🤖 Funding without control — notes, the waterfall, and the public ledger

> Status: designed, not adopted. No notes exist and no money has been > taken under this model. This document is the plan of record for how outside > investment would enter, sit, and leave — it becomes live only after an Irish > solicitor and tax advisor have reviewed the instrument (§ Regulatory > guardrails) and Series 1 is deliberately opened. Until then it is a spec, > and like every spec in this repo it is published so it can be argued with.

Eleven takes no venture capital. The product is public-service and commercial — members pay for what things cost plus resilience (docs/tier-economics.md), and the books are already on the public record (docs/status.md). This document extends the same posture to investment: money may fund the work, but money has no control. There are no investor shares, no board seats, no votes, no exits. What an investor buys is a position in a published algorithm; what protects them is not power but transparency with teeth.

The model in one paragraph: investors buy profit-participating notes in named series. The money sits through a seasoning period and behind a reserve floor, then a quarterly waterfall streams distributable surplus out — pro-rata to noteholders until each hits a fixed cap multiple and the note extinguishes, alongside fixed shares for the team and the commons. Every parameter, every computation input, and every payment is published in a machine-readable ledger on the status pages. The algorithm is versioned in this repo; each series pins the version it was sold under. An independent verification panel — funded senior to everyone as an operating cost — audits the claims: the encryption architecture, the published economics, and whether the money actually moved the way this document says it must.

The one rule here: money has no control

• Notes carry no votes, no board seats, no vetoes, no information rights beyond the public ledger everyone already has.
• The only enforceable investor rights are the transparency promises: that the ledger publishes, that the verification panel stays funded, and that distributions follow the pinned algorithm. Breach of those — and nothing else — gives noteholders a remedy (§ Events of default).
• The company can always refuse money; money can never redirect the mission. Mission changes sit behind the guardian's golden share (§ Entities), which no amount of investment can buy.
• Symmetrically, the company cannot change a sold note. Algorithm changes apply to future series only (§ Changing the algorithm).

Entities

Two entities, one of which does almost nothing:

• The operating company — an ordinary Irish private company (a DAC if we want the mission bound into a legal objects clause). It runs everything: the fleet, payroll, the raise itself. Deliberately boring to operate.
• The guardian — a small passive entity holding a single golden share in the operating company's constitution. Its only powers are vetoes: sale or merger, weakening the E2EE architecture, gutting the licence, or applying an algorithm change retroactively to sold notes. It never trades, never employs, never touches product decisions. (Form — CLG, trust, or an existing steward foundation — is an open decision; the lesson from the earlier CLG is that the mission lock must never be the operating entity.)

The instrument: profit-participating notes

A note is a simple contract, identical for every investor in a series:

• Principal — the amount invested.
• Cap multiple — the total the note can ever return, as a multiple of principal (default 2.0×; a series fixes it anywhere in 1.5×–3.0×). No interest, no compounding, no fees: the cap is the whole return.
• No maturity date — the note lives until its cap is reached through the waterfall, however long that takes. Distributions scale with revenue and nothing else.
• No security — noteholders rank as unsecured creditors behind ordinary trade creditors and payroll. This is at-risk money and the note says so plainly.
• Algorithm pin — the note names the git commit of this document it was sold under. That version governs the note forever.

Series

Raises happen in named series (S1, S2, …), the way releases are minted. A series fixes, before it opens: its size ceiling, cap multiple, seasoning period, and algorithm version. All of that is published in the ledger when the series opens — terms are identical for every subscriber and there are no side letters, by rule. The company may refuse any subscription without reason (mission-alignment is allowed to be a judgment call), and every subscriber clears KYC/source-of-funds checks before funds are accepted.

Inflows and seasoning

Subscribed money lands in the treasury and sits:

• Seasoning: no distributions to a series' noteholders until the later of (a) 24 months after the series closes and (b) the reserve floor holding for two consecutive quarters. New money funds building first; it cannot arrive and immediately start extracting.
• Seasoning gates noteholder payments only — the verification retainer and ordinary operations are never gated.

The reserve floor

Before anything is distributable, the treasury must hold 12 months of budgeted operating costs (the budget itself is a published ledger input). Below the floor, nothing streams and the ledger says so. The floor is recomputed each quarter from the forward budget, so growth raises it.

The waterfall

Computed once per quarter, from cash actually received and spent — no accrual games. Normative pseudocode; the prose around it explains intent, but a note incorporates this computation by reference:

quarter(q):
  R  = cash revenue received in q
  C  = operating costs paid in q          # includes the verification retainer
  F  = reserve floor top-up needed        # to reach 12 months forward budget
  D  = R − C − F                          # distributable surplus

  if D ≤ 0:            publish inputs; distribute nothing
  else:
    investors = 0.60 × D    # pro-rata by remaining cap, seasoned series only
    team      = 0.25 × D    # the profit-share pool
    commons   = 0.15 × D    # price cuts, free-tier subsidy, aligned grants

  each note's payment = investors × (note remaining cap ÷ Σ remaining caps)
  a payment reduces the note's remaining cap; at zero the note extinguishes

  rounding: the investor and team pools round down to the cent — leftover
  cents always land with the commons, never the money
  if no note is seasoned: the investor pool is retained in the treasury
  (never redirected to the other pools; team and commons still flow)
  if the pool exceeds every remaining cap: notes fill and extinguish, and
  the excess is published as residue — its destination is a decision made
  and published at the time, like the post-extinguishment fold below
  when all notes are extinguished: investors' 60% folds into commons and team
  (35% / 25%), or into lower prices — decided and published at the time

Notes on intent:

• Pro-rata by remaining cap, not by principal — so early series aren't crowded out by later, larger ones, and every note converges on its cap at the same relative pace.
• The commons share is accounted publicly: each quarter's ledger entry says where the 15% went (which prices were cut, what was granted, to whom).
• The split constants (60/25/15), the cap-multiple range, seasoning, and the reserve months are parameters of the algorithm version — changing any of them is a new version (§ Changing the algorithm).

A worked quarter, for scale honesty: Series 1 raises €300k at 2.0× — a €600k lifetime obligation ceiling. A quarter brings €40k revenue, €28k costs, €4k reserve top-up → D = €8k → €4,800 to noteholders, €2,000 to the team pool, €1,200 to the commons. Remaining caps fall to €595,200. At that pace the cap is decades away — the honest reading is that noteholders are paid back at the speed the product actually earns, and possibly never in full. This is patient, at-risk money by construction, and the offer documents say exactly that.

Verification: the assurance panel

The credibility of every public claim — "the server holds only ciphertext", "the price is the cost plus resilience", "the money moved as published" — rests on someone independent checking. The panel is what the raise structurally guarantees:

• Funding is senior by construction: the retainer is an operating cost (inside C), never a waterfall share — it cannot be starved by tuning the splits. It is prefunded 12 months ahead in a segregated account, topped up quarterly; if the balance ever drops below 12 months, that is an assurance lapse, published as a flag on the status pages the day it happens.
• Independence is contractual: at least three members; the company appoints at most a minority; members cannot be removed, and the retainer cannot be reduced, in response to findings.
• Output is public: at least annually, unredacted after a fixed 30-day remediation window — (1) an architecture audit of the E2EE claims (docs/no-plaintext.md, the security ledger), (2) a ledger audit (do the published numbers reconcile to bank statements), (3) an economics audit (are the published allowances the enforced ones — docs/tier-economics.md), and (4) an algorithm-compliance audit: were the quarter's distributions the pinned algorithm's outputs for the published inputs.

The ledger

The money's public record, in the committed-data pattern the status pages already use (docs/status.md — carbon, economics, contributors):

• web/status/funding.json — committed data, republished as-is by the box's status timer alongside funding.html (the Investing tab of the status pages, which also carries an interactive simulator that imports and runs the served algorithm module over a chosen scenario). Three arrays: - series[] — id, opened/closed dates, size, cap multiple, seasoning, algorithm version (git commit). - notes[] — pseudonymous note ids with principal, remaining cap, series. KYC identities stay private (they are personal data and buy no influence anyway); amounts and movements are public. - quarters[] — every input (R, C, F, the forward budget behind the floor) and every output (per-note payments, team, commons, and where the commons went), plus reserve and retainer balances.
• All ledger amounts are integer cents — no floats near money, and every computation is deterministic to the cent (remainder cents are assigned by largest fractional remainder, ties broken by note id).
• The algorithm ships as code: web/status/waterfall.js, a pure function from funding.json to the quarter's payments, Node-tested against pinned vectors (test/waterfall.test.mjs + test/waterfall-vectors.json) in the same style as format.js (tools/waterfall.mjs re-exports it for Node-side use). It lives in the published status directory on purpose: the Investing page serves it and imports it, so the public simulator runs the normative module rather than describing a copy. Anyone can re-run it: an audit is a re-execution. Legally the pinned prose governs; a divergence between prose and code is a defect fixed in code, in public.

Events of default — the teeth

The note's only covenants are the transparency promises, so those are the only defaults. If any of these holds and is not cured within 90 days:

1. the ledger stops publishing, or publishes figures the verification panel finds irreconcilable with bank records;
2. the assurance lapse flag stands uncured (the panel defunded); or
3. a distribution is made off-algorithm, or an algorithm change is applied retroactively to a sold note —

then every note's unreturned principal becomes repayable. That is the entire remedy: no step-in rights, no board seats, no control even in default. Investors can force the money back out; they can never take the wheel.

Wind-down

• Solvent wind-down: after all obligations, remaining treasury goes first to notes up to unreturned principal (not cap), then to the commons — published, like everything else. The golden share blocks sale-for-parts as an exit.
• Insolvency: notes rank as unsecured, behind trade creditors and payroll. The offer documents say so in plain language.

Changing the algorithm

This document is versioned in git; a note pins the commit it was sold under and that version governs it forever. Changing parameters or mechanics is a new version that can apply only to series opened after it — enforced twice: contractually in the note, and by the guardian's golden-share veto on retroactive application. (The deploy-pinning instinct, applied to money.)

Regulatory guardrails

The structure must stay inside these lines, and adoption is gated on professional review of each:

• Prospectus rules — notes are securities; offers stay inside an EU Prospectus Regulation exemption (the Irish national threshold — confirm the current figure with the solicitor — and/or ≤149 non-qualified persons per member state, and/or qualified investors only). Series size ceilings are set to keep each raise inside the exemption used.
• Not deposit-taking — the money is at-risk with contingent, algorithm-determined returns and is never repayable on demand (default remedies excepted). Nothing in the copy or the contract may resemble a deposit.
• Tax — profit-participating interest can be treated as a distribution (non-deductible) in Ireland, and withholding may apply to payments. The waterfall's economics are only real once the instrument's tax treatment is nailed down; this is the advisor's first question.
• Per-series sign-off — every series gets legal review before it opens, not just Series 1.

What this is not

• Not VC: no equity, no exit, capped upside, revenue-paced returns that may take decades or never complete. It selects for patient, mission-aligned money — customers, peers, steward-ownership funds — and that is the point.
• Not a bank: money in is at risk, and "sits for a while" is seasoning, not safekeeping.
• Not governance: the raise funds the work and the checking of the work. The mission is locked where money can't reach it.