On this page

BSA ID and the Lana profile DRAFT 0.3.0

Plain-words text · Technical specification · All documents

English text rendered from the project's source documents. The Slovene original is on lananostr.site. Where this text and the definitions differ, the definitions win.

Precedence: where this document and definitions 0.3.0 differ, the definitions (docs/bsa-records-0.3.0.json) win; the difference is a mistake in this document, to be fixed.

Foundation. Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden. All transactions are public and stored on the relays, so the ledger can be restored from them at any moment. Applications only read from the relays, check and show. The six development principles: docs/nacela-razvoja.md.

The essence#

The BSA ID is the number of a BSA account (Balanced Stage Account). It is the member's Nostr public key: 64 characters in hexadecimal (HEX). It is never shown as npub.
The BSA ID comes from the same private key as the LANA WIF. One private key gives one BSA ID and a LANA address. A member does not need to remember anything new.
The public key really is the wallet. Whoever knows the BSA ID can pay the member; whoever has the private key can pay from the account.
The ledger knows people only by their key. The circle's ledger always holds only the BSA ID, never a name. The name lives only in the Lana profile and in the member home. A person can change both at any time, and a relay keeps only the newest version. (Decided 16 October.)
Every member can be found. Every member has a member home: a short public record with their BSA ID, circle and present name. There is no choice of "listed or not". This follows from the owner's principle "everything is public".
Whoever knows a BSA ID also sees that account's balance and payments. Every payment and every balance is public in the circle's ledger on the relays. The app says so in one sentence on joining.
Search by BSA ID is instant: relays find records fastest by their author's key, so one query returns the member's profile, member home and circle.
The secret stays the BSA WIF. The sign-in field is still called "BSA WIF (secret, never share it)". The name "BSA ID" is used only for the public account number. The private key is never public anywhere.
One circle at a time, moving with a reference [Decided 23 Oct 2026, E-8 and E-9]: a person is a member of one circle at a time; their newest member home says which circle is the last. When they move to another circle the BSA ID stays the same, and the new circle admits them only with the reference of their last circle (below, under the member home).

How the BSA ID and the LANA address relate#

The private key gives the public key. From it come the BSA ID and the LANA address (the compressed and the uncompressed address of the same key).
The BSA ID cannot be worked out from a LANA address, because the address is a fingerprint of the key, and the key cannot be worked back from a fingerprint.
A BSA ID allows four possible LANA addresses, so an address is checked by seeing whether it is one of those four.
A WIF has four forms, all valid: it starts with T, A, 6 or 3.
One person with two Lana keys has two BSA IDs. So one person with two keys can found two circles or be in two circles at once; the ledger does not catch this, it would need Lana's person check [Decided 23 Oct 2026, E-8, the note].

Where the BSA ID is shown#

on the QR code for receiving a payment, on payment requests and on member lists;
in every entry of the circle's ledger, for the payer and for the receiver. There is no name in the ledger: the app takes it from the present profile when it shows the entry;
in a short form, for example d4d4d4d4…c263, with the full id on click;
the LANA address on a second line, taken from the Lana profile or from sign-in.

The Lana profile#

A Lana profile is mandatory and minimal (the owner's decision). The BSA ID is the key that signed the profile, so the profile already carries it.
What BSA really needs in the profile: the key (that is the BSA ID, and every profile carries it by itself) and the name (for display and search). The member can change the name at any time. The ledger never copies it. The currency is not required: a member's currency is their circle's currency, the profile can only suggest it. BSA needs nothing else.
The wallet address in the profile: the Lana relays accept a profile only if it has a wallet address. Every key has a LANA address, even if no LANA ever sits on it, so the app fills this field itself with the address of the member's key. Few will have LANA; for those there is the registrar.
A member without a profile: the app creates one on joining, with the name, the address of their key, the circle's currency and the language.
Supplementing the profile (proposal P10, waiting for the owner's yes): the profile gets a pointer to the member's home circle and a rule for every Lana app: "keep every field and tag you do not manage".
Why membership is not in the profile: the profile form in MejmoSeFajn and some other apps deletes fields it does not know on every save. So membership is written in the circle's ledger, and the member home points to it. The pointer in the profile only helps search.
Until the forms keep unknown fields, the LetsBalance app writes nothing into an existing profile.

The member home#

What it is: a short record signed by the member, into which a witness of the circle adds its confirmation that this is really its member. It carries the BSA ID, the circle by its circle id and with its genesis fingerprint, the day of joining, the name words from the profile and the LANA address. The circle id is the fingerprint of the found act the founder signs; it is the circle's name for ever (decided 17 Oct 2026, C5).
It is mandatory (the owner's decision). Joining is complete when the member has signed their member home, a witness has confirmed it, and the joining is booked in the circle's ledger. The joining entry in the ledger carries only the key, never a name.
The truth is the circle's ledger. Joining and leaving are signed public records in the ledger. The member home only points to them. In everyday terms: the member home is like the name on a letterbox. Who really lives in the house is written in the official register of residents; for us, that is the circle's ledger. You can change the name on the letterbox; the register knows the resident only by number.
The name words are always in the member home, so search by name is fast. This was proposal P9; it now follows from the principle "everything is public". It does not go against the owner's decision on names: when a member changes their name, they sign the member home again, and a relay keeps only the newest one.
Leaving is a signed public record in the circle's ledger. Who was a member, from when to when, stays in the ledger for good, by key. If someone only deletes their member home, nothing changes in the ledger.
Moving to another circle [Decided 23 Oct 2026, E-8 and E-9]: when a member says "I want to leave" and has settled (no minus and no open OWN process, E-9 (a)), a reference is issued for them by itself in the old circle's ledger. With it they join the new circle and sign a new member home for it. In the new circle they get the same step they built; the new circle sends the same amount to the old circle's community, which closes the old account (E-9 (b)). The newest member home counts, since a person is a member of one circle at a time. By the newest member home the new circle sees which circle a person comes from, and it does not admit them without that circle's reference. Whoever has no member home in any circle needs no reference [Proposal]. Said plainly: a deleted member home or a second key of the same person is not caught by this; proposal: the root relays never delete member homes [Proposal]. In detail in the document "Running a circle".
Who confirms (decided, question 3): a witness of the circle. Today that is the circle's node, which is so far the only witness. Once a circle has more witnesses, any of them confirms.
Where it lives: on the circle's relays from day one (decided, question 2). While the circle borrows the Lana relays, there too. With very many members, also on index relays split by the first characters of the key (proposal, question 16). A member's address carries their circle, the way a postal address carries the town, so paying needs no worldwide lookup.

Search#

By BSA ID: one query to two relays at once returns the profile, the member home and the registered Lana wallets. "Not found" holds only once both relays have answered. A silent relay never means "this person does not exist".
Before paying, the app checks in the circle's ledger on the relays that this person joined and has not left. The circle's witnesses check it again when booking.
By name: first the member homes with the words of the name (at most 50 results), then those members' profiles. A result whose words are not in the profile's name is dropped. With more results the app asks for the full name.
A member cannot be found by an old name. A relay keeps only the newest profile and the newest member home, and the ledger carries no names.
Search by part of a name can be offered by a search service that anyone may run. Since results are signed, a search service can hide someone but cannot invent anyone.
Name words are always written the same way: without diacritics and accents, in lower case, for example "Čebašek Žiga" becomes "cebasek ziga".

One key for LANA and BSA: what if it is stolen#

Proposal (question 11, waiting for the owner's yes).

The risk: the BSA ID comes from the same private key as the LANA wallet. Whoever steals the key can empty both. Today nothing can be frozen. Whoever loses the key can no longer pay from the BSA account; the balance stays public but locked.
What is already decided: a member enters the BSA WIF into their own circle's app. The app signs in the browser and does not send the key to the server. The project owner accepted the risk that a dishonest circle could intercept the key (16 Oct 2026).
Proposal: guardians. A member may, if they wish, name guardians in advance, for example three other members, two of whom must agree. The member signs this as a public record in the circle's ledger.
Freeze: if the key is stolen or lost, two guardians sign a freeze. The BSA account can then no longer pay.
Move to a new key: the member creates a new key and the guardians sign the move. The balance, the wave and the whole history of the account continue under the new BSA ID.
Everything is public: who the guardians are, who froze, when, and to which key the account went. Here too the ledger knows the guardians only by key.
What guardians cannot do: they cannot pay from the account. They do not protect LANA on the Lana chain; that money is outside the circle.
Without guardians things stay as today: a stolen key can empty the account, a lost key locks it.
Open in this proposal: whether a move to a new key first waits for a public notice (for example 72 hours), so that two guardians cannot take over an account by themselves; how a freeze is lifted if the member finds the key again; what happens to payments still sent to the old BSA ID.

Public for ever, and the name#

Decided 16 October 2026 (question 5).

The ledger is public for ever and carries only keys. Blocks, acts, seals and snapshots know people only by their BSA ID. The ledger never copies a name.
The name lives only in the Lana profile and in the member home. A person can change both at any time. A relay keeps only the newest version. In the owner's words: "A person can change their name, and then it is no longer known what belonged to whom."
The key stays the same. The same key is in the BSA account, in the LANA wallet and in the Lana profile. Whoever knows whose key it is sees all of that key's payments and balances, for ever. Habits show in the payments, large balances stand out. We do not hide this; it follows from the principle "everything is public".
A warning at every free-text field: at a payment's purpose, the reason of an "against", the reason of an exclusion, and a project's title and description, the app writes "public for ever; do not write names, personal or bank data". On joining it says that payments and balances are public for ever.
To be honest: a name can remain in old copies of a profile that someone saved, and in free text that someone writes. The ledger itself does not carry it.
Dropped: a legal review as a condition before the first public booking, and a separate record for free text beside the ledger. Free text is part of the signed record and is public for ever, which is why the warning matters.

Existing members#

The current app already uses this key as the member's id, and sign-in already checks that the Nostr key matches the LANA key. Nothing moves; only the label on screen changes: the account number is now the "BSA ID". At the next sign-in the app asks the member to sign their member home. The names the current app keeps on its server do not go into the ledger on the relays, not even when the whole history goes there.

Decided#

The six development principles (the project owner, 16 October 2026). The whole ledger is kept only through the relays, and applications only read from the relays. Nothing is ever hidden. The four Lana relays will not carry 100 billion payments, so the system must be scalable.
What follows from them without a new decision: every member can be found by their present name (formerly proposal P9). The balance and payments of every account are public on the relays. Joining, leaving and every membership decision are signed public records in the circle's ledger. This changes the text of the decision of 16 October "a member is whoever has a member home on the relays": a member is whoever has a joining entry in the ledger and no leaving entry; the member home stays mandatory as a pointer. When publishing is switched on, the whole history goes to the relays. Nothing stays on a server that cannot be rebuilt from the relays.
Public for ever, and the name (the project owner, 16 October 2026, question 5: "A person can change their name, and then it is no longer known what belonged to whom"). The ledger knows people only by key (BSA ID, HEX). The name lives only in the Lana profile and in the member home, which a person can change at any time; a relay keeps only the newest version. The ledger never copies a name. Every free-text field carries the warning "public for ever; do not write names, personal or bank data". The legal review as a condition and the separate free-text record are dropped.
The circle's relays (the project owner, 16 October 2026, question 2: "yes"). From day one every circle has its own relay in the box, and together at least four relays with at least three owners. Member homes are on the circle's relays. The Lana relays in 38888 stay the root directory for good and a borrowed home for small circles with limited space. The rule "relays only from 38888" applies to the root relays, not to circles' ledgers.
Witnesses (the project owner, 16 October 2026, question 3: "yes, as the assistant proposes, no money cap"). A circle starts with one witness, and the app shows "not yet decentralised" in public; there is no money cap. Then four witnesses with four different owners, three of whom must agree; at most one witness per owner. Any witness of the circle confirms a member home.
There is no bank data, there are no payouts and there are no money deposits in BSA (the project owner, 16 October 2026, question 6: "Bank data are unnecessary in this system ... because the funds are never paid out", and in the afternoon, point 6a: "Forget deposits in money, that is a completely different system"). A BSA account has no field for bank data. An account's wave grows only from what the member receives. A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin") (decided 6c, the project owner, 16 October 2026: »6c, da«; document "The ledger on the relays").
The BSA ID is the Nostr public key in HEX, from the same private key as the LANA WIF, never npub (16 Oct 2026; the rule "never npub" holds since 5 Oct 2026).
A Lana profile is mandatory and minimal: key and name; the app fills the wallet field; how the profile is supplemented is proposal P10 (16 Oct 2026).
The member home is mandatory (16 Oct 2026).
Every circle has its own app (circle in a box), never one master app for several circles. A member enters the BSA WIF into their own circle's app, which signs in the browser. The risk of a dishonest circle is accepted (16 Oct 2026).
Private keys and the BSA WIF never go anywhere (principles, 16 Oct 2026).
Root relays are only the Lana relays in 38888 (14 Sep 2026). Circles start on borrowed Lana relays (16 Oct 2026).
Nothing goes to the relays without the owner's yes (16 Oct 2026).
The other earlier decisions (one seal a day; one currency per circle; the seller's circle quotes the rate and the buyer accepts it, which replaces the earlier decision about the owner's rate key; the currency values in 38888 are LANA prices; whoever creates a circle founds it, with no personal approval (since 23 Oct 2026 only a member of an existing circle, E-8); 72 hours of public notice (since 23 Oct 2026 the vote, E-5) and the step outward) are listed in the document "World relay network".
Which refusals go into the ledger (the project owner, 17 October 2026, C3: "YES"). When the circle refuses a payment or an act of a key that is neither a member of the circle nor an applicant, it only answers and does not write the refusal into the ledger. Refusals of members and applicants are written into the ledger, at most 20 refusals of one key a day; above that the circle only answers. A signed act, for example a request to join, is valid 7 days: what is not booked by then no longer counts. Both numbers were in the world-wide record of rules, the same for every circle (C1); since 23 Oct 2026 they are default circle settings, changed by the Circle Heart (E-1).
A circle's name is its circle id (the project owner, 17 October 2026, C5). In the owner's words: "I don't understand why you don't do this right away", and after the explanation: "You can do it all together in phase D". The circle id is the fingerprint of the found act the founder signs; it never changes. The member home names the circle by it. The circle key is not part of the circle's name, so three of the four (now Heart members) can replace it with public notice (since 23 Oct 2026 72 hours by default; a circle setting, E-1), and the witnesses book the change. Proposal: it signs only the circle's record in the directory and, once, the found act in block 1. This is the circle's key, not a member's key: for a member's stolen key the proposal of guardians stays (question 11).
One circle at a time, and the reference (the project owner, 23 October 2026, E-8 and E-9; the owner's words: »... ker ne more hkrati sedeti v dveh krogih«, "... since they cannot sit in two circles at once", and »Sprejema se v nov krog samo z refrenco, brez tega ni nič«, "A new circle admits only with a reference; without it there is nothing"). A person is a member of one circle at a time. When they say "I want to leave" and have settled, the reference is issued by itself; a new circle admits a person from another circle only with it. The same day the project owner also decided (»1 a,« and »... in se zadeva izniči«, "... and the matter cancels out"): an open OWN process blocks the reference also without a debt; in the new circle the person gets the same step, and the same amount goes to the old circle's community, which closes the old account. The BSA ID stays the same. The newest member home says which circle a person comes from. One person with two keys is not prevented (that would need Lana's person check). The full decisions are in the document "Running a circle".

Proposals and questions waiting for the owner's yes#

Question 11: guardians for a stolen or lost key, as above. They protect only the BSA account, not LANA.
Question 16: profiles and member homes with millions of members. Proposal: on the circles' relays, also on the Lana relays while a circle borrows them, and with very many members also on index relays split by the first characters of the key. At 10 billion members the profiles alone would take about 10 TB on each Lana relay.
Question 10: 38888 as a directory, not a dependency. Proposal: the circle's link and QR code carry its circle id, the addresses of at least two of its relays and also its genesis fingerprint as an extra check, so paying a member and checking membership do not depend on the root relays. This changes the present set-up, where a member was found only through them. That the circle id is the circle's name is decided (17 Oct 2026, C5); what exactly the link carries is a proposal.
Proposal P10: the BSA ID needs no new profile field, because it already is the profile's key. The profile only gets a pointer to the home circle (its circle id) and the rule "keep fields you do not manage". The profile supplement is published as a separate new revision of the profile definition.
Proposal P11: six existing profiles have a wallet address that is not their own key's. Proposal: show their own key's address and do not block them.
Proposal P7: one yes per definitions version and one yes for switching on each kind of record, member homes included.
The reference: moving with a step, safety (for E-9 (b)): it is decided that an open OWN process blocks the reference also without a debt (a), and that in the new circle the person gets the same step while the same amount goes to the old circle's community, which closes the old account (b); the definitions write it so. Proposal: this wave counts against the new circle's step outward; a join that does not fit waits on the waiting list (a question for the owner). In detail in the document "Running a circle".
Member homes are never deleted [Proposal, E-9]: the root relays never delete a member home, since by the newest one a new circle sees which circle a person comes from.