LIFELINE

Aid money that cannot vanish between the donor and the delivery, on rails everyone can audit.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• International NGO. Tranches release on attested delivery, not on invoices.
• Donor government. A ledger you can read instead of a report you must trust.
• Local implementing partner. Your own registry, your own sovereignty, paid on proof.
• Field logistics. Trucks and warehouses attest handoffs with signed identities.

The problem

Between a donor and a delivered sack of grain sit four intermediaries, three currencies, and a reporting chain built from photographed receipts. Diversion is discovered in audits a year later, if at all, and the honest majority of implementers pays the reputational bill for the dishonest few.

The system

LIFELINE moves a 2.4 million unit drought response through registries run by the donor, two NGOs, and nine local implementing partners, each sovereign, each federated bilaterally. The grant is a contract with escrowed tranches. Nothing is wired ahead: tranche three exists on the ledger, visible to every party, and releases only when field agents holding their own signed identities attest that distribution eleven actually happened, at the site, on the day.

In week six a partner’s numbers stop matching its attestations. Nobody files a lawsuit first. Its licence suspends, its ability to receive further tranches ends within a sync cycle, and every unit it already touched remains on a ledger the donor, the auditor and the press can read. The remaining partners keep operating uninterrupted, because quarantine here is per-participant, economic, and reversible on evidence. The final report to the donor is not a PDF of claims. It is a query.

The cast and their ceilings

The flow, step by step

1. The grant funds as escrow. Nothing is wired ahead of proof.
2. Field agents attest the distribution with their own signed identities.
3. The partner claims against its attested delivery.
4. Tranche three releases on evidence, not on invoices.
5. The donor reads a ledger, not a report.

Each need, mapped to a live primitive

The attack this chamber refuses: The paper distribution

The attack. A partner claims tranche four for a distribution that never happened, backed by nothing but its own report.

Why it fails. The delivery gate accepts attestations, not reports, and the attestors are separate identities the partner does not control. A claim without matching attestations never reaches the escrow, and a partner whose numbers drift from its attestations is quarantined economically within a sync cycle.

What actually happens. The tranche stays in escrow for a partner who can prove delivery. Every unit the diverting partner already touched stays on a ledger the donor and the press can read.

Deep architecture

LIFELINE deployed: the donor’s frame holds the grant contract and its tranches; implementing partners claim from their own registries; field attestors sign what actually happened, where it happened; and a public mirror lets the donor, the auditor and the press read the same season. Beneficiary registration and last-mile logistics stay with the humanitarian systems built for them, which is why they sit below with no wires into the money. The trace replays tranche three, attestation to credit.

The deployment, traced

1. The grant is a contract: milestones, terms, nine partners named.
2. The tranches fund at award. Nothing is wired ahead; tranche three exists on the ledger, visible to every party.
3. A field attestor, holding its own signed identity, attests distribution eleven: at the site, on the day.
4. The partner claims the tranche from its own registry.
5. The fabric couriers the signed commands home. The relaying peer is never the principal.
6. The escrow-holding frame, and only it, releases the tranche.
7. The money crosses registries with an idempotency key.
8. The partner’s own TEG credits it, under its own law.
9. One truth per tranche, on the grant ledger, append-only.
10. The season mirrors out, signed. The donor, the auditor and the press read the same record.
11. Week six: a partner’s numbers stop matching its attestations. The evidence is already on the ledger.
12. Its licence suspends: further tranches stop within a sync cycle. Nobody files a lawsuit first, the other eight partners keep operating, and the quarantine reverses on evidence.

Adoption, phase by phase

Discover: One grant, re-told as tranches.

• Runs. Nothing. One finished grant redrawn as milestones, attestations and tranches.
• Agents. None. Programme and compliance define what counts as delivery evidence, before anyone is standing in the field.
• Integrates. Nothing. Beneficiary systems and logistics stay untouched, now and later.
• Deliberately not yet. No registry, no escrow, no attestor.
• Proof that gates the next phase. One historical response re-expressed as tranches and attestations, and the final report reproduces as a query over the model.

Pilot: One partner, one corridor, real attestations.

• Runs. The donor runs a single-VM frame; one implementing partner joins with a registry seat.
• Agents. grant-desk, partner-ops, two field attestors on phones. donor-watch reads from day one.
• Integrates. Distribution schedules in via the SDK; the humanitarian systems remain the operational truth.
• Deliberately not yet. Small tranches. One partner. Quarantine is drilled, not needed.
• Proof that gates the next phase. Three distributions release from escrow on field attestations alone, with zero settlement emails between the organisations.

Production: The full response, visible all season.

• Runs. The donor’s sovereign frame; a registry per implementing partner, free licence, federated bilaterally.
• Agents. The full cast across nine partners; the public mirror serves the auditor and the press the same signed record.
• Integrates. Programme systems feed schedules; the ledger feeds reporting instead of the other way round.
• Deliberately not yet. Cross-donor pooling. One donor’s response proves the shape first.
• Proof that gates the next phase. A partner audit is completed from the ledger and the mirror alone, and the partner agrees with every number in it.

Federation: Many donors, many partners, one grammar.

• Runs. Unchanged. New donors and partners bring frames or seats.
• Agents. Partner track records travel with their DIDs to the next response.
• Integrates. Each new relationship is a signed card and a licence, not a memorandum negotiation.
• Deliberately not yet. Nothing structural. Growth is corridors.
• Proof that gates the next phase. A new partner onboards mid-response and receives its first attested tranche within a week, with no bilateral integration project.

Sizing

One tranche, attestation to credit

sequenceDiagram
  participant Fld as field-attestor (on site)
  participant Par as partner-ops (their frame)
  participant Fab as federation fabric
  participant GC as grant contract (donor frame)
  participant TEG as tranche escrow
  participant XT as cross-registry pay
  participant Mir as public mirror
  Fld->>Fab: distribution attested, signed
  Par->>Fab: tranche claim
  Fab->>GC: relayed commands (principal checked)
  GC->>TEG: release tranche three
  TEG->>XT: pay partner (idempotency key)
  XT->>Par: their TEG credits, exactly once
  TEG-->>Mir: signed mirror update
  Note over Mir: donor, auditor and press read the same record
  Note over GC: mismatched numbers suspend a licence, not a convoy

Topology, as declared

flowchart LR
  D["donor frame"] -->|"fund grant contract"| CS["contract spine<br/>escrowed tranches"]
  F["field attestors<br/>SPIFFE identities"] -->|"signed delivery attestations"| G{"delivery gate"}
  P["partner registry<br/>sovereign, licensed"] -->|"tranche claim"| G
  G -->|"release on evidence"| TEG["TEG escrow mover"]
  TEG --> ES[("grant ledger<br/>donor-readable")]
  Q["licence drift"] -.->|"economic quarantine"| P

Standing it up

• Infrastructure. One registry per implementing partner, free licence, federated with the donor frame.
• Agents. 4 roles. The field attestors are the design work, and phones can carry them.
• Integration. Beneficiary registration and last-mile logistics stay with the humanitarian systems built for them.

What this does not claim

• LIFELINE moves and audits the money. It does not verify need, select beneficiaries, or replace humanitarian coordination.
• No sanctions-screening claim: screening obligations remain with the transacting organisations and their own counsel.