# Pillar ## A Percent-Native, Fixed-Supply Monetary Protocol White Paper - Draft (high-level) Author: Sam Gon & Jaaz Date: Jan 4, 2026 Status: Draft copy (references technical doc for formal specs) Revision: Feb 6, 2026 (clarifies backing vs. legacy conversion, vps mechanics, and redemption timing) --- ## Overview - Purpose: Pillar is a percent-native, fixed-supply monetary protocol that allocates liquidity under custody instead of issuing debt. - Scope: Assumes sovereign participation and conversion of legacy debt; emphasizes fairness, auditability, and unilateral exit via redemption. - Unit model: Shares represent fixed fractions of supply; user-facing labels (e.g., dollar/penny) are immutable aliases to share amounts. - Governance stance: Sovereign Country Nodes clear and sign; Processing Nodes provide availability; diversity, caps, and rotation protect against capture. - More detail: Abstract and Executive Summary cover the narrative; technical specifics live in `technical-doc.txt`. --- ## Abstract Global sovereign and central-bank liabilities are converted into a percent-native monetary base with a fixed maximum share supply. A one-time global swap converts legacy currencies into a single USD-equivalent unit of account at a ratified FX snapshot; thereafter, all balances and transfers are expressed as shares of max supply, while any "USD/CAD/etc" display is UI-only. User-facing labels (for example, "dollar," "penny") map to fixed share amounts. Liquidity is allocated, not borrowed; fees replace interest; yield comes only from usage. Physical redemption (when enabled) removes reserve assets from custody and burns redeemed shares at a published value-per-share, enabling unilateral exit without relying on market liquidity. Sovereign-run nodes clear and sign epochs; non-sovereign nodes provide availability and verification. --- ## Executive Summary - Percent-native unit: balances and prices are shares of max supply; labels are fixed share-amount aliases for UX. All ledger math is in shares; labels never rebase. No discretionary expansion beyond a fixed maximum share supply; issuance (if enabled) is deterministic; redemption burns shares and removes backing. - Liquidity allocation, not debt: principal remains system-owned; usage fees (percent of assigned liquidity over time) are the only cost. Banks become custodians/allocators with capped fees; anyone can allocate under the same rules. - Governance assumption: all sovereigns onboard; global debt moved onto the network. Debt holders become stakeholders with self-custodied liquidity; participation is voluntary. - Finality and DA: sovereign Country Nodes sign epochs; Processing Nodes relay and store erasure-coded fragments. Stake-weighted finality; availability attestations each epoch. - Operator subsidy (optional): a time-locked reserve pool unlocks a fixed 1-2% per year (deterministic schedule) and is distributed to Country Nodes proportional to fee volume processed to bootstrap infrastructure without discretionary monetary expansion. - Exit: Physical redemption (when enabled) burns shares and removes reserve assets at the published `vps` (subject to a transparent redemption window cap and FIFO queue). Labels still map to the same share amounts. No market counterparty is required to request exit. --- ## 1. Genesis and Monetary Anchoring - One-time conversion/novation of existing sovereign and central-bank liabilities into Pillar balances and system accounts (genesis distribution). Assumption: commercial banks and central banks subscribe and convert legacy deposits and debt obligations onto the network under a ratified legal mechanism. - FX conversion (assumption): all legacy currencies are converted to USD-equivalent at a ratified FX snapshot for genesis accounting. After genesis, FX rates are informational/UI-only and do not drive mint/burn. - Practical mapping (illustrative): legacy deposit balances become share balances in user wallets; legacy loan books become allocation/repayment schedules managed by bank allocators under custody rules (no new money creation from lending). - Illustrative notional anchors: - Converted global monetary debt supply at genesis: 300 trillion USD-equivalent units (converted into Pillar balances at the FX snapshot). - Time-locked operator reserve pool: 300 trillion USD-equivalent units worth of shares, unlocking at 1-2% annually (deterministic schedule). - Deterministic mapping (illustrative): 1 USD-equivalent unit = `DOLLAR_SHARES = 1_000` shares, so 600T USD-equivalent units correspond to `SHARE_SUPPLY_MAX = 600_000_000_000_000_000` shares. - Backing is the protocol-defined accounting anchor used for publishing `vps` and (when enabled) for redemption/issuance pricing. In the technical doc, `backing_amount` refers to this published anchor (and may include reserve assets held in custody and/or other ratified backing components). - Share supply max is fixed (illustratively, `SHARE_SUPPLY_MAX = 600_000_000_000_000_000` shares = 100% of max). Labels map to fixed share amounts for usability. - A reserve capacity can be defined at genesis as `reserve_pool_shares` (unissued shares held by the protocol). Issuance consumes `reserve_pool_shares`; redemption burns shares; reserve capacity is not replenished by redemption. A portion of `reserve_pool_shares` may be time-locked for operator subsidy unlocks. - Front-end values are labels bound to fixed share fractions; the ledger records shares only. Labels do not change if backing or value-per-share changes. --- ## 2. Core Truths and Invariants ### 2.1 Percent-Native Units - Balances, fees, and prices are denominated in shares (fixed-point fractions of max supply). - Labels ("dollar," "penny") are immutable aliases to fixed share amounts; labels do not change when backing changes. ### 2.2 Liquidity and Debt - Liquidity is system-owned at all times; it is assigned under custody, not borrowed. - No monetary issuance through principal-plus-interest money creation. Borrower costs are usage fees and allocator risk/service fees under custody rules. ### 2.3 Lending and Risk - All allocations are fully reserved. - Defaults reduce the allocator's locked liquidity; no bailouts or socialized loss. ### 2.4 Yield - Holder yield comes from usage fees and base transaction fees; distributed pro-rata by share. Operator compensation is fee-funded and may also include the optional time-locked reserve unlock described above. - Yield is activity-dependent and non-compounding by default. ### 2.5 Assets and Exit - Physical assets may be deposited into custody; deposits increase redeemable backing and (if issuance is enabled) receive shares from `reserve_pool_shares` at the published `vps`. - Redemption burns shares and removes backing at the published `vps` (subject to caps/queue). `SHARE_SUPPLY_MAX` remains constant; circulating shares change only via deterministic issuance and burn. Purchasing power still floats with demand and backing. ### 2.6 What the System Never Does - No discretionary issuance, QE, or inflation targeting. - No enforced participation or identity capture in the base protocol. - No guarantees of price stability or purchasing power. --- ## 3. Node Architecture and Roles ### 3.1 Country Nodes (Sovereign Settlement) - Operated by central banks or designated authorities. - Duties: intake/validate, allocate liquidity, enforce custody rules, collect fees, sign epochs, participate in global coordination. - Constraints: cannot mint, alter supply, block cross-border transfers, or rehypothecate liquidity. ### 3.2 Processing Nodes (Infrastructure) - Non-sovereign relays/verifiers; store erasure-coded fragments; provide data availability. - No custody, no policy authority, no monetary influence. --- ## 4. Ledger, Settlement, and Consensus (Summary) - Non-monolithic fabric: each Country Node keeps local logs + partial state + rolling commitments; no single canonical chain. - Epoch settlement: short epochs; each node emits batch hash `h_i^e = H(B_i^e)` plus liquidity/fee/burn deltas. - Global root: `R^e = MerkleRoot(h_1^e, h_2^e, ..., h_N^e)`; stake-weighted signatures >= 66% for finality. - Data availability: erasure-coded fragments distributed across nodes; m-of-n attestations per epoch with penalties for non-availability. - Cryptography: Ed25519 or secp256k1; SHA-256 or BLAKE3; optional zk for validity/stress proofs (non-monetary). --- ## 5. Liquidity and Fee Model - Custodial allocation: principal stays system-owned; allocators can assign but not own or spend principal. - Usage fee (illustrative): `UsageFee = shares_assigned * r_s * dt` (simple, percent over time). Principal returns 1:1. - Allocator fee (risk/service): an optional capped spread paid to the allocator for underwriting/servicing; defaults and losses remain allocator-borne. - Rate discovery (non-discretionary): `r_s` may be fixed at genesis or computed via a deterministic, utilization-based function within governance-bounded limits (changes time-locked) to reduce non-price rationing when liquidity is scarce. - Principal recycling: repaid principal returns to the liquidity pool; fees route to the Global Yield Pool. --- ## 6. Yield Distribution - Sources: usage fees + base transaction fees. - Distribution: pro-rata by share; passive, non-compounding by default. - Low-activity states: yield can approach zero; no inflationary make-up. --- ## 7. Physical Assets and Exit - Deposit: verified asset enters custody; redeemable backing increases; depositor receives shares from `reserve_pool_shares` at the published `vps` (if issuance is enabled). - Redemption: shares are surrendered and burned; backing is removed from custody at the published `vps` (subject to cap/queue); no market counterparty is required. - Reserve capacity is not replenished by redemption; no discretionary reissue. --- ## 8. Real-World Implementation Considerations - Legal/regulatory: sovereign charters for Country Nodes; KYC/AML at custodial ramps; sanctions screening; clear redemption processes. - Custody/audit: independent proofs of reserves, segregation, third-party audits, on-chain commitments to audit results. - Hardware/keys: HSM-backed signing, threshold keys for root control, rotation/compromise playbooks. - Network resilience: multi-region deployments, DDoS resistance, DA fallback via Processing Nodes, periodic reconstruction drills. - Oracle/bridge risk: FX feeds are UI-only after genesis; the genesis FX snapshot used for conversion is a one-time, ratified input with published sources. Avoid bridge-based mint/burn; keep external dependencies non-monetary. - Governance/upgrades: invariant locks; narrow upgrade hooks; regression tests for monetary invariants. - Economic stress: fee elasticity and allocator discipline in low activity; redemption surges and exit cascades. - Sovereign transaction tax (optional): Country Nodes may apply a domestic transaction tax up to 10% in addition to network fees; tax rules are published and tax proceeds route to sovereign treasury accounts. - Compliance/observability: deterministic telemetry for uptime and availability; transparent slashing enforcement; privacy-respecting monitoring. - Activity shocks: fee droughts and redemption surges handled via floors (MIN_SHARES, minimum redemption), transparent vps publication, and DA-backed reconstruction; see technical doc T9. - Custody cadence: periodic independent audits with on-chain commitments to results; attestations required to maintain Country Node eligibility. - Privacy optionality: base layer is bearer; optional two-key attestations for off-chain credit signals without linking spend history. - Ratified genesis constants (see technical doc): `SHARE_SUPPLY_MAX = 600_000_000_000_000_000` (6e17); labels (`PILLAR_SHARES = 1`, `DOLLAR_SHARES = 1_000`, `PENNY_SHARES = 10`); `MIN_SHARES = 1`; `r_s = 0.02` simple annually; DA `(k=10, n=16, m=12, S=8)`; epoch length 2s; minimum redemption `1_000` shares; redemption window 86,400s; redemption cap 0.5% of backing per window; reserve unlock 1-2% annually (fee-volume weighted distribution to Country Nodes). - Governance/upgrade guardrails: share supply and label table immutable; DA/finality thresholds and stake caps set at genesis; any change requires sovereign quorum (>= 80% by weight plus diversity) with invariant locks and a public time lock preventing discretionary monetary change. - Redemption scheduling: minimum redemption enforced; per-window cap; FIFO queue and published schedule/asset_out to prevent discretion. - Genesis anchors (illustrative): 300T converted monetary debt supply and 300T time-locked operator reserve. - Sovereign tax cap: max 10% transaction tax per Country Node (plus network fees). - Fee accrual/time base: `dt` measured in seconds; usage fees accrue per epoch with floor rounding; see technical doc T2. - DA specifics: m-of-n attestations with random sampling; penalties for non-attestation; see technical doc T6. ## 9. Adversary Model and Mitigations - Colluding Country Nodes: attempt false roots or censorship. Mitigation: 66%+ stake-weight signatures, slashing on conflicting roots, exclusion from finality. - Data withholding: publish roots but hide fragments. Mitigation: erasure coding + m-of-n availability attestations with penalties/exclusion. - Fake custody/audits: claim deposits or hide shortfalls. Mitigation: independent custody attestations, on-chain commitments to audit results, transparent value-per-share publication. - Stake concentration: a few operators dominate weight. Mitigation: stake caps/decay and diverse sovereign participation. - Spam/DoS: micro-tx floods. Mitigation: `MIN_SHARES` floors, base fees, batching, network hardening. - Rounding/precision abuse: dust to drift balances. Mitigation: deterministic floor to `MIN_SHARES`; dust returned or rejected. - Governance capture: parameter tampering (labels, share supply, DA thresholds). Mitigation: invariant locks and narrowly scoped upgrade hooks. - Oracle/UI manipulation: misleading FX/UI data. Mitigation: UI-only oracles, multiple sources, no monetary mint/burn via bridges. ### Fairness and Participation Safeguards - Diversity for finality: require signatures from a minimum number of distinct sovereigns per epoch in addition to the 66% weight threshold. - Weight caps/decay: hard caps on any single sovereign's eligible stake weight plus decay for inactivity or faults; requalification needed after slashing. - Rotating proposers/attestors: deterministic randomness to rotate proposers and DA attestors so no bloc dominates ordering or availability attestations. - User/infra attestations: include non-sovereign processing nodes in DA attestations (m-of-n) with rewards/penalties to keep verification broad. - Participation gating: fee/yield participation only for nodes meeting availability/finality requirements to prevent free-riding by large idle operators. - Public proofs: easy inclusion/availability proofs so light clients can challenge missing transactions or withheld data against signed roots. --- ## 10. Value Granularity and Label Stability ("Penny Candy") - Labels map to fixed share fractions (e.g., penny, dollar) to avoid the penny-candy drift where small labels can distort value under inflation or deflation. - Use high precision shares to allow micro-pricing; define minimum transfer and rounding rules in the technical doc. - Batch/multiplex micro-payments at settlement if needed; avoid hidden fees via rounding. - Purchasing power still floats with demand and backing; labels do not fix external prices. Labels never rebase; the ledger remains share-native. - Clarification: a "penny" remains a stable alias to 10 shares, and a "dollar" to 1,000 shares. As a result, a Penny may represent more than one local unit under deflation and less than one under inflation in external terms, while the conversion math remains fixed and auditable. --- ## 11. Conclusion The system replaces discretionary monetary trust with deterministic, percent-native accounting. Liquidity is allocated under custody with fee-based yield; when redemption is enabled, holders can request exit via redemption without requiring market counterparties. Sovereign nodes clear and sign; processing nodes keep data available; users hold shares that represent fixed fractions, while value-per-share floats with demand and backing. --- ## 12. Glossary - Share: fixed-point fraction of max supply (e.g., `SHARE_SUPPLY_MAX = 600_000_000_000_000_000` shares = 100%). Balances and fees use shares. - Label: UX alias mapping to a fixed share amount (e.g., "dollar" = X shares; "penny" = Y shares). - Pillar: atomic label amount equal to 1 share (`PILLAR_SHARES = 1`). - Country Node: sovereign-operated clearing/settlement node; signs epochs. - Processing Node: relay/verification/DA node with no custody or policy role. - Global Liquidity Pool: system-owned principal available for allocation. - Global Yield Pool: usage + transaction fees for pro-rata distribution. - Reserve Capacity (`reserve_pool_shares`): protocol-held, unissued shares available for deterministic issuance; consumed on issuance; not replenished by redemption (redeemed shares are burned). - Burned Shares: shares in an irreversible burn sink (removed from circulation). - Circulating Shares: `SHARE_SUPPLY_MAX - reserve_pool_shares - burned_shares`. - Value Per Share (`vps`): `backing_amount / circulating_shares` (published redemption/issuance price when enabled). - StakeWeight: weight for finality derived from bounded custody, correctness history, uptime. - Usage Fee: simple percent-over-time charge on assigned liquidity; no compounding by default. - Country Tax: optional sovereign transaction tax applied by a Country Node up to 10% (plus network fees). --- ## 13. Governance and Upgrade Guardrails - Immutable: share supply max (`SHARE_SUPPLY_MAX`); label table; monetary invariants (no discretionary issuance). - Upgrade-scope: DA parameters, epoch length, stake caps/decay, quorum thresholds - changeable only via sovereign quorum without violating monetary invariants. - Transparency: publish parameter sets and changes on-chain; upgrades require waiting period and audit proofs. --- ## 14. Visual and Layout Notes (Google Docs) - Supply lifecycle: genesis conversion -> share balances -> allocation -> fee flow -> issuance/redemption -> supply partitions and published `vps` (images to come). - Network topology: Country Nodes (sovereign hubs) + Processing Nodes (DA mesh) + coordination layer (images to come). - Fee flow: usage fees -> Global Yield Pool -> pro-rata distribution; principal returns to liquidity pool (images to come). - DA diagram: erasure-coded fragments across nodes with m-of-n recovery and attestations per epoch (images to come). --- ## 15. Technical Reference For formal equations, constants (label-to-share mappings), rounding rules, and edge-case handling, see `technical-doc.txt` (sections aligned to the numbering in this white paper). --- ## 16. Parameter Verification - Each epoch publishes the current parameter set (DA params, epoch length, stake caps/decay, redemption caps, fee rate bounds, quorum thresholds). - Parameters are signed by the sovereign quorum and subject to a time lock before activation. - Light clients verify parameter signatures and epoch alignment to detect unauthorized changes.