Entry
Any accredited CHV with the terminal setup and a lower-range bond. Standard screening and attendance milestones.
05–06Validators & payers
A workforce that already exists, given a stake.
The protocol does not recruit strangers. It gives community health workers a bond, a standard attestation format and a reputation that travels — and gives payers a vault that enforces itself.
5.1 · The human-in-the-loop imperative
A step counter proves nothing about metabolic health. A photo of a pill proves nothing about swallowing it.
This is not a sensor problem waiting for better hardware. Payer deposit schedules are public, so the size of the fraud incentive is known in advance — and single-device self-attestation has been defeated in every health incentive program that relied on it at scale.
The realistic defense is a person whose collateral is at risk and whose presence in a community makes persistent fraud costly and visible. Community Health Validators are that defense — often serving the same neighbourhoods for years.
5.2 · Point-of-care hardware handshakes
Off-the-shelf devices. No proprietary hardware.
Certified mobile terminals pair with validated glucose meters, blood pressure cuffs and anthropometric tools. Certification sits at the software and key level: secure enclave, authenticated Bluetooth, captured device attestation.
Open the session
The validator's terminal generates a nonce and registers a session identifier on L1.
Participant joins
The participant's device connects over a short-range authenticated channel.
Peripheral measures
An authenticated reading goes to both devices at once, bound to the session nonce.
Value stays home
The raw reading is stored in the participant's secure enclave, where proof construction begins.
Validator signs
The validator reviews a structured summary — not the value — and signs with an accreditation-bound key.
Submit together
Proof and signature go to the verification contract as one pair.
2×
To fabricate a session, an adversary must compromise the terminal's secure element and the participant's device — at the same time, in real time, inside a correctly formatted Bluetooth session. Records cannot be replayed or split.
5.3 · Validator economics, bonding & slashing
Choose a bond. Earn by its tier.
The tier sets the maximum milestone value a validator can attest per cycle, the fee they earn and the slashing exposure they carry.
Supervised
Clinical supervision credentials and a larger bond. Unlocks medication adherence and maternal care.
Institutional
Licensed diagnostic sites and community health centers with institutional-grade bonds. The full milestone taxonomy.
Negligence
Partial slash, capped
Failing the session protocol in a way that leaves an unverifiable record costs part of the bond posted on that milestone — capped below the fee earned. Honest edge cases are not punished.
Collusion
Full slash, tier revoked
Proven coordination with a participant to fake an attestation means the entire bond, loss of tier and a mandatory referral to the accrediting authority.
Fee rates scale with tier and ease down as the network grows, on a governance schedule. Early validators who carry bootstrap risk earn above-market fees until throughput normalizes — without locking in rates that would price out institutional payers later.
ModeledAt modeled throughput, a Tier 2 validator's average program week compares favourably with the local daily wage. Actual earnings depend on program availability, geography and individual throughput.
5.4 · Multi-generational family care accounts ✓Deployed
Care decisions are made by households, not individuals
A daughter funds her father's diabetes follow-ups. A grandparent's home manages the children's nutrition. Sponsors control the money; only the participant controls what the sponsor sees.
| Sponsor can… | Family sponsor | Employer vault |
|---|---|---|
| Fund and revoke the deposit | ||
| See program statusactive · pending · verified | ||
| See aggregate completion rates | ||
| See milestone details & scheduleonly if the participant grants it | ||
| Read clinical data or proof contents | ||
| Choose which milestones are pursued |
By default
With participant consent
Never
6.1 · Multi-gateway custodial settlement
Domestic currency in. Domestic currency out.
Payers do not hold crypto balance sheets, and participants never touch a foreign token. The crypto layer lives entirely inside the protocol's settlement infrastructure.
Payer
Licensed custodian
Payer Vault · LRGN locked
Milestone verified
Local-currency gateway
Participant
6.2 · Institutional Payer Vault
The payer does not trust the protocol. The contract enforces it.
Locked at activation
Funding schedule
How much is committed per milestone class, per participant in the cohort.
Locked at activation
Release conditions
Which attestation types and evidence standards unlock a payment.
Locked at activation
Clawback rules
What returns to the payer on early exit, expiry with unverified milestones, or a voided attestation.
Governance can change parameters for future programs; it cannot touch a vault that has already activated.
Each verified attestation triggers a proportional release in real time. Participants see rewards arrive as they act — contemporaneous feedback has larger adherence effects than deferred rewards — and the payer's exposure shrinks as the cohort progresses.
6.3 · Compliant local-currency gateways
New jurisdiction = new certified partner
01
Licensed partners only
Regulated digital asset intermediaries, licensed payment institutions or permitted banks in the disbursement jurisdiction.
02
Compliance stays with them
Each gateway runs its own AML and KYC. The protocol is not a financial institution and never handles domestic currency.
03
Diversity by design
Vaults reference a registry of gateways, not one address. If a partner fails or exits, programs route to alternatives.
04
Targeted pause
An emergency function can halt one gateway's disbursements while all others continue.
6.4 · Federated research pipeline ‡Proposed
Scientific value without a central dataset
Proposed for Phase II and not required for the initial network. Participation is opt-in, off by default, and has no effect on program eligibility or rewards.
Submit a query
A research institution specifies population, computation and privacy parameters, and locks LRGN for the licence fee.
Compute on device
Opted-in devices run the circuit inside a secure enclave against locally held data.
Return proofs only
Each device returns a commitment under differential privacy. Raw outputs and identities are discarded.
Release in aggregate
One statistical attestation is released — only if the contributing cohort meets the anonymity threshold.
The licence fee flows to the burn channel, and a smaller share pays the devices that contributed a proof, at a rate governance sets separately from clinical rewards.