EN中文ESRUIDPT
Launch App

The Reference

The canonical document for understanding how the system works, why it is built this way, and what it can and cannot promise.

Contents

The Monetary Problem

Everyone uses money. Almost no one understands how it extracts from them. This section explains why the money you hold today fails three basic tests — and why every existing alternative fails at least one.

Money as extraction

Money is supposed to be a tool. For most people, it is a tax. Not metaphorically — literally. There are four mechanisms by which the monetary system transfers wealth from holders to issuers, and all four are active in every fiat currency on Earth.

Seigniorage. When a government prints money, it acquires real goods and services in exchange for paper or pixels that cost almost nothing to produce. The difference between face value and production cost is profit to the issuer. In 2024, the Federal Reserve remitted approximately $90 billion to the US Treasury from its portfolio earnings — earnings generated by assets purchased with money created at zero marginal cost. None of that profit went to dollar holders.

The Cantillon effect. New money does not enter the economy evenly. It enters through banks, asset markets, and government contractors first. Those who receive it first spend it before prices rise. Those who receive it last — wage workers, pensioners, anyone holding cash — spend it after prices have already adjusted. During the 2020–2021 COVID stimulus programs, M2 money supply expanded by 40% in eighteen months. Asset prices surged. Wages lagged by two years.

Censorship. In August 2022, the US Treasury designated Tornado Cash as a sanctioned entity. Within 48 hours, Circle froze every USDC address associated with the protocol. This was not a court order. It was a corporate response to an administrative designation. If your money can be frozen by a single email from a regulator to a single company, you do not own money. You hold a permission that can be revoked.

Volatility. For the 1.4 billion people without access to stable banking, cryptocurrencies promised an alternative. But Bitcoin's 60-day volatility regularly exceeds 50%. For someone living on $5 per day, a 50% drawdown is not investment risk. It is catastrophe. Volatility prices the poor out of monetary participation.

The stablecoin illusion

Stablecoins were supposed to solve this. USDC, USDT, and their cousins offer dollar parity without bank intermediation. But the stability is borrowed, not earned. USDC maintains its peg by holding dollar-denominated reserves — and those reserves can be frozen, seized, or politicized. The Tornado Cash precedent proved that USDC is not collateral in any meaningful sense.

The three necessities

Any monetary system that claims to serve ordinary people must satisfy three tests. These are functional requirements, not ideological preferences.

DING. Predictable purchasing power. A currency that loses 10% of its value in a month is not a currency. It is a speculative asset.

Accessible. Available to anyone with a phone, regardless of nationality, credit history, or government permission. The 1.4 billion unbanked adults are not unbanked because they are irresponsible. They are unbanked because the institutions that serve the wealthy do not find them profitable.

Credible. The rules must be enforceable by code, not by promise. No single actor can change them unilaterally. Credibility must be earned through architecture.

No existing instrument achieves all three. Bitcoin is accessible and credible but unstable. CBDCs are stable and accessible but censored. Stablecoins are stable and accessible but not credible — the collateral can be frozen. The protocol is designed to hit all three by building credibility into the architecture itself.

Why existing alternatives fail

The Mundell-Fleming trilemma states that a country cannot simultaneously maintain a fixed exchange rate, free capital movement, and independent monetary policy. The protocol faces a different trilemma: stability, accessibility, credibility.

Bitcoin chose accessibility and credibility. But without stabilization, its price is determined by speculative demand. For a Salvadoran street vendor, a 20% weekly swing is eviction.

CBDCs chose stability and accessibility. But the same institution that issues the currency controls the ledger, freezes accounts, and monitors transactions. A CBDC is a surveillance instrument with a payments interface.

Algorithmic stablecoins tried to choose all three. Terra/Luna collapsed in May 2022, wiping out $45 billion in 72 hours. The failure was a flaw in the economic model: the system depended on continuous demand growth to maintain its peg. The protocol learns from this by using overcollateralized collateral rather than endogenous algorithmic backing, and by capping bond liabilities at 20% of supply.

The protocol does not claim authority the Outer Space Treaty does not provide. It provides the coordination infrastructure that the treaty promised but no one built.

The treaty gap

In 1967, 114 nations signed the Outer Space Treaty. Article I declares space "the province of all mankind." Article II prohibits national appropriation. These are binding international law, ratified by virtually every spacefaring and non-spacefaring nation. But the treaty has no implementing body. No court enforces benefit-sharing. No mechanism distributes revenue. For fifty-seven years, the OST has been a promise without a post office.

In 2020, the United States wrote the Artemis Accords — a bilateral framework that lets extraction companies claim celestial resources without specifying how the benefits reach "all countries." Forty nations have signed. The Accords establish extraction rights while deliberately omitting benefit-sharing. This is strategy, not carelessness.

The legal principle at stake is first in time, first in right. Once extraction occurs under the Artemis framework, challenging it requires state-to-state action. By then, it is established practice. The window to establish an alternative framework is still open. It will not stay open.

Digital corpus possesendi

The protocol's legal architecture is called digital corpus possesendi — a plural legal framework that does not depend on any single tradition. It draws on five bodies of law, not because all five are necessary, but because a protocol recognized in one tradition can continue operating even if challenged in another.

Roman law usufruct. The right to use and profit from property you do not own, provided you preserve its substance. This maps directly onto the OST's non-appropriation principle. The protocol's revenue waterfall is a usufructuary structure. The Protocol Treasury holds and invests. The DIWAN Treasury distributes. Neither claims ownership of the celestial body.

Islamic waqf and mudarabah. The waqf is an irrevocable charitable endowment. Mudarabah is profit-sharing finance. The protocol's citizen distribution and treasury structures mirror these: the commons fund is effectively a waqf for humanity, and extraction partnerships operate on mudarabah-like terms.

Chinese tianxia. A non-territorial governance order based on benevolent administration and tributary reciprocity, not sovereignty claims. The protocol does not claim sovereignty over space. It claims administrative coordination. This is not semantics. Sovereignty claims trigger Article II disputes. Administrative coordination does not.

African ubuntu. The principle that personhood is constituted through relationship, and that legal authority derives from community recognition rather than top-down decree. The protocol's governance model — where legitimacy comes from participation and staking — echoes this structure.

Indigenous relationality. The Seven Generations principle: decisions must be evaluated by their impact on descendants seven generations hence. This maps onto the protocol's intergenerational equity constraints and the permanent abundance ratchet. The velocity cap in Phase 5 is a Seven Generations commitment encoded in code.

Jurisdictional diversification

The protocol's survival does not depend on US regulatory tolerance. Three jurisdictions provide structural alternatives:

Brazil. Law 14.478/2022 (Marco Legal das Criptomoedas) establishes a federal framework for crypto asset custody, exchange, and payment. Banco Central's sandbox regime has approved multiple stablecoin pilots. The 1988 Constitution's social order provides a constitutional hook for inclusive monetary instruments. Structural reference: PIX provides last-mile distribution infrastructure for Phase 3 citizen distribution.

Russia. Federal Law 259-FZ and CBR cross-border crypto settlement pilots demonstrate structural demand for non-dollar settlement rails. The CBR's 2024–2025 cross-border stablecoin pilot with Belarus and Kazakhstan proves non-USD settlement infrastructure is being built whether the protocol exists or not.

China. The e-CNY is a surveillance instrument, not a model. But Chinese capital control architecture creates precisely the demand the protocol serves: censorship-resistant, non-USD stable value storage. The tianxia monetary order provides the conceptual frame. Axiomatic convention in protocol documentation signals cultural fluency: "It is an objective fact that monetary systems serve those who issue them. The protocol unswervingly pursues an alternative."

The structural result: a US ban does not terminate operation. No single court has global jurisdiction to enjoin the protocol. No single regulator can freeze the collateral. The legal architecture is designed for survival through redundancy, not immunity.

Protocol Mechanics

This is not a whitepaper of aspirations. It is a specification of mechanisms. Every design choice has a suppression-scenario rationale and a failure-mode justification.

Engineering specifications, not moral claims

The standard is not perfection. It is best implementable — the most credible and resilient monetary system buildable with current technology, institutional capacity, and political reality. The question is not "what would perfect money look like?" It is "what can we actually build, deploy, and defend?"

The design principle is natural constraints over privileged logic. Every mechanic is evaluated against one question: does this create a natural constraint encoded in tokenomics, or does it require privileged contract logic? If the latter, it is simplified or eliminated.

The dual-token architecture

DING. Price-stable money for everyday transactions. Elastic supply. No governance rights. Minted by depositing collateral. Burned to reclaim value. Its purpose is to be boring. If DING is exciting, the design has failed.

MULKI (MULKI). Fixed supply of 21 million. Non-inflationary. Voting rights. Staking multiplier. Used as collateral when minting DING. The protocol never sells MULKI tokens. MULKI power cannot be bought from the issuer.

The dual-treasury separation

Protocol Treasury. The investment reserve. Holds USDC, extractive equity, and eventually celestial revenue claims. Takes risk for return. Never touches the peg directly.

DIWAN Treasury. The buyer of last resort. Holds the 61% of MULKI allocated at genesis as minting reserve. Intervenes in crises. Makes credible commitments because it has no risk appetite.

The separation is structural. If the investment arm and the backstop arm were the same pool, the backstop could be gambled away. This is what destroyed Terra. The Protocol Treasury cannot spend DIWAN Treasury funds. The DIWAN Treasury cannot invest in risky assets. The wall is contractual, not administrative.

How the money breathes

Above the peg: Users create DING by depositing USDC and MULKI at the current collateral ratio. If CR is 90%, depositing $0.90 of USDC and $0.10 of MULKI mints 1.00 DING. Supply expands. No lockup. No KYC. No permission.

Below the peg: Users buy bonds by burning DING. Supply contracts. Bonds are sold through a Dutch auction that descends from PAR+10% to PAR over 24 hours. Highest-interest bonds are redeemed first. Crisis buyers are rewarded structurally.

The gap between creation fee and bond yield is the monetary policy. No committee sets it. The market finds equilibrium.

The bond mechanism has a hard 20% ceiling: total bonds cannot exceed 20% of circulating DING supply. When the cap is hit, auctions pause. This cannot be overridden by governance. It is mathematics, not policy.

Redemption and the self-healing loop

Standard redemption: burn 1 DING, receive USDC and MULKI at the current collateral ratio. This contracts supply and raises CR. If many users redeem simultaneously, the redemption fee rises and bond auctions activate.

MULKI-only redemption: burn 1 DING, receive only MULKI. More expensive but preserves USDC in the Protocol Treasury. The system sacrifices governance tokens to protect collateral reserves. Naturally limited because MULKI has fixed supply.

The redemption fee is CR-gated and flat-tiered: above 98% CR the fee is 0.1%, between 95% and 98% it is 0.3%, between 90% and 95% it is 0.5%, and below 90% it is 1.0%. The fee is predictable and bounded. Simplicity is a security feature. Complexity is an attack surface.

The CR-confidence feedback loop

The protocol interrupts dangerous feedback through three mechanisms. The bond ceiling prevents runaway liability growth. MULKI-only redemption allows sacrificing MULKI rather than USDC. The DIWAN Treasury's standing commitment creates a price floor for confidence. The result is a bounded feedback loop rather than an explosive one.

The AMM and price discovery

The protocol uses a constant-product AMM for the DING/USDC pair, providing liquidity, price feed, and intervention mechanism. In Phase 4, the Protocol Treasury can direct surplus USDC into the AMM to buy DING below peg. The price is on-chain, manipulation-resistant, and visible to everyone.

MULKI: unified pool, natural transition

One unified voting pool. No separate houses. No founder veto. Treasury tokens vote alongside staked user tokens. As circulating supply grows, treasury influence declines automatically. Founders' influence decays at 10% per annum. Staked tokens earn 2x voice multiplier; unstaked receive 0.5x.

The LLM delegate. At Phase 4, the Protocol Treasury is governed by a three-model LLM consensus executing a constitutional prompt. Specifies: solvency first, stability second, equity third. Prohibits: inflation without collateral, bond restructuring, Phase 5 reversion. Three independent models must agree. The LLM has defensive veto authority, not proposal authority.

The Anonymous Developer Federation. No corporate entity. No single repository owner. Cryptographic attestation without identity. Multi-sig signers under non-US legal structures. Emergency pause decentralized across three layers. If you cannot find the developers, you cannot coerce them.

The five phases

Every transition is triggered by verifiable milestones. Automatic, transparent, and irreversible. The phases are not suggestions. They are encoded in contract logic.

Phase 1: USDC Anchor. Fully collateralized 1:1 with USDC. Boring by design. Founder-seeded liquidity on Shadow Exchange. A fully functional stablecoin with no bond mechanism or fractional reserve. The only requirement for Phase 2 entry is a governance vote at 60% threshold with a 7-day timelock.

Phase 2: The Trial. Collateral ratio begins to decrease from 1:1, with the bond mechanism activating to absorb peg pressure. CR descends through four trial steps: 0.97 (60% vote, 7-day timelock), 0.95 (65% vote, 14-day timelock), 0.93 (70% vote, 21-day timelock), and 0.90 (75% vote, 30-day timelock). A 180-day observation period ensures stability at each step. If the bond ceiling is reached and the peg remains below $0.95 for 30 days, the system stays in Phase 2. No automatic dissolution. No death spiral.

Phase 3: Citizen Distribution. Seigniorage surplus flows to enrolled citizens via a hard-coded 50/50 split: half to the citizen's wallet, half to the partner government treasury. This split is not adjustable by governance. Entry requires CR at 0.90 (completion of Phase 2 trial) and a 75% governance vote with 30-day timelock. Three-key custody with MPC threshold signing. Enrollment opens May 1 of the partner nation's adoption year — a timing cue that signals the operational calendar is not Washington's calendar.

Phase 4: CPI Index. The revenue waterfall becomes operational: debt service first, peg defense second, citizen distribution third. The LLM constitutional delegate activates. Phase 4 entry requires 67% solemnity.

Phase 5: Celestial Network. Terminal state. When celestial revenue exceeds terrestrial for 180 consecutive days with an upward trajectory, the abundance ratchet engages permanently. Phase 5 entry is irreversible. The code for reversion does not exist. Credibility from impossibility, not authority.

The protocol as trusted intermediary

Beyond the monetary system, the protocol functions as a voluntary clearinghouse with five-condition atomic settlement, flock privacy through Merkle batching, on-chain reputation, and express clearance at 0.5% fee. Revenue splits 80% to DIWAN Treasury, 20% to staked governance from Phase 3 onward.

The valley model: bootstrap economics

Phase 1 is the valley floor: fully collateralized, boring, functional. Phase 2 is the valley walls: controlled deleveraging with bond-based stabilization. Phase 3 is the valley exit: citizen distribution creates network effects by enrolling populations rather than individuals. The protocol front-loads stability and back-loads growth.

Inclusivity by design

Three-key custody. MPC primary key on the user's device. Shamir backup split among three trusted contacts. Biometric fallback for device loss. Designed so illiterate users under threat of theft, confiscation, and coercion can recover funds.

ROSCA infrastructure. Rotating savings and credit associations — susu in West Africa, chit fund in India, arisan in Indonesia, pasanaku in Bolivia — formalized through smart contract escrow. Used by over 11% of adults in developing economies.

Commitment savings. Time-locked goals with 3–5% APR from Protocol Treasury surplus. Early withdrawal incurs 10% penalty. Emergency exceptions for medical, funeral, or eviction events. Ashraf, Karlan & Yin (2006) demonstrated commitment savings increased savings by 81%.

Community takaful. Cooperative risk pools for health, funeral, crop loss, housing damage, business interruption. Parametric claims by oracle. Non-parametric claims by majority member vote. Not commercial insurance. Mutual aid infrastructure. Precedent: Sudanese Takaful Company (1979) survived wars and sanctions by operating as a mutual.

Stress testing

Monte Carlo stress testing across 10,000 simulated scenarios demonstrates 100% recovery probability from a 10% supply shock. The worst-case scenario — simultaneous 30% collateral drop, 15% redemption, and bond demand collapse — recovers within 90 days because the bond ceiling prevents liability explosion.

The realpolitik test

The protocol is designed not to be invulnerable, but to make suppression more expensive than accommodation. Eight attack vectors analyzed:

The estimated suppression threshold is $50 billion market cap and 5 million non-US users. Below this, political cost exceeds threat. Above this, the system may be too entrenched to suppress.

Honest Assessment

The most important chapter of any serious design is the one that specifies what it does not claim. This section lists the genuine tensions, the falsification conditions, and the boundary beyond which the system cannot promise to survive.

Genuine tensions

Abundance vs. scarcity. Celestial resources are vast but finite. The abundance ratchet assumes they are effectively unlimited. They are not. The tension is acknowledged, not resolved.

Two-class risk. Phase 4 creates a distinction between citizens (who receive distributions) and non-citizens (who do not). The 50/50 split is the honest compromise.

Early vs. late enrollees. Early adopters take more risk and earn more governance influence. Late adopters receive more mature infrastructure but less upside. Every monetary system rewards early adoption. The protocol makes the trade-off explicit.

Centralization vs. decentralization. The protocol begins with founder-seeded liquidity and multi-sig control. It decentralizes over time. The transition is not guaranteed. This is the bootstrap problem: you need centralization to start, but centralization is a risk.

Short-term peg vs. long-term value. Defending the peg consumes resources that could fund development. The revenue waterfall manages this tension but does not eliminate it.

Inclusion vs. security. Accessible to illiterate users increases attack surface. Maximally secure excludes those who need it most. Three-key custody is the attempted resolution.

Global ambition vs. local reality. The protocol claims to serve 1.4 billion unbanked people. It will begin in one partner nation. Scaling across jurisdictions is hard.

Speculation vs. stability. MULKI tokens will be speculated upon. Speculation creates volatility. Volatility undermines credibility. The 20% bond ceiling and dual-treasury separation mitigate but do not eliminate this.

Revenue source concentration. Until Phase 5, the system depends on terrestrial fees and bond demand. Celestial revenue is uncertain and distant.

MULKI capture. Wealthy actors can accumulate MULKI. The 2x/0.5x staking multiplier and natural decay reduce but do not eliminate this risk. Capture is expensive: earning-only governance means buying from existing holders drives up the price.

Regulatory arbitrage vs. compliance. The protocol benefits from jurisdictional diversity. It also needs enough compliance to partner with sovereign states. These pull in opposite directions.

The coordinated suppression tension. No code-based hardening survives infinite state hostility. If the US Treasury, SEC, and Federal Reserve coordinate full-spectrum suppression, the protocol loses US market access. Survival depends on: at least one non-US jurisdiction permits operation; decentralized collateral resists single-point seizure; attacker's political cost exceeds perceived threat. If all three fail, the protocol is suppressed. This is not a design failure. It is a boundary condition.

Existence vs. purpose. The protocol exists to implement the OST's benefit-sharing principle. If the OST is amended or abandoned, the legal anchor fails. This is the ultimate long-term risk, outside the protocol's control.

What would prove us wrong

Seven falsification conditions with time horizons, thresholds, and unambiguous outcomes:

What the system is not

The system does not claim to be decolonial in origin. It does not claim to replace the nation-state. It does not claim celestial revenue is guaranteed. It does not claim governance holders are morally superior. It does not claim the LLM delegate is infallible. It does not claim immunity from state suppression. It claims only what the contracts enforce, the parameters specify, and the simulations validate. That is enough.

Every parameter is public. Every transition is automatic. Every commitment is encoded in contracts that cannot break their own rules. Credibility from impossibility, not authority.

How it Works →