Organic

Organic DÃO

DECENTRALISED COMMUNITY OS

A community intelligence and governance system for communities, organisations, ventures, research groups and digital nations. 10 bounded layers for capability-based access, member-controlled identity and trust. The Event Spine is the source of operational truth; every claim above it can be replayed, verified and challenged.

Architecture · ten bounded layers

Each layer has one job, one set of guarantees and a clean seam to the layers above and below. No layer alters another's invariants; no layer bypasses consent / capability checks.

Layer 1

Event Spine

Immutable, tenant-scoped record of every state-changing fact.

  • ·Per-aggregate hash chain + global sequence
  • ·Merkle batches sealed by service role
  • ·Idempotency, concurrency, replay-tested
Layer 2

Constitutional Layer

Axioms, constitutional versions, amendments, activations.

  • ·Constitution versions are append-only
  • ·Amendments require ratified governance
  • ·Activation and anchor references are auditable
Layer 3

Identity + Capability Layer

Members, private profiles, capability grants and revocations.

  • ·Roles held in user_roles, never on profile rows
  • ·Capabilities grant + revoke are separate events
  • ·has_role / has_capability are security-definer
Layer 4

Consent-as-a-Service

Purpose-bound grants, receipts, revocations, SAR / export / deletion.

  • ·Every grant produces an immutable receipt
  • ·Consent limits what measurement can see
  • ·Effective consent projection is rebuildable
Layer 5

Governance Layer

Proposal lifecycle FSM, secret-ballot voting, eligibility, ratification.

  • ·State transitions enforced server-side
  • ·Ballots secret; eligibility projected
  • ·Founding-member ratification is a first-class event
Layer 6

Cognitive Layer

Provider-agnostic AI router — suggestion + knowledge, never execution.

  • ·Provider secrets stay server-side
  • ·Input scan blocks secrets / PII leaks
  • ·Outputs immutable; cannot execute payments
Layer 7

Collective Intelligence

Bottom-up pattern & persona shaping across five intelligence pathways: Health & Wellbeing, Psychometrics & Values, Shopping & Retail (+2 reserved). Consented aggregate insights across ventures, wallets, identities.

  • ·Patterns emerge bottom-up from member observations + venture context — never top-down
  • ·k-anonymity (min 25) + differential privacy; no aggregate query can reconstruct an individual
  • ·Every insight routed to a Fable-of-5 pathway; insights immutable except status / redaction
Layer 8

Institutional Memory

Approved historical context: claims, evidence, decisions, lessons.

  • ·Records immutable + versioned + challengeable
  • ·Redaction jobs respect consent + retention class
  • ·Predictions must link to outcomes
Layer 9

Connected Ventures + Plugins

Ingestion gateway, iD Plugin, Wallet Plugin — member-controlled surface.

  • ·Ventures never touch raw card / CVV / seed / password
  • ·Read permission never implies action permission
  • ·AI proposes wallet actions; the member authorises
Layer 10

Outcome + Bounded Self-Improvement

Measurement specs, meta-cognitive monitoring, drafts (never self-execute).

  • ·Every material action defines success + failure metric
  • ·Historic performance snapshots are immutable
  • ·System may draft; constitution, voting, wallet + memory retention are off-limits to auto-change

Third-party integrations

Every external system is reached through a bounded adapter with an explicit purpose and a hard privacy/capability boundary.

PostgreSQL (managed backend)

INTEGRATED

Purpose

Event Spine, projections, RLS policies, security-definer helpers, migrations.

Boundary

Source of truth for operational state. Secrets held server-side; publishable key never touches wallet or admin surfaces.

ADI Foundation Mainnet

INTEGRATED

Purpose

On-chain anchoring of identity registrations, venture deployments and Merkle batch roots.

Boundary

Only hashes and Merkle roots cross the boundary. PII, UIDs and wallet data never leave the off-chain database. Each venture runs its own address space on shared L2.

Anthropic Claude & Gemini

INTEGRATED

Purpose

Deliberative reasoning and knowledge retrieval: proposal drafting, ensemble review, meta-review, summarisation and embedding.

Boundary

Reached only through the Cognitive Router. Input scanned for secrets / PII / financial identifiers before dispatch. Outputs are immutable and challengeable. Cannot alter financial permissions or execute transactions. Provider disagreement tracked as a meta-cognitive metric.

Cloudflare (edge runtime)

INTEGRATED

Purpose

SSR, server functions and public API routes for webhooks and cron.

Boundary

Server-only environment reads secrets from the platform vault. Node-only APIs avoided; Web-standard fetch, crypto and streams.

Wallet providers (open banking / card / crypto / rewards)

planned

Purpose

Provider-agnostic data ingestion for balances, transactions, rewards, assets.

Boundary

No raw card, CVV, password, seed phrase or private key stored. Only hashes + ciphertext. Every action requires explicit member authorisation.

iD Plugin host applications

INTEGRATED

Purpose

Ventures embed the iD Plugin so members carry identity + consent across surfaces.

Boundary

Signed plugin versions with CSP baseline. Configuration cannot alter consent meaning. Trust metrics are read-only for the venture.

Non-negotiables

  • · Events are immutable. Corrections are additional events.
  • · Personal identity fields are never placed directly on-chain.
  • · Read permission never implies action permission.
  • · AI may propose. It may not execute payments or alter financial permissions.
  • · Constitution, voting, personal + financial data rights, wallet permissions, payment destinations, provider credentials, memory retention and high-impact model routing require human authorisation.