Alpha Data Omega

Governance · non-economic

Nominate a person. Vote with a reason.

Every industry keeps its own field. Anyone can nominate an individual to steward one; the nominee accepts by an invite meant only for them; then anyone can vote — once per person, once per network — and every vote carries a public reason. Votes are mass. The more a nominee earns, the further the field pulls their trit toward the null seat at the center.

No tokenNo treasuryReason is requiredIdentity never on the ledgerRefusal is a place

The industry fields

votes = mass · center = null seat

Pick an industry. Each accepted nominee is a trit placed on the ring; the weight of votes behind them is mass, and mass falls toward the null seat at the middle — the same zero the field abstains into. A nominee with no votes sits out at a pole; as reasons accumulate the field draws them in toward consensus. Nothing here decides on its own — the field only shows where the reasons are pulling.

—
null seat · Θ
null seat — consensus / abstention nominee trit — size & pull ∝ votes

Reasons on the record

How a nomination moves

nominate · accept · vote · record

  1. Nominate

    Name a person and the industry they should steward, with the reason you trust them. The nomination opens pending — nobody can vote yet.

  2. Accept

    The nominee receives an invite meant only for them. They read the stewardship grant and accept it themselves. Only then do they appear on the field.

  3. Vote

    Anyone may vote for an accepted nominee — once per person, once per network — and every vote must carry a public reason. The reason is the vote.

  4. Record

    The reason and a one-way vote token are written to a content-addressed ledger and pinned to IPFS. The field gains mass and draws the nominee toward the seat.

Nominate & accept

step 01 · 02

You were nominated to steward —

Nominated by another participant, with this reason:

The stewardship grant
  • Stewardship is a duty of care for a domain, not an office of power. It carries no economic right, no token, and no treasury.
  • Accepting places your name on a public field. The reasons people give for and against you are public; who they are is not.
  • You may step down at any time. A steward can be re-nominated, and the field can pull the seat elsewhere.
  • Refusal is first-class: declining this grant is a recorded, honorable outcome, not a failure.

Nominate an individual

Name a person you would trust to steward an industry, and say why.

0/600

The invite goes only to the nominee. They cannot appear on the field until they accept it themselves. The nominee's email is used to reach them and to make one accept-link — it is never published.

What the invite carries

An accept-link is a single-purpose token, in the spirit of an NDA grant.

token = HMAC(server_secret, nominationId · nomineeEmail)

The link resolves to one nomination and one action: accept, or decline. It proves the holder was the person invited — without the server ever storing a password, and without the token revealing the email it was made from. It expires, and it is spent once.

  • The nominee is the only party who can move a nomination from pending to accepted.
  • Declining is recorded as a first-class outcome, and closes the nomination cleanly.
  • Nothing about the nominee's contact details reaches the public ledger — only the name they confirm and the industry.

Delivering the invite email is a server-side seam (see _worker.js, sendInvite). In this preview the accept-link is shown back to you so the flow is walkable end to end.

Vote with a reason

step 03 · one per person · one per network

A vote without a reason is not a vote. Choose an accepted nominee, write the reason you stand behind them, and cast it. Your reason becomes public and permanent on the ledger; the link between you and it does not. Each person may vote once per nominee, and each network once — enforced by a one-way token, not by keeping your identity.

Cast a vote

The reason is the vote. It is published; you are not.

0/500

Your email is turned into a one-way token the moment it reaches the server and is never stored in the clear. The public record carries only the hash of that token, so double votes are blocked without anyone learning who you are.

What lands on the ledger

Every vote pins one record. This is its whole shape.

{ "industry": "health-medicine", "nominee": "A. Steward", "reason": "the public review text", "nul": "sha256( HMAC(secret, email) )", "ts": "2026-08-18T00:00:00Z" }

No email. No IP. No name of the voter. The nul field is a nullifier hash — a one-way commitment that lets the field reject a second vote from the same person, and lets you prove a vote was yours by recomputing it, while telling the public nothing about you.

Identity never touches the ledger

nullifier · consent · provenance
The nullifier

A one-way vote token

The server folds your email (and, separately, your network address) into an HMAC under a secret it never reveals. That token is the key that blocks a repeat vote. Only its hash is published — the token itself never leaves the server, so the public record cannot be run backwards to an email.

Per-person & per-network

Two gates, both one-way

One token from your email, one from your network address. A nominee counts you once on each. The email token is the public nullifier; the network token stays server-side as a flood guard and is never published.

Content-addressed

The reason is the record

Each vote's reason, nominee, industry and nullifier hash are serialized, addressed by their own content, and pinned to IPFS. The address is derived from the bytes, so a record cannot be quietly edited — its name would change. The ledger is append-only; votes are added, never rewritten.

Mass, not money

Votes pull the trit

Vote count is the only weight in the field. As it grows, the nominee's trit is drawn from its pole toward the null seat — the field settling on a steward. There is no token, no stake, no purchase; a vote costs a reason and nothing else.

The pull curve

pull(v) = 1 − 1/(1 + 0.045v)

The exact function driving the field above: 0 votes sits at the pole, and pull climbs toward — but never reaches — 1 at the null seat. Marked below are three accepted nominees from the seed data on this page.

Line chart of pull(v) = 1 − 1/(1 + 0.045v) for v from 0 to 100 votes

v = votes on the accepted nominee; pull = 0 (out at the pole) to 1 (settled at the null seat). Curve and markers are computed live from the formula above, not drawn by hand.

Flag · consent scopeBy voting, a participant consents to their reason being published permanently and irrevocably on a public, content-addressed ledger, unlinked from their identity. Nominees separately consent, at accept time, to their name appearing on a public field. Open decision: whether a voter may later request their reason be delisted from the cached view (the pinned bytes cannot be unpinned by us alone), and whether nominee accept-consent should itself be pinned as a signed record.
Flag · ZK depthThis preview uses a nullifier, not a full zero-knowledge proof. The unlinkability rests on the server holding its HMAC secret honestly: the server could, in principle, correlate a nullifier back to an email it has seen. A true zero-knowledge design — a Semaphore-style membership proof where the client generates the nullifier and the server never sees the email at all — removes that trust. Open decision: ship the nullifier now and label the trust boundary plainly, or gate voting behind the heavier ZK circuit before launch.