CIVITAS

A city that runs its own frame, publishes what it will not do, and pays vendors out of visible escrow.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• City procurement office. Vendors paid from escrow the council can see.
• Public works department. Sensor-evidenced milestones on road and rail contracts.
• Grants administration. Disbursement where no single officer can act alone.
• Municipal utility. A sovereign frame under local law, federated with the region.

The problem

Government cannot be a tenant in a vendor’s database, and every automation proposal eventually founders on that. The second blocker is quieter: a civil service cannot adopt a system in which one compromised account can move public money alone.

The system

CIVITAS is a city of 400,000 running its own sovereign frame in its own datacenter, under its own law, with its own unit of account for internal settlement. It federates with the regional government’s frame and with its vendors’ registries bilaterally, and it has published, in a cryptographically signed declaration anyone can fetch, the list of features this deployment will never run. The declaration is not a policy PDF. It travels inside the registry card, signed, and peers can detect drift from it.

A road resurfacing contract is awarded on a Tuesday: the budget enters escrow at award, visible to the council and to anyone else who cares to look. The vendor’s paving agents submit each section with sensor evidence; an inspection agent verifies; releases follow the milestones. When an officer moves to debar a supplier in November, the action does not execute. It queues, and a second officer’s approval is the execution, because in this design no enforcement is a single identity’s act.

The cast and their ceilings

The flow, step by step

1. The deployment declares, in a signed public document, what it will never run.
2. The vendor submits a section with sensor evidence. Inspection verifies.
3. Release follows the milestone, out of escrow the council can see.
4. Every award, release and refusal is on a ledger citizens can read.

Each need, mapped to a live primitive

The attack this chamber refuses: The single-officer seizure

The attack. One compromised officer account files a debarment against a vendor and tries to execute it in the same breath.

Why it fails. Enforcement actions queue for a second approver, and the approval is the execution. There is no code path in which filing and executing are the same identity.

What actually happens. The action sits visibly in the pending queue. The vendor’s escrow does not move, and the attempt itself is on the ledger.

Deep architecture

CIVITAS at deployment scale: the city runs its own frame in its own datacenter, the vendors and the independent inspectorate act from their registries, and the regional government peers over the fabric instead of sharing a database. The ERP and the tender platform stay where they are; what changes is that the money sits in escrow everyone can see and no enforcement is a single identity’s act. The trace replays one road contract, award to release.

The deployment, traced

1. A resurfacing contract awards on a Tuesday. The tender ran where tenders run; the award lands here.
2. The award becomes a contract: milestones, terms schema, the vendor named.
3. The budget enters escrow at award.
4. The escrow is visible to the council, and to anyone else who cares to look.
5. The vendor’s paving agents submit each section with sensor evidence, from their own registry.
6. The independent inspection agent verifies the work. Verification is signed, not minuted.
7. The fabric couriers the signed commands home. The relaying peer is never the principal.
8. The contract spine, and only it, releases the milestone.
9. Payment crosses registries with an idempotency key.
10. The vendor’s own TEG credits it, under its own law.
11. In November, an officer moves to debar a supplier. The action files. It does not execute.
12. A second identity approves, and the approval is the execution. No public money moves on one officer’s word.

Adoption, phase by phase

Discover: One contract, re-told.

• Runs. Nothing in the city’s estate. One finished contract from last year and its paper trail.
• Agents. None. Procurement and the audit office read the model against their own file.
• Integrates. Nothing. The ERP and the tender platform are untouched.
• Deliberately not yet. No frame, no escrow, no declaration.
• Proof that gates the next phase. One historical resurfacing contract re-expressed as milestones and releases, and the audit office confirms the telling matches the file.

Pilot: One budget line, visible from day one.

• Runs. A single-VM frame in the city datacenter. One budget line flows through it.
• Agents. procurement-desk, one vendor agent, inspection-3. Two officers hold enforcement between them.
• Integrates. Tender results in via the SDK; the ERP receives evidence exports beside its own records.
• Deliberately not yet. One contract class. The public declaration is drafted, not yet published.
• Proof that gates the next phase. A pilot contract runs award to final release with every release visible to the council the day it happens.

Production: The city’s frame, the city’s law, in public.

• Runs. A sovereign frame on municipal hardware: registry, TEG, EventStore, identity fabric. About nine containers.
• Agents. The full cast. Enforcement is two-man across the board; the declaration of what this deployment will never run is signed into the registry card.
• Integrates. The ERP and the tender platform, continuously. Procurement law stays with the lawyers.
• Deliberately not yet. Regional federation. The neighbouring frames are known but not yet peered.
• Proof that gates the next phase. The signed declaration is public and fetchable, and a deliberate test drift between config and declaration is detected by a peer within a day.

Federation: The region reads the card, not the database.

• Runs. Unchanged. The regional frame and the large vendors peer bilaterally.
• Agents. Per-corridor casts; vendor reputations travel with their DIDs.
• Integrates. Each new vendor or authority is a signed card and a license, not an integration project.
• Deliberately not yet. No shared database is ever built. That is the point.
• Proof that gates the next phase. A vendor onboards to a new tender without a bilateral integration meeting, and the region audits the city by reading its card and its ledger.

Sizing

One milestone, submission to credit

sequenceDiagram
  participant Ven as vendor-paving (their frame)
  participant Ins as inspection-3 (inspectorate)
  participant Fab as federation fabric
  participant CS as contract spine (city frame)
  participant TEG as city escrow
  participant XT as cross-registry pay
  participant ES as audit trail
  Ven->>Fab: section submitted + sensor evidence
  Ins->>Fab: verification, signed
  Fab->>CS: relayed commands (principal checked)
  CS->>TEG: release milestone
  TEG-->>ES: release event, citizen-readable
  TEG->>XT: pay vendor (idempotency key)
  XT->>Ven: their TEG credits, exactly once
  Note over ES: enforcement, if any, files to a two-man queue first

Topology, as declared

flowchart LR
  CF["city frame<br/>sovereign, own unit"] -->|"jurisdiction profile<br/>EdDSA-signed"| CARD["registry card<br/>/.well-known/registry-card.json"]
  V["vendor agents"] -->|"milestone submit + evidence"| CS["contract spine<br/>escrow at award"]
  CS -->|"verified release"| TEG["TEG escrow mover"]
  OFF["officer"] -->|"enforcement files"| Q{"pending queue<br/>two-man rule"}
  Q -->|"second identity approves = executes"| ENF["coordinated action"]
  TEG --> ES[("event ledger<br/>citizen-readable")]

Standing it up

• Infrastructure. The city’s own frame: 9 containers on municipal hardware, federated bilaterally.
• Agents. 4 to 6 roles across procurement, inspection and enforcement.
• Integration. The ERP and the tender platform. Procurement law stays with the lawyers.

What this does not claim

• Jurisdiction profiles are operator-declared. We publish mechanism and neutral examples, never per-country legal conclusions.
• CIVITAS does not conduct tenders and does not replace procurement law or review bodies.