A design study for an economic infrastructure and a new kind of exchange that prices verifiable consequences instead of expected cash flows — with no blockchain, no mining, no token, no carbon-credit laundering, and no founder who can switch it off.
Provisional name. This is a design + a runnable reference prototype, not a live market and not investment advice. Every magnitude in the demo is explicitly simulated.
The old exchange asks one question: how much money can this asset produce?
That question is agnostic to who gets hurt. A company can burn a river, underpay a supply chain, and export its waste to a poorer country, and if the cash flow is good the asset is "good." The damage is real; the price simply does not carry it.
This project asks a different question:
What verifiable value was produced, for whom, with what damage, under what risk, and how much future was left standing afterward?
We define one accounting identity:
V_net = productive_value − environmental_harm − social_harm − unresolved_risk
and one unit, the Net Consequence Unit (NCU):
NCU = proven benefit − total cost imposed on the world
The NCU measures bounded, verifiable, contestable consequences of projects, technologies and operations. It is never a score of a person, their reputation, or their virtue. There is no path in this system to rank human beings. That road is social credit, and we refuse it by construction.
Trust does not come from wasting electricity to make a number expensive. It comes from signed receipts, double-entry accounting, a tamper-evident log, independent replicas, diverse auditors drawn by lot, the right of anyone harmed to challenge a record, and public correction of false ones.
Money must not be able to buy more reality. A billionaire cannot outvote a measurement. A founder can vanish and the protocol keeps its memory. Some harms are not priced at all — they bar listing outright.
The goal is not a green coin. The goal is an infrastructure where consequences cannot be erased by marketing, bought by the rich, or switched off by whoever built it.
The design declares its own failure if it collapses into something that
already exists. Read docs/DESIGN.md §"Failure conditions".
Short version:
| If it were really… | …it would fail because |
|---|---|
| a carbon market | harms here can be prohibited, not just priced; additionality is enforced against a named baseline; no fungible "offset" that lets irreversible damage continue |
| ESG scoring | ESG scores firms on self-reported box-ticking; NCX prices bounded events with signed evidence and a standing right of challenge |
| blockchain / a token | no chain, no mining, no coin; integrity comes from signatures + hash-chained logs + independent replicas, not from burned energy |
| social credit | there is deliberately no code path that attaches an NCU to a person |
docs/DESIGN.md the full design: economy, asset, architecture, governance,
environmental method, pricing, audit, threat model,
90-day prototype plan, kill criteria, open questions
docs/THREATS.md the adversary's chapter: 15 attacks, each with
prevention / detection / response / recovery / residual risk
prototype/ a runnable, dependency-light reference (Python + Ed25519)
cd prototype
pip install cryptography # the only dependency
python3 demo_case.py # end-to-end: the automation-platform test case
python3 test_prototype.py # 20 checks: tamper, quorum, additionality, ...The demo lists an automation platform (answers customer messages, reads payment receipts by computer vision, can make errors that hurt families), computes its NCU against the named manual-process baseline, records a signed balanced receipt, gathers a diverse auditor quorum, blocks a same-jurisdiction collusion cluster, processes a family's dispute as an append-only correction, and detects a silent edit to history.
This is stage 0: a design and a mechanism demo. It does not prove the economics work, that real auditors would stay independent, or that any of it is legal in any jurisdiction. Those are open questions, listed as such. Numbers in the demo are invented to show the mechanism, never to assert magnitudes.
Contributions, and especially serious attempts to break it, are welcome — see the threat model.
AGPL-3.0 — a networked-service copyleft, chosen deliberately: anyone who runs this as a service must share their modifications, so the infrastructure cannot be quietly enclosed.