provide mutual credit services are published to the governance layer — or, where the jurisdiction requires none, a finding to that effect is published there instead. +10. A deployment begins in escrow — collateralized, no negative balances, no counterparty credit extended — and switches to a hybrid or full mutual credit system only after the operator builds capacity, the prosumer network is notified, and the local authorizations to provide mutual credit services are published to the governance layer — or, where the jurisdiction requires none, a finding to that effect is published there instead — and a switch to full mutual credit is ratified by the deployment's prosumers. 11. No single host, account, or vendor whose removal could stop the network. 12. A member's positions and history survive any frontend; a community's records survive any operator. @@ -129,6 +149,12 @@ A build that crosses any of these is not a smaller JFA; it is different software Acemoglu, D., & Robinson, J. A. (2019). *The Narrow Corridor: States, Societies, and the Fate of Liberty*. Penguin Press. +Greco, T. H. (2009). *The End of Money and the Future of Civilization*. Chelsea Green Publishing. + +Knapp, G. F. (1924). *The State Theory of Money*. Macmillan. (Original work published 1905) + +Moore, B. J. (1988). *Horizontalists and Verticalists: The Macroeconomics of Credit Money*. Cambridge University Press. + Network Theory Applied Research Institute. (2025a, October). *Addressing democratic information velocity* (P1-002). https://www.ntari.org/post/ntari-whitepaper-addressing-democratic-information-velocity Network Theory Applied Research Institute. (2025b, June). *The material culture of democratic deliberation*. https://www.ntari.org/post/the-material-culture-of-democratic-deliberation @@ -139,4 +165,4 @@ Toffler, A. (1980). *The Third Wave*. William Morrow. *Network Theory Applied Research Institute, Inc. — 501(c)(3) — EIN 92-3047136 — info@ntari.org* -*Software: AGPL-3.0 · Specification: CC BY-SA 4.0* +*Software: AGPL-3.0-or-later · Specification: CC BY-SA 4.0* diff --git a/jfa-conformance-suite.py b/jfa-conformance-suite.py index b7cf0b6..a38f180 100644 --- a/jfa-conformance-suite.py +++ b/jfa-conformance-suite.py @@ -97,28 +97,39 @@ # Substrate layer — the residential posture Invariant("SUB-no-inbound-requirement", "substrate", "without requiring open inbound ports or a static address", "implementation", "node tests: a node registers, heartbeats, polls for work and reports over outbound connections only - no listening port, no static IP, behind NAT/CGNAT and dynamic addressing; the residential case of L11 (new 2026-09-08)"), + Invariant("SUB-redundant-execution", "substrate", "runs on at least two independent hosts", + "implementation", "substrate tests: work whose result settles a spend or enters the record executes on at least two independent hosts and their disagreement is rated, never trusted; integrity-assured, not confidentiality-assured (open question 9(c) resolved; new 2026-10-07)"), # Record layer — the topology - Invariant("REC-six-holders", "record", "held six ways", - "implementation", "record tests: each transactor, the operator, and both witnesses keep records beside the chain (was REC-four-holders; recounted 2026-08-27)"), + Invariant("REC-six-holders", "record", "held by six parties", + "implementation", "record tests: each of the two prosumers, the operator, the orchestrator, and both witnesses keep records beside the chain (was REC-four-holders; recounted 2026-08-27; orchestrator added and anchor retracked 2026-09-30)"), Invariant("REC-public-chain", "record", "one public chain distributed across the substrate", "implementation", "record tests: single public chain on substrate serving non-parties (reverses old 9.3)"), Invariant("REC-truth-not-currency", "record", "never a currency unit", "implementation", "federation tests: what crosses record communities is reputation and history only"), Invariant("REC-witness-minimum", "record", "label itself unfederated", "implementation", "deployment tests: an operator platform with fewer than two independent witnesses forces the unfederated label (was 8.3; reworded 2026-08-25)"), - Invariant("REC-witness-work", "record", "compensated compute/record service provided by prosumers", - "implementation", "substrate tests: record-keeping and witnessing assigned as compensated substrate work (reworded 2026-08-27)"), + Invariant("REC-witness-work", "record", "compensating the prosumers who keep the record", + "implementation", "substrate tests: record-keeping and witnessing assigned as compensated substrate work (reworded 2026-08-27; anchor retracked to the frontend market wording 2026-09-17)"), + Invariant("REC-witness-draw", "record", "assigned by a draw seeded from the public chain", + "implementation", "record tests: witness assignment by a draw seeded from a public-chain block hash, verifiable by anyone; the substrate market pays the witness, never the operator observed (lineage REC-witness-work; new 2026-10-07)"), # Covenant layer - Invariant("COV-adjudicators", "covenant", "rated on their conduct by both prosumers", - "implementation", "covenant tests: adjudication conduct ratable by both parties (was 7.2-adjudicator-rated)"), + Invariant("COV-adjudicators", "covenant", "the parties to it rate the adjudicator", + "implementation", "covenant tests: adjudication conduct ratable by the parties to the adjudication - the operator on a platform, the witnesses across platforms (was 7.2-adjudicator-rated; anchor retracked 2026-09-30)"), Invariant("COV-operators-adjudicate", "covenant", "platform operators adjudicate between their prosumers", "implementation", "dispute tests: adjudication of apparent covenant breaches performed by platform operators (new 2026-08-25)"), Invariant("COV-witness-adjudication", "covenant", "adjudicated at the witness layer", "implementation", "dispute tests: cross-platform disputes adjudicated by the exchange's witnesses (new 2026-08-25)"), + Invariant("COV-operator-dispute-witnesses", "covenant", "no operator adjudicates a dispute to which it is a party", + "instrument", "P1-001 §10.9 routes a prosumer's dispute with its own operator to that platform's standing witnesses; dispute tests: a platform's routing never seats an operator on its own case (new 2026-09-22; lineage COV-operators-adjudicate, COV-witness-adjudication)"), # Governance and E&I operational detail (delegates/recall, reopening decided # matters, operator economic management, the hybrid definition) moved to the # bylaws and companion-article level on 2026-08-27; GOV-delegates, GOV-reopen, # EI-operator-economy and EI-hybrid are retired from this registry. + # Governance layer — membership and the franchise, returned to the document + # on 2026-09-22 because a vote resting on an instrument the architecture can + # be read to forbid is a paper check (amendment of 2026-09-22, §1). + Invariant("GOV-prosumer-membership", "governance", "by participating as a prosumer on a federated platform", + "instrument", "P1-001 §§3.3, 3.8: a prosumer of a federated platform may take up membership of the stewardship organization on the terms its bylaws provide (new 2026-09-22)"), # The lines that cannot be crossed Invariant("L1", "lines", "always summing to zero", "implementation", "economy tests: each exchange moves two balances netting to zero (was 7.1-zero-sum)"), @@ -139,7 +150,7 @@ Invariant("L9", "lines", "set by the operator and never derived from reputation", "implementation", "boundary tests: one uniform limit per operator community, set by that operator; never per-member, never derived from reputation (was 9.5; operator-set 2026-08-25)"), Invariant("L10", "lines", "published to the governance layer", - "instrument", "escrow switch to hybrid or full mutual credit gated by operator capacity, prosumer-network notice, and published local authorizations to provide mutual credit services, or a published finding that none is required (was 8.7; regated 2026-08-25; review->authorization 2026-08-31; null case 2026-08-31)"), + "instrument", "escrow switch to hybrid or full mutual credit gated by operator capacity, prosumer-network notice, and published local authorizations to provide mutual credit services, or a published finding that none is required; a switch to full mutual credit further ratified by the deployment's prosumers (was 8.7; regated 2026-08-25; review->authorization 2026-08-31; null case 2026-08-31; ratification 2026-10-07)"), Invariant("L11", "lines", "whose removal could stop the network", "implementation", "deployment tests: participant-owned hardware; no hosting chokepoint (was 8.1)"), Invariant("L12", "lines", "survive any frontend", @@ -164,8 +175,10 @@ LINE_COUNT = 12 # Product names must not appear anywhere: the document is product-agnostic. +# LBTAS is the covenant, not a product, and may be named wherever the Covenant +# layer label would otherwise be undefined (principal's decision, 2026-09-30). PRODUCT_NAMES = ["Sohocloud", "SoHoLINK", "Cloudy", "Slack", "Discord", "Mycelium", - "LBTAS", "Agrinet", "NTARI/OS", "GitHub", "Wix", "Fruitful"] + "Agrinet", "NTARI/OS", "GitHub", "Wix", "Fruitful"] # Concepts the 2026-08-24 triage retired or reversed; their anchor phrases # must NOT reappear in the document. diff --git a/jfa-dispute-mechanics.md b/jfa-dispute-mechanics.md new file mode 100644 index 0000000..87b109f --- /dev/null +++ b/jfa-dispute-mechanics.md @@ -0,0 +1,75 @@ +# JFA Dispute Mechanics — Design + +*Adopted 2026-08-25; revised 2026-10-07 to carry the September–October amendments: six record holders with the orchestrator, witness adjudication against one's own operator, and the witness draw. Subordinate to the official document ([janus-facing-architecture.md](janus-facing-architecture.md)); where the two disagree, the official document governs. Decisions recorded here were made by NTARI stewardship; the constraints each part inherits are cited by suite registry ID.* + +## 1. The frame: operator responsibility, market discipline + +Responsibility for managing each platform's economy and information exchange rests on its **operator**. The operator runs the ledger, adjudicates covenant breaches between its prosumers, executes remedies, annotates defaults, sets its community-wide credit limit (L9), and publishes its economy's trailing default rate. Apart from the limit, which the official document binds in line 9, these economic-management duties are bylaws-level obligations: the 2026-08-27 revision moved them out of the official document and into the governing bylaws. + +The checks on the operator are not institutional routing but the architecture's own market machinery: + +- Every filing lands on the public chain the moment it is made, so a complaint can never be quietly buried at intake. +- Every adjudication is rated by the parties to it (COV-adjudicators), and those ratings accumulate into a **publicly displayed adjudication reputation** — shown as the count of outcomes at each rating level, never one number (L8 applies to operators too). +- Leaving an operator is cheap, so competition disciplines (the cost-of-leaving principle): prosumers weigh an operator's adjudication reputation, credit limit, and default rate when choosing where to trade. + +## 2. Filing + +**Who may file.** Any record holder of the exchange: either transactor, the operator, the orchestrator, or a witness. (A witness who spots tampering can file; a stranger to the exchange cannot.) + +**What lands on the chain.** Two commitments, and only two: the **filing** (at the moment it is made) and the **resolution** (when decided). Each is structural facts and hashes only — exchange reference, dispute type, timestamps, party references, and the salted hash of the underlying material (L7: no narratives, no identities). The story — evidence, statements, the dialog itself — stays in the six holders' own records: the two prosumers, the operator, the orchestrator, and the two witnesses. + +**When.** Each E&I category protocol sets its own dispute window — produce disputes close in days; research-citation disputes may stay open for years. Where a category protocol is silent, the operator's platform rules set the default window, consistent with the operator-responsibility frame. + +## 3. Adjudication + +**Same platform.** The platform operator adjudicates between its prosumers (COV-operators-adjudicate). + +**Cross-platform.** When the transactors are on different platforms, the dispute is adjudicated at the **witness layer**: the independent witnesses who hold records of the exchange decide it (COV-witness-adjudication). This is one reason the two-witness minimum (REC-witness-minimum) is load-bearing — witnesses are not only integrity checks but the neutral bench for disputes no single operator should judge. + +**Against one's own operator.** A dispute between a prosumer and the operator of its own platform is adjudicated by that platform's witnesses; no operator adjudicates a dispute to which it is a party (in NTARI's instance, bylaws §10.9). + +**Witness assignment.** Witnessing is a function of the substrate: it is assigned as compute work through the substrate market, and the prosumers who perform it are paid for it (REC-witness-work). Standing witnesses are assigned by a draw seeded from a public-chain block hash, so anyone can verify the assignment, and are paid by the substrate market, never by the operator they observe: the operator pays the market for witnessing as a service, and the market assigns and pays the witnesses (REC-witness-draw). Each standing seat is held for two years; the two seats are staggered so that one is redrawn each March equinox, and a platform always keeps one witness who saw its history. A witness must be independent of the platform it observes — not the operator, not under common ownership or control with it, holding no interest in it, and not a prosumer of the platform — and is ineligible for any draw while the mode of its adjudication-conduct ratings is −1 (in NTARI's instance, bylaws §3.10). A witness's neutrality comes from the assignment being verifiable substrate work rather than a party's choice. + +**The bench.** A dispute between a prosumer and the operator of its own platform is heard by three: the platform's two standing witnesses and a third witness drawn for the dispute alone, by the same verifiable draw, paid through the market only when a dispute arises. A dispute that crosses platforms is heard by five: the two standing witnesses of each platform and one drawn seat. The drawn seat is the only neutral tie-break a split bench has — every default except a fresh draw favors one side, since the operator is the respondent and holds the funds — and rotation changes who witnesses, never how many. + +**Rating the adjudicator.** Wherever adjudication occurs, the parties to it rate the adjudicator: between its own prosumers, the operator; across platforms or against the operator, the witnesses. The rating enters the adjudicator's public distribution like any other covenant assessment. + +## 4. Outcomes + +All outcomes land as **annotation, never erasure** (L6). Four remedies are available: + +1. **Rating annotation** — the disputed exchange's rating is corrected or contextualized on the record. The baseline remedy. Final. +2. **Restitution** — a compensating mutual-credit transfer from the party at fault, within the community-wide limit; in escrow, restitution is made from the held escrow (below). Final. +3. **Trust suspension** — the trust gate closes for the party at fault; they trade prepaid or collateralized until the covenant readmits them. Appealable. +4. **Expulsion referral** — for grave breaches, the adjudicator refers expulsion to the governance layer. Expulsion suspends a member's vote for a bounded term; operators and witnesses never expel, only governance does. Appealable. + +An operator's **bar** — ending a prosumer's activity on its own platform — is not a remedy of adjudication. It rests on at least three adjudicated −1 ratings, attached as evidence (in NTARI's instance, bylaws §12.3(b)). + +**In escrow.** Where a deployment operates in escrow, a −1 rating on an exchange holds that exchange's escrow for adjudication. The adjudication may return all or part of the amount to the consumer, deliver all or part of the payment to the producer, or divide it between them. Whoever adjudicates is rated on the adjudication, and an operator adjudicating between its own prosumers receives its payment regardless of outcome. Where the operator is itself a party, the platform's witnesses adjudicate (§3). + +**Appeals.** Annotation and restitution are final — the adjudicator's public rating is the check. Trust suspension and expulsion referral may be appealed to the governance venue, under the procedure the governing instrument provides. (In NTARI's instance, bylaws §12.5 governs, including its ten-week cooldown before resubmission.) + +## 5. Defaults and the hole + +In mutual credit, a member who leaves with a negative balance leaves a hole: live claims in the community now exceed live promises. The design handles it by containment and visibility, not pretense: + +- **Recorded, never erased.** The defaulted balance stands on the chain, annotated, never erased, for as long as the chain's storage is funded and any holder keeps a copy. Its truth follows the member wherever recorded truth travels. +- **Annotated by kind.** *Deceased*, *departed*, *adjudicated*, or *unknown* — a death carries no reputational meaning; a walk-away is signal. Same permanence, different meaning. +- **Capped.** The community-wide limit (L9) — one number for everyone, set by the operator, never derived from reputation — is precisely the most any single member's disappearance can cost the community. +- **Measured as a flow, not a stock.** The operator publishes the **trailing default rate**: dead credit created over a recent rolling window, as a share of trade volume. A cumulative tally grows scarier every decade while meaning less; the rate stays comparable forever and is the dial-reading an operator uses to tune the limit. It is the community's inflation gauge, and — published — part of how operators compete. +- **No architectural levy.** No reserve or insurance is required at the architecture level. A community that wants to mutualize default losses may build a reserve in its own covenant; currencies are sovereign, so the choice stays home. + +## 6. Record protocol requirements + +Two schema requirements fall out of this design: + +- **Dispute commitments.** The Record protocol carries two dispute commitment types — filing and resolution — each holding structural facts and hashes only, referencing the disputed exchange. +- **Salted hashes.** Every transmission is hashed with a random salt held in the parties' own records. Hashes are one-way, but a short, predictable transmission (a rating, a price) could otherwise be guess-matched against the public chain by hashing likely candidates; the salt makes every public hash unguessable. Verification is unchanged: a holder produces content plus salt, and anyone can check the pair against the chain. + +## 7. Registry hooks + +Suite IDs binding this design: COV-operators-adjudicate, COV-witness-adjudication, COV-adjudicators, L6 (annotation), L7 (structural facts only), L8 (distribution display), L9 (operator-set limit), REC-witness-minimum, REC-six-holders, REC-public-chain, REC-witness-work (assignment as compensated substrate work), REC-witness-draw (the verifiable draw; the market pays, never the operator observed). (Operator economic management beyond the limit is a bylaws-level obligation as of 2026-08-27 and no longer carries a registry ID.) Implementation test suites for a record, covenant, or economy repo should cite these IDs; until they do, conformance with this design is self-attested. + +--- + +*Network Theory Applied Research Institute, Inc. — info@ntari.org* diff --git a/jfa-structure-article.md b/jfa-structure-article.md new file mode 100644 index 0000000..53faa8e --- /dev/null +++ b/jfa-structure-article.md @@ -0,0 +1,111 @@ +# Five Layers, Twelve Lines: The Shape of the Janus Facing Architecture + +*Network Theory Applied Research Institute — August 2026* + +The Janus Facing Architecture (JFA) is named for the Roman god who embodied the concept of looking in two directions at once — just as every economic participant faces both production and consumption. Every member of an economy is not just a consumer but a *prosumer* (Toffler, 1980), simultaneously producing economic value even if all they have to offer is time. Software built on this observation cannot split a person into a producer and a consumer identity. That is the name's first face. The second face is political, and it is the reason the architecture looks the way it does. + +## The corridor and the Red Queen + +In *The Narrow Corridor* (2019), Daron Acemoglu and James Robinson argue that liberty is not a natural condition but a narrow corridor a society has to fight its way into and fight to stay inside. Their Leviathan — Hobbes's name for the state — comes in forms. The Absent Leviathan cannot coordinate or protect anyone. The Despotic Leviathan coordinates by dominating. The Paper Leviathan has the org charts of a state and none of the capacity. Liberty exists only under the fourth form, the Shackled Leviathan: strong enough to coordinate, shackled by a society strong enough to check it. And staying there is never settled. The Red Queen effect — named for the queen who tells Alice she must keep running just to stay in place — demands that state and society grow together, each expanding its capacity because the other does. When one side outruns the other, the corridor is lost. + +Why does a software architecture open with political theory? Because every platform is a Leviathan in miniature: it coordinates supply and demand, enforces rules, and keeps the record. The dominant platforms of the present economy are despotic by construction — the operator holds the market, the money rail, and the record, while members hold nothing but an account. And the institutions meant to shackle them are failing the Red Queen's race. NTARI's whitepaper on democratic information velocity documents the mismatch: platforms evolve at internet speeds while democratic institutions evolve at meeting schedules, a velocity gap that lets concentrated power accumulate faster than society's capacity to check it. NTARI's study of the material culture of democratic deliberation traces that failure into the tools themselves: deliberative infrastructure is material culture — the way a spear encodes assumptions about hunting, a governance platform encodes assumptions about who may know and who may decide — and the prevailing architectures encode broadcast: information flowing one way, citizens as passive recipients, synthesis locked to electoral cycles at postal speed. + +The answer is to stop trying to shackle the Leviathan from outside. If the check must run as fast as the coordination, the check has to live in the same being. With the internet and telecommunications, a community that coordinates the economy can be the same community that checks the coordination, the two roles exchanged continuously between individual members. A shackled Leviathan, in code — built to run the Red Queen's race at the Red Queen's speed. + +## An Internal Currency System + +Most money is exogenous and chartal — issued by a central authority and imported into communities through banks to facilitate local transactions (Knapp, 1924). Credit is distributed in the same fashion: even the credit union, the most local and member-owned form of capital disbursement, is exogenous at bottom — it lends out the chartal currency concentrated by particular communities, and it prices its trust with credit scores, judgments produced by monitoring individuals and cast from afar. Cryptocurrency, for all its innovation, did not address this issue, only relocating it from central banks to the owners of mining hardware. JFA lets a community transform the issuance model to endogenous mutual credit: money issued by members to one another as they transact (Moore, 1988; Greco, 2009). At the moment of exchange, one balance goes down and one goes up, and the two always sum to zero. Credit is issued only for value provided; it is earned, never bought, and never redeemable for fiat. There is no external issuer and no interest at any stage. Nothing is held in reserve once a deployment reaches full mutual credit — the escrowed cold start described below is the deliberate exception. + +The money rules come with a deliberate cold start: a new deployment begins in escrow — collateralized, no negative balances, no trust extended — and switches to a hybrid system or full mutual credit only after the operator builds capacity, the prosumer network is notified, and the local authorizations to provide mutual credit services are published to the governance layer — or, where the jurisdiction requires none, a finding to that effect is published there instead. The hybrid stage is exactly what it sounds like: escrow and mutual credit run across the same system, and each prosumer decides which they accept. + +## Nine decades of evidence + +Mutual credit is not a thought experiment. It has one of the longest, best-documented track records of any alternative monetary design — and the recurring finding is not merely that these systems survive, but that they stabilize. + +An analysis in *Nature Human Behaviour* of 1,477 member firms and 48,170 transactions form Sardinia's Sardex mutual credit network found that trade in the network is organized around geodesic cycles — credit flowing in loops and returning to where it began — which is precisely the circulation geometry a zero-sum currency needs to remain liquid without an issuer (Iosifidis et al., 2018). Sardinia's entire island territory is ~9,300 sq. miles, representing not just a typical urban city, but the suburban, rural and industrial assets of a functional economic region. + +The Swiss WIR, founded in 1934 by businesses frozen out of Depression-era bank credit, has operated continuously for more than ninety years and grew into a network of tens of thousands of small and mid-sized firms. WIR turnover is strongly countercyclical, rising when the Swiss economy contracts, because cash-short firms economize by trading on mutual credit instead — a spontaneous stabilizer credited with helping secure Swiss employment through downturns (Stodder, 2009). The follow-up study found the stabilization operates through both balances and velocity: the money moves fastest exactly when the wider economy needs it most (Stodder & Lietaer, 2016). This is the mirror image of fiat credit, which is procyclical — banks lend freely in booms and withdraw in busts. Mutual credit runs the other way. The benefit of having these opposing monetary algorithms is obvious — fiat and mutual credit systems can exist independent of one another, but together provide liquidity options in shifting trust environments. + +The Republic of Ireland ran an accidental national-scale experiment. Industrial disputes closed the Irish banks three times between 1966 and 1976 — for six months in 1970 — cutting the economy off from most of its money supply. It kept growing. Firms and households traded on uncleared cheques underwritten by personal knowledge of the drawer, with publicans and shopkeepers acting as informal credit assessors (Murphy, 1978). A community issued its own credit, peer to peer, on local reputation — the covenant's premise, run at national scale by accident. + +The evidence extends to where money is scarcest. Kenya's Sarafu community inclusion currency scaled to roughly 55,000 accounts and some 300 million Sarafu in recorded transactions through the COVID-19 shock of 2020–2021, with the complete anonymized transaction record published as open research data (Mattsson, Criscione & Ruddick, 2022) — mutual credit functioning as economic infrastructure precisely when national currency stopped circulating in its communities. + +Swiss business, a Sardinian exchange, an accidental Irish experiment, a Kenyan aid network: the common finding is that endogenous credit holds up exactly when exogenous money fails. What every one of these systems also shares is a central operator its members simply had to trust — WIR became a bank, Sardex is a company, Sarafu runs on a foundation's platform. JFA keeps the economics the evidence supports — zero-sum issuance, credit limits, managed defaults — and removes the leap of faith: the record outlives every operator, reputation travels without permission, and the operator itself is rated, published, and cheap to leave. + +## The grid: five layers, three tiers + +The stack is five functional layers — Substrate, Record, Covenant, Governance, and Economy & Information (E&I) — each implemented in three tiers: the **frontend**, for prosumer collaboration; the **orchestrator**, a backend providing overlapping coordination across geographic communities; and the underlying **protocol**, the pattern for securely handling data across tiers. + +**Substrate** is the hardware where everything happens — CPUs, GPUs, printers, storage and sensors owned by prosumers, running on consumer-grade computers in homes, offices and storage as well as repurposed industrial equipment. Its protocol exchanges instructions and orders across a distributed compute/storage market; its orchestrator federates prosumer compute power, creating more options across geography; its frontend is the E&I interface for prosuming compute and storage. Nodes join the market over encrypted overlays and outbound polling — no open inbound port, no static address — so a home connection as the provider ships it is a full participant. One constraint governs the layer: it must have no single host, account, or vendor whose removal could stop the network, and the outbound posture is what keeps that true across residential providers. + +**Record** is a series of distributed, compensated functions of the substrate, conserving hashes of the dialog between the E&I and Covenant layers for public record. The record of what happened is held six ways: Each party to a transaction keeps a record of their own; the operator keeps its own; two witnesses keep their own; and hashes are committed to one public chain, distributed across the substrate. Six holders, one truth. The chain is append-only: harm is forgiven by annotating, never by erasing. + +The protocol tier captures, categorizes and hashes each transmission in the stack — establishing reputation through the Covenant layer and the basis of truth as an exchange medium in E&I. Only hashes reach the chain; the content stays with the parties — no narratives, no identities in the shared record. The orchestrator federates records across geography, enabling shared reputation and exchange — and what federation shares is recorded truth, reputation and exchange history, never a currency unit. + +**Covenant** is the social contract enforced by the governance in code, informing expectations for prosumer interactions. Prosumers rate their interactions as they generate hashable transmissions through interaction; the orchestrator is an API serving compliant assessments across the stack's markets; the frontend is any E&I interface where the API is served. Two rules keep reputation honest. First, reputation is never one number: what others see is the count of exchanges at each rating level, so one bad outcome cannot hide inside a good average. Second, reputation answers exactly one question — how does this prosumer perform within the social covenant of the network? How much credit they may draw is a community-wide limit set by the platform operator, one number for everyone, never derived from reputation. Merged, the two would recreate the credit score, which is the thing the covenant exists to replace. When apparent breaches in covenant occur, platform operators adjudicate between their prosumers; disputes that cross platforms go to the exchange's witnesses. Adjudicators are rated on their conduct by both prosumers involved — the referees are inside the reputation system too. + +**Governance** is how humans collaborate on building and maintaining the stack. The protocol is a nonprofit steward of copyleft software; the orchestrator is membership obtained by operating a federated instance of JFA software; the frontend is the synchronous/asynchronous coordination of members governed by the organization's bylaws. + +**Economy & Information** is hosted on record layer substrate, and facilitates covenant compliance. Each economic or information platform has a protocol designed for its specific kind of exchange — agriculture, games, research citation — and its own frontend, customizable by the user; membership in the governance layer is what orchestrates them, and every platform runs on revokable hardware obtained and recorded by the substrate layer. Each platform's operator manages the economy it hosts — setting its credit limit, one number for everyone, which prosumers can weigh when choosing where to trade; the operator's remaining economic duties live in the bylaws. + +## Between Federations + +Members operate software speaking the same protocol, recorded on substrate rented from the community, with different frontend features to support prosumers. Together they troubleshoot bugs, navigate security, innovate on the shared protocol, and find ways to expand the market. Members are organized by the layer(s) they operate addressing any issues within their layer's stack and adhering to the GNU Affero General Public Licensing requirement to publicly publish changes to the source code. This is steamlined by good governance. + +Each federation's currency is sovereign — no shared unit, no conversion. When two communities trade, the exchange is two sovereign spends bound atomically by the public chain. Because nothing redeemable ever crosses federations, there is nothing to transmit and nothing to clear. + +Exit is protected the same way. A member's positions and history survive any frontend; a community's records survive any operator. The mechanism is the record topology itself: the public chain plus the per-party records mean no operator holds anything hostage. Underneath it all runs one disciplining rule: each layer is governed by the cost of leaving it. Where leaving is cheap, competition disciplines; where leaving is dear, members get a vote; where leaving is impossible, decisions stay open to challenge. + +## The twelve lines + +These twelve properties are required of the JFA stack. +1. Money created only at the moment of exchange, summing to zero. +2. Credit earned, never bought, never redeemable for fiat. +3. Sovereign currencies, no shared unit, no conversion. +4. Value stays home; only truth crosses. +5. Cross-community exchange bound atomically by the public chain. +6. The record append-only — forgive by annotating, never by erasing. +7. No narratives, no identities in the shared record. +8. Reputation never expressed in one number. +9. Reputation decides *whether*; a community-wide limit set by the operator decides how much. +10. Deployments begin in escrow and earn their way to mutual credit through operator capacity and a regulatory review published to the governance layer. +11. No single point whose removal stops the network. +12. Every member's positions and history survive any frontend, every community's records survive any operator. + +A build that violates any of these is not a different JFA stack. It is different software. + +## Legibility, mechanized + +The architecture's openness is not left as a promise. The official document ships beside an executable conformance suite that verifies the document itself — its nine sections, the three tiers in every layer, the twelve lines, and the presence of every registered invariant in the exact section that carries it. The suite maintains a registry of twenty-six invariants; twenty-three can only be enforced by tests living beside running code or a governance instrument, and the suite confirms this, labeling them unbound rather than pretending to check them. It also checks that retired concepts stay retired. A claim of conformance without tests citing the registry IDs is named what it is: self-attested. + +The software stack is licensed under the GNU Affero General Public License; the specification under Creative Commons Attribution–ShareAlike. Both are copyleft: anyone may build new frontends, federations, protocols and architectures from them, and what they build stays open. + +## Sources + +Acemoglu, D., & Robinson, J. A. (2019). *The Narrow Corridor: States, Societies, and the Fate of Liberty*. Penguin Press. + +Greco, T. H. (2009). *The End of Money and the Future of Civilization*. Chelsea Green Publishing. + +Iosifidis, G., Charette, Y., Airoldi, E. M., Littera, G., Tassiulas, L., & Christakis, N. A. (2018). Cyclic motifs in the Sardex monetary network. *Nature Human Behaviour*, 2(11), 822–829. + +Knapp, G. F. (1924). *The State Theory of Money*. Macmillan. (Original work published 1905) + +Mattsson, C. E. S., Criscione, T., & Ruddick, W. O. (2022). Sarafu Community Inclusion Currency 2020–2021. *Scientific Data*, 9, 426. + +Moore, B. J. (1988). *Horizontalists and Verticalists: The Macroeconomics of Credit Money*. Cambridge University Press. + +Murphy, A. E. (1978). Money in an economy without banks: The case of Ireland. *The Manchester School*, 46(1), 41–50. + +Network Theory Applied Research Institute. (2025a, October). *Addressing democratic information velocity* (P1-002). https://www.ntari.org/post/ntari-whitepaper-addressing-democratic-information-velocity + +Network Theory Applied Research Institute. (2025b, June). *The material culture of democratic deliberation*. https://www.ntari.org/post/the-material-culture-of-democratic-deliberation + +Stodder, J. (2009). Complementary credit networks and macroeconomic stability: Switzerland's Wirtschaftsring. *Journal of Economic Behavior & Organization*, 72(1), 79–95. + +Stodder, J., & Lietaer, B. (2016). The macro-stability of Swiss WIR-Bank credits: Balance, velocity, and leverage. *Comparative Economic Studies*, 58(4), 570–605. + +Toffler, A. (1980). *The Third Wave*. William Morrow. + +--- + +*The official document and conformance suite are stewarded by the Network Theory Applied Research Institute, Inc., a 501(c)(3) — info@ntari.org. This article describes the architecture; it never governs it.*