Listen Get

Earth Optimization Protocol: Technical Specification

Identity, Pooling, Settlement, and Oracle Design for Interoperable Outcome Prizes

Author
Affiliation

Mike P. Sinn

Institute for Accelerated Medicine

Abstract

The Earth Optimization Prize165 is a pool of money. Two numbers on a Scoreboard: how long people live, how much they earn. By 2040, if global HALE reaches 79.4 years (95% CI: 70.8 years-94.9 years) and median income reaches $4,381 (95% CI: $3,007-$6,211), Earth Optimization Points holders split the pool. If not, depositors divide the realized pool pro rata. Registration asks two questions: yes or no on the 1% Treaty, and how much military vs. clinical trials (with Optimitron evidence so the voter sees what each dollar actually buys). Anyone can start a second pool. It joins the network automatically, because all pools measure the same two numbers.

That “automatically” requires six things this paper specifies: (1) verify each person is real and only counts once (identity layer with proof-of-personhood); (2) register pools so metric commitments are checkable, not promises (pool registry); (3) a vote, Earth Optimization Points, and deposit claims with rules that work across pools (token mechanics); (4) any verified voter can claim from any pool directly, no netting, no settlement (cross-pool claims); (5) every front-end shows the same combined voter count and pool size (scoreboard aggregation); and (6) an oracle that reads the WHO and World Bank reports and triggers treasury release when the numbers are met (terminal general-welfare metric oracle), with decentralized surveys as a cross-check. The goal is a protocol simple enough that a second pool can launch without asking the first pool’s permission.

Keywords

outcome prizes, outcome prize, proof-of-personhood, pool interoperability, oracle design, mechanism design, decentralized surveys

Technical specification for interoperable outcome prize pools using one shared pool model. Two targets by 2040: global HALE and median income matching the 1% Treaty projections. Covers cross-pool proof-of-personhood, a permissionless pool registry, vote, points, and deposit mechanics, direct cross-pool claims, tamper-evident scoreboard aggregation, and a terminal general-welfare metric oracle.

Technical specification for interoperable outcome prize pools using one shared pool model. Two targets by 2040: global HALE and median income matching the 1% Treaty projections. Covers cross-pool proof-of-personhood, a permissionless pool registry, vote, points, and deposit mechanics, direct cross-pool claims, tamper-evident scoreboard aggregation, and a terminal general-welfare metric oracle.

Introduction

This is the wiring diagram. If the Earth Optimization Prize165 is the promise (“make the world measurably better and collect money”), this paper is the plumbing that makes multiple independent prize pools work together without trusting each other. If you are not building software for this system, you can safely skip to the mechanism paper. If you are, everything below is load-bearing.

The Earth Optimization Prize165 is a same-pool outcome prize that rewards humanity for hitting two targets by 2040: global HALE reaching 79.4 years (95% CI: 70.8 years-94.9 years) and global median income reaching $4,381 (95% CI: $3,007-$6,211). If the targets are not met, depositors divide the realized pool pro rata by deposits. If both targets are met, that same treasury releases to participants proportionally.

Registration asks two questions:

  1. Yes or no on the 1% Treaty166 167. “Should 1% of military spending be redirected to clinical trials?” Binary, concrete, the specific political demand that politicians can act on. Public-facingly, this is the game score; formally, it produces the vote (the scoreboard headcount, which is the political pressure) and eligibility to earn Earth Optimization Points. The 1% Treaty is also the thing that IABs168 fund the lobbying campaign for, so the voter count directly feeds the financial instrument’s value.

  2. How much military vs. clinical trials? The core reallocation question, shown with Optimitron169 evidence: cost per DALY for military spending vs. clinical trials, lives saved per dollar, economic returns per dollar. The voter sees the data and picks an allocation. The aggregate result from millions of people is a global citizen preferred split between war and medicine, generated by the evidence-informed wishocratic mechanism the book proposes170. The user does not need to understand “Wishocracy” or “Optimitron” as concepts. They see what each dollar buys in each category and choose how to split it.

Broader wishocratic allocation across all spending categories (education, infrastructure, research, defense, etc.) is available as optional deeper engagement after registration, but these two questions are the minimum viable referendum.

Downstream use of registration data. Aggregate results from both questions are published as global citizen preferences: the total headcount for and against the 1% Treaty, and the population-weighted preferred allocation between military and clinical trials. This data is publicly available to any front-end, campaign, or policymaker. The headcount is the political pressure; the allocation data is the citizen mandate.

The mechanism paper demonstrates that independently operated pools sharing these metrics are complements rather than competitors: every new pool increases the combined reward visible to every voter. That argument assumes six capabilities that do not yet exist:

  1. A person verified in one pool cannot re-register in another (identity layer).
  2. Any pool committing to the standard metrics is automatically interoperable (pool registry).
  3. The vote, Earth Optimization Points, and deposit claims have defined rules that work across pool boundaries (token mechanics).
  4. A verified voter can claim their share from any pool directly (cross-pool claims).
  5. Every front-end displays the same combined voter count and pool size (scoreboard aggregation).
  6. Treasury release is triggered by independently verified welfare improvements (terminal general-welfare metric oracle).

This paper specifies each. The design constraint throughout is minimizing coordination: a second pool should be able to launch without asking the first pool’s permission.

Identity Layer

Problem

The prize grants one vote per person. Without cross-pool deduplication, a person could register in the Japan pool, the EU pool, and the Gates Foundation pool, claiming three shares of the combined treasury. At scale, Sybil attacks would transfer wealth from legitimate voters to attackers and destroy the proportional-claiming guarantee that makes interoperability work.

Requirements

The identity layer must provide three properties:

  • Liveness. The registrant is a real person, not a bot, deepfake, or synthetic identity.
  • Uniqueness. The registrant has not already registered in any participating pool.
  • Privacy. The pool learns “this is a unique human who has not registered elsewhere,” not “this is Alice Chen from Osaka.”

Existing Approaches

World ID (Worldcoin/Tools for Humanity). Iris biometrics hashed into a zero-knowledge proof. Strong uniqueness and privacy. Concerns: hardware dependency (requires Orb scans), centralized enrollment infrastructure, jurisdictional bans.

BrightID. Social-graph-based uniqueness. No biometrics; participants attend verification parties where existing members vouch for new ones. Lower uniqueness guarantees (colluding vouchers can create fake identities). Better decentralization.

Proof of Humanity (Kleros). Video submission plus vouching, adjudicated by Kleros courts on disputes. More decentralized than World ID, weaker liveness guarantees, slower onboarding.

Government ID. Strong liveness and uniqueness within one country. Cross-country deduplication is unsolved. Privacy is poor.

Minimum Specification

The protocol does not mandate a specific identity provider. It defines an identity attestation interface that any provider can implement:

Attestation {
  unique_human_root: bytes32    // Provider-specific unique identifier hash
  provider_id: string           // Which identity system issued this
  liveness_timestamp: uint64    // When liveness was last verified
  zk_proof: bytes               // Zero-knowledge proof of uniqueness
}

A pool accepts an attestation if:

  1. The provider_id is on the registry’s approved provider list (see §3).
  2. The zk_proof verifies against the provider’s public verification key.
  3. The unique_human_root does not appear in the global nullifier set (a shared append-only log of hashes representing registered humans, without revealing which human maps to which hash).

The global nullifier set is the critical shared state. It must be append-only, publicly auditable, and accept entries from any participating pool. A Merkle tree published on a public blockchain or a federated append-only log both satisfy these requirements.

Liveness decay. An attestation expires after 12 months. Voters must re-verify annually to remain eligible for claims. This prevents deceased or fabricated identities from accumulating perpetual shares.

Sybil via multiple providers. If a person verifies with World ID in Pool A and BrightID in Pool B, they get two entries. Mitigation: the protocol should launch with a single approved provider and add cross-provider bridging as providers develop interop standards.

Coercion. An employer or government forces citizens to register and vote a particular way. Mitigation: coercion to vote a particular way is already illegal in every democracy, and because the vote cannot be sold or surrendered for value, there is no transferable asset to extract. The registration headcount matters more than which way any individual votes; the exposure to evidence during registration is what shifts preferences. Voluntary recruitment, the primary bottleneck (pluralistic ignorance), is rewarded through Earth Optimization Points.

Governance of the Identity Layer

The identity provider (the Bouncer, in the system roles) is not a neutral utility. Whoever controls proof-of-personhood controls who gets to vote and who gets paid. Two governance requirements follow:

Provider selection. The initial provider is chosen by the Launch Host during the first 90-day cycle, subject to review panel approval. Adding or removing providers after launch requires a bonded proposal (to prevent frivolous churn) and majority approval from existing verified voters. This prevents the Launch Host from unilaterally switching to a captured provider after the game has started.

Provider compromise. If a provider is compromised (Sybil attack detected, provider ceases operations, or privacy breach), the protocol suspends attestations from that provider, freezes affected votes and points pending re-verification, and opens a migration window for affected voters to re-verify through an alternative provider. The global nullifier set remains intact; only the attestation linkage changes. This is the digital equivalent of reissuing passports after a printing press is stolen, except faster and without the queue at the post office.

Pool Registry

Problem

The prize paper claims that any pool committing to the same metrics “automatically joins the reward network.” This requires a public record where pools declare their metric commitments and where anyone can verify those commitments. Without a registry, “same metrics” is a verbal promise, and interoperability requires bilateral agreements between every pair of pools.

Data Model

Each registry entry contains:

Field Type Description
pool_id bytes32 Unique identifier (hash of creation transaction or registration event)
operator string Human-readable name of the operating entity
metric_commitments string[] Must be exactly ["global_hale", "median_real_income"] for interoperability
treasury_address address On-chain address or auditable account holding pool funds
treasury_balance_attestation bytes Signed attestation of current balance (updated periodically)
identity_providers string[] Which proof-of-personhood providers this pool accepts
registration_timestamp uint64 When the pool joined the registry
status enum active, suspended, deregistered

Registration

Permissionless. Any entity can register a pool by submitting the data model fields and posting a minimum treasury deposit (prevents spam). The registry enforces one hard constraint: metric_commitments must exactly match the canonical set. A pool that measures “GDP per capita” instead of “median real income” is not interoperable and cannot register. This is the mechanism that turns metric alignment from social convention into protocol constraint.

Balance Attestation

Pools must update their treasury_balance_attestation at least monthly. For on-chain treasuries, this is automatic (the balance is publicly readable). For off-chain treasuries (bank accounts, endowment funds), the pool must provide a signed attestation from an approved auditor or custodian. A pool whose attestation is more than 90 days stale is automatically flagged as suspended and excluded from the scoreboard.

Disputes

If evidence emerges that a pool is reporting fraudulent balances or has been compromised, any participant can file a dispute. The protocol should support at least one dispute resolution mechanism (e.g., a bonded challenge where the challenger posts a stake, and a panel of pool operators or independent arbitrators adjudicates). Disputed pools are flagged but not immediately suspended, to prevent griefing attacks.

Implementation Options

On-chain registry. A smart contract on a public blockchain. Permissionless, censorship-resistant, globally accessible. Gas costs and blockchain dependency.

DNS-like federation. Each pool publishes a standardized JSON file at a well-known URL (e.g., /.well-known/earth-optimization-pool.json). Aggregators crawl and index these files. No blockchain dependency, but requires trusted aggregators.

The protocol should specify the data model and validation rules, not the implementation layer. Either approach works if it provides permissionless registration, public auditability, and enforced metric constraints.

Token Mechanics

Overview

The prize mechanism keeps three things deliberately separate. Conflating any two of them is how earlier drafts of this protocol accidentally built a market in votes.

  • The vote is a civic act: one per verified human, non-transferable, never for sale. It is the yes/no on the 1% Treaty plus the military-vs-clinical-trials allocation. It produces the coalition headcount (political pressure) and establishes who is eligible to earn points.
  • Earth Optimization Points are the reward claim. They are earned by verified humans for participating (registering and voting, recruiting other verified humans, completing the wishocratic allocation). They cannot be bought, and they cannot be traded. On success, the pool is distributed to points-holders.
  • Deposits are money contributed to grow the pool. On failure, depositors recover the realized pool pro rata to their deposits. On success, deposits fund the points payout.

These are protocol primitives. Other instruments (bonds, revenue-share contracts, EOS shares, campaign financing vehicles) are separate tools that supporting institutions might use; they are outside the scope of this protocol. The vote in particular is never any of those things: not equity, not a token you can sell, not a claim you can buy. Money and influence are kept on separate tables by construction.

The Vote

What it means. A vote records one verified human, counted once, as (1) a member of the coalition demanding the 1% Treaty and (2) an evidence-informed allocation between military and clinical trials. The headcount is the political pressure; the allocation is the citizen mandate. Registration includes the 1% Treaty referendum (yes/no) and the allocation question (with Optimitron evidence).

Recording. One vote is recorded when a person completes proof-of-personhood verification and answers the two registration questions. One person, one vote, across all pools, deduplicated via the global nullifier set.

Non-transferable. A vote cannot be sold, lent, or transferred. There is no secondary market in votes, by design: a market in votes is a market in influence, the exact thing this system exists to abolish. (An earlier draft of this protocol made the vote a tradeable token with secondary-market pricing. That was a mistake, and it is corrected here: recruitment is rewarded by earning Earth Optimization Points, not by selling votes.) Coercion to vote a particular way is already illegal in every democracy, and since the vote cannot be surrendered for value, there is nothing to coerce a sale of.

Expiry. A vote’s eligibility expires when the underlying identity attestation expires (12 months). Voters re-verify annually to keep earning and claiming. Expired votes are excluded from the headcount and from claims until renewed.

Earth Optimization Points

What they are. Earth Optimization Points are the claim on the prize pool: the answer to “what do I get for helping?” You earn points for the work that moves the outcome. Voting earns a point; recruiting other verified humans earns more; completing the deeper wishocratic allocation earns more. On success, the pool is distributed in proportion to points: your share is your points divided by the total points earned across the network. Nobody is handed a share for merely existing; everyone earns it by acting, and the people who built the coalition are paid the most, without anyone ever buying or selling a vote.

Earned, not bought. Points cannot be purchased with money. The only way to obtain them is to do the work: register and vote, recruit other verified humans, complete the deeper wishocratic allocation. This is what keeps them on the rewards-program side of the line (earned through behavior, like frequent-flyer miles) rather than the security side (bought as an investment).

Non-tradeable. Points cannot be sold or traded on a secondary market. They are redeemed from the pool when the targets are met. Starting non-tradeable is deliberate: it preserves the option to add regulated tradeability later, with proper exemptions, without first having to unwind a live market.

Borrowing from the future. Points are issued now against a pool whose final size is unknown and grows with participation. This is the engine: a movement with almost no money today can pay people out of the world it builds tomorrow, and because every new participant enlarges the pool, the earlier you earn points, the more each one is ultimately worth. The reward is real but contingent. If the targets are missed, points pay nothing and the pool returns to depositors.

Expiry. Points follow the same liveness rule as the vote: the holder must keep a current identity attestation to remain eligible to claim. Points do not accrue to deceased or unverified identities.

Settlement note. Because the payout is weighted by points rather than split evenly per head, cross-pool settlement aggregates a global total-points figure and each claimant’s global point count, instead of a simple headcount (§5). The system already records points per person in order to credit recruitment, so this is one more shared quantity, not a new kind of coordination. Since points are earned only through verified action, a large share reflects a large contribution, never purchased influence.

Deposits

What they are. Deposits are money contributed to grow the prize pool. One deposit claim is recorded per unit of currency deposited.

On failure. If the targets are not met by the deadline, depositors redeem their claims for a pro-rata share of the realized pool, relative to deposits. The protocol promises no fixed rate. During the lock-up the treasury follows the pool’s published allocation policy (in the canonical model, the Prize Treasury allocation described in the economics chapter). If the portfolio gains value, the realized pool grows; if it loses value, the failure-branch payout shrinks. Investments and balances must be published so depositors and auditors can verify real value before depositing.

On success. When the oracle triggers release, deposits fund the distribution to Earth Optimization Points holders. The depositor’s principal is gone; it has been spent buying the outcome (a world with measurably more health and income), which was the deposit’s stated purpose.

This is a security, and is treated as one. A deposit is money paid in with an expectation of a return on the failure branch, from a pooled and managed investment. That is a security under any honest reading, so the deposit instrument is offered through a real exemption, not dressed up as a “utility” anything. See the economics chapter for the offering structure.

Recruiter attribution. Points are credited to the verified human who earned them and recorded on the shared points ledger. There is no recruiting middleman and no side market in votes: the only way to accumulate points is verified action, and the only thing the ledger tracks is who did what.

Inheritance and Estate Transfer

A 15-year lock-up means depositors will die during the accumulation period. The protocol must handle this without creating ghost claims or orphaned funds.

Deposit claims. A deposit claim is inheritable. A depositor designates a beneficiary at the time of deposit (or updates it any time before death). On the depositor’s death, the claim passes to the beneficiary on the same terms: pro-rata share of the realized pool on failure, or nothing on success (the deposit funds the points payout). If no beneficiary is designated, the custodian follows the applicable intestacy rules, the same way a brokerage account does. Beneficiary designation is a core feature, not an afterthought. A deposit claim is not traded on a secondary market; it is transferred only by inheritance.

Votes and points. A vote, and the Earth Optimization Points earned with it, are tied to a living, verified human and are not inheritable. They expire when the identity attestation expires (12 months) and is not renewed. The claim depends on continued proof-of-personhood, because the whole point is that each claim represents one verified living person. Points cannot be passed to a successor, because they cannot be transferred at all.

Unclaimed funds. If a depositor dies without a designated beneficiary and no heir can be identified within the jurisdiction’s window (typically 3-5 years), the deposit stays in the pool and follows the same rules as every other deposit: on failure it increases the pro-rata share for all other depositors, on success it funds the points payout. The protocol does not create a separate “unclaimed” category.

Tax treatment. Estate treatment of a deposit claim varies by jurisdiction; the protocol cannot standardize tax law. Pool operators should publish local guidance and advise depositors to consult estate-planning professionals. In most jurisdictions a deposit claim is a financial asset included in the decedent’s estate at fair value (pro-rata pool share).

Cross-Pool Claims

Problem

Voter V registered in Pool A. Pools A, B, and C all hold treasury funds. When the oracle triggers release, V must be able to claim from all three pools, not just Pool A.

Direct Claims (No Netting)

Let \(p_i\) be the Earth Optimization Points earned by claimant \(i\) across the whole network, and \(P\) the total points earned by everyone. Each pool independently pays each claimant a share of its own treasury proportional to that claimant’s points:

\[ \text{claim from pool } p = T_p \cdot \frac{p_i}{P} \]

The claimant visits each pool (or a front-end that aggregates claims), proves they are a verified unique human via their identity attestation, and collects \(T_p \cdot p_i / P\) from each pool. Their total payout is:

\[ \text{total}_i = \sum_{p \in \text{pools}} T_p \cdot \frac{p_i}{P} = \frac{p_i}{P} \sum_{p \in \text{pools}} T_p \]

No inter-pool fund transfers. No netting. No settlement window. Each pool manages its own treasury and pays out independently. The shared state is \(P\) (the global total points) and each claimant’s \(p_i\) (their global point count), both recorded on the points ledger the system already maintains in order to credit recruitment.

Why This Works

Each pool knows its own treasury \(T_p\) and can read \(P\) and the claimant’s \(p_i\) from the shared points ledger, so every pool can pay its share independently. The claimant’s total is identical whether they claim pool by pool or all at once. The only coordination is agreeing on \(P\) and on each person’s \(p_i\), exactly as the earlier headcount design relied on the global voter count \(N\).

Failure Modes

Pool goes offline. The voter cannot claim from that pool. Their claims from all other pools are unaffected. The offline pool’s treasury is held until the operator resurfaces or a dispute mechanism releases it to depositors.

Pool is undercapitalized. If a pool’s actual treasury is less than attested, it pays out what it has. The pool operator is flagged for fraud via the registry dispute mechanism (§3). Other pools are unaffected.

Scoreboard Aggregation

Problem

The prize mechanism’s political power comes from a single number: the combined size of the coalition (voters plus money). If front-ends display only their own pool’s numbers, the coalition looks fragmented. Every front-end must display the same global totals.

Data

The scoreboard aggregates two numbers:

  • Combined voter count. The number of unique verified humans across all participating pools. Deduplicated via the global nullifier set (a person registered in two pools counts once).
  • Combined pool size. The sum of all attested treasury balances across all participating pools.

API Specification

Every participating pool exposes a standardized endpoint:

GET /.well-known/earth-optimization-pool/status

Response {
  pool_id: bytes32,
  voter_count: uint64,
  voter_nullifiers_root: bytes32,
  treasury_balance: uint256,
  attestation_timestamp: uint64,
  signature: bytes
}

An aggregator (run by anyone) queries all registered pools, computes the union of nullifier sets, and publishes:

GET /api/scoreboard

Response {
  total_unique_voters: uint64,
  total_pool_size_usd: uint256,
  pool_count: uint32,
  pools: [ { pool_id, voter_count, treasury_balance, status } ],
  computed_at: uint64
}

Any front-end can query any aggregator (or run its own) to display the global totals. Since the computation is deterministic (given the same pool status responses), any two honest aggregators produce identical results. Front-ends can query several and flag discrepancies.

Tamper Evidence

Inflated voter count. A pool publishes its nullifier Merkle root. Auditors can request the full nullifier set and verify each entry against the identity provider’s records. Pools that refuse are flagged as suspended.

Inflated treasury balance. For on-chain treasuries, the balance is independently verifiable. For off-chain treasuries, the attestation must come from an approved auditor. The protocol should move toward requiring on-chain proof-of-reserves over time.

Pool status endpoints should update at least daily. Aggregators should recompute at least every hour. The scoreboard is a political tool (showing coalition size), not a financial ticker.

Terminal General-Welfare Metric Oracle

Problem

The entire mechanism depends on a single trigger: did global HALE and global median real after-tax income actually improve? If this measurement is wrong, gameable, or disputed, the treasury either releases when it should not (rewarding failure) or refuses to release when it should (punishing success). Oracle design is the credibility bottleneck of the entire system.

What Is Measured

Two metrics, matching the Earth Optimization Prize targets:

Metric Baseline Target by 2040
Global HALE

63.3 years (95% CI: 60.8 years-65.8 years)

 79.4 years (95% CI: 70.8 years-94.9 years) (+16.1 healthy years)
Global median income $2,138 (95% CI: $1,700-$2,568) (measured today) $4,381 (95% CI: $3,007-$6,211) (treaty-trajectory median; see GDP Trajectories)

Global HALE (Healthy Life Expectancy). Years a person born anywhere on Earth can expect to live in full health, as measured by the WHO’s HALE methodology. Not life expectancy (which counts years lived in poor health). Global, not per-country: the prize rewards improving the species-level number, not cherry-picking which countries count.

Global median real after-tax income. The global median household’s annual disposable income after taxes and transfers, adjusted for purchasing power parity and inflation. Source: World Bank, OECD, or equivalent global data aggregators.

Who Measures

Institutional data. The WHO publishes global HALE; the World Bank’s poverty platform and the OECD publish country-level median income figures with established methodologies. No institution publishes a single global median income number, so the oracle aggregates the published country medians into the global figure under the methodology locked at baseline. These are among the most-measured numbers on Earth; the oracle’s job is aggregation under locked rules, not building novel measurement infrastructure.

Decentralized surveys. Institutional data has two weaknesses: it lags by 1-3 years, and it depends on national statistical offices with uneven quality. The protocol should also support decentralized surveys collected by the same verified voter base. The identity layer already provides a global network of verified humans. Periodic health and income surveys (phone-based, app-based, or integrated into the voter re-verification process) would provide an independent, near-real-time data source that does not depend on any government or institution. This is not a replacement for institutional data; it is a cross-check and a gap-filler for countries with weak statistical infrastructure. Over time, as the voter base grows, decentralized survey data may become more comprehensive than institutional sources for the specific metrics the prize cares about.

Dispute resolution. If an institutional report is contested (e.g., evidence that a national statistical office inflated its figures, affecting the global aggregate), any participant can file a dispute by posting a bond. An independent academic panel reviews the evidence and issues a binding ruling. If the challenger wins, the report is rejected and the provider must resubmit corrected data; the challenger’s bond is returned plus a reward. If the challenger loses, the bond is forfeited.

Trigger

Binary. By 2040, both metrics must meet or exceed the targets above. Both metrics must improve for release; improvement in only one triggers nothing. This prevents gaming by, for example, increasing income through policies that reduce health.

If both targets are met, the treasury releases to Earth Optimization Points holders. If either target is missed, depositors divide the realized pool pro rata.

Gaming Resistance

Methodology changes. The WHO or World Bank could change how HALE or income is calculated, producing apparent improvement without real change. Mitigation: the protocol locks measurement methodology at baseline. Any methodology change requires re-baselining, which resets the improvement clock.

Selective reporting. Data providers could exclude unhealthy or poor subpopulations from global aggregates. Mitigation: decentralized survey cross-checks using the voter base, plus independent data sources (hospital records, insurance claims, mortality registries, satellite-derived economic indicators).

Coverage gaps. Global medians depend on data from countries with weak statistical infrastructure. Mitigation: the protocol specifies minimum population coverage (e.g., data must represent at least 80% of the global population). Improvements measured from a partial sample do not trigger release. Decentralized surveys help fill coverage gaps where institutional data is thin.

Implementation Roadmap

Phase 1: Single Pool

State. One canonical pool with proof-of-personhood registration and a single treasury. No interoperability needed because there is only one pool.

Deliverables. Identity attestation interface (§2), vote, points, and deposit contracts (§4), basic scoreboard (just one pool’s numbers), manual oracle reporting (Tier 1 institutional data published by the pool operator with a dispute email address), treasury invested in government bonds with published investment policy.

Success criterion. 10,000+ verified voters, treasury > $1M.

Phase 2: Pool Registry + Cross-Pool Identity

State. A second pool launches. The registry and cross-pool identity recognition become necessary.

Deliverables. Pool registry (§3), global nullifier set for cross-pool deduplication (§2), aggregated scoreboard (§6) showing combined totals from both pools. Direct cross-pool claims (§5) enabled (any voter claims from any pool).

Success criterion. 2+ pools operating independently, scoreboard showing combined voter count and treasury, at least one cross-pool claim executed.

Phase 3: Decentralized Surveys

State. The voter base is large enough to produce statistically meaningful survey data.

Deliverables. Periodic health and income surveys integrated into the voter re-verification process (§7). Survey data published alongside institutional data for cross-checking. Graduated release thresholds activated.

Success criterion. Survey data covering 50+ countries, correlation with institutional data above 0.9 for overlapping populations.

Each phase can operate without the subsequent phases. A single pool with manual oracle reporting is a functional (if centralized) prize. Each phase removes a centralization dependency and makes the mechanism harder to capture, corrupt, or shut down.