ProtoLedger Money Standard v4.0
A Two-Layer Standard for Evaluating Money and the Systems That Issue It
Specification v4.0 · June 2026 · Apache 2.0 · Authored by Oleh Bezuhlyi
Fitness for purpose, at a stated readiness · Outcome-scored · Evidence-graded · Tail-aware · Value-disclosed · Falsifiable
Open for Community Review. Defaults — gates, tail-rule thresholds, evidence tiers, time windows, archetype weights — are published so they can be rejected. Challenge any of it at /protoledger/challenges/.
What this version is
v4.0 closes the four structural gaps that separated earlier drafts from a working measurement instrument: an evidence protocol (each property names admissible evidence types, tiers, and time windows); an instance rule (the object scored is a subject and its holding form); use-based scope (a subject is scored on the layers it actually serves, not the layers its issuer claims); and tail-aware scoring (properties whose headline claim is reliability are scored on their failure distribution, not their average day).
It also assigns a gate set to every archetype; splits each property's score into a Today score and a Ceiling score; adds B10 — Claim Enforceability for all IOU-shaped money; sharpens the B3/B4 boundary to eliminate double-counting of decentralisation; adds assessor conflict-of-interest disclosure; and gives every published assessment a validity period and event-triggered re-score rule.
Design commitments
- Two objects, two scales, never summed. A perfect system can be poor money, and excellent money can run on an unsound system.
- Outcome, not mechanism. A property is satisfied by its result. No design is rewarded for resembling a preferred architecture.
- Evidence, not assertion. Every score cites evidence of a named tier. Issuer claims are the lowest tier, not a substitute.
- The tail, not the average day. Where the claim is stability, the score reflects probability × severity × recoverability of the bad day.
- Today and Ceiling are different numbers. Each property carries both. A ceiling may never pose as a working system.
- Contested values are disclosed, not scored. Privacy, personhood, issuance ethic, and autonomy are positions on an axis.
- Fitness for a named purpose. The standard reports a profile for a declared use-case, not one context-free rank.
- Scope follows use, not claims. If a thing functions as money at scale, it is scored as money.
- Falsifiable and un-owned. The contribution is the honest axis set and procedure, not the verdict; the weights belong to the reader.
I. The Object: Subject, Instance, and Scope
An assessment names not just a subject ("Bitcoin", "USDC", "the US dollar") but an instance — the concrete form in which a holder actually holds and transfers it. "Bitcoin" held as a native UTXO, as a Lightning balance, as wrapped wBTC, and as an exchange IOU are four different holdings with four different profiles. A score that does not name its instance is ambiguous in a way an adversary can exploit.
A bridged or wrapped instance inherits the minimum of its own soundness and the soundness of every bridge, custodian, and contract in its dependency path, which is listed in the assessment.
Scope is use-based. A subject is scored on Layer A if it is used as money at non-trivial scale, regardless of how the issuer describes it; on Layer B if it is, or depends on, a system that issues, settles, or custodies that money. N/A-by-design remains available but now requires a positive argument logged in the assessment. Absence of a marketing claim is not an argument. A property that does not apply is not a failure; a property dodged is.
II. Archetypes and Their Gates
Every assessment names a use-case archetype. The same subject-instance scores differently across archetypes; that divergence is information, not noise. A gate failure caps the verdict and must be stated, not footnoted.
| Archetype | Gates | |
|---|---|---|
| A | Daily Medium of Exchange | A1 ≥ 7 and A3 ≥ 7 |
| B | Long-Horizon Store of Value | A1 ≥ 7 and B1 ≥ 7 |
| C | Censorship-Resistant Settlement | A1 ≥ 7 and B3 ≥ 7 and B4 ≥ 7 |
| D | Programmable Collateral / Base Layer | B2 ≥ 7 and B5 ≥ 7 |
| E | Unit of Account | A2 (short-horizon) ≥ 7 |
Universal gates, all archetypes:
- Any "money in use" / "ready today" verdict requires
A1 ≥ 7on the Today score. - Any "sound system" verdict requires
B1 ≥ 7andB2 ≥ 7on the Today score. - Ceiling scores never satisfy a gate for a "ready today" verdict — only for a verdict explicitly labelled ceiling.
III. Layer A — Monetary Fitness
Does it work as money for its users? Scored on the result, never the mechanism. M is the unweighted mean of the Layer A Today scores, N/A-by-design items excluded.
| Code | Property & outcome required |
|---|---|
| A1 | Acceptability & LiquidityCounterparties will take it, and it can be entered or exited at scale without large loss. The master property. |
| A2 | Value Stability (tail rule)Predictable purchasing power over the relevant horizon. Short-horizon (unit-of-account) and long-horizon (store-of-value) figures reported separately. |
| A3 | Usability & SafetyA non-expert can hold and transfer it without specialised skill, and survive error, loss, theft, and fraud without catastrophe. |
| A4 | Portability & DivisibilityMoves and splits cleanly at the scale and speed of real transactions, including across borders. |
| A5 | FungibilityUnits are interchangeable in practice; no unit carries history that degrades its acceptance. Scores the observed outcome, not the privacy design (see Layer C). |
| A6 | RecognizabilityEasy to authenticate; hard to spoof. For digital instances: fake tokens, ticker confusion, look-alike contracts, address poisoning, phishing rank here. |
| A7 | Cost Efficiency & CapacityLow cost to transact and hold at the declared archetype's scale — not merely at today's load. |
IV. Layer B — System Soundness
Is the system behind the money sound? Held separate from the definition of money itself. S is the unweighted mean of the Layer B Today scores, N/A-by-design items excluded.
| Code | Property & outcome required |
|---|---|
| B1 | Supply IntegrityNo privileged party can quietly dilute holders; the issuance rule is known and hard to change. A fixed cap is not required — a rule-bound elastic supply qualifies. |
| B2 | Settlement Assurance (tail rule)Confirmed transactions stay confirmed and behave as promised; no silent reversal, no double-spend. |
| B3 | Resilience, Liveness & CapacityKeeps settling — at usable capacity — through attack, outage, partition, and the failure or coercion of any single operator. |
| B4 | No Single Point of ControlNo one party can unilaterally rewrite state, censor, seize funds, or gate participation. Scored on control over state or inclusion — pure availability belongs in B3. |
| B5 | Rule AuditabilityAnyone can independently verify the rules and the current state. |
| B6 | Forward Security MarginCryptographic and economic assumptions have headroom against foreseeable threats. Post-quantum readiness is one case, not the whole line. |
| B7 | No Invisible RentOperators cannot skim value from transaction ordering, position, or privileged information. The outcome MEV-resistance targets. |
| B8 | Capture-Resistant Rule-ChangeThe rules for changing the rules are explicit and resist takeover by any single faction. |
| B9 | Resource ProportionalityRunning cost is proportional to the value secured; no waste for its own sake. Mechanism-agnostic. |
| B10 | Claim Enforceability (tail rule · N/A for pure bearer)Where the money is a claim on an issuer/custodian: the claim is legally enforceable, backing is bankruptcy-remote, and redemption works in practice — including on a bad day. |
V. Layer C — Disclosed, Not Scored
Eight axes the standard records and discloses but never marks "wrong" or awards points for. Four are contested values; four are mechanism facts — descriptive, disclosed rather than scored because the standard scores outcomes only. Treating any of these as an objective measurement is how a standard launders ideology through a number.
From fully transparent, through fungibility-grade privacy, to total untraceability. The outcome side of privacy is scored in A5.
Anonymous → pseudonymous → verified unique human. Dual-use: a personhood proof is at once a freedom tool and an instrument of control.
Fixed cap, rule-bound elastic, work-based, egalitarian mint, or pre-allocated.
Independence from issuer or state versus recourse, consumer protection, and legal acceptability.
Proof-of-Work, Proof-of-Stake, BFT, institutional, or none.
Ossified, on-chain vote, or institutional — with its capture surface named: sclerosis, plutocracy, or opacity.
Issuer/operator jurisdictions, applicable regimes, and legal constraints on holders by region. Enforceability of a claim is scored in B10.
The named worst cases — depeg, bridge failure, custodian insolvency, 51% capture, protocol-bug class — with the tail-scored properties they feed (A2, B2, B10).
VI. The Scoring Model
Two scores per property: Today and Ceiling
Each Layer A and Layer B property receives two integers, 0–10. Today is supported only by Achieved-tier evidence — real systems demonstrating the outcome now, for this instance; it feeds all gates and "ready today" verdicts. Ceiling is what the property could reach with known, specified work, and carries a class: Buildable (parts exist and are specified) or Speculative (unproven). A speculative ceiling can never anchor a comparative claim against another subject's Today score.
The verdict's readiness mix is three percentages by property count: share where Ceiling − Today ≤ 1 (mature), where the gap is Buildable, and where the gap is Speculative.
Outcome bands
| 7–10 | Strong — outcome substantially achieved; minor gaps or caveats. |
| 4–6 | Partial — significant gaps that affect real users. |
| 0–3 | Weak / Absent — nominally addressed but materially missing, or not addressed at all. |
Tail rule (A2, B2, B10)
Tail-scored properties are scored on the failure distribution, not the typical day: the typical-day band, capped by the bad-day record. A property cannot score above 6 if a failure of material severity has occurred within the assessment window without full recovery and a demonstrated structural fix; it cannot score above 8 if the worst credible failure mode is uninsured, unrecoverable, and borne entirely by the holder.
Evidence tiers
- T1 — Independently verifiable data: on-chain measurements, reproducible market data, published incident records.
- T2 — Independent third-party: full audits, peer-reviewed studies, regulator findings, formal verification.
- T3 — Attested: attestations, agreed-upon-procedures reports, signed legal opinions.
- T4 — Issuer claims: documentation, marketing, whitepapers.
A Today score above 6 requires at least one T1 or T2 citation. T4 evidence alone supports a score of at most 3. Conflicting evidence is resolved upward in tier, not in favour of the subject.
Time windows
Market and incident evidence covers a 3-year window (or full life, if shorter); stability is additionally reported at 30d / 1y / 5y; "current" structural facts (concentration, authority, reserves) are measured within 90 days of publication.
Aggregation and weights
The headline pair is the unweighted mean of Layer A Today scores (M) and Layer B Today scores (S), N/A-by-design items excluded from the denominator. The two means are presented as a pair — never added, never multiplied, never blended. Archetype-weighted views are permitted, but every weighted figure must publish its full weight vector beside it and show the unweighted pair with it. Any leaderboard must be per-archetype, per-instance-class, and must show its weights.
Verdict format
M ·.· / 10 · S ·.· / 10 — for subject (instance), archetype X, readiness target (today / ceiling) · readiness mix __% / __% / __% · gate check: pass / capped (reason) · Layer C disclosures attached · assessed date, valid until date.
The pair may be rendered as a position on a fixed 10×10 M×S grid (M horizontal, S vertical). A grid position is shareable like a grade but cannot be mistaken for one, and must carry the archetype and instance labels.
VII. Assessment Lifecycle
- Validity. An assessment is valid for 12 months, after which it must be re-affirmed or is marked stale and removed from any leaderboard.
- Event triggers. A re-score of affected properties is mandatory within 30 days of: a depeg or redemption suspension; a reorg or settlement failure of material depth; a successful attack on the dependency path; a sanction, seizure, or freeze; a contentious fork or forced rule change; an issuer insolvency anywhere in the path. The triggering event and the score delta are published together.
- Versioning. A score is always read as (subject, instance, archetype, standard version, assessment version, date). Historic scores are never silently edited.
VIII. Assessor Disclosure
Every published assessment carries the assessor's identity (or stable pseudonymous identity with track record); a holdings disclosure (any position in the subject, its competitors, or correlated instruments); a funding disclosure (who paid, if anyone — subject-funded assessments are permitted but must be labelled on the verdict line, not in an appendix); and affiliations relevant to Layer C values. An undisclosed conflict, once demonstrated, voids the assessment and is recorded in the challenge log.
IX. How to Use It
- Name the subject, the instance, the archetype, and the readiness target. State the values-vector you will judge Layer C against. List the dependency path.
- Score Layer A on outcomes: Today and Ceiling per property, citing tiered evidence, applying the tail rule where marked.
- Score Layer B the same way, marking N/A-by-design items with their logged argument rather than zeroing them.
- Apply the archetype gates plus the universal gates. If a gate fails, cap the verdict and say so explicitly.
- Record Layer C positions and note alignment with your stated values-vector.
- Report the pair (M / S), the readiness mix, the disclosures, and the validity date. Never reduce it to one number.
Worked Reads (illustrative)
Judgement-based illustrations of how the instrument reads under v4.0 — not figures derived from the full evidence rubrics.
Fiat USD (insured bank deposit, archetype A) — M high · S mixed
B10 strong (deposit insurance, legal claim); B1 moderate (discretionary issuance); B4 low and not N/A — the deposit instance has a clear single point of control, unlike physical cash where several B items are N/A by design.
Bitcoin (native L1 self-custody, archetype B) — M mixed · S strong
Tail rule leaves B2 strong (no material settlement failure in window). A3 is the binding weakness for non-experts. Ceiling > Today on B6 (PQ migration: Buildable, unexecuted). The dominant real holding — exchange IOU — is a different profile with B10 and B4 in play.
Fiat-backed stablecoin (issuer-direct, archetype A) — M strong · S guarded
Peg history caps A2; redemption-under-stress, reserve audit tier, freeze authority, and bankruptcy-remoteness produce a scored B10 figure instead of a disclosure-only caveat. Single-issuer control reads on B4.
Reflexivity and Challenge Process
The standard's claim to completeness is procedural, not declarative: every demonstrated omission has a path into the standard, and every score has a path to correction. The challenge process runs at three levels:
- Leaf challenge — disputes a score for a specific subject-instance, with evidence. Resolved against the evidence tiers; higher tier wins.
- Constitutional challenge — proposes adding or removing a property, changing a gate, the tail rule, the evidence tiers, or default weights, with argument.
- Completeness challenge — demonstrates a scorable property that is absent, or a contested value treated as scorable. A sustained challenge produces a new property or axis in the next version, with the challenger credited.
All challenges are versioned and public. Submit one at /protoledger/challenges/.
Open Problems
- Calibration data. The rubrics name what to measure; a companion calibration file must fix the numeric thresholds per band. Those thresholds will be contested, and should be.
- Tail estimation. The rule caps on observed failures; estimating the probability of unobserved failure modes remains judgement wearing a number. The rule bounds the damage; it does not eliminate it.
- The stability tension. The conflict between a fair supply and a stable one is real and unresolved; the standard exposes it rather than picking a side by omission.
- Profile legibility. The M×S grid glyph mitigates but does not solve the shareability gap against a single dishonest number.
- Assessor incentives. Disclosure makes conflicts visible; it does not fund independent assessment.