RESTORE Blueprint v6.0 — the technical implementation guide for developers and node operators. Moving from ideological purity (v4) to pragmatic, survivable "Centralised Lite" Day 1 architecture. Deeper decentralisation unlocks only when geographic density thresholds are met.
RESTORE v6 does not launch as a global DHT mesh network. It launches as a centralised service that monitors its own obsolescence. The protocol state for a given H3 Hex Res-8 (approx. 0.7 km²) is governed by the number of verified, active human principals within a 30-day epoch.
Instant cryptographic handshakes are insufficient for Sybil resistance in physical systems. v6 requires a mathematical demonstration of physical, sustained reality.
| Constraint | Rule | Rationale |
|---|---|---|
| Scarcity | Is > 80 → max 5 vouches / 30-day window | Prevents farming of vouches at scale |
| Entropy check | Jaccard index of 3 vouching nodes' interaction graphs must be < 0.6 | Family/friend clusters cannot vouch a fake network |
| Decay | V decays linearly over 90 days | Refreshed only by new interaction Entropy (E), not re-vouching |
| Device fingerprint | Uptime pattern heuristics flag server-farmed emulators | Non-invasive Sybil detection |
v6 replaces abstract SC minting with hard economic anchors to prevent hyperinflation.
The maximum daily SC that can be minted in a Hex (M_max) is capped by verified real-world outputs:
Every Sunday at 00:00 UTC, the ledger applies a decay factor to all unspent balances above the sustenance threshold:
Stokvels are susceptible to the "tragedy of empathy" — one user continuously requesting grace periods, draining the circle. v6 enforces a Mathematical Empathy Backstop:
// STOKVEL GRACE CONSTRAINT — v6 // C_total = User A's lifetime SC contributions to the Stokvel // D_total = User A's current accumulated grace debt if (D_total >= C_total * 0.30) { ui.grace_request_button.disabled = true; // Community CANNOT override this. // The system protects the community's capital. }
When Phase 2 activates, devices shift to local WASM inference. Low-RAM Tier C devices must offload computation to Tier A "Local Inference Providers" via BLE.
A rogue Local Inference Provider intercepts plain-text queries from vulnerable neighbours, building surveillance profiles on their specific problems (e.g., "how to fix my solar panel", "need food"). This is a critical privacy vector.
v6 implements TOP for all offloaded local inference. Three mechanisms operate simultaneously:
All prompts generated by the agent client are cryptographically padded to uniform block sizes (e.g. exactly 2048 bytes). The provider only sees identical-length byte arrays — it cannot infer query type from length.
The client agent periodically generates syntactically valid but semantically meaningless "ghost queries" and sends them to the provider. The provider burns CPU computing a response to a ghost. Proportion: ~30% real, ~70% ghost during idle periods.
The client does not immediately transmit a query. It holds the query for a random interval and batches it with ghosts, destroying temporal analysis.
In Phase 2, if the internet goes down, the Hex continues operating on local BLE/LoRa gossiping. Two nodes in separate offline partitions could theoretically spend the same funds before reconnecting.
When a node enters ISOLATION_OVERRIDE mode (unable to reach global NTP or external LoRa gateways):
v6 also detects pre-emptive fund splitting across multiple accounts. Splitting behaviour is flagged before the partition occurs, triggering a freeze.
When the internet returns and partitions merge, the longest chain does not automatically win (vulnerable to rapid fake encounter spamming). Each partition submits a Merkle proof of its state. The system calculates a CHAIN_SCORE:
// CHAIN_SCORE — Entropy-Weighted Merge Resolution CHAIN_SCORE = (Unique_TEE_Count * 0.4) + (Geographic_Spread_H3_R10 * 0.3) + (Interaction_Entropy * 0.3) // The chain demonstrating broader physical movement, // higher unique hardware participation, and tighter // interpersonal mesh integrity overrides the narrower, // potentially synthetic chain.
RESTORE implements automated circuit breakers that require human intervention to lift. The governance layer prevents both machine failures and human capture.
| Trigger | Condition | Action |
|---|---|---|
| Velocity spike | > 300% SC generation vs 24h average | Hex SC ledger frozen |
| Sybil clustering | 50+ "new" users in 10m radius within 1 hour | Hex SC ledger frozen |
| TEE collision | Identical TEE attestation payloads from distinct devices | Both accounts suspended |
| Fund splitting | Cross-account correlation before partition detected | Linked accounts frozen |
To prevent professional politicians, juries are strictly temporary and partially random. This is the key departure from v5's Optionality-Score-based selection, which created a permanent governance elite.
// SORTITION JURY PROTOCOL — v6 SELECTION_POOL = users.filter(u => u.identity_score > 80) jury = VRF_select(SELECTION_POOL, size=12) // partial random selection via verifiable random function DUTY_CAP: no user may serve > 2 juries per rolling 30 days RESOLUTION_THRESHOLD: 8 / 12 majority required → PASS: unfreeze ledger with patched state → FAIL: permanent rollback DEADLOCK_PROCEDURE: if deadlocked after 48h: → escalate to 72-hour hex-wide simple majority vote
| Parameter | Value |
|---|---|
| Pool eligibility | Is > 80 |
| Selection method | Verifiable Random Function (VRF) — partial random |
| Jury size | 12 |
| Duty cap | 2 juries / 30-day rolling window |
| Verdict threshold | 8/12 majority |
| Deadlock resolution | 72-hour hex-wide vote after 48h deadlock |
End of RESTORE Blueprint v6.0
Refer to WHITEPAPER-v6 for the socio-economic philosophy.
Public Domain — copy, fork, build, share without restriction.