Running a circle: witnesses and the Circle Heart DRAFT 0.3.0

Plain-words text · Technical specification · All documents

English text rendered from the project's source documents. The Slovene original is on lananostr.site. Where this text and the definitions differ, the definitions win.

Precedence: where this document and definitions 0.3.0 differ, the definitions (docs/bsa-records-0.3.0.json) win; the difference is a mistake in this document, to be fixed.

Foundation. Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden. All transactions are public and stored on the relays, so the ledger can be restored from them at any moment. Applications only read from the relays, check and show. The six development principles: docs/nacela-razvoja.md.

What is decided and what is not. The development principles, what follows from them, the owner's answers to questions 1–9 (16 October 2026), the owner's answers to the open points (the same day), the owner's answers C1–C7 (17 October 2026), the owner's answers 1A, 2A and 3A (the evening of 17 October 2026), the owner's answers before phase E (E-1 to E-9, 23 October 2026) and earlier decisions are decided. All of them are in the "Decided" list at the end. Whatever is not decided is a proposal waiting for the project owner's "yes". Each proposal names its question number or carries an "Open" label (for example Open 8g). What changed on 23 October 2026 carries one of three labels: [Decided 23 Oct 2026, E-n] (the owner's decision; the owner's words are in the "Decided" list), [Proposal] (my proposal, waiting for the owner's yes) and [Consequence] (follows from a decision and needs no new one). The owner's answers to the questions (a) and (b) on the reference, the same day, are written under E-9. The decisions of 23 October replace some earlier ones: the world rules record (C1 and 1A), the objection (8c), "no special rejection, an objection stops a project" (C4), the fixed 72 hours (C5), at most three circles per founder (decision 9) and "the circle chooses its witnesses itself" (decision 3); the list is under "Replaced". Only the removal of deposits and payouts (6 and 6a, step D0) is built; the rest is not yet.

The essence#

• Nobody's single key moves the community's money or changes any right. Every change is a signed public act. It follows a public rule and counts only once the circle's witnesses have written it into the circle's ledger. Decided (questions 3 and 8).
• Witnesses are computers that check every block of the ledger themselves and sign it. A circle has four witnesses with four different owners; three must agree. At the start there is a single witness, and the app says so in public. There is no money cap. Decided (question 3). Witnesses will be chosen by lot among the circles' computers, not by the circle itself; until there are enough circles to draw from, a circle has one witness, its own computer. [Decided 23 Oct 2026, E-7]
• The Circle Heart is the people who created the circle and tend it. They decide where judgement is needed. In the live circle there are four: the founder and three other Heart members; each of them is a Heart member. The circle's members do not elect the Heart: whoever disagrees leaves and creates their own circle. The Heart itself adds and removes Heart members. [Decided 23 Oct 2026, E-2]
• A project is decided by a consensus vote, "all for, or it falls". Any member proposes a project and at publication sets how long the vote runs: at least 72 hours (the default; a circle setting). All members vote, for or against. A project passes only if nobody is against at the end and at least three Heart members are for; nobody decides on their own project. The Heart can also put any other proposal to a vote. [Decided 23 Oct 2026, E-5] This replaces the 72 hours of public notice, the objection (8c) and the approval by three.
• The community's money always goes to projects. Project wallets, the reserve, the world account and the step-outward account have no key. Money moves only by a public rule that every witness checks. Decided (question 8 and answers 8a, 8b, 8e, 8f, 8i, 8j and 6c); 8d follows from decision 8; 8g and 8h stay open; the objection of 8c was replaced by the vote (E-5).
• There are no deposits, no payouts and no bank data. Funds are never paid out. Deposits of money are a completely different system. The wave grows only with what a member receives. Decided (question 6 and answer 6a). A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin") (decided 6c, below).
• The circle key only stamps the mirror. It signs only the circle record (the ledger's mirror), which restates what is already in the ledger. Proposal: it follows from decisions 3 and 8, but the project owner has not confirmed it explicitly. A circle is named by its circle id, not by a key. So the circle key can be replaced: k Heart members (three of four in the live circle) replace a stolen or lost one with public notice, and the witnesses book the change into the ledger. Decided 17 October 2026, C5 (below). The notice is no longer a fixed 72 hours but a circle setting, 72 hours by default. [Decided 23 Oct 2026, E-1]
• The time values and limits are circle settings. Every circle sets its own periods (72 hours, 90 days, 30 days, 7 days, 10 minutes, the validity of an act, the daily refusal limit). The values in the definitions are only defaults; the Circle Heart changes them within the bounds of the definitions. There is no world rules record and no signer of it any more. The same for every circle: a project needs at least three Heart votes for and none against; the money and gravity computation is the same. [Decided 23 Oct 2026, E-1] This replaces C1 and 1A (below, under settings).
• Members come and go by a public rule. The Heart chooses whether the circle admits anyone, only by invitation, or at most so many members with a waiting list [Decided 23 Oct 2026, E-6]. The Heart can exclude a member for 3 months [Decided 23 Oct 2026, E-3]. A person moves from circle to circle only with a reference, which is issued by itself once the member says "I want to leave" and has settled [Decided 23 Oct 2026, E-9]. A person is a member of one circle at a time; only a member of an existing circle founds a new one, and each key founds one circle [Decided 23 Oct 2026, E-8].
• Everything is public, for ever: every proposal, vote, reason, decision and every payment. The ledger knows people only by their key (BSA ID). A name lives only in the Lana profile and in the member home, which the person can change at any time. Decided (question 5). The exception is the OWN processes: they run encrypted in the OWN apps, and only the decision reaches the ledger [Decided 23 Oct 2026, E-4]. This is a tension with principle 1 (below, under OWN processes).

Who is who in a circle#

The circle's witnesses#

Decided (the project owner, 16 October 2026, question 3: "yes, as the assistant proposes, no money cap"): a circle starts with one witness and says so in public; there is no money cap; then four witnesses with four different owners, three must agree; at most one witness per owner. Decided 23 Oct 2026, E-7 (»A niso priče računlaniki in se določajo z žrebom«, "But aren't witnesses computers, and they are chosen by lot"): witnesses are computers, chosen by lot among the circles' computers; until there are enough circles to draw from, a circle has one witness, its own computer, labelled in public; the Heart's vote is only for exceptions. This replaces the part of decision 3 "the circle chooses and replaces its witnesses itself". The procedures below (the draw, the exceptions, changing the node, when the node keeps someone out, when a witness lies) are the direction for phase I or proposals, unless marked otherwise.

What a witness does. A witness is like a witness at the signing of a contract, except that it recomputes every number itself. When the node proposes a new block, every witness checks it from start to end: the payers' signatures, cover, the wave, every account line after the entry, and that the circle's sum is exactly zero. It takes its computation from nobody; it builds it only from the blocks on the relays. Only then does it sign the block. At one block number it signs one block only, never two different ones.

Every witness has its own relay with the circle's whole history. Every day it publishes a statement: the state of the circle it computed and a fingerprint of all its votes that day. A single vote is shown on request or as evidence (question 23).

How many. Four witnesses; three must agree. One may break or even lie, and nothing happens. If two do not work, payments wait while reading goes on. Nobody can damage the ledger meanwhile, because nothing counts without three signatures. Proposal (Open 3a): in a circle above about 10,000 members there are seven witnesses and five must agree. Whether one owner may then hold two is for the project owner to decide; until then at most one.

When a payment counts. Decided (question 1). When a majority of witnesses (three of four) has confirmed the block and at least three relays hold it. The payer sees "paid · public on N of M relays". Whether sending to the other relays continues without waiting is question 17.

Who the witnesses are. Witnesses are the circles' computers. They are chosen by lot among the circles' computers (below), not by the circle itself [Decided 23 Oct 2026, E-7]. Until there are enough circles to draw from, a circle has one witness: its own computer in the box, labelled in public (decision 3, unchanged for 0.3.0) [Decided 23 Oct 2026, E-7]. Every witness is named in public together with its owner. Decided: at most one witness per owner. Two witnesses with one owner would already be too many: that owner, together with two different honest witnesses, could sign two different blocks with the same number.

Independent does not mean "needs nobody". Decided (question 3): the circle can replace any relay without asking anyone, and it depends on no other circle and on no server. With the draw the circle no longer chooses its witnesses itself: it gets them from the network of circles and is itself a witness for other circles. The Heart removes a witness that misbehaves until the next draw [Decided 23 Oct 2026, E-7]. So the circle depends on no single other circle, but it does depend on the network of circles. Said plainly: this is a tension with principle 5 (every community is technically independent); phase I must show how a circle stays a cell of its own [Consequence].

The witness draw: the direction for phase I. [Decided 23 Oct 2026, E-7: the direction; the details of the draw are phase I; 0.3.0 has no code for it]

1. Every circle puts its computer into a common draw. So every circle is a witness for other circles and they for it; "everything keeps circulating" (the owner's words).
2. The draw comes from a public random number that nobody knows in advance and nobody can choose, for example a block of the Lana chain.
3. The schedule changes regularly and is known in advance, so a new witness gets ready in time.
4. A new witness loads the circle from the latest seal and from there on checks everything itself.
5. Open for phase I: fake circles (whoever makes many empty circles would get more places in the draw); matching the load (a large circle must not get too small a computer); absent witnesses (what happens when a drawn witness does not work).

Exceptions: the Heart's vote. [Decided 23 Oct 2026, E-7] The Heart's vote is only for exceptions, for example to remove a witness that misbehaves until the next draw. For every such change (a new witness, a replacement, a removal, a recovery) at least three Heart members must be for (the threshold is the larger of k and 3; three of four in the live circle) and no Heart member against [Decided 23 Oct 2026, E-10: always at least three]. The new witness signs that it accepts the role. The change is public for as long as the notice of a change runs: 72 hours by default, a circle setting [Decided 23 Oct 2026, E-1]. The current witnesses write it into the ledger; the new witness starts with the block after that entry (clarification, 17 Oct 2026 (D4 review)).

A change of the circle's relays goes by an act of k Heart members with the same notice [Proposal; the notice: Decided 23 Oct 2026, E-1]. A new relay first receives the circle's whole history, and only then is it listed.

When a witness leaves. Proposal (D4 review, round 3, 17 Oct 2026). A witness may resign at any time, alone, by a signed act. The resignation takes effect after the notice of a change, 72 hours later by default [Decided 23 Oct 2026, E-1]. The Heart can also remove a witness, or replace it with a new one, by the rule for exceptions above (at least three for, no Heart member against). A new witness must accept the role first. The last witness cannot leave until another one has been added.

Changing the node. Proposal. If the node stalls, k Heart members and the current witnesses hand the node's role to another witness. There is no waiting, because this does not change who checks. Proposal (from the text of question 3): later the node's role rotates among the witnesses by itself.

When the node keeps someone out. Proposal. The node must return a signed receipt at once for every note it accepts. If the payer gets none within 10 seconds, they publish their note to the circle's relays as evidence, and the witnesses forward it to the node. A receipted note that is neither booked nor refused within a minute is public evidence. A node that keeps failing to book such notes is replaced. Evidence alone never stops the circle.

When a witness lies. A witness that signs two different blocks at one number leaves public proof behind. The Heart removes or replaces it by the rule for exceptions: at least three Heart members for, no Heart member against, with notice (72 hours by default) [Decided 23 Oct 2026, E-7, E-10 and E-1]. Such an exception is exactly what the Heart's vote is for. If more witnesses conspired than the circle can bear, everyone who recomputes the ledger and every member's app that checks its own lines would show it. Other circles then stop accepting this circle's payments, and the step outward bounds the damage outside.

Day one: one witness, labelled in public#

Decided (question 3): a start with one witness, a public label, no money cap. Decided (question 2): the circle has its own box relay and in total at least four relays with at least three owners. How the Lana relays count is question 14.

A circle may start with a single witness, its own server in the box. The live circle starts this way too. A single witness is still vulnerable: it can break, or someone can steal its key. So:

• the app says in a visible place "one witness · not yet decentralised";
• there is no money cap (the owner's decision);
• anyone can recompute the ledger every day and restore it from the relays as a check; the result is public;
• every member's app checks by itself that exactly one block exists at its block number;
• relays: the circle has its own box relay from the first day and in total at least four relays with at least three owners (decided). The Lana relays are a borrowed home for small circles. Whether the four Lana relays count as one owner, and what holds until their owner applies the write rules for ledger records, is question 14 (below).

What this start does not prevent: a wrong entry can be booked before anyone notices. There is no money cap, so only the daily check that anyone can run, and every member's app, catch it. Replacing the only witness then also rests on the Heart alone. Until there are enough circles to draw from, the circle stays with one witness; once there is a draw (phase I), the draw assigns its witnesses, until three of four must agree [Decided 23 Oct 2026, E-7].

The Circle Heart: a Heart member, three other Heart members#

Decided (the project owner, 16 October 2026, question 4: "the first people of the first circle (all of them)", and answer 4a: "I am then add a fourth person too"): the live circle has four: the founder and three other Heart members. Decided (question 8 and answer 4a): nobody decides on their own project. Decided 23 Oct 2026, E-2 (»Upravitelji bodo po novem Srce kroga, tako se bo njihova postavitev imenovala«, "From now on the stewards will be the Circle Heart; that is what their office will be called"; »tisti ki je ustvarili krog in ga negujejo tisti imajo moč... tisti, ki jim kaj ni prav gredo lahko ven in ustvarijo svoj boljši krog«, "those who created the circle and tend it have the power... those who don't like something can leave and create their own, better circle"): this is the Circle Heart; one person in it is a Heart member; the circle's members do not elect the Heart.

The Circle Heart is like the signatories of a society's account: a decision counts only if enough Heart members sign it.

• The name. The Circle Heart (SL »Srce kroga«); one person in it is a Heart member (SL »član Srca«) [Decided 23 Oct 2026, E-2]. The technical names in the records (steward_*, stewards_required) stay, since programs read them [Proposal].
• The live circle: the Heart is the founder and three other Heart members. Their keys (BSA ID) are entered when the Heart is written into the ledger; not now.
• Power lies with those who created the circle and tend it. The circle's members do not elect the Heart; the question "do members vote" is answered: no. Whoever disagrees leaves and creates their own circle [Decided 23 Oct 2026, E-2]. So the two election acts are dropped [Consequence].
• The Heart itself adds and removes Heart members. k Heart members sign the change (three of four in the live circle) [Decided 23 Oct 2026, E-2; k = 3: the proposal stays]. It takes effect after public notice, 72 hours by default; the notice is a circle setting [Decided 23 Oct 2026, E-1]. A new Heart member must accept the role first. The Heart changes k the same way [Proposal (D4 review, round 3)].
• The founder seats the first Heart in the found act [Proposal]. While a circle has fewer Heart members than a project needs (at least three), no project can pass, so all the community's money goes to the reserve (it follows from decision 8 and E-1). A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin") (decided 6c, below).
• What the Heart decides (k Heart members, unless marked otherwise): adding and removing Heart members, and k [E-2]; the circle settings [E-1]; excluding a member and readmitting after an exclusion [E-3]; closing an old account [E-3]; witnesses only in exceptions, with for votes and none against in the Heart [E-7] — these four need always at least three Heart members: the threshold is the larger of k and 3, and a Heart of fewer than three cannot do them [Decided 23 Oct 2026, E-10]; closing an OWN process (one Heart member; any member opens it) [E-4, E-10]; changing the circle key [C5]; closing a project that is already receiving [8e]; relays, the rate source, the list of circles a circle does not sell to, changing the node [Proposal]. One Heart member puts any other proposal to a vote (below) [Decided 23 Oct 2026, E-5; that one member is enough: Proposal].
• The Heart does not book. It only signs a decision. The witnesses make the booking, and only if the decision followed the rule: enough signatures, the notice has passed, the vote has ended.
• Never about themselves: a Heart member never decides on their own proposal (decided 10 October); their vote for does not count among the three Heart votes on a project they proposed or that pays them (the app already works this way today). Since the live circle has four, the other three can pass such a project.
• Resigning: a Heart member may resign at any time, alone, by a signed act. The resignation takes effect after the notice of a change, 72 hours later by default [Decided 23 Oct 2026, E-1; the procedure: Proposal (D4 review, round 3, 17 Oct 2026)]. The last Heart member cannot resign until another one has been added.
• Leaving the circle: a Heart member who leaves the circle loses the Heart seat (at once, by an entry in the same block; k goes down when it is above the number left); the last Heart member cannot leave until the Heart adds another [Decided 23 Oct 2026, E-11].
• An excluded Heart member first loses the seat in the Heart. Coming back after an exclusion, they are only a member, not a Heart member [Decided 23 Oct 2026, E-3].
• Without the Heart where possible. What a rule can decide, a rule should decide. So money goes to projects and on from the reserve by itself; so the first on the waiting list comes in; so a reference is issued.
• Said plainly (principle 3). The Heart has power in its circle that the members cannot take away by a vote. Principle 3 says there are no central authorities. The project owner decided this is right because anyone who disagrees can leave and found their own circle. What limits the Heart: everything is public and signed; every decision needs k signatures; the Heart cannot change the money and gravity computation nor the floor of three votes for a project; a single "against" of any member makes a project fall. But leaving is not free for everyone: whoever is in minus gets no reference and cannot move to another circle until the debt is settled (by them or by someone else). Whether this balance is right is for the project owner to decide. [Consequence of E-2 and E-9; tension with principle 3]

The consensus vote: all for, or it falls#

Decided 23 Oct 2026, E-5 (»Srce kroga lahko tudi daje na glasovanje predloge, ki rabijo biti v 100% sprejeti... to kar imamo danes v LanaAlignes.world... To je kot, da bi dal na glasnovanje projekt in vsi lahko glasujejo za, če je ne proti zadeva pade. Torej projekt rabi imeti vsaj 3 glasove za iz Srca kroga in nobenega proti in 72 ur biti na glasovanju«, "The Circle Heart can also put proposals to a vote that need to be 100% accepted... what we have today in LanaAlignes.world... It is like putting a project to a vote, and everyone can vote for; if someone is against, it falls. So a project needs at least 3 votes for from the Circle Heart and none against, and to be on the vote for 72 hours"; the addition: »Trajanje glasovanja, ok da je nakjrajsi 72 ur«, "The vote's duration: ok, the shortest is 72 hours"): a vote as in Lana Aligns, for or resistance. This replaces 8c.

• Who proposes. Any member proposes a project, as so far [Proposal]. A Heart member may put any other proposal to a vote: a short title and the text of the proposal [Decided 23 Oct 2026, E-5; that one Heart member is enough: Proposal].
• How long. The proposer sets how long the vote runs at publication; the duration never changes afterwards [Decided 23 Oct 2026, E-5]. The shortest duration is a circle setting, 72 hours by default [Decided 23 Oct 2026, E-5, addition]. The longest is a circle setting, 14 days by default [Proposal].
• Who votes. All members of the circle, for or against [Decided 23 Oct 2026, E-5]. Each member has one vote per proposal; their newest vote counts; they can change it until the end of the vote [Decided 23 Oct 2026, E-5]. An "against" carries a short public reason; a "for" carries none [Decided 23 Oct 2026, E-5]. A vote cast after the end is refused [Consequence].
• When it passes. At the end of the vote a proposal passes only if no member is against and at least three Heart members are for (a circle setting, never below 3) [Decided 23 Oct 2026, E-1 and E-5]. For a project, the proposer's and the recipient's "for" do not count among those three (nobody decides on their own project) [Consequence of decision 4a]. The same holds for any other proposal: no "against" and at least three Heart members for, except that here the proposer's own "for" counts ["none against": Decided 23 Oct 2026, E-5; three Heart votes for any other proposal too: Proposal; the proposer's vote counts: Decided 23 Oct 2026, E-11]. Votes are counted with the roles at the end of the vote [Proposal].
• Otherwise it falls. A proposal that fell may be proposed again, changed [Decided 23 Oct 2026, E-5].
• What follows. A project that passed opens and starts receiving money (below, under projects). Any other proposal that passed is a public decision in the ledger [Decided 23 Oct 2026, E-5].
• What is dropped. The 72 hours of public notice before approval, the objection that stops a project until the objector withdraws it (8c), a public answer to every objection before approval (10 and 15 October), the approval by three, and rule C4 "no special rejection by one person, only an objection stops a project" [Consequence of E-5]. Said plainly: now a single "against" from any member, a Heart member included, makes a project fall; there is still no separate act "I reject".

Projects: the community's money always goes to projects#

Decided (the project owner, 16 October 2026, question 8): "money always goes to projects, which have no key". A receiving project receives up to its amount. Gravity and the wave-growth counter-bookings flow into it. Surplus goes to the reserve. When a new project passes, the reserve moves to it by itself. "So projects are always what gets funded." Decided (the project owner, 16 October 2026, answers to the open points): a project pays its doer once it has collected the whole amount (8a); inflow goes to projects in order, with no limits for now (8b); a project is closed with public notice, and a project that does not fill within 90 days ends by itself (8e); paying a project does not use up the community's money (8f). An earlier decision stays: a proposer never decides on their own proposal (10 October 2026). 8d follows from decision 8. Decided later the same day: 6c (the start for the reserve at founding). Decided 23 Oct 2026, E-5: a project is decided by the consensus vote "all for, or it falls" (above); this replaces "three approve it and nobody objects" of decision 8, the objection of 8c, the 72 hours of notice and the answer to every objection (10 and 15 October), and C4. Decided 23 Oct 2026, E-1: a project's periods are circle settings with defaults (72 hours of notice before closing, 90 days, 30 days). Open: 8g and 8h.

The project replaces Common Good and the community order. Common Good as one wallet, from which an order used to be paid, no longer exists. Nor does the fund key.

A project wallet has no key. It is like a safe for which no key exists. Nobody opens it by hand. It opens only when the conditions written on it are met, and every witness checks them. The same holds for the reserve.

The life of a project.

1. Proposal. Any member publishes a project: what should be done for the community, who does it, what it costs and how long the vote runs (at least 72 hours by default) [Decided 23 Oct 2026, E-5]. What it costs is the project's amount. There is no amount limit and no other limit for now (decided, 8b). The project's image is on three independent file servers; on the relays are its fingerprint and address (question 24).
2. The doer consents. Whoever carries the project out (the recipient) confirms by signature that they take it on, or declines it (proposal: as today for an order). Whoever proposes a project for themselves has confirmed it by proposing it.
3. The vote. All members vote, for or against, until the end the proposer set (above, "The consensus vote: all for, or it falls"). An "against" carries a short public reason. [Decided 23 Oct 2026, E-5]
4. Passed or fallen. At the end the project passes only if no member is against and at least three Heart members are for; the proposer and the recipient do not count among those three. Otherwise it falls, and it may be proposed again, changed [Decided 23 Oct 2026, E-5]. The proposer may withdraw it earlier; if the recipient declines it during the vote, the project ends and its votes with it [Consequence].
5. Opening. A project that passed opens once the recipient has consented (proposal: as today) and, for a step raise, once the step fits under what was built. A project opens once its last condition holds, even when no act brings that about; projects that passed are re-checked in order of publication after every entry (clarification, 17 Oct 2026 (D1 review)). A project that has not opened 30 days after publication (the default; a circle setting) expires (proposal, as today for an order).
6. Receiving. An open project starts receiving. The reserve moves to it by itself, up to the project's amount. Then the inflow (below) flows into it.
7. Up to its amount. The project receives up to its amount. Whatever comes beyond goes on: to the next receiving project, otherwise to the reserve.
8. Payment to the recipient. Once the project has collected its whole amount, the rule pays it in full to the recipient (decided, 8a). As with every receipt, the recipient's wave grows, and the counter-booking goes on as inflow. Whether the recipient must be a member of the circle is Open 8h (proposal: yes).

Inflow. Into a receiving project flow:

• gravity: what the morning gravity takes from members' balances;
• wave-growth counter-bookings: when a member receives a payment below the wave cap, their wave grows and the same amount goes to the project. It used to go to Common Good. The project owner called them "new steps"; this is not the step outward;
• contributions: a member may pay a receiving project and name the project in the payment. Proposal (Open 8g): a member gives only their plus, as today, not from the wave; the project gets at most what it still lacks to its amount; anything more goes to the reserve; a contribution naming no project goes to the reserve; a contribution to a project that is not receiving yet is refused;
• returns that used to go to Common Good (for example when the step outward is lowered) now go the same way as inflow.

How this runs in the ledger. Every inflow goes to the reserve first. In the same entry it goes on from the reserve to the project that is receiving, up to that project's amount. So the reserve is empty while any project can still receive. This is exactly the owner's "the wallet that holds the reserve moves on automatically". Every receipt thus makes a single move in the ledger, as today. The reserve is passed on to the projects after every entry, not only after one that brought money into the reserve; so a project that a contribution fills exactly is paid too (clarification, 17 Oct 2026 (D1 review)).

Paying a project does not use up the community's money. Decided (8f). When a project pays a doer who is below the wave cap, their wave grows by the whole amount, and the same amount goes on at once, to the next project or to the reserve. So the real brake on projects is the vote (three Heart votes for and nobody against), not money [Consequence of E-5]. That is why the rule stays that a Heart member's "for" does not count on a project that pays them. The sum stays zero. Only raising the step outward is different (below): the step account has no wave, so such a project really does use up community money.

Several projects at once. Decided (8b): inflow goes to projects in the order they started receiving. First to the oldest until it is full, then to the next, and only at the end to the reserve. There is no amount limit and no other limit for now. To be honest: one large project then holds back every project behind it for a long time.

The reserve. The reserve is a circle wallet without a key. Surplus goes to it when no project can still receive. When a new project starts receiving, the reserve moves to it by itself, up to its amount. What remains waits for the next project. This is not the former "reserve statement" about the bank; that was dropped by decision 6.

When there is no project. Follows from decision 8 (8d): all inflow stays in the reserve.

The vote against. Decided 23 Oct 2026, E-5: a single "against" of any member that stands at the end of the vote makes the project fall. An "against" carries a short public reason and can be changed until the end of the vote. Once the project is receiving, no vote stops it any more, since the vote has ended; this matches the owner's "once it receives, it receives up to its amount". This replaces the objection (8c) and the answer to every objection before approval (10 October) [Consequence of E-5].

The sum stays zero. Gravity and the wave-growth counter-bookings now go to a project or the reserve instead of Common Good. Money only moves, so the circle's ledger still sums to exactly zero after every block.

Money on a project that is already receiving. Decided (8e): if the doer steps back, leaves the circle or loses their key, or if the project turns out to be bad, the Heart closes it with public notice. The money goes to the reserve and from there to the next project. A project that does not fill within 90 days ends by itself; its money also goes to the reserve. The closing notice (72 hours by default) and the 90 days are circle settings [Decided 23 Oct 2026, E-1]. Proposal: k Heart members sign the closing (three of four in the live circle); the 90 days count from the day the project starts receiving. A closing counts only if at least k Heart members signed it who are still in the Heart when the closing is booked; otherwise the collected signatures do not count (clarification, 17 Oct 2026 (D1 review)). Proposal (not part of the answer): the money of a project that is already receiving also goes to the reserve without a decision of the Heart when the doer declines the project, leaves the circle or is excluded [excluded: Proposal], when the proposer withdraws the project, or when payment falls due and the doer is no longer a member. If the recipient of several projects leaves, the money of each project returns to the reserve and is passed on at once, project by project (clarification, 17 Oct 2026 (D1 review)).

The step outward and a payment to another circle that hangs. Decided (8j): raising the step outward is a project like any other. Nobody pays for a payment to another circle that hangs; it is settled by the receiving circle's public ledger. In detail below, under the step outward.

The circle's relays are paid by a project, like any other project (question 15, proposal).

No deposits and no payouts#

Decided (the project owner, 16 October 2026, question 6: "funds are never paid out", and answer 6a: "Forget deposits of money, because that is a completely different system"): BSA has no deposits of money, no payouts and no bank data. Bank matters belong to Lana.

• There are no deposits. There are no custodians, no deposit confirmations and no deposit corrections. The wave grows only with what a member receives.
• The circle's main account is no longer needed. It stood for money paid in. Since there are no deposits, we do not need it.
• There are no payouts. Payout requests, payout confirmations and amounts held for payouts no longer exist.
• Bank data is nowhere. Account numbers, statements and their fingerprints are not there, because the system does not need them. The monthly reserve statement about the bank no longer exists.
• There is no deposit alarm, since there are no deposits.
• Deposits and payouts were removed from the program on 17 October 2026 (step D0). A copy of the live database showed first that there had never been a deposit or a payout.

Every act and its public rule#

An act is a short signed note: "I propose", "I vote for", "I vote against, because …", "I invite", "I want to leave", "we exclude". A person signs it in their own browser. It has a validity period of at most 7 days by default (decided 17 October 2026, C3; since 23 October 2026 a circle setting, E-1). It counts only once it is written into the ledger, and in order, so every deadline is the same for everyone and anyone can check it. Whether someone was allowed to sign it is judged by the roles at the block number where the act is booked. When a period ends, the next block must first write everything that has fallen due; the witnesses do not sign a block that leaves something out. If several deadlines fall in the same second, the return after a closing notice comes first, then the lapse of a receiving project, then the lapse of a project that never opened, then the end of a vote, then the expiry of a payment request and then a resignation; within one kind in order of publication (clarification, 17 Oct 2026 (D1 review); the end of a vote in this order: Proposal). An act that does not pass is refused by the node. Only refusals of members and of those applying to join are booked, by default at most 20 refusals of one key a day; anyone else only gets the answer (decided 17 October 2026, C3; the limit is a circle setting since 23 October 2026, E-1).

That settings, project decisions and membership each get their own signed public record is decided. There are no deposits and no payouts (decision 6 and answer 6a). For a project, the following are decided: the consensus vote "all for, or it falls", with a duration the proposer sets at publication, at least 72 hours by default, and at least three Heart votes for (E-5, E-1); "up to its amount"; payment once the whole amount is collected; closing with notice and ending after 90 days. It is also decided that raising the step is a project, and that a payment to another circle that hangs is settled by the receiving circle's public ledger. It is decided that k Heart members replace a stolen or lost circle key with public notice and that the witnesses book the change (C5); the notice is a circle setting, 72 hours by default (E-1). Also decided: joining (E-6), exclusion and closing old accounts (E-3), the reference (E-9) and the witness draw (E-7). All periods and limits are circle settings (E-1, below under settings). Everything else in the table is a proposal.

The step outward#

Decided (15 October 2026): the step is a public decision, by the same procedure as a project (formerly: as an order). Decided (the project owner, 16 October 2026, answer 8j): raising the step is a project like any other; nobody pays for a payment to another circle that hangs, it is settled by the receiving circle's public ledger. Decided 23 Oct 2026, E-5: the step too is decided by the consensus vote "all for, or it falls".

• Raising the step is a project like any other. A member proposes it and it goes to a vote: it passes only with no "against" and at least three Heart votes for [Decided 23 Oct 2026, E-5]. It fills with gravity and new steps, like any project. Once it is full, the circle's step rises by that amount. Proposal: the recipient of such a project is the step-outward account. The step may not exceed what the members have really built (decided 15 October). What was built is the sum of balance and wave of every member account, members who have left or are excluded included, since their money is still in the circle (clarification, 17 Oct 2026 (D1 review)); a closed account has neither balance nor wave any more [Consequence of E-3].
• To be honest: the step account has no wave. So money that goes into the step does not go on to other projects, as it does when a doer is paid (8f). Raising the step really does use up community money.
• Lowering (proposal) goes to a vote like a project, but never below what is already used. What is freed goes on as inflow: to a receiving project, otherwise to the reserve. In 0.3.0 the ledger does not book it yet, since its rule is not complete [Consequence].
• A payment to another circle that hangs. When a member pays into another circle, their circle holds the amount. The receiving circle may book the note only before its expiry, by default at most 10 minutes after signing (the existing note rule; the time is a circle setting since 23 October 2026, E-1). If the other circle does not answer, nobody pays for it. After 7 days (the default; a setting of the payer's circle, E-1) the payer's circle itself looks into the receiving circle's public ledger on the relays (the blocks and seals up to the note's expiry):
  • if the receiving circle did not book it, and its daily seals cover the whole time up to the note's expiry, the held amount goes back to the payer, and the entry names the receiving circle's seals as its evidence, together with the seal just before them; every witness checks those seals against the receiving circle's blocks, not only its seals. That no block was left out is shown by the receiving circle's next block, booked after the last seal's morning. If that circle has booked nothing since, its next daily seal shows it instead; before using it, the witness confirms on at least two of that circle's relays that no new block exists. If any of this is missing, nothing is booked; if the receiving circle has stopped working, the amount stays held. Proposal: only a block signed by a majority of the receiving circle's witnesses counts; a block that no majority of the witnesses in office at the time signed (for example one signed only with an old or stolen key) is ignored, so it cannot stop the return, and a change of key or witnesses in the receiving circle does not stop the check; a key that was itself that majority at the time (for example the only witness of a one-witness circle, whose key was later stolen) can still sign a second block with the same number, and then the evidence is not used and the amount stays held;
  • if it did book it, the payment stands;
  • if the receiving circle's ledger cannot be read, the payer's circle waits. It never guesses, and meanwhile it goes on booking everything else.
• Waiting alone never undoes a payment; only what the receiving circle's public ledger says returns it. The former rule, that the community refunds the payer by public decision, is dropped.
• Other circles see the whole ledger. The three numbers (step, used, built) are what they decide by. Every circle keeps its own list of circles it does not sell to.
• A sales limit for any one circle stays only an option (proposal P5). Since the ledger is public and checked by witnesses, any circle can recompute another circle's step itself, so the limit is hardly needed any more.

The circle's settings#

Decided 23 Oct 2026, E-1 (»Dejmo da lahko upravitelji spreminjajo svetovna pra vila zase, ker na koncu edino kar je pomembno je balance«, "Let the stewards change the world rules for themselves, because in the end the only thing that matters is the balance"; »1 da... vendar 72 ur ne more biti fiksno to je lahko default nastavitev, ki jo lahko spremeinijo«, "1 yes... but 72 hours cannot be fixed; it can be a default setting that they can change"): every circle sets its own periods and limits; the values in the definitions are only default settings, which the Circle Heart changes within the bounds of the definitions. There is no world rules record any more. This replaces C1 and 1A.

• They are all circle settings. Besides the wave, gravity and the longest time a block stays open, every period and limit that used to be a world rule is now a circle setting, together with new settings for the vote, the exclusion and joining [Decided 23 Oct 2026, E-1, E-3, E-5, E-6]. All are whole numbers. The definitions give each setting its bounds [the bounds: Proposal].

• The longest vote may not be shorter than the shortest one and must be shorter than the time within which a project must open, or a project that passed could never open [Proposal].
• The same for every circle (these are not settings): a project needs at least three Heart votes for and none against; the money and gravity computation is the same for every circle [Decided 23 Oct 2026, E-1]. A few fixed clock margins stay the same too (for example 5 seconds of allowed clock difference), since they are not rules a community lives by [Proposal, as before].
• 72 hours are fixed nowhere. The notice before a change of the circle key, the witnesses or the Heart members is a circle setting as well, 72 hours by default [Decided 23 Oct 2026, E-1]. This changes C5 ("a fixed 72 hours").
• How the Heart changes settings. A Heart member proposes the whole new set at once; k Heart members sign it (three in the live circle). At most one such proposal is open at a time. Once there are k signatures, the public notice starts. The new settings apply from the first block after the notice ends; the ledger writes them into its state, so everyone sees them. If fewer than k of the signers are still in the Heart when the notice ends, the change is void. [Decided 23 Oct 2026, E-1: the Heart changes them; the procedure: Proposal]
• A stolen key cannot skip the warning. The notice lasts at least change_notice_s (72 hours by default); and if any period changes, at least as long as that period was until now. Example: if the Heart shortens the notice from 72 to 24 hours, the new value applies only after 72 hours. [Proposal, E-1; not yet confirmed by the project owner; it does not limit the Heart, it only says when a change applies]
• Never retroactive. A deadline already running keeps its length: a vote, a project's open and receive lapse, a closing notice, the check of a payment to another circle, an exclusion, an invitation and the notice of a change. A project opened with a 90-day lapse keeps 90 days even if the Heart later sets 30. A member keeps their cap when wave_cap changes. [Decided C1 and E-1: never retroactive; recording the deadline when it starts: Consequence]
• During the notice apps sign with the stricter of the two values [Proposal].
• Across circles each circle applies its own values to its own side. A mismatch can only end in a refusal and a return to the payer: nothing is lost, and the sum of both circles stays zero [Proposal; in detail in the document "The ledger on the relays"]:
  • the payment note: the payer's circle judges it by its own note time, the receiving circle by its own; if the receiving circle's time is shorter, it refuses the note and the payer gets the held amount back; the app signs with the shorter of the two times;
  • the rate quote: the receiving (seller's) circle's validity counts, since the quote is its own; if the payer's circle read an older value, either it does not pay, or the receiving circle refuses the payment and the payer gets the amount back;
  • the 7 days of a payment to another circle: only the payer's circle uses them, for its own holds; too short a time can only find the evidence incomplete, so the circle waits and repeats the check, never returning early.
• Said plainly (principle 3): with this the world rules record goes, and with it the only key that had power over every circle (1A). The tension with principle 3 from 1A is removed; inside a circle that power now lies with the Heart (above, under the Circle Heart). A circle with fewer Heart members than a project needs passes no project; its start stays in the reserve.
• Decided 17 October 2026, C7: the time zone, the morning hour and the version of the time-zone database are written at founding and do not change in version 0.3.0. A later version of the definitions may say how a circle follows new clock-change rules. If the morning hour fell right into a clock change, the first of the two equal hours counts, or the first moment after the skipped hour. Decided 17 October 2026 (evening), 2A: a witness computes the morning hour with the time-zone database version the circle wrote at founding, not with its own newest one; in 0.3.0 not even the Heart can replace that version. Proposal: a witness that does not have that version signs no morning block and no seal.
• The circle writes into its ledger which version of the definitions it runs on. So nobody can swap its definitions while it runs (question 20). The settings in force are in the ledger's state at every block [Consequence of E-1].

The circle's rate source#

Decided (the project owner, 16 October 2026, question 7: "the seller's circle proposes the exchange rate and the buyer accepts it"): the receiving circle quotes the rate from a source it chooses itself; the payer accepts it or not. Decided (the project owner, 16 October 2026, answer on the starting source): for a start the European Central Bank's daily rate, the app shows the rate's date, a quote is valid for 10 minutes (since 23 October 2026 the default; a circle setting, E-1). Proposal: an alert for a stale rate and how a circle changes its source.

• When a member pays into a circle with another currency, the receiving circle (the seller's circle) quotes a rate. The rate quote is a public signed record: source, rate, time and validity. The node of the seller's circle signs it.
• The payer decides alone. The app shows the converted price. If it suits them, they sign the payment with both amounts. If not, they do not pay.
• Both circles' ledgers carry both amounts and a reference to the quote.
• The circle chooses its source itself: an outside service, or some day a record on the relays.
• For the start, decided ("something that will work for a start"): the source is the European Central Bank's daily reference rate (public, free, EUR, USD, GBP). The circle's node reads it once a day. The app shows the rate's date. A quote is valid for 10 minutes (the default; a setting of the receiving circle, E-1). To be honest: the bank itself says its daily rates are for information only and should not be used for transactions; it publishes them once per working day, so a rate can be a day old, or 4 to 5 days over holidays.
• Proposal: the Heart members are alerted when the rate is older than 120 hours.
• Proposal: the circle changes its source by an act of k Heart members, at any time.
• This replaces the earlier decision that the owner's rate key signs the rate every hour for all circles, and the proposal of a publisher list with the middle rate. The owner's rate key is no longer needed. Some day it may be one of the sources a circle chooses.
• In detail: the document "Currencies and exchange rates".

Recovery with notice#

Proposal; the condition "at least three Heart members for and no Heart member against": Decided 23 Oct 2026, E-7 and E-10.

If too few witnesses are left for enough of them to agree (after a fire or a theft, for example), at least three Heart members (the larger of k and 3) sign a recovery: a new group of witnesses and the last block number they found anywhere; no Heart member may be against [Decided 23 Oct 2026, E-7]. The recovery is public for as long as the notice of a change runs: 72 hours by default, a circle setting [Decided 23 Oct 2026, E-1]. If a valid block above that number appears anywhere during that time, the recovery is void. The ledger continues at the highest number found on any circle relay or archive relay. Meanwhile reading works and payments wait.

A vote against is signed and public#

Decided 23 Oct 2026, E-5: a vote against carries a short public reason. Decided (question 5): the ledger knows people only by their key, and every free-text field carries a warning. This replaces question 21 (an objection signed and public).

Every vote is signed and public with the key (BSA ID) of whoever casts it. An "against" carries a short public reason; a "for" carries none [Decided 23 Oct 2026, E-5]. The app shows the name from the Lana profile next to the vote. Since a single "against" makes a proposal fall, everyone sees who cast it and why. A vote can be changed until the end of the vote; the newest counts, and the earlier one stays in the ledger [Decided 23 Oct 2026, E-5]. A mistake is not deleted; a correction is added. The short reason of an exclusion is public the same way [Proposal].

Decided (question 5): the ledger knows people only by their key. A name lives only in the Lana profile and in the member home, which the person can change at any time; a relay keeps only the newest version. The ledger never copies a name. When a person changes their name, it is no longer known what belonged to whom. To be honest about it: a name may survive in old copies of a profile that someone saved, and in free text someone writes; the ledger itself does not carry it. So at every free-text field (payment purpose, the reason of an "against", the reason of an exclusion, the title and description of a project or proposal) the app says: "public for ever; do not write names, personal or bank data". A legal review before the first booking is no longer a condition, and free text does not go into a separate record beside the chain.

Wallets without a key#

Decided (question 8): project wallets and the reserve have no key. Decided (the project owner, 16 October 2026, answer 8i): the world account and the step-outward account have no key either. Decided 23 Oct 2026, E-3 (confirmed): when the Heart closes an old account, the reserve returns the value of its wave to the account »izvor« ("origin").

Today the server holds a key with which it pays orders from Common Good. Whoever has the server can spend the community's money. That key loses its power to pay.

The circle's main account stood for money paid in. Since there are no deposits (answer 6a), we no longer need it.

Money goes into and out of the keyless wallets only by a rule that every witness checks:

• inflow (gravity, wave-growth counter-bookings, contributions, returns) goes to the reserve and, in the same entry, from it to a receiving project;
• the reserve moves to a new project when it starts receiving;
• a project pays its recipient once it has collected the whole amount (8a);
• a project to raise the step pays into the step account (8j; the step account as its recipient: proposal); what a lowered step frees goes on as inflow (proposal);
• the world account holds the amount of a payment to another circle and returns it to the payer only if the receiving circle did not book the payment (8j);
• the money of a project that the Heart closes, or that does not fill within 90 days, goes to the reserve (8e);
• when the Heart closes an old account, the reserve covers its minus up to 0 (only if the member has died) and returns to the account »izvor« ("origin") as much as the account's wave was; the wave goes to 0 and the community has that much less money [Decided 23 Oct 2026, E-3, confirmed; a minus only on a death: the E-3 addition].

Joining a circle#

Decided 23 Oct 2026, E-6 (»Srce kroga lahko tudi omeji sprejamnje avtomatsko novih članov... v tem primeru se lahko nov član pride samo še na povabilo (recimo se ustvari nek posebno vabilo s strani člana... Upravitelji pa lahko omejijo skupnost na največje dovoljeno število in potem je waiting lista.«, "The Circle Heart can also limit the automatic admission of new members... then a new member can come only by invitation (say, a special invitation from a member is created... And the stewards can limit the community to the largest allowed number, and then there is a waiting list"; to the proposal: »6. ok«).

• Three options; the Heart chooses. Open: anyone comes by themselves. Invite only: a new member comes only with a member's special invitation. A maximum number of members with a waiting list: it combines with either [Decided 23 Oct 2026, E-6]. These are circle settings (invite_only, max_members, invite_ttl_s); the Heart changes them like any setting, with notice [Consequence of E-1]. By default a circle is open and has no member limit [Proposal]. A new circle is always founded open (invite_only 0): an invitation is a member's act and a new circle has no member yet, so a circle founded by invitation only could never take its first member; the Heart turns "invite only" on once the first members are in [Clarification, review of round 5, 23 Oct 2026].
• The invitation. A member signs an invitation for one key. It can be used once and is valid for 7 days (the default; a circle setting) [Proposal: so it reads in decision E-6 too]. Once it is used or expires, it no longer counts.
• The waiting list. If the circle is full, the application goes on the waiting list. When a place frees (a leave, an exclusion, an account closed, a change of the setting), the first on the waiting list comes in by itself, in order of application [Decided 23 Oct 2026, E-6]. Whoever on the list says "I want to leave" withdraws their application with it [Proposal].
• An excluded person never comes from the waiting list. The Heart always decides about an excluded person (below, under exclusion) [Decided 23 Oct 2026, E-6].
• From another circle only with a reference. Whoever was a member of another circle comes only with the reference of their last circle (below). This is a rule for every circle, not a setting [Decided 23 Oct 2026, E-9]. Whoever has never been in any circle needs no reference [Proposal].
• One circle at a time. Whoever joins a new circle has already left the old one [Decided 23 Oct 2026, E-8]. The member home (30916, the newest counts) and the reference make sure of it [Consequence of E-8 and E-9].

Exclusion#

Decided 23 Oct 2026, E-3 (»Upravitelji lahko izključijo vsakega člana s tremi glasovi za izključitev ... KO je član enkrat bil izključen je izključitev avtomatsko 3 meseci. Nato pa lahko član ponovno zaprosi za vstop o čemer odločajo Srce kroga«, "The stewards can exclude any member with three votes for the exclusion ... Once a member has been excluded, the exclusion is automatically 3 months. Then the member can apply to join again, which the Circle Heart decides"; »3. Da, vključitev nazaj nekoga ki je bil v srcu pomeni zgolj da je postal član ne potem avtomatsko da se vrne v srce«, "3. Yes, readmitting someone who was in the Heart only means they became a member, not that they automatically return to the Heart").

• Who. The Heart can exclude any member, a Heart member too [Decided 23 Oct 2026, E-3]. At least three Heart members sign the exclusion; in the ledger the threshold is the larger of k and 3 (3 in the live circle) [Decided 23 Oct 2026, E-3: "with three votes"; E-10: always at least three]. The key being excluded never counts toward its own exclusion [Proposal].
• When it takes effect. At once, when the last Heart member needed signs; there is no notice [Decided 23 Oct 2026, E-3].
• The reason. An exclusion carries a short public reason [Proposal; decision E-3 also marks the reason as a proposal]. It may name the event number of the OWN case it followed, never its content [Proposal, E-4].
• A Heart member first loses the seat in the Heart, then is excluded; at least one Heart member stays [Decided 23 Oct 2026, E-3; "at least one stays": Proposal].
• How long. An exclusion lasts 3 months, automatically [Decided 23 Oct 2026, E-3]. It is a circle setting, 90 days by default [Proposal, after E-1].
• The excluded person's money [Decided 23 Oct 2026, E-3]: the account stays and is frozen inside the circle: it pays nothing, gives nothing, does not vote and does not propose; it receives only a payment that settles its debt (below, under the reference) [the settlement: Decided 23 Oct 2026, E-9]. The morning gravity keeps visiting its plus. It may send its plus to another circle, at most as much as the plus, never from the wave. The minus stays with the circle.
• Their projects end as at a leave: a project not yet receiving ends; the money of a receiving project goes to the reserve and on [Proposal].
• When it ends the person may apply to join. The Heart decides: at least three Heart members, the larger of k and 3 [Decided 23 Oct 2026, E-3 and E-10]. The waiting list never admits an excluded person [Decided 23 Oct 2026, E-6]. If the circle is full, the Heart cannot admit them until a place frees [Proposal].
• Back only as a member. A former Heart member comes back only as a member, never automatically into the Heart [Decided 23 Oct 2026, E-3].
• The excluded and moving. An excluded person must settle before moving; without that they get no reference [Decided 23 Oct 2026, the E-3 addition and E-9].

The reference: moving to another circle#

Decided 23 Oct 2026, E-9 (»Odpustnico preimnuj v refrenco ... Torej ko nekod reče želim iztopiti iz kroga se refrenca izda sama če so izpolnjeni pogoji... če niso se je ne... nekdo ki ima dolg bo tako rabil nekoga drugega ki mu bo poplačal in v vsakem primeru se vrniti nazaj... brez refrence se ne prestopa ... / Sprejema se v nov krog samo z refrenco, brez tega ni nič«, "Rename the discharge note to reference ... So when someone says 'I want to leave the circle', the reference is issued by itself if the conditions are met... if not, it is not... someone with a debt will thus need someone else to pay it off, and in any case come back... without a reference nobody moves ... / A new circle admits only with a reference; without it there is nothing"). This replaces the "discharge note" (»odpustnica«) of the E-3 addition.

• Nobody moves without a reference. A new circle admits a person who comes from another circle only with a valid reference of their last circle. This is not a setting but a rule for every circle [Decided 23 Oct 2026, E-9].
• It is issued by itself. When a member says "I want to leave" (signs a leave), the reference is issued by itself if its conditions hold; otherwise it is not issued [Decided 23 Oct 2026, E-9]. If the conditions do not hold at the leave, the reference is issued by itself later, once they hold (when the debt is settled or the last OWN process closes), with no new act [Proposal].
• The conditions [Decided 23 Oct 2026, E-9]: no minus (a balance of 0 or more). An open OWN process together with a minus: no reference at all. An open OWN process blocks the reference also without a debt: the process has to be finished first [Decided 23 Oct 2026, E-9 (a)].
• The debt must be settled. A debt must be settled in any case; someone else may settle it too, by payments into the account, at most up to 0, also during an exclusion [Decided 23 Oct 2026, E-9; that a member of the circle or someone from another circle pays, and that no other payment reaches such an account: Proposal].
• What the reference says (a short report) [Decided 23 Oct 2026, E-9]: which projects the person published; which projects they took part in; which step (wave) they built, so they get the same in the new circle; that they have no open OWN process. Besides [Proposal]: the circle id, the membership period (from joining to leaving), the currency and the number of the block with the reference; "took part" means the projects that paid them; it names at most 100 projects of each kind, the newest.
• A new record. The reference is written into a new Nostr record [Decided 23 Oct 2026, E-9], KIND 43921 [Proposal: the number; it was free in the BSA family]. What counts is the reference entry in the old circle's ledger, confirmed by its witnesses; the 43921 is the copy one can find: the old circle's node signs it and publishes it on the circle's relays, and anyone can check it against that circle's public blocks [Proposal].
• How the new circle checks it [Proposal]: the application to join names the reference. The new circle's node checks that the reference comes from the circle the person's newest member home (30916) names, that it is for this key, that the old circle's block really carries this reference with the same step, and that the old circle's witnesses signed it. Whoever has no member home in any circle was never a member and needs no reference [Proposal]. Said plainly: this does not catch a deleted member home or a second key of the same person (that would need Lana's person check); proposal: the root relays never delete member homes [Proposal].
• The step in the new circle [Decided 23 Oct 2026, E-9: »da dobi istega tam«, "so they get the same there"; how: E-9 (b)]. In the old circle the balance is 0. The new circle opens the same step (wave) as the reference states. As with every growth of a step, the same amount goes to the new circle's community (a counter-booking from the new circle's account »izvor«, "origin"). The new circle sends that amount to the old circle's community (a payment between circles, at the rate at the time of the move if the currencies differ). The old circle closes the account (the wave goes to 0) and returns the same amount to its own »izvor«, by the closing rule (E-3): exactly the amount it received. Both communities stay as they were; »zadeva se izniči«, "it cancels out". This is how the definitions write it: the new circle opens the wave from its »izvor« ("origin") into its reserve and sends that amount to the old circle as a payment between circles, held until the old circle books or refuses it (the hold has no deadline; a silent old circle means waiting) [Decided 23 Oct 2026, E-11]; a reference is valid once: if the old circle refuses it, the new circle gets the amount back and takes the step away (the unused part of the wave goes to »izvor«, the person stays a member); a join with a step is not possible while an earlier move out of this circle is not settled [Decided 23 Oct 2026, E-11]; a circle accepts a reference once: the ledger records for good every reference on which it granted a step (a u3 line in the state, which a restore from a seal keeps too), and never accepts the same reference again — not at a join, not from the waiting list, not after a readmission, not after the person leaves and comes back [Decided 25 Oct 2026, E-13 (A)]; the old circle returns exactly the wave to its own »izvor« and closes the account (a plus that may be left stays, without a wave). Across currencies the amount is converted by the old circle's rate quote and rounded up [the shape: Proposal; §3.11 of docs/knjiga-na-relejih.md ("Membership, exclusion, the reference and closing accounts")]. Safety: below, among the proposals.
• The plus can go with the person. Whoever leaves (also to move) may send their plus to another circle, like an excluded person: at most as much as the plus, never from the wave [Proposal].
• Gravity skips nobody. Every morning visits every account, those who left and the excluded included, until they are closed. Before, the accounts of those who left were not visited, so leaving and coming back could escape gravity [Consequence of E-3: a plus "waits until gravity takes it to zero"].
• The founder of a new circle leaves the old one with a reference (below, under founding) [Consequence of E-8 and E-9].
• Said plainly (principle 5). To admit someone, the new circle must read the old circle's public ledger, as for a payment to another circle (8j). It needs nobody's permission, but it needs the other circle's public ledger; if it cannot be read, the person waits. This is a soft dependence on other circles, which principle 5 allows only as long as the circle keeps working on its own [Consequence of E-9].

Closing old accounts#

Decided 23 Oct 2026, E-3 (»Določeni stari računi se lahko brišejo in z njem tudi kapacitete... ko se brišejo bo Srce rabilo vrniti denar, da gre kapaciteta na nulo... se nikamor ne mudi in niti ni škode nobene če obtsane če pa ima skupnost preveč denarja in ne ve kam ga da je to lep način da odtsrani presežke sredstev«, "Certain old accounts can be deleted and with them the capacities... when they are deleted the Heart will need to return the money so that the capacity goes to zero... there is no hurry and no harm at all if it stays; but if the community has too much money and does not know where to put it, this is a nice way to remove surplus funds"); confirmed in the addition of 23 October 2026 (»ostalo si pravilno razumel«, "the rest you understood correctly"), with one correction: the circle covers a minus only if the member dies.

• Who. The Heart can close an old account: of someone who left, is excluded, moved away or died [Decided 23 Oct 2026, E-3]. At least three Heart members sign it: the threshold is the larger of k and 3 [Decided 23 Oct 2026, E-10]. The account of a Heart member still in the Heart cannot be closed [Proposal].
• A minus. The circle covers a minus from the reserve up to 0 only if the member has died [Decided 23 Oct 2026, the E-3 addition]. Whoever moves away in minus does not get the minus covered: it stays recorded in the old circle until someone settles it, and the person has no reference [Decided 23 Oct 2026, the E-3 addition and E-9]. The ledger cannot check whether someone died; the Heart judges that, in public and with signatures [Consequence].
• A plus waits until the morning gravity takes it to 0, or its owner sends it to another circle first [Decided 23 Oct 2026, E-3, confirmed].
• At 0 the account closes. The wave (the account's capacity) goes to 0, and the reserve returns the same amount to the account »izvor« ("origin"), where the circle's first money came from. The community has that much less money; this is a nice way to remove a surplus [Decided 23 Oct 2026, E-3, confirmed]. If the reserve has too little, the closing waits [Proposal]. A close always carries a short public reason, since the ledger cannot see a death, and it waits while part of the account's money is on its way to another circle [Proposal].
• Nothing is urgent. There is no harm if an account stays open [Decided 23 Oct 2026, E-3].
• "Deleting" means closing. The ledger deletes nothing: the account's history stays public for ever (principles 1 and 2); a closed account holds neither money nor a wave [Consequence]. A closing gives no reference [Proposal]. Whoever joins again with a closed account starts at 0 [Proposal].
• The sum stays zero. At the start the origin went into minus by the start; at every closing it gets back the value of the closed wave, and the reserve gives it [Consequence].

OWN processes#

Decided 23 Oct 2026, E-4 (»Upraviteolji tudi vodijo in ndazorujejo OWN procese. To dodaj«, "The stewards also lead and oversee the OWN processes. Add this"; »4. to je ok, kanseje dopolnimo v krogu dokumentacijo«, "4. that is ok, we will complete the documentation later in the circle").

• The Heart leads and oversees its circle's OWN processes [Decided 23 Oct 2026, E-4].
• The processes run in the existing OWN apps, encrypted. Only the decision reaches the public ledger, for example an exclusion after a process [Decided 23 Oct 2026, E-4]. An exclusion may name the event number of the OWN case, never its content [Proposal].
• A record that a process runs. So that the ledger can judge the OWN condition of a reference by itself, the ledger records when a process opens and when it closes, with no content: any member opens it (alone, at once), one Heart member closes it [Decided 23 Oct 2026, E-10: »1B, vendar OWN proces lahko sproži vsak«, "1B, but anyone can start an OWN process"]. Said openly: since an open OWN process blocks the reference (E-9 (a)), any member can hold another's reference back until a Heart member closes the process. A member who does this on purpose to harm another can be excluded for it by the Heart (the usual exclusion, at least three Heart members) [Decided 23 Oct 2026, E-10].
• The documentation. How OWN processes run in the live circle is completed later, in the circle itself [Decided 23 Oct 2026, E-4].
• Said plainly (principle 1). Principle 1 says everything is public. The content of OWN processes is encrypted; only that a process runs, and the decision, are public. This is a tension with principle 1 for the owner to decide [Consequence of E-4]. Another one: since an open OWN process blocks the reference also without a debt, the Heart, which leads the processes, can hold a person in the circle by opening one; this was said when it was decided [Decided 23 Oct 2026, E-9 (a)]. This is a tension with principle 3 (no central authorities); the safeguard is that opening a process is public and is signed by k Heart members [Proposal].

The circle key only stamps the mirror, and it can be replaced#

Decided (16 October 2026): the circle key is kept by the app and by whoever creates the circle. Proposal (it follows from decisions 3 and 8, but the project owner has not confirmed it explicitly): the circle key signs only the circle record, which is a mirror of the ledger, and, once, the found act in the first block. Decided (the project owner, 17 October 2026, C5: "I don't understand why you don't do this right away"; after the explanation: "You can do it all together in phase D"): a circle's name is its circle id, not a key; the circle key can be replaced.

The circle record on the root relays states the name, the currency, the witnesses with their owners, the Heart members, the relays and the rate source. It is like an extract from a register on a notice board: handy, but it decides nothing. The ledger decides. Every change of roles is first an entry in the ledger; the circle record only restates it. If the two differ, apps follow the ledger. The circle key is only the stamp on this extract.

A circle's name is its circle id, not a key. The circle id (SL »rojstna številka kroga«, the circle's birth number) is the fingerprint (event id) of the found act, the founding charter the founder signs. It is the circle's name for ever. It is not a key, so nobody can steal it. Another found act has another fingerprint, so it is another circle; a thief cannot make a false circle under the same name. Every tag of the circle and every keyless account come from the circle id, not from the key.

Changing the circle key. Decided 17 October 2026, C5. The Heart replaces a stolen or lost circle key:

1. A Heart member proposes the new key. The new key signs as well, as proof that it is really held (proof of possession, a proposal), so nobody can name a key someone else holds. It signs the circle id, itself and the time of the proposal, so this signature can never be used again later (proposal).
2. k Heart members sign the proposal (three of four in the live circle).
3. The proposal is public for as long as the notice of a change runs: 72 hours by default, a circle setting [Decided 23 Oct 2026, E-1; formerly a fixed 72 hours, C5].
4. The witnesses book the change into the ledger. The new key is in office from the next block (proposal).

The new key already signs the circle record of the change's own block, and from there on only it does (proposal). A record the old key signs for the state at or after the change never counts. The circle id does not change, and the ledger goes on. A stolen key and a lost key are replaced the same way. Proposal: the circle key is never the founder's, a witness's or a Heart member's key.

Said plainly, what a thief of the circle key can do until it is replaced (at least as long as the notice; 72 hours by default). They can sign circle records. Only a record that matches the ledger counts, so apps refuse a false one. But on a relay that keeps only the newest record of one key, a false record can push the real one aside; a new reader without the circle's link then finds no valid record there until the new key's record is out. A thief cannot make a false circle under the same name. Anyone can publish a record that names a circle id; it counts only when it is signed by the circle key that the ledger's mirror names at the block the record refers to (at the block of a key change already the new key). Said plainly: since the notice is now a circle setting, the Heart can shorten it (under the proposed bounds to one day at least), and the protection against a stolen key is then shorter; a shortening itself applies only after the current notice [Proposal, E-1].

The circle's real anchor is its circle id together with the fingerprint of the ledger's first block, the genesis digest (decided 17 October 2026, C5 and C6). The circle's link and QR code carry both, together with the addresses of at least two of its relays. Proposal: every daily seal and the circle's head in the directory (a pointer to the latest seal) name the circle key under the witnesses' signatures, so a reader of the directory finds the right circle record. A daily seal carries the circle key of the newest mirror in the ledger up to the last block it covers; if that block is the block of a key change, this is already the new key, which also signs the circle record for that block. The rule "the first ledger stands" (root relays remember the first genesis digest and founder for every circle id) goes into the letter to the Lana relay owner (phase G); it is now only extra safety (decided 17 October 2026, C6). Proposal: the root relays keep every circle's found act, and they remember a circle's first record only when they hold its found act and the same founder signed it (or, for a circle configured on the relay, when its configured circle key signed the record), so nobody can be the first to claim someone else's circle id. A relay accepts a replaced key only in its old role (an old circle key only for an old circle record). Under proposal P2 the founder also keeps the circle key on paper; later the Heart members can hold it together.

This replaces the part of proposal P2 about what the key signs: the circle key no longer signs a change of node or relays; that is a ledger entry. The part of P2 about where the key lives (the app in the creator's browser and a paper copy; the server holds only the node key) stays a proposal.

Founding a circle#

Decided (16 October 2026): whoever creates a circle founds it. Decided (the project owner, 16 October 2026, question 9): "I like the founding of circles this way for now." Decided 17 October 2026: the fingerprint of the found act is the circle id, and the found act names the first circle key (C5); the time zone, morning hour and time-zone database version are written at founding and do not change in 0.3.0 (C7). Decided 23 Oct 2026, E-8 (»Predlagam da novi krog lahko ustanovi samo nekdo ki je član nekega Kroga. Torej vsi krogi zrastejo z enega prvega korga. in jaz bi omejil da lahko vsak ustvari samo en krog in dokler potem postane član novega iz starega iztopi, ker ne more hkrati sedeti v dveh krogih«, "I propose that a new circle can be founded only by someone who is a member of some circle. So all circles grow from one first circle. And I would limit it so that everyone can create only one circle, and by the time they become a member of the new one they leave the old one, since they cannot sit in two circles at once"): only a member of an existing circle founds a new circle; everyone founds one circle only; a person is a member of one circle at a time. This replaces "at most three circles per founder" (decision 9). Decided 23 Oct 2026, E-1: the found act no longer names a world rules version, but all the circle settings.

The founder signs the found act (the founding charter, act found) in their own browser: name, code, the first circle key, currency, time zone, morning hour and time-zone database version (tzdata), first witness, the first Circle Heart, relays, rate source, all circle settings with their periods and limits (E-1), the start, the parent circle and the founder's reference from it (E-8, E-9) and the definitions version. There is no money cap in it. The fingerprint (event id) of the found act is the circle id, the circle's name for ever. It is booked into the ledger's first block, together with the first circle key's signature. The circle's ledger is public from its first block. There is no personal approval.

• Only a member of an existing circle. Only someone who is a member of some circle founds a new circle; every circle grows from the first one [Decided 23 Oct 2026, E-8]. So the found act names the parent circle: its circle id and the fingerprint of its first block. Only the first circle, the live circle, has no parent: it is the root of every circle [Proposal: the shape; in the examples the test circle A is the root].
• The founder leaves the parent circle with a reference. Since a person is a member of one circle at a time and nobody moves without a reference, the founder first says "I want to leave"; the found act names their reference [Consequence of E-8 and E-9; that the found act names it: Proposal]. The reference also proves that the founder was a member there and has settled.
• One key, one circle, for ever [Decided 23 Oct 2026, E-8]. The root relays remember the first found act of every founder and do not accept a second circle of the same founder [Proposal: how]. This replaces "at most three circles per founder".
• Said plainly: one person with two keys can still found two circles or be in two circles at once. Only Lana's person check could prevent that [Decided 23 Oct 2026, E-8, the note].
• The directory. A circle enters the directory on the Lana relays by a rule the relay checks itself: the founder has a registered Lana wallet, the found act names a parent circle, and the founder has founded no circle before [decision 9 and E-8; how the relay checks it: Proposal, details in phase G]. On the borrowed Lana relays every circle has limited space. The list of registered Lana wallets is kept by the Lana registrar, one body. A circle not listed keeps working through its link and QR code (question 10); listing decides only whether it can be found in the directory. Proposal P3 (the project owner confirms the first circles, seals go to the relays only from five members) is dropped.
• A tension with principles 3 and 5. Since every circle grows from the first one, the live circle is the root of every circle, and every founder must first be admitted to some circle. The live circle does not decide what other circles do and cannot stop a circle once it is founded; but a new circle cannot be born outside the chain of circles. This is a tension with principle 3 (no central authorities) and with principle 5 (every community is a cell of its own); whether it is acceptable is for the project owner to decide [Consequence of E-8].

Guardians for a member, by choice#

Proposal (question 11, waiting for the owner's yes).

The BSA ID comes from the same private key as the LANA wallet. Whoever steals the key empties both, and nothing can be frozen.

Proposal: a member may name guardians in advance by a signed act, for example three other members of whom two must sign. It is like leaving a spare key with neighbours: two of three can freeze the member's account in the circle and move it to a new key. Everything is public. LANA coins on the Lana chain are not protected by this; for those there is the registrar. Without guardians, an account whose key is lost stays locked and public.

What stays with people#

The private keys of members, witnesses and Heart members, and the circle key, are never public anywhere and never on a relay. Each stays with its holder. The node key, which also signs rate quotes, stays on the node's server. Project wallets, the reserve, the world account and the step account have no key at all. Besides its key a witness keeps only a few bytes about what it signed last, so that it never signs twice.

Today#

In the live circle today one administrator decides on limits and orders. Deposits and payouts were removed from the program on 17 October 2026 (step D0; decision 6 and answer 6a); a copy of the live database showed first that there had never been any. The Common Good key is on the server and pays orders. An objection is public without the name. One node confirms the entries. Publishing to the relays is off. Of what is described above nothing is built yet except the removal of deposits and payouts.

Decided#

the project owner, 16 October 2026, answers to questions 1–9:

1. When a payment counts ("yes"): when a majority of witnesses (three of four) has confirmed the block and at least three relays hold it. The app shows "paid · public on N of M relays".
2. Where the ledger lives ("yes"): every circle has its own box relay from the first day and in total at least four relays with at least three owners. The Lana relays in record 38888 stay the root directory for ever and a borrowed home for small circles. The rule "relays only from 38888" applies to the root relays, not to the circles' ledgers.
3. Witnesses ("yes, as the assistant proposes, no money cap"): a start with one witness and the public label "not yet decentralised"; no money cap; then four witnesses with four different owners, three must agree; the circle chooses and replaces its witnesses itself; at most one witness per owner; "independent" means "can replace any partner". The public label, the daily independent check and the public restore drill stay. The part "the circle chooses and replaces its witnesses itself" was changed by E-7 on 23 October 2026: witnesses are computers, chosen by lot among the circles' computers; the Heart's vote is only for exceptions.
4. The people who decide ("the first people of the first circle (all of them)"): in the live circle the founder and two others decide; three approve a project. Completed by answer 4a (below): four. Since 23 October 2026 they are called the Circle Heart (E-2, below).
5. Public for ever, and names ("A person can change their name, and then it is no longer known what belonged to whom"): the ledger knows people only by their key (BSA ID); a name lives only in the Lana profile and the member home, which the person can change; the ledger never copies a name; every free-text field carries the warning "public for ever; do not write names, personal or bank data". The legal review before the first booking as a condition, and free text in a separate record beside the chain, are dropped.
6. Bank data and payouts ("funds are never paid out"): there is no bank data and there are no payouts in the system. Dropped: payout requests, payout confirmations, amounts held for payouts, the monthly reserve statement about the bank and the payout brake. Question 6 is no longer an exception to principle 1: there simply is no bank data in the system. There are no deposits either (answer 6a, below).
7. Rates ("the seller's circle proposes the exchange rate and the buyer accepts it"): the receiving circle quotes the rate from a source it chooses itself; the payer accepts by signing both amounts; the quote is a public signed record of the seller circle's node. The starting source: answer below.
8. Projects ("So projects are always what gets funded"): the community's money always goes to projects; project wallets and the reserve have no key; a project starts receiving once three approve it and there is no objection ("resistence"); an objection to a newly published project stops it (since 23 October 2026 replaced by the consensus vote "all for, or it falls", E-5); a project receives up to its amount; gravity and the wave-growth counter-bookings flow into it; surplus goes to the reserve; the reserve moves to a new approved project by itself; the sum stays zero. Common Good as one wallet and the fund key are dropped. The details: answers 8a, 8b, 8c, 8e, 8f, 8i and 8j below; 8d follows from decision 8; 6c is decided below; 8g and 8h stay open.
9. Founding circles ("I like the founding of circles this way for now."): no personal approval; the ledger is public from its first block; a circle enters the directory on the Lana relays by a rule the relay checks (the founder registered with Lana, at most three circles per founder); limited space on the borrowed Lana relays. Proposal P3 is dropped. "At most three circles per founder" was replaced by E-8 on 23 October 2026: only a member of an existing circle, one circle per key.

the project owner, 16 October 2026, answers to the open points:

• 4a, four ("I am then add a fourth person too"): the live circle has four (since 23 October 2026 the Circle Heart, E-2): the founder and three other Heart members. Three approve a project. Nobody decides on their own project.
• 6a, deposits ("Forget deposits of money, because that is a completely different system"): BSA has no deposits of money. Dropped: deposits, custodians, deposit corrections (formerly 6b), question 12 and the deposit alarm. The wave grows only with what a member receives. So the circle's main account, which stood for money paid in, is no longer needed.
• 8a, paying a project: a project pays its doer once it has collected the whole amount.
• 8b, several projects ("Let it flow in order, there need be no limits for now"): inflow goes to projects in order, the oldest first; no amount limit and no other limits for now.
• 8c, objection: an objection is possible within 72 hours of publication; the project stays stopped until the objector withdraws the objection; once the project receives, an objection does not stop it. Replaced on 23 October 2026 by E-5 (the consensus vote "all for, or it falls").
• 8e, closing: a project is closed with 72 hours of public notice (since 23 October 2026 the Heart closes it; the notice is a circle setting, 72 hours by default, E-1), and the money goes to the reserve; a project that does not fill within 90 days ends by itself.
• 8f, paying a project does not use up the community's money: the doer's wave grows, the same amount goes on; the brake is the approval (since 23 October 2026 the vote, E-5); the sum stays zero.
• 8i, keyless accounts: the world account and the step-outward account have no key; the circle's main account went with the deposits (6a).
• 8j, a payment to another circle, and the step ("OK", after the explanation): nobody pays for a payment to another circle that hangs. After 7 days the payer's circle itself looks into the receiving circle's public ledger on the relays. If that circle did not book it (its daily seals cover the whole time up to the note's expiry), the held amount goes back to the payer; if it did, the payment stands; if the ledger cannot be read, the payer's circle waits and never guesses. Raising the step outward is a project like any other: a proposal, three approve it, no objection (since 23 October 2026 the vote, E-5), it fills with gravity and new steps; once it is full, the circle's step rises by that amount.
• Starting rate source: the European Central Bank's daily rate; the app shows the rate's date; a quote is valid for 10 minutes.
• 6c, the first money in a new circle (later the same day, »6c, da«): At founding, the circle's reserve gets one start (»zagon«): 1,000 in the circle's currency. It is booked from a keyless account, »izvor« ("origin"), which goes into minus by the same amount, so the ledger's sum stays zero. The start is not used up but keeps coming back (8f): a project pays a doer below the wave cap, the doer's wave grows, and the same amount goes on to the next project or to the reserve. There is no other first money: no starting wave for members, no bridge from Lana. The account name »izvor« / "origin" and the exact shape of the entry are a proposal for definitions 0.3.0 (plan step C1). The live circle (one member, no payments) gets the same start when its ledger begins (proposal: 1,000 EUR).

Development principles (the project owner, 16 October 2026):

• The six development principles: everything is public; everything is stored on the relays, replicated in at least three places; the system is decentralised; every community is balanced on its own; every community is a cell of its own; the system is fast and robust (100 billion transactions a day, 10 billion users).
• The whole ledger is kept only through the relays, truly nothing local; applications only read from the relays.
• Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden.
• The four Lana relays will not carry 100 billion transactions; the system must be scalable.

What follows and needs no new decision:

• Every payment goes to the relays with both balances after it.
• No secret addition (salt) and no 20-account threshold.
• At switch-on the whole history from the start goes to the relays.
• A new relay receives the circle's whole history.
• Settings, project decisions and membership each get their own signed public record. There are no deposits and no payouts (decision 6 and answer 6a).
• Nothing stays on a server that cannot be rebuilt from the relays; this is checked every morning.

Earlier decisions that stay:

• A proposer never decides on their own proposal (10 October 2026). The 72 hours of public notice and the answer to every objection before approval (10 October 2026, simplified 15 October 2026) were replaced on 23 October 2026 by the vote (E-5), which runs at least 72 hours by default.
• The step outward is a public decision, exactly like a project, formerly an order (15 October 2026); raising the step is now itself a project (answer 8j). The step may not exceed what the members have built. Lowering the step (never below what is used) is a proposal.
• Whoever creates a circle founds it (16 October 2026); since 23 October 2026 only a member of an existing circle, one circle per key (E-8).
• The circle key is kept by the app and by whoever creates the circle (16 October 2026).
• Every circle has its own app (circle in a box), never one master app for several circles (16 October 2026).
• Circles start on borrowed Lana relays (16 October 2026).
• The root relays are only the Lana relays in record 38888; only its relay list is read; its currency values are LANA prices, not exchange rates (rule since 14 September 2026, prices 15 October 2026, confirmed 16 October 2026; for circles' ledgers see decision 2).
• One currency per circle; no deduction and no threshold for payments across currencies (16 October 2026).
• The BSA ID is the Nostr public key in HEX of the same private key as the LANA WIF, never npub (16 October 2026).
• The Lana profile is mandatory and minimal (16 October 2026).
• The member home is mandatory (16 October 2026).
• One seal a day, after the morning (at 04:00 in the live circle; each circle writes its morning hour at founding, C7), every day (16 October 2026).
• Private keys never go anywhere (16 October 2026).
• Nothing goes to the relays without the owner's "yes" (16 October 2026).

Replaced:

• "The rate is signed every hour by the owner's rate key; the last rate counts" (16 October 2026) is replaced by decision 7.
• "After 7 days without an answer from the other circle the community refunds the payer by public decision, at most once" (10 and 15 October 2026) is replaced by answer 8j.
• 23 October 2026: the world rules record (C1) and its signer (1A) are replaced by E-1 (periods and limits are circle settings; KIND 43920 is retired, its number stays reserved); the fixed 72 hours of C5 are replaced by E-1 (a default setting); the 72 hours of notice and the answer to every objection (10 and 15 October), the objection (8c) and C4 are replaced by E-5 (the consensus vote "all for, or it falls"); "the circle chooses and replaces its witnesses itself" (decision 3) is replaced by E-7 (the draw; the Heart's vote only for exceptions); "at most three circles per founder" (decision 9) is replaced by E-8; the "discharge note" of the E-3 addition is replaced by the reference (E-9); the open question whether members elect those who decide is answered by E-2: there is no election.

the project owner, 17 October 2026, answers C1–C7 (»1. DA - parametre shrani v posebni KIND tako, da ce zaznamo da ga svetovno spremenimo se spreminjo na vseh apliakcijah · 2. DA · 3. DA · 4. DA · 5. Ne razumem zakaj tega takoj ne narediš · 6. DA — Prosim pojasni točko 5 predno gremo na D«, "1. YES - store the parameters in a separate KIND, so that when we change it world-wide they change in all applications · 2. YES · 3. YES · 4. YES · 5. I don't understand why you don't do this right away · 6. YES — Please explain point 5 before we go on to D"; after the explanation of points 5 and 1: »7 Da, Lahko narediš vse skupaj v fazi D …«, "7 Yes, you can do it all together in phase D …"):

• C1, world rules ("YES - store the parameters in a separate KIND …"; after the explanation: "You can do it all together in phase D"): the time values (72 hours of notice and for objections, 72 hours before closing, 90 days, 7 days, 10 minutes) and the three who approve a project are the same for every circle; a circle cannot change them. They live in one world-wide rules record (its own kind, KIND 43920 "BSA Rules"), signed by the same key as the definitions on lananostr.site. A change counts only from the day written in the record, at least 7 days after it is published, never retroactively. Every block and seal names the rules version, so a restore from the relays always gives the same result. Later the record can require several signatures (for example 3 of 5). Decided 17 October 2026, C1. Replaced on 23 October 2026 by E-1: the periods are circle settings, and there is no world rules record any more.
• C2, payments never wait for the morning ("YES"): payments never wait for the morning. Gravity follows visit before touch: an account's morning gravity is booked right before the first entry that touches it after the morning. Decided 17 October 2026, C2. An act (for example a vote) does not touch an account; only an entry that moves money does (clarification, 17 Oct 2026 (D1 review)).
• C3, refusals and the validity of an act ("YES"): refusals of keys that are neither members nor applicants are answered and never booked; an act is valid 7 days; at most 20 refusals of one key a day are booked. Decided 17 October 2026, C3. Since 23 October 2026 the 7 days and the 20 refusals are default circle settings (E-1).
• C4, no special rejection ("YES"): there is no special rejection by one of those who approve a project; an objection stops a project. Decided 17 October 2026, C4. Replaced on 23 October 2026 by E-5: there is no objection any more, and a single "against" of any member makes a project fall; there is still no separate act of rejection.
• C5, the circle id and changing the circle key ("I don't understand why you don't do this right away"; after the explanation: "You can do it all together in phase D"): a circle's name is its circle id, the fingerprint of the found act the founder signs, not a key. The circle key can be replaced: three of four (now Heart members) replace a stolen or lost key with 72 hours of public notice; the witnesses book the change. The 72 hours of notice were fixed and did not follow the world rule for a project's notice. Decided 17 October 2026, C5. The fixed 72 hours were changed by E-1 on 23 October 2026: the notice is a circle setting, 72 hours by default.
• C6, the rule "the first ledger stands" ("YES"): it goes into the letter to the Lana relay owner (phase G); with the circle id it is only extra safety. Decided 17 October 2026, C6.
• C7, the circle's clock ("7 Yes"): a circle's time zone, morning hour and time-zone database version are written at founding and do not change in 0.3.0; a later definitions version may say how a circle follows new clock-change rules. Decided 17 October 2026, C7.

the project owner, the evening of 17 October 2026, answers to the three questions after phase D (»vsi da«, "all yes", to the proposal »1A, 2A, 3A«):

• 1A, who signs the world rules: for now the world rules record is signed only by the key that publishes the definitions, that is, the project owner's. Several signatures (for example 3 of 5) are introduced before the first circle the project owner does not run joins (for example the first circle from another ecosystem). Who the signers will be is still open. So the tension with principle 3 (no central authorities) is limited in time and said openly. Decided 17 October 2026 (evening), 1A. Dropped on 23 October 2026 by E-1: there is no world rules record and no signer of it any more.
• 2A, the time-zone database version (part of C7): at founding the circle writes down, besides its time zone and morning hour, the version of the time-zone database (tzdata). The witnesses compute the morning hour with that version, not with their own newest one. In 0.3.0 it never changes; not even the Heart can replace it. That the Heart may replace it (for example when a country drops the clock change) can only come with a later version of the definitions. Decided 17 October 2026 (evening), 2A.
• 3A, the transition period: the 60 days of gentler gravity run for each account from its own first receipt, as definitions 0.3.0 say. Today's app counts them from the circle's start; the live circle has no payments, so today this affects nobody. At the switch to the new gravity the per-account rule applies. Decided 17 October 2026 (evening), 3A.

the project owner, 23 October 2026, answers before phase E (first answer: »2. Tale večina nima smisla vsi morajo biti allignani in če niso gredo lahko ven in ustvarijo nov krog... z bi rekel takole.. tisti ki je ustvarili krog in ga negujejo tisti imajo moč... tisti, ki jim kaj ni prav gredo lahko ven in ustvarijo svoj boljši krog.«, "2. This majority makes no sense; everyone must be aligned, and if they are not, they can leave and create a new circle... I would put it like this.. those who created the circle and tend it have the power... those who don't like something can leave and create their own, better circle."; the second answer: »Dejmo da lahko upravitelji spreminjajo svetovna pra vila zase, ker na koncu edino kar je pomembno je balance. / Upravitelji bodo po novem Srce kroga, tako se bo njihova postavitev imenovala. …«; the third answer, to points 1–7; the addition and the reference the same day; the full text is in the phase E decisions):

• E-1, circle settings (»1 da... vendar 72 ur ne more biti fiksno to je lahko default nastavitev, ki jo lahko spremeinijo«, "1 yes... but 72 hours cannot be fixed; it can be a default setting that they can change"): every circle sets its own periods and limits; the values in the definitions are default settings, which the Circle Heart changes within the bounds of the definitions. There is no world rules record and no signer any more (1A is dropped; KIND 43920 is retired, its number stays reserved). The same for every circle: a project needs at least 3 Heart votes for and none against; the money and gravity computation. 72 hours are fixed nowhere. Decided 23 October 2026, E-1.
• E-2, the Circle Heart (»Upravitelji bodo po novem Srce kroga, tako se bo njihova postavitev imenovala«): the name is the Circle Heart; one person is a Heart member. Power lies with those who created the circle and tend it; the circle's members do not elect the Heart; whoever disagrees leaves and creates their own circle. The Heart adds and removes Heart members (k = 3, the proposal stays). Decided 23 October 2026, E-2.
• E-3, exclusion and old accounts (»Upravitelji lahko izključijo vsakega člana s tremi glasovi za izključitev«; »KO je član enkrat bil izključen je izključitev avtomatsko 3 meseci«; »vključitev nazaj nekoga ki je bil v srcu pomeni zgolj da je postal član«): the Heart excludes any member, a Heart member too, with three votes, at once; an exclusion lasts 3 months; then the person may apply to join, and the Heart decides; a former Heart member comes back only as a member. The excluded person's money stays frozen, gravity visits the plus, the plus may go to another circle, the minus stays with the circle. The Heart can close old accounts; gravity takes a plus to 0; at closing the wave goes to 0 and the reserve returns the same amount to the origin; nothing is urgent. The addition (»ostalo si pravilno razumel«): this is confirmed; the circle covers a minus only if the member dies; whoever leaves in minus has no reference. Decided 23 October 2026, E-3.
• E-4, OWN (»Upraviteolji tudi vodijo in ndazorujejo OWN procese«; »4. to je ok, kanseje dopolnimo v krogu dokumentacijo«): the Heart leads and oversees its circle's OWN processes; they run encrypted in the OWN apps; only the decision reaches the ledger; the documentation is completed later in the circle. Decided 23 October 2026, E-4.
• E-5, the consensus vote "all for, or it falls" (»projekt rabi imeti vsaj 3 glasove za iz Srca kroga in nobenega proti in 72 ur biti na glasovanju«; the addition: »Trajanje glasovanja, ok da je nakjrajsi 72 ur«): as in Lana Aligns, for or resistance; the Heart puts any proposal to a vote; all members vote; if anyone is against at the end, the proposal falls; the proposer sets the duration at publication and it never changes, the shortest 72 hours by default; an "against" can change and carries a short public reason; a proposal that fell may be proposed again, changed. Replaces 8c. Decided 23 October 2026, E-5.
• E-6, joining (»Srce kroga lahko tudi omeji sprejamnje avtomatsko novih članov... samo še na povabilo ... največje dovoljeno število in potem je waiting lista«; »6. ok«): open, invite only, or a maximum number with a waiting list; the first on the waiting list comes in by itself; the Heart always decides about an excluded person. Decided 23 October 2026, E-6.
• E-7, witnesses (the addition: »A niso priče računlaniki in se določajo z žrebom«): witnesses are computers, chosen by lot among the circles' computers (details: phase I); until there are enough circles to draw from, a circle has one witness, its own computer, labelled in public; the Heart's vote (3 for, nobody against) only for exceptions. Decided 23 October 2026, E-7.
• E-8, founding (»Predlagam da novi krog lahko ustanovi samo nekdo ki je član nekega Kroga. Torej vsi krogi zrastejo z enega prvega korga.«): only a member of an existing circle; one circle per founder; a member of one circle at a time; one person with two keys is not prevented. Replaces "at most three circles per founder". Decided 23 October 2026, E-8.
• E-9, the reference (»Sprejema se v nov krog samo z refrenco, brez tega ni nič«): the reference is issued by itself when a member says "I want to leave" and its conditions hold; no minus; an open OWN process together with a minus: no reference; someone else may settle the debt, at most up to 0; the content: published projects, projects taken part in, the step built ("so they get the same there") and no open OWN processes; a new KIND; nobody moves without a reference (a rule for every circle). Decided 23 October 2026, E-9.
• E-9 (a) and (b), the answers on the reference (»1 a, / 2 torej če prestopi v drug krog in je tukaj nvo 0 in v drugem odpre korak... potem mu lahko drugi krog pošlje tej skupnosti ta denarki ga je dobil od tega člana ki ga je ustanovil nov korak.. in se zadeva izniči«, roughly: "1 a, / 2 so if they move to another circle and are at 0 here, and open a step in the other one... then the other circle can send this community the money it got from this member who opened the new step.. and the matter cancels out"): (a) an open OWN process blocks the reference also without a debt; the process has to be finished first. (b) In the old circle the balance is 0; the new circle opens the same step (wave) as in the reference; as with every growth of a step, the same amount goes to the new circle's community (from the new circle's »izvor«, "origin"); the new circle sends that amount to the old circle's community (a payment between circles, at the rate at the move if the currencies differ); the old circle closes the account (wave to 0) and returns the same amount to its »izvor«, exactly the amount it received; both communities stay as they were. Decided 23 October 2026, E-9 (a) and (b).
• E-10, four questions after round 5 (»1B, vendar OWN proces lahko sproži vsak.. ostalo ok / 2A / 3A / 4A / Sem preklopil«, "1B, but anyone can start an OWN process; the rest ok / 2A / 3A / 4A"): exclusion, readmission, account close and the Heart's witness exceptions always need at least three Heart votes (threshold = the larger of k and 3; a Heart of fewer than three cannot do them); Heart-membership and parameter changes keep k; any member may open an OWN process, one Heart member closes it; since an open OWN process blocks the reference, any member can hold another's reference until a Heart member closes the process, and a member who does this on purpose to harm another can be excluded for it by the Heart (at least three Heart members). 2A: the wave a reference brings counts against the new circle's step outward (the safety stays). 3A: the longest vote is 14 days (the default, a circle setting). 4A: the Heart may close anyone's account with a public reason and cover its minus. Decided 23 Oct 2026, E-10.
• E-11, after the review of round 5 (»1a,2a in 3c«, "1a, 2a and 3c"): the hold of a move has no deadline, only the old circle's confirmation or refusal ends it, a silent old circle means waiting; on a proposal without money the proposer's own vote counts, on a project the recipient does not count for itself; gravity is never stronger than today's (the excess: half in 30 days; the gentle part: about 1 % a month), and a change that strengthens it needs at least 30 days of public notice. Protections consistent with the decisions: a Heart member who leaves loses the Heart seat; a join with a step is not possible while an earlier move out of this circle is not settled; a reference is valid once (if the old circle refuses it, the new circle takes the step away). Decided 23 Oct 2026, E-11.
• E-13, used references (»A«): every circle's ledger records for good every reference on which it granted a step (in the state, under the state root, in the snapshot); this circle never accepts the same reference again — not at a join, not from the waiting list, not after a readmission, not after the person leaves and comes back; between circles nothing changes: the old circle answers one reference once, another circle takes its unused step away (E-11). Decided 25 Oct 2026, E-13.

Proposals and questions waiting for the owner's yes#

• Moving with a step, safety (for E-9 (b)) [Decided 23 Oct 2026, E-10 (2A)]: the wave the new circle opens counts against its step outward; a join whose wave no longer fits under the step waits on the waiting list. A question for the owner: a circle that cannot raise its step then takes in no waves from elsewhere (a founder in a new circle with step 0 waits too).
• Answered on 23 October 2026 (E-10): "three" for an exclusion, a readmission, an account close and the witnesses. Always at least three Heart members: the threshold is the larger of k and 3 (if a circle sets k = 4, four are needed); a Heart of fewer than three cannot do it.
• Proposals of 23 October 2026 (after E-1 to E-9): the notice of a settings change at least as long as the period being changed; the stricter value during the notice; the bounds of every setting; the longest vote 14 days; the length of an exclusion, 90 days, as a circle setting; a short public reason for an exclusion; one Heart member puts any other proposal to a vote; any other proposal also needs three Heart votes for; votes are counted with the roles at the end of the vote; an invitation is valid 7 days and can be used once; by default a circle is open and has no member limit; the reference is issued by itself later too, once its conditions hold; the content of the reference (the circle id, the membership period, at most 100 projects of each kind); KIND number 43921; how a new circle checks a reference; whoever was never in a circle needs no reference; the root relays never delete member homes; whoever leaves may send their plus to another circle; recording the opening (since E-10 any member) and the closing (one Heart member) of an OWN process; at least three Heart members sign an account closing (E-10), a Heart member's account cannot be closed, a closing waits if the reserve has too little, a closed account gives no reference; the parent circle and the founder's reference in the found act; the root relays accept only the first found act of every founder; the technical names steward_* stay.
• Tensions with the principles (23 October 2026), for the project owner to decide: the Heart's power, not elected by the members, including holding back a reference with an open OWN process (principle 3; E-9 (a)); the live circle as the root of every circle, and founding only through membership (principles 3 and 5); encrypted OWN processes (principle 1); witnesses drawn by lot from the network of circles (principle 5); admitting someone from another circle depends on reading the old circle's ledger (principle 5). Removed is the tension of 1A: there is no world-wide signer any more.
• Open 3a, seven witnesses in a large circle: proposal: a circle above about 10,000 members has seven witnesses, five must agree. Whether one owner may then hold two is for the project owner to decide. Until the project owner answers: at most one witness per owner.
• Open 8g, a contribution to a project: may a member give to a project only their plus, as today, and not from their wave? Proposal: only the plus. Whatever exceeds what the project still lacks goes to the reserve. A contribution that names no project goes to the reserve and from there to the projects. A contribution to a project that is not receiving yet is refused.
• Open 8h, the doer of a project: must the doer of a project be a member of the circle? For example whoever gives the circle a relay. Proposal: yes, the doer joins the circle first.
• The Heart's other decisions (for answer 4a and E-2): proposal: for the relays, the rate source, changing the node, the list of circles a circle does not sell to, closing a project, k Heart members sign (three of four in the live circle); closing an account and readmission at least three (the larger of k and 3, E-10). For changing the circle key this is decided (C5); for the Heart members E-2 (k = 3 stays a proposal); for the witnesses and recovery E-7 and E-10 (at least three for and no Heart member against).
• Returning the money of a project that is already receiving (for answer 8e): proposal: the money goes to the reserve, as when the project is closed, also when the doer declines the project, leaves the circle or is excluded, when the proposer withdraws it, or when payment falls due and the doer is no longer a member; the 90 days count from the day the project starts receiving.
• Projects (for answers 8a and 8j): proposal: the recipient consents to a project or declines it, as today for an order; any member proposes a project, as so far; a project that has not opened 30 days after publication expires; the recipient of a step-raise project is the step-outward account, and since that account has no wave, such a project really uses up community money; the step is lowered by a vote like a project, never below what is used.
• Stale-rate alert and changing the source (for the answer on the starting source): proposal: the Heart members are alerted when the rate is older than 120 hours; the circle changes its source by an act of k Heart members, at any time.
• Witness procedures (for decision 3 and E-7): the draw is the direction for phase I (a public random number, a schedule known in advance, a new witness loads the circle from the latest seal; open: fake circles, matching the load, absent witnesses); until then one witness; exceptions by the Heart's vote (at least three for, none against, with notice; E-10); changing the node with no waiting; later the node's role rotates among the witnesses by itself; the node's receipt within 10 seconds; recovery with notice. Seven witnesses in a large circle are Open 3a.
• Resigning, adding and removing witnesses and Heart members (for decisions 3 and 4, E-2 and E-7): proposal (D4 review, round 3, 17 Oct 2026): a witness or a Heart member may resign at any time, alone; the resignation takes effect after the notice of a change (72 hours by default, E-1). The Heart (k Heart members: three of four in the live circle) can add or remove a Heart member and set k (E-2), and remove or replace a witness only with at least three Heart members for and none against (E-7, E-10); each with public notice; a new Heart member or witness must accept first; the last Heart member or witness cannot leave until another is added. There is no election (E-2).
• The circle key only stamps the mirror (for decisions 3 and 8): the circle key signs only the circle record and, once, the found act in the first block. This replaces the part of proposal P2 about what the key signs; the part about where the key lives stays a proposal.
• Changing the circle key, the details (for decision C5): proposal: the new key signs as proof that it is really held (proof of possession), so nobody can name a key someone else holds; it signs the circle id, itself and the time of the proposal, so this signature can never be used again later; the circle key is never the founder's, a witness's or a Heart member's key, and the new key is not the key in office; a block holds at most one roles entry, so one block number always means one mirror and a second roles entry in the same block can never undo the first (for example a key change); every daily seal and the circle's head in the directory (a pointer to the latest seal) name, under the witnesses' signatures, the circle key of the newest mirror in the ledger up to the last block the seal covers (if that is the block of a key change, already the new key), so a reader of the directory finds the right circle record.
• The notice of the Heart's changes (for decision C5 and E-1): the notice is no longer a fixed 72 hours but a circle setting, 72 hours by default (decided 23 October 2026, E-1). A change that k Heart members signed does not wait for ever after its notice: if the witnesses do not book it within the validity of an act after the notice ends (7 days by default), it lapses and must be proposed again (proposal (D4 review, 17 Oct 2026)).
• The clarifications of 17 Oct 2026 (D1 review) need no decision from the project owner; two of them make the owner's "never retroactive" (C1, now E-1) concrete: a project opens without an act once its last condition holds, and a running deadline keeps the length in force when it started.
• Question 10: record 38888 stays the starting directory, but no circle depends on it to work; the circle's link carries the circle id, the genesis digest and relays. This keeps the owner's decision but changes how much a circle relies on it: the root relay list stays, but a circle works without it.
• Question 11: guardians for a member, by choice.
• Question 14: decision 2 says at least four relays with at least three owners. Proposal: while a circle is borrowed, three relays of at least two owners are enough (the box relay and the Lana relays); this is a temporary departure from decision 2, so it is for the project owner to approve; at least three owners at the latest when the circle gets four witnesses. I count the four Lana relays as one owner until the project owner says otherwise. Tension: until the Lana relay owner adds the write rules, only the box relay counts, so under decision 1 no payment could ever count, and the circle would depend on one outside owner. Decide: (a) the circle books nothing until then; (b) until then the Lana relays count as copies with the public label "copies without protection against deletion"; (c) until then the circle finds two more relays with the same rules at other owners.
• Question 15: a circle pays its relays by a project, like any other project. Decision 8 changes only that it is no longer an order from Common Good.
• Question 20: the circle writes into its ledger which version of the definitions it runs on.
• Question 21: replaced by E-5: every vote is signed and public with the voter's key; an "against" carries a short public reason; the app shows the name from the Lana profile (the ledger does not carry the name, decision 5).
• Question 23: each witness's daily vote summary is public; a single vote on request or as evidence (a vote that is not in a block is not published by itself: a small exception to principle 1).
• Question 24: project images on three independent file servers; on the relays their fingerprint and address (a departure from principle 2 "everything on the relays"; so it is the project owner's).
• Proposal P5: a sales limit for any one circle stays only an option.
• Proposal P7: one "yes" per version of the definitions and one "yes" to switch on each kind of record.
• Still open, without a number: how many signatures count for other decisions while the Heart has too few members; the notice period for the list of circles a circle does not sell to; what happens if the current witnesses refuse to book their own replacement; whether a sole witness that lost its record of what it signed last is replaced at once or after notice; what happens if a project to raise the step fills, but the step would then exceed what the members have built; what happens if closing an account brings what was built below the step; how today's Common Good and the live circle's open orders enter the new ledger (proposal: the Common Good balance becomes the opening reserve, open orders are published again as projects and lose their approvals and their time).