01
Validator threshold
No single operator, accreditation partner or geographic cluster carries more than a set share of attestations.
09 · 11Governance & stewardship
Economic questions get a vote. Clinical questions do not.
A token holder with no medical training voting on whether a blood pressure threshold is clinically meaningful is not decentralized governance — it is a liability. So authority is split in two.
9.1 · Bicameral governance topology
Two memberships, two kinds of power
Above bothNeither chamber can dissolve the other, and neither can amend the five architectural axioms.
Weighted by stake
Economic Chamber
Staked LRGN holders, weighted by stake size and duration.
- Protocol fee rates
- Validator tier bond ranges
- Burn allocations across the three channels
- Gateway registry and bridge certification
- Disbursements from the ecosystem grant tranche
Safety veto
Appointed by credential
Clinical Ethics & Safety Board
Licensed practitioners, health informatics specialists and independent bioethicists, verifiable against professional registries.
- Must approve any milestone registry change before it can execute
- Unilateral veto over proposals touching safety, data isolation or the clinical boundary
- Can halt attestation intake for a milestone class or geography — expiring unless renewed by supermajority
9.2 · Deterministic proposal lifecycle
Five stages. No fast path.
The contract enforces the sequence for everyone — including the Foundation and the largest holders.
Ideation
A forum template with rationale, expected effect and an implementation spec. No spec, no intake.
Temperature check
A non-binding signal vote that filters out proposals not worth a formal review.
Formal LIP
A stake deposit scaled to scope — forfeited if withdrawn without a vote after review starts.
Staked timelock
Longer for less reversible changes. Holders can exit; the Board can veto.
On-chain execution
Automatic when the timelock expires unchallenged. No committee signature required.
9.3 · Progressive decentralization
Measured thresholds, not a fixed calendar
The protocol launches under transitional stewardship and hands over when three maturity thresholds are all met.
02
Payer threshold
Program volume spread across independent payer classes, with no single payer above a cap.
03
Participation threshold
Turnout above a floor for consecutive proposal cycles — distributed authority, not apathy.
Until then, the Foundation keeps two reserved powers. Both expire permanently once the thresholds are met.
- Pause specific functions after a security incident, via a multi-signature emergency path with a bounded maximum duration
- Slow or halt token unlocks if a governance attack on the vesting contracts is detected
11.1 · Foundation fiduciary mandate
Narrow by construction
An independent non-profit that keeps a public artifact — it does not own it. Any guild can fork the codebase if stewardship is judged inadequate.
It does
- Hold the canonical open-source repository, under a permissive licence from the first release
- Administer ecosystem grants and accreditation partnerships
- Run treasury operations under multi-signature, time-locked control
It does not
- Hold clinical authority or adjudicate attestations
- Control the milestone registry beyond submitting proposals
- Give any single signer unilateral spending or emergency power
11.2 · Engineering & research working groups
Four standing guilds, four mandates
Merit-appointed by the Foundation with input from the Economic Chamber. Membership is disclosed at the credential level.
Distributed Systems & Consensus Guild
Owns the settlement layer, bridge modules and validator mesh contracts.
Cryptographic Privacy & ZK Working Group
Owns the circuit registry, proving key lifecycle and the federated compute specification.
Health Informatics & Interoperability Consortium
Owns the gateway interface, the HL7 FHIR R4 mapping layer and the milestone registry schema.
Mechanism Design & Tokenomics Desk
Owns vault logic, fee schedules, slashing parameters and burn channel allocations.
11.3 · Independent ethics council
Guarding the boundary
Alongside the Board, an independent council maintains the definition of what falls inside and outside the protocol's non-diagnostic scope, reviews adverse event reports and commissions external review of privacy guarantees.
It includes licensed practitioners, a health data protection specialist and at least one member from outside the initial regions, so ethics review is not self-referential to one legal tradition. Findings are published without participant-identifying information.
11.4 · Contributor privacy
Mandates, not names
A public roster of who controls settlement contracts or proof keys would turn the protocol's most sensitive functions into a list of pressure points. Contributors are instead verified and bonded through licensed institutional custody partners — continuously, not once.
The public can verify which guild holds which mandate and the bond behind it. No protocol function requires a publicly named individual to sign.