Every community (a circle) runs its own balanced ledger. When a member of one circle pays a member of another, the payment passes through one world wallet per circle, so three ledgers stay at exactly zero at once: the payer’s circle, the world, and the receiver’s circle. Nobody can give what the rules do not allow, and nobody can turn printed balance into euros.
Status: design for phase 3. Circles run alone today; connecting them comes next.
01
The building block
Every circle has one world wallet
A world wallet is a technical account that lives in two ledgers at the same time: inside its own circle, and in the world ledger that connects all circles. Inside the circle it shows what the circle owes to or is owed by other circles; in the world it shows the same position with the opposite sign. That is why every circle, and the world, always sums to zero.
Inside circle A
Ana→World wallet A
Ana gives 100 €B. Circle A: Ana −100, world wallet A +100.
In the world
World wallet A→World wallet B
The world moves 100 €B from A to B. World: A −100, B +100.
Inside circle B
World wallet B→Bojan
Bojan receives 100 €B. His wave grows by 100, and his community gets the matching 100.
Circle AAna −100 + world wallet A +100 = 0
WorldA −100 + B +100 = 0
Circle Bworld wallet B −100 + community B +100 = 0
Why it matters: no circle can create balance that another circle has to carry. What circle A buys from the world shows up as a negative position of A in the world, and that position has a hard limit (section 04).
02
A payment crosses
One signed note, two countersignatures
A payment between circles is a single note, signed in the payer’s browser with their own key. Each circle runs a node that checks and countersigns, but holds no member keys, so a node can refuse a payment but can never forge one.
1
Ana signs the note
In her browser, with her own key. The note names Bojan, the amount, the currency and her previous note, so it cannot be copied or replayed.
2
Circle A’s node checks and reserves
Is this Ana’s latest note (no fork)? Does her wave cover it? Is circle A inside its limit for buying outside? Are both circles active on the public federation list? If yes, it countersigns and reserves the amount.
3
Circle B’s node confirms
It checks that Bojan belongs to circle B and countersigns the same note. Only a note with both countersignatures counts.
4
All three ledgers book it
Circle A, the world and circle B each book their side, as in section 01. Each ledger still sums to zero.
5
Silence releases the money
If circle B refuses or stays silent for 72 hours, circle A voids its countersignature and Ana’s reserved amount is free again. Nothing is lost in between.
No central authority: circles recognise each other through a public federation list on the relays. Every key in it carries the period when it was valid, so a retired or compromised key can be closed without losing history.
03
Worked example
Two circles, two payments, three zeros
Ana and Cene live in circle A; Bojan and Dora in circle B. All values are in EURB. Member cells show balance · wave growth. Read any group of columns across: it sums to zero.
Step
Ana A
Cene A
Community A
World wallet in A
Sum A
World A · B
Sum world
World wallet in B
Bojan B
Dora B
Community B
Sum B
0 · Before
0
0
0
0
0
0 · 0
0
0
0
0
0
0
1 · Ana pays Bojan 100
−100
0
0
+100
0
−100 · +100
0
−100
0 · +100
0
+100
0
2 · Dora buys honey from Cene for 60
−100
0 · +60
+60
+40
0
−40 · +40
0
−40
0 · +100
−60
+100
0
Step 1 · buying from another circle
Ana goes 100 into her trough. In the world, circle A now stands at −100: it has received 100 of work from the world that it has not yet given back.
Step 2 · selling to another circle
Dora pays 60 for Cene’s honey. Cene’s wave grows by 60 and his community gets the matching 60, exactly as for a payment inside his circle. Circle A’s position in the world improves to −40.
Every group · zero
Circle A, the world and circle B each sum to zero after every step. Trade between circles moves positions, never creates them.
Note: these bookings show the design as described for phase 3. The exact rows will be fixed in code when circles connect.
04
Limits between circles
A circle cannot buy from the world without end
A circle that only buys from others sinks in the world ledger. Its own community fills its world wallet’s trough, and the circle may buy from others at most 2.5 times its wave. Once it reaches that limit, it has to sell before it can buy again.
Green circle
Buys outside up to 2.5× its wave. Witnesses for its community orders come from other circles once it is connected.
Yellow circle
Other circles see a warning. Every new community order needs two witness confirmations and an explanation from its administrators.
Red circle
Its limit for buying outside narrows automatically from 2.5× to 1× its wave. Any circle may choose not to sell to red circles at all.
Nobody loses money: a light never takes a balance away. People inside the circle keep trading; only the door to the outside and the way to new printing get narrower.
05
Why cheating does not pay
Three locks, no euros, and a light everyone sees
A cheat is not recognised from one booking but from a pattern. Every day the app computes signs from the ledger and shows them to every member; other circles see the light and the values of the signs, without names. A cheat would have to get past all three locks at once.
1
Public notice
Every community order is public for 72 hours and anyone can object. A proposer never decides on their own proposal, and an objection must be answered publicly before approval.
2
A random witness confirms the work
Payment comes only after a witness confirms the work. The witness is drawn from a Lana block that did not exist when the proof was submitted, so nobody can choose them. They cannot be linked to the order, and nobody learns who they are until they answer.
3
The circle’s light
Seven signs inside the circle and four between circles are computed every day. Rules are checked at the moment of payment, not from yesterday’s light.
What a cheat would try
What stops it
Print a lot and take euros out
Members are never paid out euros. Euros that come in go to BEF, which runs LanaPays.us, so a cheat never sees them.
Print and buy goods in other circles
The limit of 2.5× the circle’s wave, the signs between circles, the red light narrowing it to 1×, and circles that refuse to sell to red circles.
An administrator approves a fake order for a friend
A random, unconnected witness refuses it; refused work lights a sign of evidence.
Order money flows back to the proposer
The “money flowing back” sign follows it, also through two people in between.
Fake accounts pour money into one person
The “funnel” and “pass-through accounts” signs. A witness must be a member for 30 days who paid at least three different people.
Clear honest witnesses out of the way
Payments a cheat sends to others exclude nobody from being a witness.
Cash everything out on one green day
Rules are checked at payment; an unusual day calls a second witness before paying.
A new administrator, or quietly changed thresholds
A new administrator cannot approve for 30 days; a change of thresholds or of one member’s wave takes effect after 14 days and is visible to all.
A node forges a payment
Nodes hold no member keys. Every note is signed by the payer and can be checked by anyone.
Signs inside a circle
Z1 printing against giving
Z2 unusual day
Z3 who gets the orders
Z4 money flowing back
Z5 funnel
Z6 pass-through accounts
Z7 refused work
Signs between circles
M1 at the limit for buying outside
M2 only buys, hardly sells
M3 order money goes out to other circles
M4 a sudden jump in buying outside
What is not a cheat: a large real project, like building a house, lights only signs of scale and so a yellow light. A city circle that buys food outside lights yellow too. A light never escalates by itself, and it goes out after 14 days with no sign, or when two witnesses accept the administrators’ explanation.
06
Findings
What the analysis showed
We simulated a world of connected circles, each with one world wallet, members with a wave of one million, and communities that may print for work done. These are the results that shaped the rules above.
Almost none
refused payments: with one world wallet per circle, exchange between circles flows almost without refusals.
≈ 220,000
EURB of goods: the most a circle that prints one million got from others over two years, before any light or witness.
3.3 %
of all trade between circles: the share that worst case reached.
0 €
in euros: what a cheat can take out, because members are never paid euros.
What this means: even with no witness and no light, a circle that printed a million took only a small share of what others traded in the simulation, and none of it in euros. The witness, the signs and the light are there to stop it much earlier. Thresholds are a starting point and will be checked in simulation before they go live.
Still open
Red light in the world: only a narrower door, with each circle choosing whether to sell (proposed), or no sales to red circles by default.
Payment only after a witness confirms (proposed), or an advance of up to 30 % for materials.
Witnesses unpaid (proposed), or paid a small amount by the community.
The circle protocol on the relays still has to describe v2 waves before circles can connect.