Architecture · Buffer pool
Buffer Pool — Operational Specification
How the buffer pool absorbs reversal risk without becoming a pooled investment vehicle.
The buffer pool is the architectural mechanism that protects Earth Credit holders against catastrophic loss of underlying ecological condition. When a property’s verified condition declines materially, credits previously issued may be invalidated — but the buffer pool replaces them, so non-retired buyers’ compliance claims remain valid.
This document closes the gap flagged in earlier iterations of 06-risks/02-pressure-tests.md Test 4, and survives the adversarial audit performed at the close of the fourth iteration.
Why a buffer pool
Without a buffer pool:
- A landowner deliberately destroys the property’s ecological condition; or wildfire, hurricane, insect outbreak, or methodology error causes verified-condition collapse
- Outstanding Earth Credits issued against that property’s prior verified condition lose their underlying basis
- Buyers who retired those credits for compliance claims are exposed
- Trust in Earth Credits as a commodity collapses
This is the same problem Verra (AFOLU buffer) and Gold Standard (compliance buffer) solve for carbon credits. Earth Credits need an equivalent — but the equivalent must be designed for the ECI methodology’s specific risk distribution, not blindly imported from carbon markets.
Architectural placement
The buffer pool sits at the registry layer (per 04-registry-function-specification.md) and is governed by the Methodology Foundation once formed (per 00-foundations/07-methodology-foundation.md and 07-execution/05-methodology-foundation-formation.md).
Issuance event
│
│ Earth Credits = Verified Acres × ECI_conservative × Threat × Constant
│
▼
Issuance split (atomic; cannot be unwound):
│
├─► (85–95%) → Property's wrapper LLC treasury (revenue)
│
└─► (5–15%) → Buffer Pool registry account (Foundation-held)
Contributed credits are NOT property of the wrapper LLC
and not subject to its operating agreement; they are
issued directly to the Foundation registry account.
Catastrophic event triggers reversal:
│
▼
Methodology stewards verify event + eligibility threshold (transparent process)
│
▼
Foundation board ratifies (or audit committee non-objection in Year 1)
│
▼
Buffer Pool credits replace invalidated NON-RETIRED credits in buyer accounts
│
▼
Buyer's compliance claim remains valid; cryptographic reversal receipt published
│
▼
Foundation pursues subrogation / NRD-lite enforcement against destroying party
│
▼
Methodology stewardship reviews whether issuance rules need adjustmentIssuance: the buffer pool credits are the Foundation’s, immediately
A subtle but important point. At issuance, the methodology calculates total credits X for the property’s verified condition. Of X, a portion Xbuffer (5–15%) is issued directly to the Foundation’s buffer-pool registry account. The wrapper LLC receives X − Xbuffer. The buffer-pool credits are never the wrapper LLC’s property and are never subject to its operating agreement. This matters because:
- Property stakeholders cannot claim a residual interest in the buffer pool
- The wrapper LLC’s bankruptcy or dissolution does not reach the buffer pool
- The Foundation has clean ownership for governance and disposition
- Subrogation against a destroying landowner does not run through the wrapper LLC’s treasury
Counsel-confirmation required for this issuance structure in each deployment jurisdiction. In Vermont, the issuance is documented in the operating agreement and methodology incorporation per 01-nrd-lite/05-methodology-incorporation.md.
Buffer contribution rate — risk-adjusted, methodology-versioned, published
Each issuance contributes a percentage of credits to the buffer pool. The contribution rate is risk-adjusted, methodology-determined, and published before issuance (i.e., the property knows its rate before signing).
| Risk profile | Buffer contribution | Indicative criteria (methodology-versioned; see EC-M parameter table) |
|---|---|---|
| Low | 5% | Threat multiplier ≤1.2; established stewardship history (>5 years); jurisdiction with strong enforcement; ecosystem with mature methodology fit |
| Moderate | 8% | Threat multiplier 1.2–1.6; typical stewardship history; jurisdiction with adequate enforcement |
| High | 11% | Threat multiplier 1.6–2.0; weaker stewardship history; jurisdiction with weaker enforcement |
| Frontier | 14% | Threat multiplier >2.0, OR first-of-kind ecosystem under methodology, OR first deployment in jurisdiction |
Indicative criteria are illustrative and live in the methodology specification (Landseed-PBC/earth-credit-package), not this document. The methodology version in effect at issuance determines the rate; subsequent methodology versions do not retroactively change rates for already-issued credits.
Comparison to existing benchmarks
| Standard | Buffer rate |
|---|---|
| Verra VCS AFOLU | 10–60% (project-type-dependent) |
| Gold Standard Land Use & Forests | 10–20% (project-type-dependent) |
| NRD-DAO Earth Credits (this spec) | 5–14% (risk-adjusted) |
Earth Credits’ lower base rates reflect the ECI methodology’s structural protections: continuous-condition measurement (vs. one-time avoided emissions), threat multiplier already discounting at issuance, and per-property isolation limiting concentration risk. Frontier rate (14%) is below Verra’s mid-tier (15%) by design — the architecture must demonstrate this is justified through empirical reversal data, not assumed.
Adversarial concern: rate-setting moral hazard
The methodology stewards who set rates also benefit from issuance volume (registry fees scale with issuance). Lower rates → easier landowner acceptance → more issuance. This creates a structural incentive to under-rate properties.
Mitigation:
- Rate criteria are published and parametric — a property’s rate follows mechanically from threat multiplier, stewardship history, and jurisdiction; it is not discretionary
- An audit committee (independent of methodology stewards; per Foundation governance) ratifies rate criteria annually and reviews actual reversal outcomes vs. rate-implied expectations
- Quarterly public report includes actual draw rate vs. rate-implied expected draw rate; sustained under-rating is publicly visible
- An external independent reviewer (insurance actuary or equivalent) confirms rate adequacy at year 3 and year 5
This does not eliminate the moral hazard; it makes it observable. The architecture treats observability as the primary mitigation per Principle 4 (cryptographic attestation, not testimony).
Adversarial concern: privacy of risk profiles
Per the transparency table below, per-property risk profiles are public. A landowner whose property is rated “Frontier” is publicly tagged as such. This may damage the relationship.
Mitigation: at engagement, the property is informed of the rate and the parametric criteria that determined it. The property can provide additional evidence to argue for a lower-tier rate (stewardship history documentation, jurisdiction-specific enforcement evidence). The methodology stewards must publish their rate decision with reasoning. Properties may decline to proceed if they believe the rate is mis-set; the rate is not imposed unilaterally. Consent at issuance is the primary protection.
Catastrophic event definition
A “catastrophic event” qualifying for buffer-pool reversal is one of:
| Event type | Definition | Verification path |
|---|---|---|
| Force majeure ecological loss | Wildfire, hurricane, flood, severe insect outbreak, climate-driven catastrophic loss exceeding 30% of property’s pre-event ECI | Satellite imagery + on-site assessment + sensor data + methodology stewards’ verification |
| Deliberate destruction | Landowner or third party causes condition loss in violation of NRD-lite enforcement floor | Same as above + NRD-lite enforcement record (recording office; counsel-led litigation if disputed) |
| Methodology error invalidation | Methodology stewardship determines that prior issuance was based on systematic methodology error (rare, narrowly defined) | Foundation supermajority (not stewardship-only) + audit committee approval + 60-day public comment period |
| Buyer-side fraud cancellation | Buyer requests credit invalidation due to documented misrepresentation by the property at issuance | Foundation methodology stewards + outside counsel review; misrepresentation must be evidenced (not asserted) |
Buyer-side cancellation is narrowly defined. A buyer cannot unilaterally cancel a credit. The cancellation requires evidence of misrepresentation at issuance, reviewed by Foundation stewards and outside counsel. Without documented misrepresentation, retired credits are final.
Methodology error invalidation: the highest-stakes category
Methodology error invalidation lets stewards effectively void prior issuances. This is a serious moral hazard. The architecture constrains it:
- Cannot be invoked by methodology stewardship alone
- Requires Foundation board supermajority (not majority)
- Requires audit committee approval
- Requires 60-day public comment period before action
- Affected property and credit holders have right to respond
- Methodology error must be documented as systematic (one bad assessment is not methodology error; it’s an assessment error and goes to force majeure or buyer-side fraud)
This is structurally restrictive by design. Cumulatively, the architecture treats methodology-error invalidation as a near-emergency mechanism, not a normal lever.
Eligibility threshold
Not every event triggers buffer-pool draw. The threshold:
- ECI loss exceeding 30% of pre-event score, OR
- Documented destruction of substantial portion of property (>10% of acres), OR
- Methodology stewardship determination of systematic error (with the constraints above), OR
- Documented buyer-side fraud (with the constraints above)
Below threshold: condition decline is reflected in future ECI assessments and future credit issuance. Past-issued credits remain valid. The buffer pool does not draw for normal condition fluctuation.
Coordination with NRD-lite enforcement (subrogation)
When the buffer pool draws because of deliberate destruction, the Foundation has standing to seek recovery from the destroying party:
- The buffer pool draw is not a waiver of NRD-lite enforcement rights
- The Foundation, as buffer-pool drawer, is subrogated to the property’s enforcement rights to the extent of the draw
- Subrogation is documented in NRD-lite + wrapper-entity operating agreement at deployment
- Counsel-led recovery action proceeds on Foundation’s behalf
- Recovery (if any) refunds the buffer pool, not the wrapper LLC
This is standard subrogation doctrine adapted for the buffer-pool context. Counsel-confirmation required per jurisdiction.
Reversal process — operational SLA and fallbacks
When a catastrophic event qualifies:
| Step | Description | Owner | SLA | Fallback if unavailable |
|---|---|---|---|---|
| 1 | Event documented (sensor data, satellite imagery, on-site assessment) | Methodology stewards + registry | T+0 to T+10 days | Audit committee may commission third-party assessment |
| 2 | Pre-event vs. post-event ECI calculated; loss percentage determined | Methodology stewards | T+10 to T+20 days | Methodology stewards’ designated alternate (named at deployment) |
| 3 | Eligibility threshold confirmed | Methodology stewards | T+20 days | Audit committee may compel review |
| 4 | Foundation board ratifies (Year 2+) or audit committee non-objection (Year 1) | Foundation board / audit committee | T+30 days | Quorum rules in Foundation bylaws; emergency convening if needed |
| 5 | Number of credits requiring reversal calculated; replacement credits issued with isReplacement: true and replacementFor: <original_receiptHash> flags | Registry function | T+35 days | Cryptographically deterministic from inputs; no fallback needed |
| 6 | Buffer pool credits transferred to replace invalidated credits; notifyReplacement(receiptHash, replacementFor) delivered to affected DAOs’ M5 | Registry function (multi-key signoff) | T+40 days | Multi-key holders’ designated alternates |
| 7 | Buyers of invalidated credits notified; replacement credits in their accounts | Registry function | T+50 days | Email + cryptographic notification + public registry update |
| 8 | Cryptographically attested record of reversal published | Registry function (cryptographic anchor) | T+55 days | Anchor to permissionless chain; backup to Software Heritage / IPFS |
| 9 | Methodology stewardship reviews whether reversal indicates issuance-rule adjustment | Methodology Foundation | T+90 days | Review report published regardless of recommendation |
| 10 | Subrogation / enforcement action initiated where applicable | Foundation + outside counsel | T+30 days | Counsel-led; statute-of-limitations-tracked |
Total turnaround target: 30–60 days from event documentation to buffer-pool draw completion. Steps 9 and 10 extend beyond.
If any SLA step is missed: public notification; Foundation board emergency convening; audit committee oversight intensifies.
Where the cryptographic receipts live
Reversal receipts are anchored cryptographically. The architecture commits to:
- A primary anchor on a permissionless distributed ledger (specific chain TBD; methodology-versioned, not architecturally bound to any chain)
- A backup anchor on Software Heritage or equivalent institutional archive
- A backup anchor on a content-addressed durable store (IPFS or successor)
- Paper-record archival (annual report) at Foundation premises
Triple-archive commitment matches Q-archival-1 resolution per 06-risks/04-proposed-resolutions.md.
Buffer pool composition
The buffer pool holds:
- Earth Credits set aside from issuances (the primary asset)
- No cash, no other digital tokens, no derivatives, no other assets
The credits are held in a Foundation-controlled registry account. They are not tradeable. They are not retire-able by external parties. They exist solely to backfill catastrophic reversals.
Important regulatory note: by holding only ecological-commodity-credits and explicitly disclaiming derivatives, the buffer pool is not an insurance product, not a financial product, not a swap/derivative under CFTC framework. It is a methodology-level reserve. Counsel-confirmation required — see “Regulatory characterization” section below.
Buffer pool sizing — modeled, not aspirational
Initial sizing (Year 1, first 5–20 properties)
- Aggregate buffer contribution rate: ~7–8% (mix of moderate-rated properties)
- Expected reversal frequency: low (the methodology has no operational track record yet, but ECI is a continuous-condition measure with no permanence promise; reversals should be empirically observable as ECI drops)
- Buffer pool size at end of Year 1: ~7–8% of total cumulative issuance
Steady-state sizing (Year 5+)
After 5+ years of operation, the Foundation board reviews:
- Empirical reversal frequency: actual reversals per year per property
- Empirical reversal magnitude: average % of pre-event ECI lost per reversal
- Whether buffer pool has been adequate (draws/contributions ratio)
- Whether contribution rates need adjustment (per risk tier)
- Independent insurance-actuary confirmation of adequacy
If reversals are rarer than expected:
- Contribution rates can be reduced (floor at 3% for low-risk; rate criteria revised)
- Excess buffer credits can be retired (taken out of circulation)
- Important: retirement is not a price-support tool; the Foundation does not target a market price. Retirement reduces total circulating supply, which affects pricing as a side effect, but the rationale must be buffer-adequacy, not market intervention.
If reversals are more frequent than expected:
- Contribution rates increase (up to 18% for frontier; rate criteria revised)
- Buffer pool grows
- Methodology stewardship reviews issuance rules
- Insurance backstop engagement considered earlier
Why the floor at 3% and the ceiling at 18%
A lower bound prevents rate-arbitrage incentives; an upper bound prevents prohibitive rates that would block deployment in genuinely high-risk contexts (where the architecture is most valuable). These bounds are reviewable annually but require Foundation supermajority + 60-day notice to change.
Insolvency scenarios
What if the buffer pool is exhausted by catastrophic concentration of reversals?
| Scenario | Response |
|---|---|
| Single major event causes >50% of buffer pool draw | Foundation board emergency meeting (within 10 days); audit committee review; insurance backstop activated if engaged; contribution rates increase for new issuance; methodology stewardship review |
| Buffer pool exhausted | New issuance paused (registry function refuses new attestations) until buffer pool replenished by accumulated contributions; existing-credit holders informed within 30 days; methodology stewardship reviews issuance rules; audit committee determines minimum buffer-pool size before new issuance resumes |
| Systemic failure (multiple major events) | Methodology stewardship triggers full review; Foundation board emergency assembly; possible methodology version change (with notice); full transparency to all stakeholders; potential coordination with insurance backstop |
In extreme cases, the Foundation may seek external insurance or reinsurance for the buffer pool. This is a Year 3+ consideration, not first-year planning.
Year 1 vs. Year 2+ governance — and the gap between
The buffer pool is a Foundation function in mature operation. But the Foundation takes 12–18 months to form (per 07-execution/05). What governs the buffer pool in Year 1 — and what happens in the gap?
| Period | Governance |
|---|---|
| Year 1, before Foundation formation | Buffer pool sits at registry function (Landseed PBC). Governance: methodology stewards + audit committee (independent: 2 outside ecologists + 1 outside finance/audit). Multi-key signoff for all draws. Quarterly public report. |
| Year 1.5, Foundation formation in progress | Joint governance: Landseed PBC interim authority + Foundation transition committee. Preparatory transfer arrangements documented and ready to execute on Foundation’s IRS determination. |
| Year 2+, Foundation operational | Foundation board sets policy. Methodology stewards verify events. Audit committee approves rate criteria annually. Multi-key signoff continues. Annual + per-event public reporting. |
What if Landseed PBC fails before Foundation forms?
This is the Test 16 scenario in 06-risks/02-pressure-tests.md applied to the buffer pool specifically. Mitigations:
- Buffer pool credits are held in a registry account that is not Landseed PBC corporate property
- The registry account is held in a fiduciary structure (counsel-confirmation required, but candidate structures: bare trust with named successor trustees, or escrow with counsel-named successor escrow agent)
- A successor trustee/escrow agent is named at architecture launch (before any issuance)
- If Landseed PBC fails, successor takes over per documented protocol; emergency Foundation formation accelerated; meanwhile, no new issuance against affected properties until governance re-stabilizes
This is the architecture’s most fragile interim period (Months 0–18). It is not fully resolved without external counsel confirmation of the fiduciary structure. Counsel-confirmation required as a Q-buffer-1 follow-up.
Foundation governance of buffer pool
| Authority | Threshold |
|---|---|
| Set/adjust rate-criteria parameters (within published 3%–18% range) | Audit committee + methodology stewards majority |
| Change rate-criteria range itself | Foundation board supermajority + 60-day notice |
| Define eligibility threshold for reversals | Foundation board supermajority + 60-day notice |
| Approve specific reversal events | Methodology stewards majority + audit committee non-objection |
| Sell/retire excess buffer credits | Foundation board majority + 60-day notice + non-price-support attestation |
| Methodology error invalidation | Foundation board supermajority + audit committee approval + 60-day public comment |
| Insurance backstop engagement | Foundation board supermajority + audit committee approval |
The audit committee is independent of the methodology stewards (composed of two outside ecologists plus one outside finance/audit per 00-foundations/07-methodology-foundation.md). This separation prevents methodology stewards from unilaterally determining their own oversight.
Buyer notification and trust
Critical for buyer trust: every credit holder knows whether their credits are buffer-protected and how:
| Notification | Timing | Channel |
|---|---|---|
| At purchase | Buyer’s purchase agreement explicitly notes credits are buffer-protected per Foundation policy; risk profile of underlying property; rate at issuance | Purchase contract + cryptographic attestation of credit metadata |
| Annual statement | Foundation publishes annual buffer-pool report (size, draws, adequacy, contribution rates, reversals) | Public publication + email to credit holders |
| At reversal event | Affected buyers notified within 30 days of event documentation; replacement credits in their accounts within 60 days of eligibility confirmation | Email + cryptographic notification + public registry update |
| At policy change | All credit holders notified of contribution-rate or eligibility-threshold changes 60 days before effective | Public publication + email |
| At Year 1→Year 2 transition | All credit holders notified of governance transition (Landseed PBC → Foundation) with 60-day notice | Email + public publication |
This transparency is essential for the assay-office thesis: buyers trust because they can verify.
Regulatory characterization — counsel-confirmation required
The buffer pool is novel; its regulatory characterization is not settled. Counsel must confirm:
| Concern | Position | Counsel-confirmation required |
|---|---|---|
| Insurance characterization (state insurance regulators) | Not insurance: buffer pool replaces commodity in kind, not in cash; no premium paid by buyer; no actuarial promise to a specific buyer | Yes — in each US state where credits are sold, plus any non-US jurisdiction |
| CFTC characterization (commodity pool / swap / clearing) | Not a commodity pool: no investor pooling; not a swap: no derivative contract; not a clearing function: not standing between counterparties to a contract | Yes — federal CFTC counsel |
| Securities characterization (Foundation governance positions) | Foundation governance positions are non-transferable, fiduciary, not investment instruments | Yes — securities counsel reviewing Foundation bylaws |
| Tax characterization (Foundation receipt of buffer-pool credits) | 501(c)(3) public charity receiving in-kind contributions of methodology-attested ecological commodity credits; tax treatment depends on credit fair-market-value at issuance | Yes — tax counsel on Foundation Form 1023 |
Until counsel-confirmation completes for each concern, the buffer pool operates with explicit regulatory caveats in all buyer-facing materials.
What the buffer pool does NOT do
For absolute clarity:
- Does not protect against price decline. Buffer pool replaces invalidated credits; it does not insure against market price changes.
- Does not compensate property’s beneficiaries for lost revenue. If property’s condition is destroyed, future revenue is lost; buffer pool doesn’t replace it.
- Does not retroactively replace already-retired credits. Once a credit is retired (claimed by a buyer for compliance), it’s done; buffer pool replaces only invalidated, non-retired credits in active accounts.
- Does not eliminate the underlying conservation risk. Real conservation depends on stewardship and relationships; the buffer pool is a financial-credit-side backstop, not a conservation tool.
- Does not function as a price-support mechanism. Retiring excess buffer credits affects pricing as a side effect; targeting price is explicitly prohibited and audit-committee-tracked.
- Does not reach pre-issuance ecological loss. The buffer pool only replaces credits that were issued; it does not compensate for loss of expected future issuance.
- Does not waive NRD-lite enforcement. The Foundation pursues subrogation independently of the buffer-pool draw.
Buffer pool transparency
All buffer pool operations are publicly verifiable:
| Aspect | Public | Cryptographic anchor |
|---|---|---|
| Total buffer pool size (number of credits) | ✓ | Annual + per-event |
| Contribution rates (risk-adjusted, by property at issuance) | ✓ (with property identifier; not personal details) | Per-issuance |
| Risk-tier rate criteria (parametric) | ✓ | Methodology version |
| Reversal events (event, scope, replacement, root cause) | ✓ | Per-event |
| Foundation board decisions on rates | ✓ (with vote tally; member identities public) | Annual minutes |
| Audit committee oversight findings | ✓ | Annual report |
| Per-property risk profiles | ✓ (with property identifier; consent-based privacy where culturally required, e.g., Template C) | Per-property |
| Specific reversal amounts per property | ✓ (after event) | Per-event |
| Subrogation outcomes | ✓ (after action) | Per-event |
| Methodology error invalidations | ✓ (with public comment record) | Per-event |
| Annual actuarial review (Year 3+) | ✓ | Annual |
This is consistent with the architecture’s general transparency principle: trust comes from cryptographic verifiability and observability, not from concealment.
Template C exception
For Template C deployments, per-property risk-profile disclosure is subject to FPIC. The community may request that risk-profile detail is aggregated or omitted from public reporting. The architecture’s commitment is that aggregate statistics remain public; per-property detail may be community-restricted. This is a NURJ-paper-grounded concession to data sovereignty. It does not extend to Tier 1 templates.
Year 1 vs. Year 2+ operations
| Aspect | Year 1 (interim, Landseed PBC) | Year 2+ (Foundation) |
|---|---|---|
| Buffer pool location | Registry function (Landseed PBC) — held in fiduciary structure | Methodology Foundation registry account |
| Contribution rate setting | Methodology stewards + audit committee (independent) | Audit committee + methodology stewards majority; range changes by Foundation board supermajority |
| Reversal authorization | Methodology stewards + audit committee non-objection + multi-key signoff | Foundation board ratification + methodology stewards verify + audit committee non-objection + multi-key signoff |
| Public reporting | Quarterly + per-event | Annual + per-event |
| Insurance backstop | None | Considered Year 3+ |
| Successor governance if Landseed PBC fails | Named successor trustee/escrow agent + emergency Foundation formation | Foundation continuity per bylaws |
This evolution mirrors the broader registry-to-Foundation transition. The Year 1 interim is the architecture’s most fragile period and requires explicit successor-trustee documentation before any issuance.
Critical pre-first-issuance decisions
Before any Earth Credit can be issued (Phase 5 of the sensor-to-credit walkthrough):
| Decision | Required | Owner |
|---|---|---|
| Confirm initial buffer contribution rate-criteria (5%/8%/11%/14%) | Yes | Methodology stewards + audit committee |
| Define eligibility threshold for reversals | Yes | Methodology stewardship + counsel |
| Establish buffer pool registry account in fiduciary structure | Yes | Landseed PBC + counsel + named successor trustee |
| Document successor trustee / escrow agent + protocol | Yes | Counsel + Landseed PBC + named successor |
| Document buyer-notification policy | Yes | Registry function |
| Operationalize reversal process with named alternates | Yes | Registry function |
| Subrogation language in NRD-lite + operating agreement | Yes | Counsel per jurisdiction |
| Counsel confirmation: not insurance, not commodity pool, not swap | Yes | Counsel — securities, CFTC, state insurance |
| Audit committee composition (2 ecologists + 1 finance/audit) | Yes | Landseed PBC + outside-search |
These are operational tasks for first-pilot deployment. They are not architectural decisions; they are execution decisions that follow from this specification.
Metrics tracked
Foundation tracks per quarter / annually:
| Metric | Why |
|---|---|
| Total credits issued | Trend |
| Total buffer-pool credits accumulated | Sufficiency |
| Reversal events count and magnitude | Frequency; sizing accuracy |
| Buffer pool draws (credits replaced) | Adequacy |
| Buffer pool draws / total issuance ratio | Risk |
| Actual draw rate vs. rate-implied expected draw rate | Rate-setting moral hazard observability |
| Subrogation recovery (when applicable) | Buffer-pool replenishment |
| Time from event to reversal completion | Operational SLA performance |
| Public-comment volume on methodology-error invalidations | Foundation governance health |
| Audit committee findings | Governance quality |
These metrics inform contribution-rate adjustments, methodology evolution, and Foundation governance.
Adversarial findings — addressed in this iteration
This document was hardened in response to adversarial audit. Findings addressed:
| Finding | How addressed |
|---|---|
| Risk profile assignment was hand-wavy | Added parametric criteria table; rate is mechanical, not discretionary |
| Contribution rate range had no benchmark justification | Added Verra/Gold Standard comparison and lower-rate justification |
| Contradiction between “5% low-risk” and “3% reduction floor” | Resolved: 3% is the floor for rate-criteria adjustment after empirical review; 5% is the rate at issuance for low-risk properties under current criteria |
| ”Excess buffer retirement” looked like price support | Explicit non-price-support attestation required; audit committee tracks |
| Methodology error invalidation had no safeguards | Added Foundation supermajority + audit committee + 60-day public comment + systematic-error scope |
| Buyer-side cancellation was undefined | Narrowly defined: only documented misrepresentation, with counsel review |
| Foundation property at issuance was ambiguous | Explicit issuance structure: buffer credits issued directly to Foundation, never property of wrapper LLC |
| No coordination with NRD-lite enforcement | Added subrogation framework |
| Year 1 governance gap | Explicit interim governance and successor-trustee structure |
| Failure scenarios (Landseed PBC fails before Foundation) | Successor trustee/escrow agent named at launch; emergency Foundation formation |
| SLA fallbacks if stewards/board unavailable | Named alternates per role; emergency convening protocols |
| Cryptographic receipt publication infrastructure | Triple archive: permissionless ledger + Software Heritage + IPFS + paper |
| CFTC / insurance regulatory risk | Counsel-confirmation required across regulatory dimensions; explicit caveats in buyer materials until confirmed |
| Privacy of risk profiles | Consent at engagement; rate is published before issuance; property may decline |
| Methodology version handling | Methodology version at issuance determines rate; subsequent versions don’t retroactively change |
| Rate-setting moral hazard | Parametric criteria + audit committee + actual-vs-expected-draw observability + outside actuary at Year 3 and Year 5 |
| Captain Landseed coordination | (Not addressed in spec; coordination protocol lives in coalition entity interfaces; flagged for 05-interfaces/02-coalition-entities.md) |
What remains unresolved
After this iteration, six buffer-pool-specific items remain open:
- Counsel-confirmation across regulatory dimensions (insurance, CFTC, securities, tax) — pending counsel engagement
- Successor-trustee/escrow structure (specific fiduciary form, including “Foundation supersession clause” per Attack A-8) — pending counsel engagement
- Subrogation language per jurisdiction — pending per-jurisdiction counsel
- Empirical reversal data (none yet; methodology has no operational track record) — Year 1+ collection
- Replacement-credit flagging implementation (per Attack A-12 + Fix 9 in
02-governance-templates/02-modules.md) — registry function and M5 must coordinate; mandatory before any catastrophic-event drill - Foundation governance capture mitigation (per Attack A-4) — Foundation bylaws must specify supermajority for audit committee nominations and rate-criteria changes; must be addressed before Form 1023 filing
These are external-dependency or pre-issuance items, not architectural gaps.
Cross-references
- Registry function:
04-registry-function-specification.md - Methodology Foundation:
00-foundations/07-methodology-foundation.md - Foundation formation plan:
07-execution/05-methodology-foundation-formation.md - Test 4 (landowner destruction):
06-risks/02-pressure-tests.md - Test 16 (Landseed PBC fails):
06-risks/02-pressure-tests.md - Methodology incorporation:
01-nrd-lite/05-methodology-incorporation.md - Q-buffer-1 resolution:
06-risks/04-proposed-resolutions.md - Q-archival-1 (cryptographic receipts):
06-risks/04-proposed-resolutions.md