eleven / ocho Public

Download this file

1	# 🤖 Funding without control — notes, the waterfall, and the public ledger
2
3	> **Status: designed, not adopted.** No notes exist and no money has been
4	> taken under this model. This document is the plan of record for how outside
5	> investment would enter, sit, and leave — it becomes live only after an Irish
6	> solicitor and tax advisor have reviewed the instrument (§ Regulatory
7	> guardrails) and Series 1 is deliberately opened. Until then it is a spec,
8	> and like every spec in this repo it is published so it can be argued with.
9
10	Eleven takes no venture capital. The product is public-service *and*
11	commercial — members pay for what things cost plus resilience
12	(`docs/tier-economics.md`), and the books are already on the public record
13	(`docs/status.md`). This document extends the same posture to investment:
14	money may fund the work, but **money has no control**. There are no investor
15	shares, no board seats, no votes, no exits. What an investor buys is a
16	position in a published algorithm; what protects them is not power but
17	transparency with teeth.
18
19	The model in one paragraph: investors buy **profit-participating notes** in
20	named series. The money sits through a **seasoning period** and behind a
21	**reserve floor**, then a quarterly **waterfall** streams distributable
22	surplus out — pro-rata to noteholders until each hits a fixed **cap
23	multiple** and the note extinguishes, alongside fixed shares for the team and
24	the commons. Every parameter, every computation input, and every payment is
25	published in a machine-readable **ledger** on the status pages. The algorithm
26	is versioned in this repo; each series pins the version it was sold under. An
27	independent **verification panel** — funded senior to everyone as an
28	operating cost — audits the claims: the encryption architecture, the
29	published economics, and whether the money actually moved the way this
30	document says it must.
31
32	## The one rule here: money has no control
33
34	- Notes carry **no votes, no board seats, no vetoes, no information rights**
35	beyond the public ledger everyone already has.
36	- The **only enforceable investor rights are the transparency promises**:
37	that the ledger publishes, that the verification panel stays funded, and
38	that distributions follow the pinned algorithm. Breach of those — and
39	nothing else — gives noteholders a remedy (§ Events of default).
40	- The company can always refuse money; money can never redirect the mission.
41	Mission changes sit behind the guardian's golden share (§ Entities), which
42	no amount of investment can buy.
43	- Symmetrically, **the company cannot change a sold note**. Algorithm
44	changes apply to future series only (§ Changing the algorithm).
45
46	## Entities
47
48	Two entities, one of which does almost nothing:
49
50	- **The operating company** — an ordinary Irish private company (a DAC if we
51	want the mission bound into a legal objects clause). It runs everything:
52	the fleet, payroll, the raise itself. Deliberately boring to operate.
53	- **The guardian** — a small passive entity holding a single **golden share**
54	in the operating company's constitution. Its only powers are vetoes: sale
55	or merger, weakening the E2EE architecture, gutting the licence, or
56	applying an algorithm change retroactively to sold notes. It never trades,
57	never employs, never touches product decisions. (Form — CLG, trust, or an
58	existing steward foundation — is an open decision; the lesson from the
59	earlier CLG is that the mission lock must never be the *operating* entity.)
60
61	## The instrument: profit-participating notes
62
63	A note is a simple contract, identical for every investor in a series:
64
65	- **Principal** — the amount invested.
66	- **Cap multiple** — the total the note can ever return, as a multiple of
67	principal (default **2.0×**; a series fixes it anywhere in 1.5×–3.0×).
68	No interest, no compounding, no fees: the cap is the whole return.
69	- **No maturity date** — the note lives until its cap is reached through the
70	waterfall, however long that takes. Distributions scale with revenue and
71	nothing else.
72	- **No security** — noteholders rank as unsecured creditors behind ordinary
73	trade creditors and payroll. This is at-risk money and the note says so
74	plainly.
75	- **Algorithm pin** — the note names the git commit of this document it was
76	sold under. That version governs the note forever.
77
78	## Series
79
80	Raises happen in **named series** (S1, S2, …), the way releases are minted.
81	A series fixes, before it opens: its size ceiling, cap multiple, seasoning
82	period, and algorithm version. All of that is published in the ledger when
83	the series opens — terms are identical for every subscriber and there are no
84	side letters, by rule. The company may refuse any subscription without
85	reason (mission-alignment is allowed to be a judgment call), and every
86	subscriber clears KYC/source-of-funds checks before funds are accepted.
87
88	## Inflows and seasoning
89
90	Subscribed money lands in the treasury and **sits**:
91
92	- **Seasoning**: no distributions to a series' noteholders until the later
93	of (a) **24 months** after the series closes and (b) the reserve floor
94	holding for **two consecutive quarters**. New money funds building first;
95	it cannot arrive and immediately start extracting.
96	- Seasoning gates *noteholder* payments only — the verification retainer and
97	ordinary operations are never gated.
98
99	## The reserve floor
100
101	Before anything is distributable, the treasury must hold **12 months of
102	budgeted operating costs** (the budget itself is a published ledger input).
103	Below the floor, nothing streams and the ledger says so. The floor is
104	recomputed each quarter from the forward budget, so growth raises it.
105
106	## The waterfall
107
108	Computed once per quarter, from cash actually received and spent — no
109	accrual games. Normative pseudocode; the prose around it explains intent,
110	but a note incorporates this computation by reference:
111
112	```
113	quarter(q):
114	R = cash revenue received in q
115	C = operating costs paid in q # includes the verification retainer
116	F = reserve floor top-up needed # to reach 12 months forward budget
117	D = R − C − F # distributable surplus
118
119	if D ≤ 0: publish inputs; distribute nothing
120	else:
121	investors = 0.60 × D # pro-rata by remaining cap, seasoned series only
122	team = 0.25 × D # the profit-share pool
123	commons = 0.15 × D # price cuts, free-tier subsidy, aligned grants
124
125	each note's payment = investors × (note remaining cap ÷ Σ remaining caps)
126	a payment reduces the note's remaining cap; at zero the note extinguishes
127
128	rounding: the investor and team pools round down to the cent — leftover
129	cents always land with the commons, never the money
130	if no note is seasoned: the investor pool is retained in the treasury
131	(never redirected to the other pools; team and commons still flow)
132	if the pool exceeds every remaining cap: notes fill and extinguish, and
133	the excess is published as residue — its destination is a decision made
134	and published at the time, like the post-extinguishment fold below
135	when all notes are extinguished: investors' 60% folds into commons and team
136	(35% / 25%), or into lower prices — decided and published at the time
137	```
138
139	Notes on intent:
140
141	- **Pro-rata by remaining cap**, not by principal — so early series aren't
142	crowded out by later, larger ones, and every note converges on its cap at
143	the same relative pace.
144	- **The commons share is accounted publicly**: each quarter's ledger entry
145	says where the 15% went (which prices were cut, what was granted, to whom).
146	- The split constants (60/25/15), the cap-multiple range, seasoning, and the
147	reserve months are **parameters of the algorithm version** — changing any
148	of them is a new version (§ Changing the algorithm).
149
150	A worked quarter, for scale honesty: Series 1 raises €300k at 2.0× — a €600k
151	lifetime obligation ceiling. A quarter brings €40k revenue, €28k costs, €4k
152	reserve top-up → D = €8k → €4,800 to noteholders, €2,000 to the team pool,
153	€1,200 to the commons. Remaining caps fall to €595,200. At that pace the cap
154	is decades away — the honest reading is that **noteholders are paid back at
155	the speed the product actually earns**, and possibly never in full. This is
156	patient, at-risk money by construction, and the offer documents say exactly
157	that.
158
159	## Verification: the assurance panel
160
161	The credibility of every public claim — "the server holds only ciphertext",
162	"the price is the cost plus resilience", "the money moved as published" —
163	rests on someone independent checking. The panel is what the raise
164	structurally guarantees:
165
166	- **Funding is senior by construction**: the retainer is an operating cost
167	(inside `C`), never a waterfall share — it cannot be starved by tuning the
168	splits. It is prefunded **12 months ahead** in a segregated account,
169	topped up quarterly; if the balance ever drops below 12 months, that is an
170	**assurance lapse**, published as a flag on the status pages the day it
171	happens.
172	- **Independence is contractual**: at least three members; the company
173	appoints at most a minority; members cannot be removed, and the retainer
174	cannot be reduced, in response to findings.
175	- **Output is public**: at least annually, unredacted after a fixed 30-day
176	remediation window — (1) an architecture audit of the E2EE claims
177	(`docs/no-plaintext.md`, the security ledger), (2) a ledger audit (do the
178	published numbers reconcile to bank statements), (3) an economics audit
179	(are the published allowances the enforced ones —
180	`docs/tier-economics.md`), and (4) an **algorithm-compliance audit**: were
181	the quarter's distributions the pinned algorithm's outputs for the
182	published inputs.
183
184	## The ledger
185
186	The money's public record, in the committed-data pattern the status pages
187	already use (`docs/status.md` — carbon, economics, contributors):
188
189	- **`web/status/funding.json`** — committed data, republished as-is by the
190	box's status timer alongside `funding.html` (the **Investing** tab of the
191	status pages, which also carries an interactive simulator that imports and
192	runs the served algorithm module over a chosen scenario). Three arrays:
193	- `series[]` — id, opened/closed dates, size, cap multiple, seasoning,
194	algorithm version (git commit).
195	- `notes[]` — **pseudonymous** note ids with principal, remaining cap,
196	series. KYC identities stay private (they are personal data and buy no
197	influence anyway); amounts and movements are public.
198	- `quarters[]` — every input (`R`, `C`, `F`, the forward budget behind the
199	floor) and every output (per-note payments, team, commons, and where the
200	commons went), plus reserve and retainer balances.
201	- **All ledger amounts are integer cents** — no floats near money, and every
202	computation is deterministic to the cent (remainder cents are assigned by
203	largest fractional remainder, ties broken by note id).
204	- **The algorithm ships as code**: `web/status/waterfall.js`, a pure function
205	from `funding.json` to the quarter's payments, Node-tested against pinned
206	vectors (`test/waterfall.test.mjs` + `test/waterfall-vectors.json`) in the
207	same style as `format.js` (`tools/waterfall.mjs` re-exports it for
208	Node-side use). It lives in the published status directory on purpose: the
209	Investing page serves it *and* imports it, so the public simulator runs the
210	normative module rather than describing a copy. Anyone can re-run it: **an
211	audit is a re-execution**. Legally the pinned prose governs; a divergence
212	between prose and code is a defect fixed in code, in public.
213
214	## Events of default — the teeth
215
216	The note's only covenants are the transparency promises, so those are the
217	only defaults. If any of these holds and is not cured within **90 days**:
218
219	1. the ledger stops publishing, or publishes figures the verification panel
220	finds irreconcilable with bank records;
221	2. the assurance lapse flag stands uncured (the panel defunded); or
222	3. a distribution is made off-algorithm, or an algorithm change is applied
223	retroactively to a sold note —
224
225	then every note's **unreturned principal becomes repayable**. That is the
226	entire remedy: no step-in rights, no board seats, no control even in
227	default. Investors can force the money back out; they can never take the
228	wheel.
229
230	## Wind-down
231
232	- **Solvent wind-down**: after all obligations, remaining treasury goes
233	first to notes up to *unreturned principal* (not cap), then to the
234	commons — published, like everything else. The golden share blocks
235	sale-for-parts as an exit.
236	- **Insolvency**: notes rank as unsecured, behind trade creditors and
237	payroll. The offer documents say so in plain language.
238
239	## Changing the algorithm
240
241	This document is versioned in git; **a note pins the commit it was sold
242	under and that version governs it forever**. Changing parameters or
243	mechanics is a new version that can apply only to series opened after it —
244	enforced twice: contractually in the note, and by the guardian's golden-share
245	veto on retroactive application. (The deploy-pinning instinct, applied to
246	money.)
247
248	## Regulatory guardrails
249
250	The structure must stay inside these lines, and adoption is gated on
251	professional review of each:
252
253	- **Prospectus rules** — notes are securities; offers stay inside an EU
254	Prospectus Regulation exemption (the Irish national threshold — confirm
255	the current figure with the solicitor — and/or ≤149 non-qualified persons
256	per member state, and/or qualified investors only). Series size ceilings
257	are set to keep each raise inside the exemption used.
258	- **Not deposit-taking** — the money is at-risk with contingent,
259	algorithm-determined returns and is never repayable on demand (default
260	remedies excepted). Nothing in the copy or the contract may resemble a
261	deposit.
262	- **Tax** — profit-participating interest can be treated as a distribution
263	(non-deductible) in Ireland, and withholding may apply to payments. The
264	waterfall's economics are only real once the instrument's tax treatment is
265	nailed down; this is the advisor's first question.
266	- **Per-series sign-off** — every series gets legal review before it opens,
267	not just Series 1.
268
269	## What this is not
270
271	- Not VC: no equity, no exit, capped upside, revenue-paced returns that may
272	take decades or never complete. It selects for patient, mission-aligned
273	money — customers, peers, steward-ownership funds — and that is the point.
274	- Not a bank: money in is at risk, and "sits for a while" is seasoning, not
275	safekeeping.
276	- Not governance: the raise funds the work and the checking of the work. The
277	mission is locked where money can't reach it.
278