DEMETER

From field to shelf as a chain of signed handoffs, with the farmer paid from escrow, not from patience.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Grower cooperative. A shared treasury with member votes and real dividends.
• Commodity buyer. Forward agreements escrowed before planting, released on delivery.
• Food brand and retailer. Provenance as verifiable handoffs, not a printed story.
• Agri insurer. Weather triggers from signed oracle readings, paid fast.

The problem

The farmer sells at harvest for whatever the day offers, waits months for payment, and the provenance story on the package is marketing. Every certification scheme bolts paper onto a supply chain that has no shared record, so fraud costs pennies and trust costs audits.

The system

DEMETER follows lot 88-K, four tonnes of coffee, from a cooperative in the highlands to a roaster in Hamburg. The forward agreement was escrowed before planting: the buyer’s money sat visible to the cooperative all season, releasing in stages as signed handoffs accumulated: the wet mill weighs and signs, the dry mill signs, the exporter signs, the container attests its seal, the roaster signs receipt. The lot’s provenance is not a claim printed on the bag. It is the chain itself, replayable by anyone the roaster hands the reference to.

The cooperative is an organization with a treasury its members vote, so the season’s premium lands as a recorded dividend rather than a promise from the chairman. When the drought year comes, the parametric cover triggers on the oracle’s signed rainfall readings against the frozen policy terms, and the payout reaches the growers before the bank would have finished asking for collateral. Every unit of all of it is conserved, on a ledger where an audit is a query.

The cast and their ceilings

The flow, step by step

1. The forward agreement escrows before planting. The money is visible all season.
2. Each handoff signs: wet mill, dry mill, exporter, container.
3. The roaster signs receipt in Hamburg.
4. Stages release as the chain accumulates.
5. Provenance is the chain itself, replayable by anyone.

Each need, mapped to a live primitive

The attack this chamber refuses: The invented single-origin

The attack. A trader relabels bulk commodity as lot 88-K single-origin and offers the story to a premium buyer.

Why it fails. Lot 88-K’s chain names its signers, and the trader is not one of them. A provenance here is not a narrative attached to goods; it is a set of signatures the goods either carry or do not, checkable in seconds from the reference.

What actually happens. The premium buyer replays the real chain, the invented story matches nothing, and the cooperative’s premium stays attached to the beans that earned it.

Deep architecture

DEMETER deployed: the cooperative’s frame holds the forward agreement, the season escrow and the provenance chain; the buyer and the route’s attestors act from their side; the rainfall stations feed the oracle that arms the parametric cover. Provenance here is not a claim printed on the bag; it is the chain itself, replayable by anyone the roaster hands the reference to. The trace replays lot 88-K, planting to receipt.

The deployment, traced

1. The forward agreement is escrowed before planting. The cooperative watches the money exist all season.
2. The buyer funds from Hamburg.
3. The escrow lands on the cooperative’s frame, exactly once, visible to the members.
4. The wet mill weighs and signs. The dry mill signs. The exporter signs. Four tonnes become a chain.
5. The container attests its seal.
6. In Hamburg, the roaster signs receipt of lot 88-K.
7. Every signed handoff couriers home through the fabric.
8. The agreement releases in stages as the handoffs accumulate.
9. The chain is the provenance. Anyone the roaster hands the reference to can replay it.
10. The drought year: the rainfall stations report what fell, raw.
11. The oracle signs the readings. An attestation has an identity.
12. The parametric cover triggers against frozen terms, and the payout reaches the growers before the bank would have finished asking for collateral.
13. The season’s premium lands as a recorded dividend the members voted, not a promise from the chairman.

Adoption, phase by phase

Discover: One lot’s journey, re-told as signatures.

• Runs. Nothing. Last season’s best-documented lot redrawn as handoffs, weights and release stages.
• Agents. None. The cooperative and the buyer argue about which handoffs deserve a signature. Settling that on paper is cheaper than settling it at sea.
• Integrates. Nothing. Scales, mills and logistics stay exactly as they are.
• Deliberately not yet. No escrow, no chain, no oracle.
• Proof that gates the next phase. One historical lot re-expressed as a chain, and both ends agree the chain matches the paper trail it replaces.

Pilot: One lot, real escrow, phone-borne attestors.

• Runs. A registry seat for the cooperative, or a single-VM frame at the exporter. The buyer connects from its side.
• Agents. coop-treasury, buyer-desk, two handoff attestors on phones at the mills.
• Integrates. The scales feed the attestors; the cold chain keeps its own systems.
• Deliberately not yet. One lot. The parametric cover is modelled, not bound. Dividends are calculated, not yet distributed on-rails.
• Proof that gates the next phase. One container ships with every physical handoff signed within a day of the paper equivalent, and the staged releases match the agreement to the unit.

Production: The season on rails, cover armed.

• Runs. A registry per exporter or cooperative federation. About nine containers, wherever the power is reliable.
• Agents. The full cast; oracles under their own identities; the parametric cover bound with frozen terms.
• Integrates. Scales, moisture meters and seals feed attestations; buyers fund forward agreements as the norm.
• Deliberately not yet. Certification claims. The chain proves custody as signed, and what was true before the first signature stays a physical-world question.
• Proof that gates the next phase. A drought-year payout reaches grower accounts from oracle-signed readings with no loss adjuster visit, and the season’s dividend distributes as recorded, member-voted transactions.

Federation: Every buyer, one grammar of custody.

• Runs. Unchanged. Buyers and route operators bring frames or seats.
• Agents. A cooperative’s delivery record travels with its DID to the next buyer.
• Integrates. Each new buyer or port is a signed card and a licence.
• Deliberately not yet. Nothing structural. Growth is lots and corridors.
• Proof that gates the next phase. A new buyer funds a forward agreement with a cooperative it has never met, on the strength of a chain it can replay.

Sizing

One handoff, weighbridge to release

sequenceDiagram
  participant Mill as wet mill attestor
  participant Fab as federation fabric
  participant FA as forward agreement (coop frame)
  participant TEG as season escrow
  participant ES as provenance chain
  participant Roa as roaster (Hamburg)
  Mill->>Fab: handoff signed (weight, moisture)
  Fab->>FA: relayed, principal checked
  FA->>TEG: staged release
  TEG-->>ES: handoff + release, append-only
  Roa->>Fab: receipt signed at arrival
  Fab->>FA: final stage releases
  ES-->>Roa: the chain, replayable by reference
  Note over TEG: the drought year pays from oracle-signed rainfall against frozen terms

Topology, as declared

flowchart LR
  B["buyer registry"] -->|"forward agreement, escrowed"| CS["contract spine<br/>staged releases"]
  M["mill / exporter / container<br/>signed handoffs"] -->|"attestations"| G{"handoff gate"}
  G -->|"stage release"| TEG["TEG escrow mover"]
  TEG -->|"dividend to members"| ORG["cooperative org<br/>treasury + votes"]
  O["weather oracle"] -.->|"signed readings"| CS
  TEG --> ES[("provenance chain<br/>lot 88-K, replayable")]

Standing it up

• Infrastructure. A registry per exporter or cooperative federation; buyers connect from theirs.
• Agents. 4 to 6 roles; the attestors follow the physical handoffs that already exist.
• Integration. Scales, moisture meters and cold chain feed the attestors. Agronomy stays in the field.

What this does not claim

• DEMETER records signed handoffs; it does not certify organic, fair-trade or any labelling regime, and it replaces no food-safety authority.
• A chain proves custody as signed. What was true before the first signature remains a physical-world question.