# SAMAEL — Whitepaper v0.1

**Voluntary Nations & the Sixty-Day Commons: Governance, Token Design, Enforcement, and the Fairness/Accessibility Charter**

- **Status:** v0.1 — design doc now aligned with the implemented, verified prototype (M2/M3/M4 built 2026-08-27–28). Where the text below says "M3 decides" or "detail to be modeled in M3", the decision has been made and is recorded in §10 + the project plan. Numbers that remain proposals (rates, thresholds) are flagged as such; mechanism choices are now executable code.
- **Date:** 2026-08-26 (v0) · 2026-08-28 (v0.1 alignment)
- **Author:** Lucifer, for Charles Anaman (Waali Wireless Wombats)
- **Sources:** `study/Samael/Samael.md` (brainstorm v0.1, 2026-08-25) · `study/Samael/research-retroshare-bitcoin.md` (fork source research) · `study/Samael/project-plan.md` (milestones M1–M5, living acceptance log) · `study/Samael/decisions/0001-testnet-fork-decision.md` (ADR 0001) · `study/Samael/ledger/` (M3 executable spec) · `study/Samael/web-console/` (M2 prototype) · `study/Samael/comms/` (M4 design + binding schema)
- **Companion deliverables:** this document is **M1** of the project plan. M2 (working web console), M3 (ledger sim), and the M4 comms design are now implemented behind it — see §11 for the artifact map.

---

## 0. Abstract

Samael is a fork of peer-to-peer communication and ledger technology that lets any person **register a nation**, **choose a nation**, **vote on laws and projects**, and **share in a pooled treasury that resets every 60 days**. Two commitments anchor every design decision:

1. **Voluntary jurisdiction** — a law binds only those who voted for it; everyone else is a metered guest, never a captive.
2. **The commons cannot be hoarded** — pooled value is re-allocated each epoch; the pool is funded in large part by a vanity tax whose rate the nation sets by social vote.

The test Samael performs on every authority is: *May I leave? May I disagree? May I start my own?* If the answer is yes, it is legitimate. If no — it is what we are replacing.

This whitepaper formalizes (1) the governance model, (2) the epoch/token mechanics with the math made explicit, (3) the enforcement model, and (4) the accessibility + fairness charter that the software must satisfy as acceptance criteria, not a polish phase.

---

## 1. First Principles

1. **Acceptance** — the system is hospitable to difference. Nations may be small, strange, and self-defined; no nation may coerce another.
2. **Respect** — non-predatory by design. No member is bound by a law they did not choose; no guest is price-gouged; medical emergencies are never "unpaid guests."
3. **Exit as the ultimate check** — every citizen may secede at any time **with their fair share**, computed by the ledger. The threat of exit disciplines every nation.
4. **The commons has a pulse** — pooled value that is not put to use returns to the pool. Wealth is stewardship, not a trophy.
5. **Legibility** — every rule is expressible in plain language and inspectable math. No hidden fees, no dark patterns, no black-box judges.

---

## 2. Governance Model

### 2.1 Nation = constitution + registry + treasury + voting

A nation is four things recorded on the ledger:

- **Constitution** — a human-readable document plus a code hash, ratified at founding. Amendments require a supermajority (threshold chosen by the nation); anyone who voted against an amendment may exit with their share instead of being bound. Amendment is therefore always honest: you cannot be dragged along.
- **Citizenship registry** — a cryptographic relationship: you hold a key, you attest to the constitution, the nation accepts you. Joining is low-friction by design; leaving is one visible action.
- **Treasury** — the pooled commons (§3).
- **Voting mechanism** — §2.3.

Nations may recognize each other (mutual aid, trade, defense) — inter-nation relations are themselves voluntary contracts.

### 2.2 Citizenship: join and exit

- **Join:** sign the constitution with your key; nation accepts (or, if the nation votes so, gates entry). No birthright coercion, no application fee by default.
- **Exit ("leave with your share"):** at any epoch boundary the ledger computes your fair share (§3.2) and pays it out. One visible action, no confirm-shaming, no cooling-off trap. (Optional grace-period exit — a consumer-protection cooling-off window — is a per-nation vote.)

### 2.3 Voting

- **Default: quadratic voting** (Lalley & Weyl). Cost in credits of casting *v* votes on one question is **v²**. Minorities can concentrate their credits on what they care about; intensity is expressible; majority steamrolling is expensive. Credits budget per citizen per epoch, e.g. **B = 100**.
- **Optional: liquid democracy** — revocable delegation for busy citizens.
- **Optional: futarchy** — voters price policy outcomes via prediction markets; the policy with the best expected value wins. Pairs naturally with the pooled economy.

### 2.4 Ostrom's eight principles (the commons playbook)

| # | Ostrom principle | Samael mapping |
|---|---|---|
| 1 | Clear boundaries | Citizenship registry |
| 2 | Congruence with local conditions | Nations are small and self-defined |
| 3 | Collective-choice arrangements | Voters make all rules |
| 4 | Monitoring | Transparent ledger; random audits |
| 5 | Graduated sanctions | Reputation, demurrage, exclusion — never prison |
| 6 | Conflict resolution | Voluntary courts (§2.5) |
| 7 | Rights to organize | Nations may federate |
| 8 | Nested enterprises | Nations within confederations |

### 2.5 Courts without coercion

Disputes go to a **marketplace of courts**: parties pick an arbiter (a nation's court, a hired professional, a random jury of voters drawn by the ledger). Judgments are enforced only through what the parties consented to — escrow, bonds, reputation, exclusion from the commons. **No swords, only keys.**

---

## 3. Token & Epoch Design — the Sixty-Day Reset

### 3.1 Definitions

- **Epoch:** fixed period **T = 60 days**, universal across Samael (nations may not shorten or lengthen; predictability is a fairness feature).
- **Pool P** at epoch *e*: total treasury value held by the nation at the epoch boundary, including carried-over decay, taxes, and fees collected during the epoch.
- **Citizens** C = {c₁ … cₙ}, each with share weight wᵢ (default 1; a nation may vote need-weighted weights).

### 3.2 Allocation formula (the transparent math the UI must render live)

At each epoch boundary, the pool's distributable value is re-allocated:

```
Aᵢ(e) = ( wᵢ / Σⱼ wⱼ ) × P(e)
```

- Equal shares: Aᵢ = P/n.
- Need-weighted (if the nation votes so): weights scale the share.
- **This is a reset, not a tax-and-dividend.** Holding entitlements do not compound across epochs; each epoch starts from the allocation.

### 3.3 The reset — three implementation options (M3 decided → Option 2)

| Option | Mechanism | Tradeoffs |
|---|---|---|
| **1. Rebase** (Ampleforth-style) | Balances/supply adjust at epoch boundary by consensus rule; holders keep a constant *fraction* of the pool | Simple for a single-token system; full-node consensus change; share-preserving rather than equalizing |
| **2. Demurrage sweep** (Gesell) | Each unspent UTXO decays at epoch end; decayed value flows to the pool, then pool is re-allocated | True anti-hoarding; requires covenant-ish logic or consensus-level state transition — the hard part in a Bitcoin-derived model |
| **3. Off-chain allocation rights** | Chain records pool state; allocations are *rights* computed off-chain and claimed on-chain | Least invasive; most trusted-actor-ish |

**Decision (made in M3, 2026-08-27):** **Option 2 — demurrage sweep is implemented** in the ledger sim (the executable spec, per ADR 0001). Decay is linear intra-epoch: `floor(V × d × h/T)` where T = 60 ticks, `h` = ticks held (spend/contribute/vanityPurchase take `now`; default 0 = epoch start). Proven properties in the test suite: spend at t=30/60 pays exactly half/the full epoch decay; mid-epoch-born change pays only remaining ticks at the boundary; every consumption path decays; supply invariant holds. Option 1 (rebase) remains the documented fallback; the nation does not choose the mechanism — the protocol does, once. ADR 0001 defers the Bitcoin Core fork to M5+; the zero-dependency sim is the canonical implementation of this section's math.

### 3.4 Decay (demurrage) math

Value held unspent for the whole epoch decays toward the pool:

```
V_returned_to_pool = d × V₀        (d ∈ [0,1], nation-voted, default 0.10/epoch)
V_holder_keeps    = (1 − d) × V₀
```

Linear intra-epoch: value spent at time t decays proportionally `d × (t/T)`. Rationale: savings without purpose are socially recycled; **velocity of purpose** is a design goal. Default d = 10% per 60 days is a proposal for review — high enough to matter, low enough not to punish ordinary liquidity.

### 3.5 Hoarding vs. investment (the honest tension)

If all unspent value decays, nobody can save for a house, a business, or a pension inside the pool. Candidate resolutions (nation-voted; code must express all three):

1. **Productive-investment exemption** — value committed to a nation-approved productive instrument (business equity, infrastructure bonds, education) is not idle and does not decay.
2. **Two-tier money** — a decaying **commons token** (consumption/allowance) + a **capital token** (investment, issued only through approved productive channels, itself subject to vanity tax at conversion).
3. **Personal exemption threshold** — a modest decay-free personal buffer, respecting dignity; nobody is policed for a rainy-day fund.

---

## 4. Vanity Tax

### 4.1 Definition by social vote, not by code

"Vanity" is **never hard-coded**. Voters set, per category (yachts, jets, jewelry, branded luxury, conspicuous consumption), a tax rate via periodic polls or prediction markets. A category is "vanity" only while the nation's voters say so.

### 4.2 Rate schedule & revenue (the transparent math)

```
T(k, V) = rₖ × V          rₖ ∈ [0, 0.90]   (voted per category k)
Revenue to pool = Σ over vanity purchases of T(k, V)
```

- Example: r = 70% on a 100,000-token vanity purchase → 70,000 tokens to the pool, 30,000 to the seller side. The rate is rendered live in the UI at the point of purchase — **no surprise math**.
- **Fairness constraint:** the vanity tax must not double-punish luxury bought with an already-decaying commons token. Design rule: the vanity tax applies at the *conversion* path (commons → capital/consumption) or at purchase, never both. **Implemented in M3:** `setVanityRate`/`vanityPurchase`/`vanityRevenue` — integer basis points, rate capped at 0.90, floor-exact `T(k,V)` credited to the pool, seller keeps the rest, no double-tax, full audit log.

### 4.3 Detection (the honest problem)

Vanity cannot be computed in consensus. Realistic options, in order of preference:

1. **Merchant/wallet-side category tagging with audit** (the sales-tax model) — simplest, most compatible with existing commerce.
2. **Oracle committees** — staked, slashed, reviewable (accountability is mandatory, or the system is fantasy).
3. **Statistical audits** with stiff penalties for mis-tagging.
4. **Market-based definition** — "vanity" is anything a category's prediction market prices as vanity.

---

## 5. Voluntary Jurisdiction & Enforcement

### 5.1 What can be enforced, honestly

- **Ledger-enforceable:** who holds what, who voted for what, what was funded, citizenship, escrow conditions, pay-per-use metering at the point of transaction.
- **Not ledger-enforceable:** whether someone *actually* enjoyed an offline service, whether a physical vanity good was bought, whether a guest secretly benefited without paying.

Samael enforcement is therefore **access control + reputation + social consequence — never violence**. This is simultaneously a feature (no police state is possible) and a limit (some free-riding is unavoidable — as in every state, except states hide it behind taxes).

### 5.2 Client-side jurisdiction (the Freenet lesson)

The chain stays minimal: it records **who opted into what**. Jurisdiction is computed client-side — your wallet knows which laws you voted for and applies their rules to your transactions; validators know which laws a counterparty opted into. A passing law is not a global rule change; it is a **bundle attached to its voters' keys**. This is the technical translation of "enforced only on those who voted for it."

### 5.3 Guest access: pay-per-use at current-day value

- Voters fund the service (healthcare pool, education commons, infrastructure) and use it free.
- Non-voters get **guest access at current-day value**: a smart-contract meter, payment per use, no subsidy.
- **Fairness cap (respect principle):** guest price ≤ cost + small margin (proposal: **cost × 1.10**, nation-voted ceiling). Guests are future members, not enemies; pricing is never punitive and never a weapon.

### 5.4 Defense

A nation that cannot defend its pool will be eaten. Defense is itself a vote-funded project; nations form voluntary mutual-defense pacts. Candid limit: physical defense is where "voluntary" meets its hardest test. Samael cannot abolish violence; it can make coercion **expensive, illegitimate, and avoidable**.

### 5.5 AI ethics: legible, appealable, human-final

Algorithmic law must be legible, appealable, and human-final. Every automated rule has a human review path; no black-box judges. This is the consumer-protection principle applied to machines (Charles's expertise made explicit).

---

## 6. Fairness & Accessibility Charter (product commitments — non-negotiable)

Every Samael increment ships against these criteria; they are acceptance tests, not a polish phase.

### Accessibility (WCAG 2.2 AA)

- Sufficient contrast; keyboard-only navigation; visible focus; ARIA landmarks/labels; screen-reader tested.
- **Plain language:** every mechanism (60-day reset, vanity tax, pay-per-use) explained in plain words with concrete examples; jargon only with a tooltip.
- Respect `prefers-reduced-motion` and `prefers-color-scheme`; scalable text (no fixed tiny fonts); alt text everywhere.
- i18n-ready strings; low-bandwidth-friendly; works on mobile (Linux mobile + web).

### Fairness

- **Transparent math:** the allocation formula (§3.2), decay rate (§3.4), and vanity-tax rate (§4.2) are rendered live with the exact numbers — no hidden fees, no dark patterns.
- **Opt-in consent:** laws and charges are explicit; nothing is applied silently.
- **Easy exit:** one visible "leave with your share" action; no confirm-shaming.
- **Low-friction entry:** identity/citizenship is easy to join and leave; accommodations for low literacy.
- **Fair defaults:** quadratic voting protects minorities; guests pay cost + small margin, never punitive; emergencies are never billed as unpaid-guest violations.

---

## 7. Technical Architecture (fork-first)

### 7.1 Layer map

| Layer | Base | Role | License note |
|---|---|---|---|
| Comms & identity | Retroshare fork (C++) | Friend-to-friend messaging, nation channels, GPG-style identities, Tor/DHT transport | AGPL-3.0 — copyleft implications for combined distribution (flagged for counsel) |
| Ledger | Bitcoin Core fork (C++) | Pool, epochs, votes, citizenship, escrow | MIT — permissive |
| Content | IPFS | Proposals, constitutions, project artifacts, immutable records | |
| Apps | TypeScript/Node, Rust, Go, Elixir, Zig (per curriculum) | Wallet, nation UIs, Linux-mobile clients (Plasma Mobile / Phosh) | |

### 7.2 What the Bitcoin fork adds

- **Nation registry** — special transactions (or OP_RETURN-anchored state): nation creation, constitution hash, citizenship joins/exits, recognition pacts.
- **Vote transactions** — ballots as transactions (quadratic credits spent), tallied per epoch, results committed on-chain.
- **Epoch mechanics** — §3.3 options; consensus-level state transition (demurrage sweep) or rebase rule.
- **Covenants (CTV-style)** — binding "this money can only go to the pool at epoch end" needs covenant logic; contentious in Bitcoin, fine in our own fork where we control consensus.
- **Pay-per-use meters** — HTLC-style atomic payments for guest access; escrow for milestone-funded projects.
- **Testnet-first:** fork, rebrand, custom genesis, custom rules.

### 7.3 What the Retroshare fork adds

- Nation-scoped channels (only citizens of nation X read/post) on the friend-to-friend model.
- GPG-style identity as the seed of citizenship keys.
- Transport resilience (DHT, Tor) — a nation that lives only in code cannot be bombed.
- Plugin model is the natural seam for new nation primitives.

### 7.4 Fork survival (the two killers)

From the Bitcoin fork literature: **replay protection** and **activation** are the two things that kill forks. Both are planned from day one in the fork baseline (custom genesis, unique signing, explicit activation heights).

### 7.5 Honest limits

- **The chain cannot see the world.** Vanity, harm, benefit — all require oracles, categories, and human judgment. Oracles must be staked, slashed, and reviewable.
- **Consensus is not community.** A fork gives you a ledger; a nation gives you people. The hard 90% is the social layer — which is why this document spends more words on governance than on code.

---

## 8. Risks & Open Questions (tracked, not feared)

1. **Guest non-payment:** guest uses the commons and refuses to pay → exclusion is the honest answer; violence is not an option. Exclusion has limits against determined free-riders.
2. **Defining vanity without tyranny:** category lists can be gamed or weaponized. Who audits the auditors? (Answer direction: prediction markets + stake.)
3. **Capital formation under the reset:** can a nation fund a 30-year infrastructure bond? Requires the productive-exemption design (§3.5).
4. **Third parties:** children, visitors, animals, emergencies. Humane defaults required; emergencies never billed.
5. **Sybil & vote buying:** quadratic credits + identity cost + reputation; small nations are attackable. Nations need validator/miner decentralization or hybrid consensus.
6. **Legal exposure:** a currency fork touches AML/BSA/securities law in most jurisdictions. Samael ships with a legal strategy and a legal-wrapper-entity option per nation.
7. **51% of a nation's voters** can do anything a government can do to its own members — exit-with-share must stay cheap enough that tyranny is *losing*.
8. **"Current-day value"** for a service with no market → cost + margin default; oracle markets as upgrade.
9. **A nation's pool is a target** — defense pacts, threshold signatures, geographic opacity (Freenet-style). None perfect; all designed for.

---

## 9. Roadmap & Acceptance Criteria

- **M1 — Whitepaper v0 ✅ (this document, 2026-08-26; v0.1 alignment 2026-08-28)**
- **M2 — Working web console ✅ v0.4 (2026-08-28).** Nation registry, citizenship join/exit, quadratic-voting UI, treasury/epoch visualization with the 60-day reset explained visually, vanity-tax category voting — accessible + fair per §6. The console's live flows (join/vote/vanity/leave/epoch-reset) run on the **real M3 ledger sim** vendored into the browser, not a mock. Deploy this first as the "working project" — remaining: static-host target decision + physical NVDA/VoiceOver pass (waiting on Charles).
- **M3 — Ledger prototype ✅ v0.8 sim (2026-08-27→28).** Standalone UTXO sim, zero deps, adopted as executable spec (ADR 0001): nation register/join/exit, quadratic vote txs (v² credits, per-epoch reset), demurrage sweep (Option 2), covenant guards (constitution-hash commitment, supermajority amendments, `releasedSince`), signed state-commit chain (`chain.js`: Ed25519, consensus epoch+tick). Suite: ledger 41/41, chain 55/55, supply invariant after every op. Bitcoin Core fork deferred to M5+.
- **M4 — Comms layer ✅ design v0 (2026-08-27→28).** Retroshare plugin seam (`rs_samael`, service id 0x2004), citizenship gate at two layers, AGPL comms / MIT ledger split, binding-statement schema (`key-binding-v1`: PGP fingerprint ↔ Ed25519, dual-sig, revocation, real GnuPG verification). Fork-time C++ skeleton is the remaining M4 work (needs go-ahead + Qt6 toolchain).
- **M5 — Linux-mobile client + public deploy.**

**M2 acceptance criteria (from §6):** keyboard-only walkthrough passes; contrast/focus/ARIA checks pass; plain-language explainers for reset + vanity tax with live math; "leave with your share" one click, no confirm-shaming; reduced-motion respected; works at 320px width and on low bandwidth. **Status:** automated checks green — axe 0 violations / 0 incomplete (3 views), sr-pass CLEAN (26 tab stops, visible focus, 0 unnamed elements), 320px no-overflow, 3G interactive ≈3s at 74KB, `test-real-flows.js` 18/18. Physical NVDA/VoiceOver + deploy remain.

**Metric of success for the whole project:** voluntary adoption and *retention* — people stay because it is good, not because they cannot leave. Everything else is decoration.

---

## 10. Implementation Status Map (v0.1)

Every mechanism in this whitepaper that is marked "implemented" has a verified artifact. Source of truth for ongoing status: `study/Samael/project-plan.md`.

| § | Mechanism | Artifact | Verification |
|---|---|---|---|
| 2.1 | Constitution commitment + amendments | `ledger/utxo-ledger.js` covenant guards | suite 41/41; supermajority integer-ppm-exact; no one dragged along (`releasedSince`) |
| 2.2 | Join / exit-with-share | `ledger/utxo-ledger.js` + web-console flows | 18/18 flow tests; exit = own tokens + floor pool share, decay-exempt |
| 2.3 | Quadratic voting (v² credits, 100/epoch) | ledger + console | credits consumed/reset by `advanceEpoch`; add-only v0 with honest no-undo copy |
| 3.3 | Demurrage sweep (Option 2) | `ledger/utxo-ledger.js` | linear `floor(V×d×h/T)`, T=60 ticks; boundary-dodge proven impossible |
| 3.4 | Linear intra-epoch decay | ledger | spend at t=30/60 pays exactly half/full; supply invariant holds |
| 4.2 | Vanity tax (integer bp, cap 0.90) | ledger `setVanityRate`/`vanityPurchase`/`vanityRevenue` | floor-exact to pool; no double-tax; rate = median of seeded votes in console |
| 5.2 | Client-side jurisdiction (opt-in bundles) | `comms/comms-design-v0.md` §5.2 | citizenship gate at two layers (transport + client policy); verify-then-relay |
| 7.3 | Plugin seam + identity binding | `comms/rs-samael-plugin-spec-v0.md`, `comms/binding-statement-schema-v0.md` | binding validator 9/9 + PGP 5/5 (real GnuPG); chain.js bindKey/revokeBinding 55/55 |
| 6 | Accessibility + fairness | `web-console/` (axe, sr-pass, viewport checks) | axe 0/0; sr CLEAN; 320px OK; 3G ≈3s; plain-language explainers live |

**Still open (proposals, not code):** §3.5 hoarding-vs-investment exemptions (three nation-voted options), §4.3 vanity detection (oracle/market options), §5.3 guest pricing ceiling, §5.4 defense pacts, §8 open questions 1–9. These are deliberately deferred: the sim proved the money mechanics; the social-mechanism layer needs a real nation's votes, not a whitepaper's.

---

## 11. References

*(former §10; renumbered when §10 Implementation Status Map was added in v0.1 — see project-plan.md for the canonical milestone log.)*

- de Puydt, "Panarchie" (1860) — https://panarchy.org/depuydt/1860.eng.html
- Nozick, *Anarchy, State, and Utopia* (1974) — framework for utopia; exit as check
- Ostrom, *Governing the Commons* (1990) — eight design principles
- Gesell, *The Natural Economic Order* (1916) — demurrage / Freigeld
- Lalley & Weyl, *Quadratic Voting* (2017) — https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2003531
- Hanson, *Futarchy* (2000) — https://mason.gmu.edu/~rhanson/futarchy.html
- Szabo, *Formalizing and Securing Relationships on Public Networks* (1997) — https://nakamotoinstitute.org/formalizing-securing-relationships/
- Ampleforth rebase mechanism — https://docs.ampleforth.org/
- Optimism RetroPGF — https://optimism.io/retrofunding
- Bitcoin whitepaper & Bitcoin Core — https://bitcoin.org/bitcoin.pdf · https://github.com/bitcoin/bitcoin
- Retroshare — https://retroshare.cc · https://github.com/RetroShare/RetroShare
- Freenet (Rust platform) — https://freenet.org · Hyphanet — https://www.hyphanet.org
- IPFS / Helia — https://docs.ipfs.tech · https://docs.ipfs.tech/reference/js/api/
- WCAG 2.2 — https://www.w3.org/TR/WCAG22/

---

*Samael, in some traditions, is the one who tests. This system is named for the test it performs on every authority: "May I leave? May I disagree? May I start my own?" If the answer is yes, it is legitimate. If no — it is what we are replacing.*