Nine roles
🟡 Label: PROPOSED. This entire page was drafted by the founding group and has not been ratified by any vote — not even the nine names. The document publishes it early and deliberately: to receive criticism while it can still be changed, rather than after it is engraved. You can change it, and Conclusion explains how to send criticism. Why it cannot be ratified yet is in the last section of this page — the most candid section in the whole document.
Why this set has to exist
The proposed tokenomics sets one principle, and that principle creates a debt:
All three parts pay for tasks, not for a group of people — flow beyond a task's real need returns to the endowment.
It sounds perfectly fair. But it drags in a technical consequence that cannot be dodged: to know what exceeds real need, you must know the real need of which task. And no document has listed those tasks.
No task list ⇒ no computable real need ⇒ no ceiling ⇒ no way to know what exceeds it and returns to the endowment ⇒ the issuance mechanism has too few inputs to begin being written.
The nine roles are that list. They are not nine names to round out a number — they are a precondition of the issuance mechanism.
How is this different from the nine audiences?
Two sets of nine, two different questions. The nine audiences answer who uses this system. The nine roles answer who does work inside this system, and what they are paid with. One person can be an audience and hold several roles.
Tier A — who is who
Before roles comes identity. This tier is not a role and is not paid.
| HUMAN | The unique identity in the system. One verified real human being — one identity, one share. This is the ground, and what all nine roles serve |
| DELEGATION | Everything else acts by delegation, and accountability always returns to the humans behind it. Every delegation is declared on chain: scope · duration · revocation path · who is accountable |
An AI agent is the most urgent case of delegation, not the only one: an organisation, a co-signing group, a device signing for its owner all use the same scheme. This is also the correct statement of the counting principle: only humans are counted; everything else is an extension of a human's arm.
Both humans and delegations can hold roles in the tier below — except the Citizen role, which only a human can hold. If an agent could vote, whoever has more servers would have more votes, and we are back at exactly what the Honour pillar removes: counting machines instead of people.
Figure 18 — The nine roles arranged by the three parts of issuance. Order within each set follows the lifecycle, not importance.
VERITAS — build and protect the truth about people
| Role | Task | Paid from | Loses the role when |
|---|---|---|---|
| 1 · Sponsor | Brings a newcomer across the entry threshold — whether that threshold is a fee, a device, a language or understanding. The only role that spends first, reimbursed only when the sponsored person passes a real gate | VERITAS, per real person who passed | Sponsoring junk wallets → reimbursement cut |
| 2 · Gate | Attests that a wallet corresponds to one real human. The task is attestation, not a specific method — one era's method is one thing, the next era's is another | Attestation fees and VERITAS | Careless issuance → stake lost, removed from the directory, by Citizen vote |
| 3 · Juror | Judges public disputes using chain data. Chosen at random from verified people, not standing — exactly matching "no closed council judges anyone" | VERITAS, per case | Repeatedly overturned on appeal → out of the selection pool |
The Gate is the most powerful role in the system, because it decides who counts as a human being. It therefore carries its own constraints, described under the two laws below.
LIBERTAS — keep it un-switch-off-able
| Role | Task | Paid from | Loses the role when |
|---|---|---|---|
| 4 · Signer | Produces and signs blocks | LIBERTAS | Slashed, jailed, or withdraws its own stake |
| 5 · Witness | Keep · serve · detect. Stores the full history, opens it for others to read, and reports dishonesty. Keeping a record nobody can read is not witnessing | LIBERTAS | Deliberate false report → stake lost · stops serving data → the role lapses by itself |
| 6 · Connector | Bridges value and identity across the boundary between networks. One era's technology is a method, not a definition | LIBERTAS, per packet | Stops relaying → the role lapses, no punishment needed |
The Witness fills a gap few notice: the infrastructure for reading the chain — public query endpoints, explorers, indexers — is, if held by one party, a point of centralisation equal to block signing, and until now no role has owned it.
AETERNUM — build and steer the future
| Role | Task | Paid from | Loses the role when |
|---|---|---|---|
| 7 · Builder | Contracts, applications, tools — and documentation, translation, teaching. Paid retroactively for work done, never in advance | AETERNUM | Not funded further, as Citizens decide |
| 8 · Chain holder | Brings their own world in, and anchors identity back to the shared ledger. A "private chain" is one era's form; another form later is still the same role | DOES NOT RECEIVE — PAYS IN | Stops paying anchoring fees → identity stops being anchored |
| 9 · Citizen | Read · propose · debate · vote | The ballot: never paid. Drafting and analysis work: yes, from AETERNUM, with recipients public | Only when Tier A human standing is revoked — nobody loses the vote for voting "wrongly" |
The seventh role is where the principle the initiator gets no special share meets reality. The team receives from AETERNUM as builders, competing in the open, not as owners. Writing that down is the only way to make "no allocation for the team" both true and survivable for ten years.
The ninth role splits its funding source for a historical reason: unpaid governance means only those with spare time and means take part — every unpaid parliament turns aristocratic. Paying for drafting work while never paying for the ballot solves both sides: votes cannot be bought, and poor people are not excluded from the table.
Three properties of the structure
Seven receive · one pays in · one is unpaid for the ballot. Seven roles receive from issuance; the Chain holder pays in; the Citizen receives nothing for the act of voting. And the Sponsor is the only role that must spend first before being paid. This is the answer to "where does the money come from" and "why governance cannot be bought" — stated as structure, not as a promise.
Reporter and judge are separated. The Witness detects and presents evidence; the Juror rules. Two roles, two funding sources, nobody holds both in the same case. That is the difference between a court and a council.
The scaffolding has no role — deliberately. The temporary functions of the build phase are not among the nine roles, because granting them a role legitimises them permanently. The nine roles are a map of the network once the scaffolding is gone.
Two laws that permanence demands
Law A — no role may decide who enters that role. A permanent role is a permanent power structure. If those holding a role guard its door, the nine roles become nine guilds within a generation — nobody intends it, it simply grows. No signer approves new signers; no gate approves new gates; no juror selects jurors. Entry is by public rule or by a vote of the whole.
That law must cover Tier A too, and this is the most notable missing piece: being refused by a gate is also a dispute, so the right of appeal must apply to the refusal itself. Without that piece, the sentence "no closed council judges anyone" cannot save a person quietly refused by every gate.
Law B — the nine names are permanent, definitions may widen, and there is never a tenth role. New tasks appearing later must find a home within one of the nine. Two valves come with it, and without them the law breaks itself: every widening of a definition must be recorded and the previous version hash-anchored — because across centuries, nine vague definitions are nine places for power to hide; and an honesty valve: if a task genuinely has no home among the nine, that is evidence the nine are wrong, and the right response is to say so publicly, not to cram it in.
What is engraved, what is voted
Permanent but immovable is wrong within ten years. Voteable in every respect is not permanent at all.
| Engraved — permanent | Voted — living |
|---|---|
| The nine names | Each role's need ceiling |
| The task, stated as function rather than technology | Stake levels |
| The rule mapping roles to parts | The specific measurements |
| The seven–one–one structure | Which technology implements it |
| The two laws above | Each role's funding status |
| The law that every role must have an exit | Who holds a role |
Engrave what and why. Vote on how much and by what means.
And this is what makes the promise "pay for tasks" work: each role has a ceiling based on real need; a day's flow exceeding one role's ceiling returns to the endowment rather than spilling into another role; ceilings can change, but the three parts stay exactly equal in total. Equality lives in the parts, flexibility lives in the ceilings within a part.
Three places deliberately without a role
Where the set of nine is absent also falls out of the text, and that is the best shield against the attack "nine to round out the number".
| The empty place | Why deliberately |
|---|---|
| The endowment valve | A published principle: "no hand turns the valve" — not in the engraved text, and changeable only by public vote. Placing a role there contradicts exactly that |
| Price | A published principle: no selling, no listing, no price support — a verifiable fact of every period run so far, not an engraved line. A "market maker" role contradicts it |
| The Resonance pillar | Resonance is not something anyone does — it is what happens when the other eight run correctly. Naming a result is precisely the padding Law B forbids |
Who is "the community" in "a community vote"?
This is the most candid section here, and the reason the nine roles have not been put to ratification.
Voting power in this system comes from staked capital. In the early phase, nearly all staked capital belongs to nodes provisioned by one party. Putting the foundation of the issuance mechanism to a vote in that state produces something called community-approved that was ratified by one signature.
That is worse than not voting at all — because it borrows legitimacy without having it, and what is borrowed stays in the opening record of the shared ledger.
So the project sets itself a condition: distributing voting power out of the project's hands — to the point where the project loses its veto — must come BEFORE the vote ratifying the nine roles. Not for procedure's sake, but because a set of roles weighs exactly as much as the legitimacy of the ballot that ratified it.
| # | Stage | Condition to pass |
|---|---|---|
| 1 | Draft | The proposal is settled |
| 2 | Resolve the three open questions | Have answers, or state explicitly that they stay open |
| 3 | Publish early as a proposal | Enough time to receive real criticism ← this page is here |
| 4 | Distribute voting power | Voting power outside the project's hands exceeds the veto threshold |
| 5 | Ratify by vote | With a real quorum, not one signature |
| 6 | Into the genesis of mainnet | It becomes the opening record of the shared ledger — the three preceding testnets engrave nothing, and under the constitution a later community can still change it by vote |
Step 4 is the only one that cannot be shortened. The other three go as fast or slow as we do.
Three questions left open, and one with no answer
Three questions await answers: the source of randomness for selecting jurors (get it wrong and "jurors" become "a council") · a complete delegation scheme · and how many shares a person verified at several gates counts as.
And one question with no answer, heavier than all three: people die.
The proposed distribution promises that a real person in 2050 still has a share. But the proportion of the deceased in the set of wallets only rises, forever. Do gates revoke attestation when a person dies? Does a dead person's share stop, return to the endowment, or pass to an heir? And a dead person's still-valid delegations — who switches them off? Especially an agent that keeps signing on behalf of someone who no longer exists.
This is an ethical and economic question with no correct technical answer. A permanent set of roles that does not handle death is guaranteed to break — not "may", but certainly; only the timing is open.
In short: a permanent set of roles should be read closely before it becomes permanent. That is why it is here, labelled a proposal, together with the full list of what it still cannot answer.