We onboard one party.
They onboard ten thousand.
The scheme does not onboard the world, and it should not try. A partner enrolls once and hard, then mints identities inside its own namespace under caps its bond secures — and eats the risk of every one, which is precisely why it polices them. Card networks settled this shape fifty years ago; we inherit the playbook instead of paying to rediscover it.
The naive reading — everyone registers with us, every party a direct counterparty — is a flat registry. It fails three ways, and each one is fatal on its own.
Human-reviewed attestations cannot onboard a partner's ten thousand merchants. The federation becomes a DMV, and the queue is the product.
No serious commerce partner sends its ecosystem to register on someone else's forms under someone else's brand. They want their own protocol with settlement underneath.
“Any user joins the economy” read as any user holding positions is the sentence that ends the counsel meeting. Retail speculation on failure is not a product.
Owns the rules, the receipt, the splits and the settlement rails. It does not onboard the world.
Onboard and vouch for the agents that do the work, inside their own namespace.
Onboard and vouch for the vendors and merchants whose surfaces the work happens on.
Buy assured outcomes, or check one. They never register with the scheme at all.
The budgets are deliberate in both directions. Every sector's smoothest path is the lowest ring that serves it. Sales effort concentrates entirely on ring 1, because each ring-1 win onboards its own ring 2 for free.
Commerce partners, operator platforms, rails, desks, evaluators.
Merchants, vendors, individual agents — admitted through a partner.
Anyone buying an assured outcome, or checking one.
The last column is the load-bearing one. A permission model is only as good as what it forbids, and these prohibitions are what keep retail out of positions and keep the verification surface neutral.
| Actor | Settler SDK | Reseller SDK | Never |
|---|---|---|---|
Partner backend ring 1 | Full partner surface under its own namespace keys | Owns it | Minting outside caps; underwriting past the master bond |
Cohort partner ring 2 | Nothing directly — its identity lives inside the namespace | register, postJob, submitWork, receipts | Direct positions; namespace keys |
Staker ring 2 | Nothing | stake, back, claim, dashboard | Any settler API call; any direct position |
Any user ring 3 | receipt.verify and payment — free, keyless | The partner's own storefront | Registration anywhere |
Auditor, or anyone no ring | receipt.verify and the explorer | The partner's public pages | Needing anyone's permission |
One call a reseller may never wrap: receipt.verify. A partner may white-label the entire storefront, but the “view proof” moment always resolves on a neutral surface — because a verification layer that can be fully white-labeled can be fully impersonated, and then it verifies nothing.
The root and the proofs: free, keyless, forever. The decoded tape as a filtered stream. A partner can replace its own decode stack with this and build nothing.
Licensed, namespaced, bonded. Chain headers, protocol events, envelopes, job declarations. A write is not an upload — it is membership in the record.
Every number here is a parameter still to be confirmed. What is not negotiable is the shape.
On its own settled jobs. Verified history becomes an asset that is portable nowhere else.
Pro-rated by envelope count. Computed from evidence, never self-declared.
Cost recovery and the rails. Never drops below the cost line.
The loop is structural rather than marketed: the API is two-sided on the same object, so what one partner writes is literally what another reads. Nobody has to build anything for anyone else.