Foundations
Binding architectural principles
Seven principles that constrain everything. Violating any one of them re-opens problems that took four iterations to close.
These principles constrain every downstream decision. Where a design conflicts with a principle, the design changes. Each principle is enforced architecturally — i.e., the structure of the architecture, not just the discipline of operators, is what makes the principle hold.
1. Per-property isolation
Principle: every property has its own Layer 2 governance vehicle. No parent DAO, no fund-of-DAOs, no pooled treasury, no cross-property primitives.
Why it’s binding: per-property isolation is what defeats the horizontal common enterprise prong of Howey. Pooled treasuries across properties create the exact characteristic regulators identify as a security. Isolation is not a design preference — it is the regulatory perimeter.
Architecturally enforced by:
- One wrapper entity per property (separate LLC or DAO LLC for each)
- Smart contracts (Tier 2) cannot call across DAO instances; no cross-DAO function surfaces
- Treasury isolation at the legal entity level
- Membership lists isolated at the registry level
What this rules out:
- Pooling treasuries to coordinate large stewardship spending across properties
- “Diversifying” benefit-unit holders across multiple properties
- An Institutional Fund holding governance positions in multiple properties (the Fund is a buyer of credits, not a holder of positions)
2. Earth Credits ≠ Governance Positions
Principle: Earth Credits are commodities; governance positions (benefit units) are governance roles. The two flow on parallel tracks and are visibly different at every architectural layer.
Why it’s binding: this is the firewall against the most likely securities characterization. If a regulator can plausibly argue that holding a benefit unit is functionally equivalent to holding a profit-generating financial instrument, the entire architecture collapses into a registered securities offering.
Architecturally enforced by:
- Credits are issued by Layer 3 registry; positions are issued by Layer 2 wrapper at formation
- Credits are sold to anyone; positions are held only by named stakeholders
- Credits are tradeable; positions are non-transferable except by succession
- Distribution module pays cash (or, if Q1 resolves favorably, in-kind credits via separate transactions); position count never changes in distributions
- Exchange and Fund interfaces handle credits, never positions
What this rules out:
- A DAO that holds and trades its own credits as part of governance
- A governance position that gives the holder a claim on specific credit volume
- Marketing benefit units in any form that suggests financial-investment characterization
3. Permissioned membership
Principle: governance positions are held only by named real-world stakeholders with a specific relationship to the property. Membership is non-transferable except by DAO-approved succession. There is no public offering of positions.
Why it’s binding: this defeats the public offering element under SEC and most foreign regulators’ analyses. Permissioned membership also defeats the secondary-market characteristic that is core to securities classification.
Architecturally enforced by:
- Smart contracts (Tier 2) enforce non-transferability at the contract layer
- Operating agreements (Tier 1 and Tier 2) enforce non-transferability legally
- KYC required for all members; held off-chain by Landseed compliance
- Member additions require existing-member consent (not market mechanism)
What this rules out:
- A landowner selling their position to a third party
- “Token sales” of any kind
- An Institutional Fund buying its way into governance
- Open-mint mechanisms
4. Cryptographic attestation, not testimony
Principle: the architecture acts on signed methodology outputs, not on Landseed’s say-so. Truth is verifiable from outside.
Why it’s binding: this is the operational expression of The Unauditable Market thesis. It is also the answer to “what stops Landseed from cheating its own measurements.” The whole assay-office argument depends on independent verifiability.
Architecturally enforced by:
- EC-M-1.1 methodology is open-source and auditable
- attestation receipts are cryptographically signed and content-addressed
- Registry’s credit issuance references specific attestation receipts
- Layer 2 governance vehicles consume only attested measurements
What this rules out:
- Manual methodology overrides
- Off-chain “trust me” assertions about ecological condition
- Closed-source methodology
- Centralized attestation without public verifiability
5. Templates not customization (with the Template C exception)
Principle: for stakeholder shapes that have predictable patterns (solo landowners, land trusts, corporate, sovereign, foundation-stewardship), use audited standardized templates. For Template C (indigenous co-governance), use a co-design framework with the specific community.
Why it’s binding: composability without discipline produces unauditable proliferation. Custom DAOs per property destroy audit economics, operational legibility, and regulatory consistency.
But: Template C cannot be truly templated. The NURJ paper (§II.B, §IV.B, §V) is explicit that indigenous epistemologies must define the logic, not be encoded by outsiders. Forcing every indigenous deployment into a single template would reproduce the colonial governance pattern the paper critiques. Co-design is the resolution.
Architecturally enforced by:
- Template library audited as a unit; new templates require library-level audit
- Template parameters are bounded; arbitrary customization is not exposed
- Template C is intentionally an exception, with each deployment requiring its own audit cycle
What this rules out:
- Custom DAOs per property for Templates A, B, D, E
- Skipping audit cycles to ship a one-off
- Forcing indigenous communities into a Landseed-defined template (this would violate NURJ’s prescriptions)
6. Coalition entities are counterparties, not parents
Principle: the Exchange, Signal Markets, Institutional Fund, Market Makers, registry, and Captain Landseed are external entities that interact with Layer 2 vehicles at well-defined interfaces. None owns DAOs/LLCs. None holds benefit units. None has governance rights.
Why it’s binding: coalition entities owning governance vehicles re-creates the parent/subsidiary structure that v1.2’s monolithic deed approached. It also creates the fund-of-DAOs failure mode (Bright Line 4 in 04-perimeter/).
Architecturally enforced by:
- Coalition entity governance is separate from DAO governance
- Coalition entities have no credentials in any DAO
- Interfaces are unidirectional data flows (registry → DAO; Exchange → registry → DAO; etc.)
What this rules out:
- The Fund taking governance positions
- The Exchange holding benefit units as collateral
- Captain Landseed making governance proposals
- Any “holding company” structure across DAOs
7. Graduated smart-contract complexity
Principle: smart contracts are used where they genuinely add value. Where they don’t, simpler legal structures are preferred.
Why it’s binding: smart contracts are not free. They have audit costs, technological fragility over decades, and operational overhead. For solo landowners and institutional land trusts, a Vermont LLC with a multi-sig treasury wallet provides effectively the same governance with dramatically less cost and complexity.
This is a first-principles concession that the third planning iteration made. Earlier iterations assumed every template would be a smart-contract DAO. Closer review showed:
- Template A (solo landowner) gains nothing from on-chain governance — there’s one decision-maker, distributions are simple, succession is rare
- Template B (land trust) has institutional governance already; smart contracts add a brittle layer
- Template D (corporate) wants board-style governance, not on-chain
- Template E (sovereign) involves treaty obligations and treaty-incompatible technology
For these, smart contracts are over-engineering. Vermont LLCs with sound operating agreements work.
For Template C (indigenous co-governance), smart contracts add real value:
- Multi-party FPIC checkpoints with cryptographic record
- Cultural-guardian multi-sig on culturally sensitive treasury actions
- Permissioned-but-transparent operations (community sees everything; outsiders see only what community publishes)
- Auditable governance trail for cultural risk assessment per NURJ §IV.E
Architecturally enforced by:
- Tier 1 templates use Vermont LLCs with multi-sig wallets
- Tier 2 templates (Template C and any future multi-party templates) use audited smart-contract DAOs
- Wrapper entity choice (LLC vs. DAO LLC) follows Tier
- Audit cost economics reflect the tier
What this rules out:
- Mandating smart contracts for every property
- Custom-building Tier 2 mechanisms for every Tier 1 deployment
- Skipping smart contracts for Template C (where they genuinely add value)
How these principles relate
Principles 1–4 are regulatory-perimeter principles — they keep the architecture out of securities territory and out of fraudulent-claim territory. Violating any of them collapses the architecture’s regulatory standing.
Principles 5–7 are operational-discipline principles — they keep the architecture deployable, auditable, and durable. Violating any of them makes the architecture unmaintainable but does not necessarily collapse it.
Both categories matter. The first matters more, but the second governs whether the architecture can be operated by humans over decades.
What is not a binding principle
Some things that look like principles but are not:
- The 99-year term is a default, not a principle. Per-jurisdiction caps may apply; per-property circumstances may justify shorter terms.
- The 60–85% landowner share for Template A is a parameter range, not a principle. Specific deployments will vary.
- Vermont as default US wrapper jurisdiction is a default, not a principle. Wyoming, Marshall Islands, or other are case-by-case.
- The protocol fee percentage (currently 2–5%) is a parameter, not a principle.
These can change without violating the architecture.