Community safeguards and the step outward DRAFT 0.3.0

Plain-words text · Technical specification · All documents

English text rendered from the project's source documents. The Slovene original is on lananostr.site. Where this text and the definitions differ, the definitions win.

Foundation. Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden. All transactions are public and stored on the relays, so the ledger can be restored from them at any moment. Applications only read from the relays, check and show. The six development principles: docs/nacela-razvoja.md.

Status. This is a design. Nothing has been published to the relays yet. The live circle's ledger is still in a database on its server today; we are correcting this. Decided are the principles, what follows from them, the safeguards (10 October 2026, simplified 15 October 2026), the owner's answers to questions 1–9 (16 October 2026), the owner's answers to the open points (the same day), the owner's answers to phase C (17 October 2026, C1–C7), the owner's answers to the three questions after phase D (the evening of 17 October 2026, 1A, 2A and 3A), the owner's answers before phase E (23 October 2026, E-1 to E-9) and the other earlier decisions in the "Decided" list. What changed on 23 October carries the label [Decided 23 Oct 2026, E-n], [Proposal] or [Consequence] (follows from a decision). Whatever is not decided is a proposal waiting for the owner's yes. Each proposal names its question number or carries an "Open" label (for example Open 8g).

The essence#

Everything is public. The circle's ledger is public on the relays: every payment, every balance, every project, every vote and every decision. Not only members see it, but anyone. People appear in the ledger only by their key (BSA ID); a name lives only in the Lana profile, which the person can change (decision 5). The community is not foolish. Because everything is in plain sight, cheating has nowhere to hide.

Between members, cheating gains nothing. What a member can give is their balance plus their wave. Receiving 100 grows the wave by 100 while the balance stays the same, because a receiving project or the reserve receives those 100 in the ledger (we call this the counter-booking): so they can give 100 more. Giving 100 lowers the balance by 100: so they can give 100 less. Two people passing the same money back and forth can then give exactly as much as before. Fake accounts do not help: a new account starts at zero and cannot give anything.

Capacity out of nothing appears in only two ways, and only there are safeguards:

1. Community projects. Counter-bookings and gravity flow into projects the community has passed in public (decision 8; since 23 Oct 2026 by the consensus vote "all for, or it falls", E-5). A fake project would give its recipient spending capacity for nothing.
2. Buying outside the circle. What a circle spends in other circles it receives from them as real work and goods. The step a person brings with a reference from another circle belongs here too: the new circle pays the same amount to the old circle (E-9 (b); below, "A false reference") [Consequence].

Payments between members and everything else in the circle stay simple.

There are no deposits. Money from a bank does not come into the circle, and nothing leaves the circle for a bank: there are no deposits (answer 6a, "a completely different system") and no payouts (decision 6). The wave grows only with what a member receives. A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin") (decided 6c, below). So there is no longer a deposit confirmation that could create money. Nor is there a refund to a payer from the community's money any more: a payment to another circle that hangs is settled by the other circle's public ledger (answer 8j).

Who decides: the Circle Heart#

• Today the live circle is run by one administrator, its founder.
• Decided (the project owner, 16 October 2026, question 4 and answer 4a: "I am then add a fourth person too"): in the live circle four decide: the founder and three other Heart members. Since 23 October 2026 they are called the Circle Heart; one person in it is a Heart member [Decided 23 Oct 2026, E-2]. Nobody decides on their own project.
• Power lies with those who created the circle and tend it. The circle's members do not elect the Heart; whoever disagrees leaves and creates their own circle [Decided 23 Oct 2026, E-2]. The Heart itself adds and removes Heart members (k = 3, the proposal stays). The question "how members elect stewards" is answered by this: there is no election.
• A Heart member never decides on their own proposal, and their "for" does not count on a project that pays them. Since the live circle's Heart has four, the other three can pass such a project. Until the Heart has three members who may vote "for", no project can pass, and the community's money waits in the reserve.
• Every decision is a signed act, public on the relays. Before a decision is booked, the circle's witnesses check that the rules were met: the vote has ended, nobody is against, at least three Heart members are for [Decided 23 Oct 2026, E-5]. The witnesses are like witnesses at the signing of a contract: they look whether everything is right, and sign. What does not meet the rules is not booked. More about the witnesses and the Circle Heart is in the document "Running a circle: witnesses and the Circle Heart".
• Proposal: the Heart's other decisions too are signed by k Heart members (three of four in the live circle). For replacing the circle key this is no longer a proposal: decided 17 Oct 2026, C5 (below, "A stolen or lost circle key").
• The Heart can also exclude a member (with three votes, at once, for 3 months) and close an old account [Decided 23 Oct 2026, E-3]. Both acts are public and signed; in detail in the document "Running a circle".

Safeguard 1: a public vote on a project, "all for, or it falls"#

Decided (10 October 2026, simplified 15 October 2026): a proposer never decides on their own proposal. Decided (the project owner, 16 October 2026, question 8: "So projects are always what gets funded"): money always goes to keyless projects; a project receives up to its amount; surplus goes to the reserve, and the reserve moves to a new project by itself. The project replaces the community order. Decided (the project owner, 16 October 2026, answers to the open points): a project pays once it has collected the whole amount (8a); inflow goes in order, with no limits for now (8b); closing with notice and ending after 90 days (8e); paying a project does not use up the community's money (8f). Decided 23 Oct 2026, E-5: a project is decided by the consensus vote "all for, or it falls" (as in Lana Aligns: for or resistance); this replaces the 72 hours of notice, the objection (8c), the answer to every objection (10 and 15 October) and C4. Decided 23 Oct 2026, E-1: the periods are circle settings with defaults.

1. Any member proposes a project, as so far [Proposal]: what should be done for the community, who does it, what it costs and how long the vote runs (at least 72 hours by default; the duration never changes afterwards) [Decided 23 Oct 2026, E-5]. There is no amount limit and no other limit for now (decided, 8b). The proposal is a signed act and is public on the relays from the moment it is booked.
2. Whoever carries the project out (the recipient) confirms by signature that they take it on (proposal: as today for an order).
3. All members vote, for or against, until the vote ends. An "against" carries a short public reason; a vote can be changed until the end, and the newest counts [Decided 23 Oct 2026, E-5].
4. A single "against" makes a project fall. At the end a project passes only if no member is against and at least three Heart members are for; the proposer and the recipient do not count among those three [Decided 23 Oct 2026, E-5 and E-1]. Otherwise it falls and may be proposed again, changed. This is stronger than before, when an objection only stopped a project until the objector withdrew it.
5. There is no separate act "I reject" (C4), but a single "against" from any member, a Heart member included, makes a project fall [Consequence of E-5].
6. A project that passed opens once the recipient has consented. The reserve moves to it by itself. Then gravity and the wave-growth counter-bookings flow into it through the reserve, up to the project's amount. Whatever exceeds it goes to the next project in order or stays in the reserve (decided, 8b). A project wallet has no key, so nobody can spend it alone; the witnesses check that the rule is met. Today an order's payment is signed by the fund key on the server.
7. Once the project has collected its whole amount, the rule pays it in full to the recipient (decided, 8a). The recipient's wave grows, and the counter-booking goes on to the next project or to the reserve. The recipient is a member of the circle (Open 8h, proposal).
8. Proposal: a project that has not opened 30 days after publication (the default; a circle setting) expires by itself (as today for an order).
9. The Circle Heart can close a project that is already receiving, with public notice (72 hours by default; a circle setting), for example when the doer steps back or leaves, or the project turns out to be bad; the money goes to the reserve and from there to the next project. A project that does not fill within 90 days (the default) ends by itself; its money also goes to the reserve (decided, 8e). Proposal: k Heart members close it (three of four in the live circle); the 90 days count from the day the project starts receiving; the money also goes to the reserve when the doer declines the project, leaves the circle or is excluded, when the proposer withdraws the project, or when the doer is no longer a member at payment.

The title, the description, the reasons of "against" votes and the project's image are public for ever. Decided (question 5): at every free-text field the app says "public for ever; do not write names, personal or bank data". The text stays inside the signed act; there is no separate record beside the chain and no legal review as a condition. Decided 23 Oct 2026, E-5: an "against" carries a short public reason. Every vote is a signed act, public with the voter's key (principle 1); the app shows the name from the Lana profile [Consequence]. This replaces question 21. Today an objection in the app is public without the name, and administrators see who objected. Proposal (question 24): the image is on three independent file servers, and on the relays are its fingerprint and address.

What this means for cheating. One honest member's "against" now makes a fake project fall. The other way round, one member's "against" can also make an honest project fall; the project may be proposed again, changed, and the "against" is public, with its reason and the key of whoever cast it [Consequence of E-5].

Paying a project does not use up the community's money (decided, 8f). When a project pays a doer who is below the wave cap, their wave grows by the whole amount, and the same amount goes on at once, to the next project or to the reserve. So a fake project does not empty the community, but it gives its recipient spending capacity in the amount of the project. The real brake is the vote (three Heart votes for and nobody against), which is why the rule stays that a Heart member's "for" does not count on a project that pays them. The sum stays zero.

The periods are circle settings (decided 23 Oct 2026, E-1; formerly world rules, C1). The periods in this document (the shortest vote 72 hours, 72 hours before closing, 90 days, 30 days (proposal), 7 days, 10 minutes) and the number of Heart votes a project needs (at least three) are default circle settings; the Circle Heart changes them within the bounds of the definitions, with public notice. The same for every circle: a project needs at least three Heart votes for and none against; the money and gravity computation. A deadline already running keeps its length: a project opened with a 90-day lapse keeps 90 days even if the Heart later sets 30 (never retroactive). The settings in force are in the ledger's state at every block, so a restore from the relays always gives the same result.

The risk, said openly. There is no world-wide key that changes values for every circle at once any more (E-1); the tension with principle 3 from 1A is removed. The new risk is inside a circle: the Circle Heart can shorten its own circle's periods, for example the notice or the shortest vote. So (proposal) a change of a period applies only once the current period has run out, and never retroactively, so a stolen key cannot skip the warning; the bounds in the definitions (proposal: for example a shortest vote of at least one day) keep a change from emptying a safeguard. Every change is public and signed.

Safeguard 2: the community's step outward#

The step is like a door the community opens for buying in other circles. How wide it opens, the community decides in public and pays for itself, with a project.

1. The world account is a technical account of the circle, one per circle. When a member buys in another circle, they pay it. When a member sells to someone in another circle, it pays them. The receiver's wave grows, and the counter-booking goes to a receiving project or to the reserve, as with any receipt. Decided (answer 8i): the world account has no key; only a public rule moves the money on it. The same holds for the step account.
2. The world account has no gravity and no member wave. Gravity would reward the community for its members buying outside. The world account is only a counter: how much the circle bought and how much it sold outside.
3. Every member buys outside with their own capacity, the same as at home.
4. The circle has a step outward. Together, members may buy outside at most the step plus what the circle has sold outside: (all purchases outside − all sales outside) ≤ step.
5. The community pays the step, with a project. Decided (answer 8j): raising the step is a project like any other. A member proposes it and it goes to a vote: it passes only with no "against" and at least three Heart votes for (E-5). It fills with gravity and new steps. Once it is full, the circle's step rises by that amount. Proposal: the recipient of such a project is the step-outward account. To be honest: the step account has no wave, so money that goes into the step does not go on to other projects. Raising the step really does use up community money, so the community opens the door outward with care.
6. The step is a public decision, exactly like a project (safeguard 1): a proposal with the consensus vote "all for, or it falls", at least 72 hours by default; the proposer never counts among the three Heart votes [Decided 23 Oct 2026, E-5]. Once the step project is full, a public rule moves it into the step account. That, too, is an entry in the circle's public ledger.
7. The step may not exceed what the members have really built: the sum of balance plus wave of all members in that currency. That sum does not inflate when money is passed back and forth (the sum of waves and the money in projects and the reserve, however, do inflate, so we do not count them). Members who have left or are excluded count too, since their money is still in the circle (clarification, 17 Oct 2026 (D1 review)); a closed account holds neither balance nor wave (E-3). When an account closes (also after a move to another circle, E-9 (b)), what was built goes down; what happens if the step then stands above it is open.
8. The step can be lowered (proposal) by a vote like a project (the ledger does not book it yet in 0.3.0), but not below what is already used (purchases minus sales). What is freed goes on like any inflow: to the reserve and from there to a receiving project.
9. Selling outside is not limited by the step and opens the door by itself: each sale outside frees the same amount for purchases outside. Proposal P5 (each circle would set its own sales limit for any one circle, that is, how much more it may sell to that circle than it buys from it) stays only an option. Every circle's ledger is public and checked by its witnesses, so any circle can recompute another circle's step and use by itself; P5 has lost most of its reason. Proposal: no limit for now; the project owner decides.
10. Visibility. Other circles see the whole ledger. Three numbers (the step, how much of it is used, and what the members have built) are what they decide by; every daily seal carries them. Every circle decides for itself whom it sells to; the list of circles it does not sell to is a public decision of its Circle Heart.

A purchase outside is written in both ledgers. Every purchase outside is a public entry in the buyer's circle's ledger (the amount held on the world account) and in the seller's circle's ledger (accepted, or refused with a reason). At the end, the buyer's circle also records it as final. If the seller's circle has another currency, it quotes the rate and the payer signs both amounts (decision 7). If the quote runs out before the payment is booked, the payment does not count and nothing is held; the app shows a new price and the payer signs again. The direct channel between the two circles stays, because it is fast, but every step is written in both ledgers.

When the other circle does not answer (decided, answer 8j). The booking is never undone by itself, and nobody pays a refund. The seller's circle may book the note only before its expiry, by default at most 10 minutes after signing (the existing note rule; a circle setting, E-1). After 7 days (by default) the buyer's circle itself looks into the seller's circle's public ledger on the relays (the blocks and seals up to the note's expiry):

• if the seller's circle did not book it, and its daily seals cover the whole time up to the note's expiry, the held amount goes back to the payer, and the entry names the seller's circle's seals as its evidence;
• if it did book it, the payment stands;
• if the seller's circle's ledger cannot be read, the buyer's circle waits. It never guesses, and meanwhile it goes on booking everything else.

In this check only a block signed by a majority of the seller's circle's witnesses counts; a block that no majority of the witnesses in office at the time signed (for example one signed only by an old or stolen key) is ignored, so it cannot stop the refund. Two blocks with one number, each signed by such a majority, are a fork, so the evidence is not used; a key that was itself that majority at the time (for example the only witness of a one-witness circle, whose key was later stolen) can still make such a fork. A change of key or witnesses in the seller's circle does not stop the check. All of this is a proposal.

Since the note has expired by then, the seller's circle can no longer book it later. So the payer gets the amount back at most once. The former rule, that the community refunds the payer by public decision, is dropped.

Example. Circle A has ten members who can each give 10,000, so the members have built 100,000.

So the ten members cannot together spend 100,000 outside: the limit is the 20,000 the community collected with a project, plus what the circle sells outside. Every row of this table is a public entry.

A fake project. Marko gets a fake project of 10,000. In the vote nobody is against, and three Heart members are for. Once the project has collected the whole amount, the rule pays it to Marko (decided, 8a). He can buy at home, but the project his money comes from is public on the relays, together with the keys of those who proposed it and voted for it. He can buy outside only if the circle has an open step that its community publicly collected with a project, so other circles can never lose more than the circle itself opened. The ledger is public and checked by the circle's witnesses, so any circle can recompute the step and its use; a node that lied would be seen by everyone. While a circle has a single witness, a dishonest node could book an error before anyone notices. That is why the app then says publicly "one witness · not yet decentralised", and every morning a restore check tests the ledger (decided, question 3). There is no money cap (the owner's decision). The sales limit (P5) stays an option.

A false reference (new, E-9 (b)). Whoever joins a circle with a reference gets the same step they built in the old circle, and the new circle sends the same amount to the old circle's community [Decided 23 Oct 2026, E-9 (b)]. A dishonest circle (for example one whose only witness is its own computer) could issue a reference with an inflated step: the new circle would give the person spending capacity and send money to the old circle. The new circle checks the reference in the old circle's public ledger, but a dishonest circle's ledger can be consistent with itself. The payment to the old circle is a payment between circles, held until the old circle books it (§3.11 of docs/knjiga-na-relejih.md ("Membership, exclusion, the reference and closing accounts")). Proposal (safety): the wave the new circle opens counts against its step outward; a join that does not fit waits on the waiting list. So a false reference cannot harm a circle by more than the step outward it opened itself (safeguard 2) [Proposal]. A question for the owner: a circle that cannot raise its step then takes in no waves from elsewhere (a founder in a new circle with step 0 waits too).

A stolen or lost circle key#

Decided 17 Oct 2026 (C5): a circle's name is its circle id, not a key, and the circle key can be replaced. The first-seen rule ("the first ledger stands") is now only extra safety (decided 17 Oct 2026, C6).

What the circle key can do. The witnesses sign the ledger and community money has no key, so the circle key cannot book anything. It stamps the mirror: the circle record in the directory (KIND 30910), which shows what the ledger already says. Proposal: the circle key signs only the mirror and, once, at founding, the found act in block 1.

What a thief can do. Whoever steals the circle key can stamp mirrors with it. A circle record counts only if it was signed by the circle key named by the ledger's mirror at the height the record gives (at the height of a change already the new key), it equals that mirror and it points to the right first block. A wrong mirror does not count, and apps follow the ledger. The thief cannot sign a block with this key, because a majority of the witnesses signs blocks; a block signed only by a stolen or old circle key does not count, not even in the check of a payment into another circle (proposal). So a theft is no longer permanent: the Circle Heart replaces the key.

How the Circle Heart replaces the key (act circle_key_change):

1. A Heart member signs the change and names the new key. The new key signs too, and so proves that whoever proposes it really holds it (proposal). Its signature covers the circle id, the new key and the time of the proposal, so it can never be used again. So nobody can name a key someone else holds.
2. k Heart members sign the change (three of four in the live circle).
3. The change is public on the relays for as long as the notice of a change runs: 72 hours by default, a circle setting [Decided 23 Oct 2026, E-1]. Everyone can see it.
4. Then the witnesses book it; the new key is in office from the next block (proposal). The circle record for the height of the change is already signed by the new key, and the daily seal that covers that height already names the new key (proposal). A block holds at most one roles entry, so a second entry in the same block cannot undo the change (proposal).
5. A mirror the old key signs for any point at or after the change never counts.

The circle id stays the same, so links, QR codes and the ledger stay as they are. A lost key is replaced the same way, and the circle can then sign a new mirror again.

No false circle under the same name. A circle's name is its circle id: the fingerprint (event id) of the found act its founder signed. It is not a key, so nobody can steal it. Whoever signs another found act gets another circle id, that is, another circle. A circle's link or QR code carries (proposal) the circle id, the addresses of at least two relays and the genesis digest as an extra pin; an app accepts only a ledger that matches both.

Extra safety. The Lana root relays should keep, for every circle id, the genesis digest and founder of the first circle record they accepted (the first-seen rule, "the first ledger stands"). This is a request in the letter to the Lana relay owner (plan phase G). Since the key can now be replaced, it is only extra safety (decided 17 Oct 2026, C6). Proposal: the root relays keep every circle's found act; they remember a circle's first record only when they hold its found act and the same founder signed it (or, for a circle configured on the relay, when its configured circle key signed the record), so nobody can be first to claim another's circle id. A retired key counts only in its own role: the relays accept the old circle key only for old circle records.

Said openly. Anyone can publish a circle record that names a circle id; only a record signed by the circle key named by the ledger's mirror at the height the record gives (at the height of a change already the new key), equal to that mirror and pointing to the right first block, counts. Until the change is booked (at least as long as the notice; 72 hours by default), a thief can stamp mirrors with the stolen key; they count only when they equal the ledger, so they change nothing.

What changes from 15 October, and why#

• Everything is on the relays (principles 1 and 2, decided 16 October): projects, votes, decisions, the step and every purchase outside are signed public records in the circle's ledger.
• Other circles see the whole ledger, not only three numbers.
• The Circle Heart instead of one administrator: the founder and three other Heart members (decided, question 4 and answer 4a; the name Circle Heart: E-2).
• Projects instead of Common Good and orders (decided, question 8): the community's money always goes to keyless projects; a project is decided by the consensus vote "all for, or it falls" (since 23 Oct 2026, E-5).
• Raising the step is a project (decided, answer 8j); Common Good used to pay it.
• People only by their key (decided, question 5); every vote signed with the key, an "against" with its reason (decided 23 Oct 2026, E-5).
• No deposits, no payouts and no bank data (decided, question 6 and answer 6a).
• The seller's circle quotes the rate, the payer accepts it (decided, question 7); for a start the European Central Bank's daily rate, the app shows the rate's date, a quote is valid for 10 minutes (decided).
• The circle's witnesses are not the random witnesses removed on 15 October. Those would have been drawn from the Lana chain to confirm work. The circle's witnesses check and sign every block of the ledger (decided, question 3). Under E-7 they will be chosen by lot among the circles' computers (the direction for phase I); even then they check the ledger's blocks, not work done. Until then a circle has one witness, its own computer [Decided 23 Oct 2026, E-7].
• A circle's name is its circle id, and the circle key can be replaced (decided 17 Oct 2026, C5): k Heart members replace a stolen or lost key (above).
• The periods are circle settings (decided 23 Oct 2026, E-1; formerly world rules, C1): the Circle Heart changes them within the bounds of the definitions; there is no world rules record any more.
• No special rejection (decided 17 Oct 2026, C4); since 23 Oct 2026 a single "against" of any member makes a project fall (E-5).
• New on 23 Oct 2026: excluding a member and closing old accounts (E-3), moving between circles only with a reference (E-9), one circle at a time and founding only from an existing circle (E-8), joining by invitation or with a waiting list (E-6).

What we removed (15 Oct 2026) and why#

• The 2.5× limit on buying outside: a number without a basis; the community's step replaces it.
• The circle's light (green, yellow, red) and the signs Z1–Z7, M1–M4: built for the old plan, in which a circle could buy from other circles with capacity created out of nothing. With the step, the damage outward is bounded in advance. Other circles see the whole ledger and decide by three numbers.
• Random witnesses drawn from the Lana chain to confirm work: too complicated for what they protect. A fake project stays in the circle, where an "against" makes it fall (since 23 Oct 2026, E-5). The witnesses drawn by lot of E-7 are something else: they check the ledger's blocks.
• Checking deposits against bank evidence: the community is not foolish, and we want to turn people's attention away from FIAT money, not towards it. (Since 16 October there are no deposits in BSA at all, answer 6a.)

What was dropped on 16 Oct 2026, and why#

• Payouts and bank data (question 6): "funds are never paid out"; bank matters belong to Lana. With them go the monthly reserve statement and the payout brake.
• Deposits, custodians, deposit corrections, the one-signature limit (question 12) and the deposit alarm (answer 6a): "Forget deposits of money, because that is a completely different system". The wave grows only with what a member receives. The circle's main account, which stood for money paid in, is no longer needed.
• A refund to a payer from the community's money by public decision (answer 8j): a payment to another circle that hangs is settled by the other circle's public ledger.
• Project limits carried over from orders (100,000 per project, one proposal a day, at most three open; answer 8b): no limits at all for now.
• The money cap while there is one witness (question 3): "no money cap".
• The legal review as a condition and free text beside the chain (question 5): the ledger carries no names; a name lives only in the profile, which the person can change.
• Common Good as one wallet, and the fund key (question 8): money always goes to projects.
• The rate signed every hour by your key, and the list of rate publishers (question 7).
• Proposal P3, that the project owner confirms the first circles (question 9).

What changed on 23 October 2026, and why#

• The world rules record and its signer (E-1): every circle sets its own periods; the values in the definitions are defaults. This removes the only key that reached every circle.
• The 72 hours of notice, the objection, its withdrawal and the answer to it (E-5): replaced by the consensus vote "all for, or it falls", as in Lana Aligns.
• The election of stewards (E-2): the question is answered, there is no election; the Circle Heart itself adds and removes Heart members.
• "The circle chooses and replaces its witnesses itself" (E-7): witnesses will be chosen by lot among the circles' computers; the Heart's vote only for exceptions.
• "At most three circles per founder" (E-8): one circle per key; only a member of an existing circle founds one.
• The "discharge note" (the E-3 addition): replaced by the reference (E-9).

Implementation sequence#

1. Now, in today's app: a proposer never decides on their own proposal; an objection is answered publicly before approval (in definitions 0.3.0 the vote replaces this, E-5). Deposits and payouts were removed from the code on 17 October 2026 (step D0). A copy of the live database showed first that there had never been a deposit or a payout.
2. With the ledger on the relays (published only after the owner's yes): projects, votes, motions, exclusions and decisions as signed acts; references for moving; keyless project wallets and reserve; inflow by rule; the Circle Heart.
3. When circles connect into the world: the world account and the step account without a key and without gravity, the step with all ten rules and its raise as a project, every purchase outside in both ledgers, settling a payment that hangs by the other circle's public ledger, the seller circle's rate quote; the sales limit for any one circle only if the project owner approves it.

Decided#

1. Development principles (the project owner, 16 October 2026): the six principles; "the whole ledger is kept only through the relays, truly nothing local; applications only read from the relays"; "transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden"; "the four Lana relays will not carry 100 billion transactions; the system must be scalable".
2. What follows from them without a new decision: every payment goes on the relays with both balances after it; no salt and no 20-account threshold; at switch-on the whole history goes to the relays; a new relay gets the whole history; settings, project decisions and membership each get their own signed public record; nothing stays on a server that cannot be rebuilt from the relays, and this is checked every morning.
3. Two safeguards (the project owner, 10 October 2026, simplified 15 October 2026): 72 hours of public notice, now of a project, formerly of an order (a proposer never decides on their own proposal, a public answer to every objection; the notice and the answer were replaced on 23 Oct 2026 by the vote, E-5) and the community's step outward (the world account without gravity, the step paid by the community by public decision, never more than the members have built). Removed: the 2.5× limit, the light and the signs, random witnesses, and checking deposits against bank evidence.
4. Answers to questions 1–9 (the project owner, 16 October 2026):
   • 1, when a payment counts ("yes"): when a majority of witnesses (three of four) has confirmed the block and at least three relays hold it.
   • 2, where the ledger lives ("yes"): every circle has its own box relay from the first day and in total at least four relays with at least three owners; the Lana relays stay the root directory and a borrowed home for small circles.
   • 3, witnesses ("yes, as the assistant proposes, no money cap"): a start with one witness and a public label; no money cap; then four witnesses with four different owners, three must agree; the circle chooses and replaces them itself (since 23 Oct 2026 the draw, E-7); at most one witness per owner.
   • 4, the people who decide ("the first people of the first circle (all of them)"): in the live circle the founder and two others decide; three approve a project. Completed by answer 4a (below). Since 23 Oct 2026 the Circle Heart (E-2).
   • 5, public for ever, and names ("A person can change their name, and then it is no longer known what belonged to whom"): the ledger knows people only by their key; a name lives only in the Lana profile and the member home; a warning at every free-text field; the legal review as a condition and free text beside the chain are dropped.
   • 6, bank data and payouts ("funds are never paid out"): no bank data and no payouts. No deposits either (answer 6a, below).
   • 7, rates ("the seller's circle proposes the exchange rate and the buyer accepts it"): the receiving circle quotes the rate from a source it chooses itself; the payer signs both amounts.
   • 8, projects ("So projects are always what gets funded"): money always goes to keyless projects; three approve; an objection stops a new project (since 23 Oct 2026 the vote, E-5); up to its amount; gravity and wave-growth counter-bookings flow into the project; surplus to the reserve; the reserve moves to a new project by itself; the sum stays zero. The details: answers below; 8d follows from decision 8; 6c is decided below; 8g and 8h stay open.
   • 9, founding circles ("I like the founding of circles this way for now."): no personal approval, by a rule the relay checks; proposal P3 is dropped. "At most three circles per founder" was replaced on 23 Oct 2026 by E-8.
5. Answers to the open points (the project owner, 16 October 2026):
   • 4a, four ("I am then add a fourth person too"): four: the founder and three other Heart members (since 23 Oct 2026 the Circle Heart, E-2); three approve a project; nobody decides on their own project.
   • 6a, deposits ("Forget deposits of money, because that is a completely different system"): BSA has no deposits; dropped: deposits, custodians, deposit corrections (formerly 6b), question 12 and the deposit alarm; the wave grows only with what a member receives.
   • 8a: a project pays its doer once it has collected the whole amount.
   • 8b ("Let it flow in order, there need be no limits for now"): inflow goes to projects in order, the oldest first; no amount limit and no other limits for now.
   • 8c: an objection within 72 hours of publication; the project stays stopped until the objector withdraws it; once the project receives, an objection does not stop it. Replaced on 23 Oct 2026 by E-5.
   • 8e: a project is closed with 72 hours of public notice (since 23 Oct 2026 the Circle Heart closes it; the notice is a circle setting, E-1), the money goes to the reserve; a project that does not fill within 90 days ends by itself.
   • 8f: paying a project does not use up the community's money (the doer's wave grows, the same amount goes on); the brake is the approval (since 23 Oct 2026 the vote, E-5); the sum stays zero.
   • 8i: the world account and the step-outward account have no key; the circle's main account went with the deposits (6a).
   • 8j ("OK", after the explanation): nobody pays for a payment to another circle that hangs; after 7 days the payer's circle looks into the receiving circle's public ledger: not booked and its seals cover the time up to the note's expiry, the held amount goes back to the payer; booked, the payment stands; the ledger cannot be read, it waits and never guesses. Raising the step outward is a project like any other; once full, the step rises by that amount.
   • Starting rate source: the European Central Bank's daily rate; the app shows the rate's date; a quote is valid for 10 minutes.
   • 6c, the first money in a new circle (later the same day, »6c, da«): At founding, the circle's reserve gets one start (»zagon«): 1,000 in the circle's currency. It is booked from a keyless account, »izvor« ("origin"), which goes into minus by the same amount, so the ledger's sum stays zero. The start is not used up but keeps coming back (8f): a project pays a doer below the wave cap, the doer's wave grows, and the same amount goes on to the next project or to the reserve. There is no other first money: no starting wave for members, no bridge from Lana. The account name »izvor« / "origin" and the exact shape of the entry are a proposal for definitions 0.3.0 (plan step C1). The live circle (one member, no payments) gets the same start when its ledger begins (proposal: 1,000 EUR).
6. Every circle has its own app (circle in a box), never one master app for several circles; one currency per circle (the project owner, 16 October 2026).
7. Private keys never go anywhere; nothing goes to the relays without the project owner's explicit yes; the BSA ID is the public key in HEX, never npub (16 October 2026).
8. The other decisions (root relays, rates, member home, the seal) are in the documents "World relay network", "Currencies and exchange rates", "BSA ID and the Lana profile" and "New circle: circle in a box".
9. Answers to phase C (the project owner, 17 October 2026):
   • C1, world rules ("save the parameters in a separate KIND, so that if we change it world-wide, it changes in every application"; after the explanation, "you can do it all together in phase D"): the time values (72 hours of notice and for objections, 72 hours before closing, 90 days, 7 days, 10 minutes) and the three who approve a project are the same for every circle; a circle cannot change them. They live in one world-wide record (KIND 43920 BSA Rules), signed by the key that publishes the definitions on lananostr.site; a change counts only from the day written in it, at least 7 days after it is published, never retroactively; every block and seal names the rules version it used; later several signatures (for example 3 of 5). Replaced on 23 Oct 2026 by E-1: the periods are circle settings, and there is no world rules record any more.
   • C2 ("YES"): payments never wait for the morning (visit before touch: an account's gravity is booked right before the first entry that touches it after the morning). An act (for example a vote) does not touch an account; only an entry that moves money does (clarification, 17 Oct 2026 (D1 review)).
   • C3 ("YES"): refusals of keys that are neither members nor applicants are answered and never booked; an act is valid 7 days; at most 20 refusals of one key a day are booked (since 23 Oct 2026 both 7 days and 20 are default circle settings, E-1).
   • C4 ("YES"): no special rejection; only an objection stops a project. Replaced on 23 Oct 2026 by E-5: a single "against" of any member makes a project fall.
   • C5 ("I don't understand why you don't do this right away"; after the explanation, "you can do it all together in phase D"): a circle's name is its circle id (the id of the found act its founder signs), not a key. The circle key can be replaced: three of the four (now Heart members) replace a stolen or lost key with 72 hours of public notice (since 23 Oct 2026 by default; a circle setting, E-1), and the witnesses book the change.
   • C6 ("YES"): the first-seen rule ("the first ledger stands") goes into the letter to the Lana relay owner (phase G); with C5 it is extra safety.
   • C7 ("7 Yes"): a circle's time zone, morning hour and tzdata version are written at founding and do not change in 0.3.0.
10. Answers to the three questions after phase D (the project owner, the evening of 17 October 2026; »vsi da«, "all yes", to the proposal »1A, 2A, 3A«):

• 1A, who signs the world rules: for now the world rules record is signed only by the key that publishes the definitions, that is, the project owner's. Several signatures (for example 3 of 5) are introduced before the first circle the project owner does not run joins (for example the first circle from another ecosystem). Who the signers will be is still open. So the tension with principle 3 (no central authorities) is limited in time and said openly. Dropped on 23 Oct 2026 by E-1.
• 2A, the time-zone database version (part of C7): at founding the circle writes down, besides its time zone and morning hour, the version of the time-zone database (tzdata); the witnesses compute the morning hour with it, not with their own newest one. In 0.3.0 it never changes; not even the Circle Heart can replace it; that they may (for example when a country drops the clock change) can only come with a later version of the definitions.
• 3A, the transition period: the 60 days of gentler gravity run for each account from its own first receipt, as definitions 0.3.0 say. Today's app counts them from the circle's start; the live circle has no payments, so today this affects nobody. At the switch to the new gravity the per-account rule applies.

11. Answers before phase E (the project owner, 23 October 2026; the owner's words and the full decisions are in the document "Running a circle"):

• E-1 (»72 ur ne more biti fiksno to je lahko default nastavitev, ki jo lahko spremeinijo«, "72 hours cannot be fixed; it can be a default setting that they can change"): the periods and limits are circle settings; there is no world rules record any more; the same for every circle: at least three Heart votes for and none against, the money and gravity computation.
• E-2 (»Upravitelji bodo po novem Srce kroga«, "From now on the stewards will be the Circle Heart"): the Circle Heart; the circle's members do not elect it; whoever disagrees leaves and creates their own circle.
• E-3: the Heart excludes any member with three votes, at once, for 3 months; it can close old accounts.
• E-4: the Heart leads and oversees the OWN processes; only the decision reaches the ledger.
• E-5: the consensus vote "all for, or it falls"; the proposer sets the duration, the shortest 72 hours by default; replaces 8c.
• E-6: open, invite only, or at most so many members with a waiting list.
• E-7: witnesses are computers, chosen by lot among circles (phase I); the Heart's vote only for exceptions.
• E-8: only a member of an existing circle founds a new one; one circle per key; a member of one circle at a time.
• E-9: moving only with a reference, issued by itself once the member has settled. The same day (»1 a,« and »... in se zadeva izniči«, "... and the matter cancels out"): an open OWN process blocks the reference also without a debt (a); in the new circle the person gets the same step, and the same amount goes to the old circle's community, which closes the old account (b).
• E-10 and E-11 (»1B, vendar OWN proces lahko sproži vsak« and »1a,2a in 3c«): at least three Heart members for an exclusion, a readmission, an account close and a witness exception; any member opens an OWN process; the wave a reference brings counts against the new circle's step outward. After the review of round 5: a move's hold waits for the old circle's word; on a proposal without money the proposer's own vote counts; gravity is never stronger than today's and is made stronger only after at least 30 days of notice (so no Heart can turn gravity into a quick way to take members' pluses); a Heart member who leaves loses the seat; no join with a step while an earlier move out is unsettled; a reference is valid once.

Replaced: "After 7 days without an answer from the other circle the community refunds the payer by public decision, at most once" (10 and 15 October 2026) is replaced by answer 8j. On 23 October 2026: the world rules record (C1, 1A) is replaced by E-1; the 72 hours of notice, the answer to objections (10 and 15 October), the objection (8c) and C4 are replaced by E-5; "the circle chooses its witnesses itself" is replaced by E-7; "at most three circles per founder" is replaced by E-8.

Proposals and questions waiting for the owner's yes#

• Open 8g, a contribution to a project: may a member give to a project only their plus, as today, and not from their wave? Proposal: only the plus. Whatever exceeds what the project still lacks goes to the reserve. A contribution that names no project goes to the reserve and from there to the projects.
• Open 8h, the doer of a project: must the doer of a project be a member of the circle? Proposal: yes, the doer joins the circle first.
• The Heart's other decisions (for answer 4a and E-2): proposal: k Heart members sign (three of four in the live circle), also closing a project and the list of circles a circle does not sell to. For replacing the circle key this is decided (17 Oct 2026, C5); for the witnesses and recovery, at least three for and no Heart member against (E-7, E-10); an exclusion, a readmission and an account close at least three too (the larger of k and 3, E-10).
• Returning the money of a project that is already receiving (for answer 8e): proposal: the money goes to the reserve, as when the project is closed, also when the doer declines the project, leaves the circle or is excluded, when the proposer withdraws it, or when payment falls due and the doer is no longer a member; the 90 days count from the day the project starts receiving.
• Projects (for answers 8a and 8j): proposal: the recipient consents to a project or declines it, as today for an order; a project that has not opened 30 days after publication expires; the recipient of a step-raise project is the step-outward account, and since that account has no wave, such a project really uses up community money; the step is lowered by a vote like a project, never below what is used.
• Stale-rate alert and changing the source (for the answer on the starting source): proposal: the Heart members are alerted when the rate is older than 120 hours; the circle changes its source by an act of k Heart members, at any time.
• A step raise that no longer fits under what was built (for answer 8j), without a number: what happens if a project to raise the step fills, but the step would then exceed what the members have built.
• Question 21: replaced by E-5: every vote is signed and public with the voter's key; an "against" carries a short public reason; the app shows the name from the profile. The warning at free-text fields is already decided (question 5).
• Question 24, project images: on three independent file servers; the relays carry the fingerprint and the address.
• P5, sales limit for any one circle: stays a proposal; proposal: none for now.
• P7, the yes for publishing: one yes per version of the definitions and one yes to switch on each kind of record, not one per record.
• The circle key (for C5): proposal: at a change the new key signs its own proof of possession, over the circle id, itself and the time of the proposal, so it can never be used again; the circle key is never the founder's, a witness's or a Heart member's key, and a new key is never the key already in office; every daily seal and circle head names the circle key in office, so a reader of the root directory picks the right mirror: a daily seal carries the circle key of the newest mirror up to the last block it covers, at the height of a change already the new key, which also signs the circle record of that height; a block holds at most one roles entry, so a second entry in the same block cannot undo the first; the circle key signs only the mirror and, once, the found act in block 1.
• Circle settings (for E-1): proposal: the bounds of every setting (for example the shortest vote from one to 30 days, an act's validity, now 7 days, from 1 to 30 days, the Heart votes a project needs from three to nine); the notice of a change lasts at least as long as the period being changed was, so a stolen key cannot skip the warning; a new value applies from the first block after the notice ends and never retroactively; during the notice apps sign with the stricter value. The open question whether the 72-hour notice of witness and relay changes, recovery and circle-key changes should follow the world notice value is answered by E-1: it is one circle setting, the notice of a change (72 hours by default). The question who holds the keys of the world record is dropped.
• A false reference (for E-9 (b)): proposal: the wave the new circle opens counts against its step outward; a join that does not fit waits on the waiting list (above, safeguard 2). A question for the owner: a circle that cannot raise its step then takes in no waves from elsewhere.
• New on 23 Oct 2026: the proposals, the open questions (for example whether a circle that cannot raise its step takes in waves from elsewhere, E-9 (b)) and the tensions with the principles for E-1 to E-9 are in the document "Running a circle". Two matter for the safeguards: a single "against" of any member makes a project fall (a stronger brake, which can also stop an honest project); and the power of a Heart the members do not elect (a tension with principle 3).