CBERCBER: the core
Status: core specification 0.4, draft · 17 September 2026. A simplified design for one cooperative. The first local reference engine now powers the simulator (Dutch interface). This is not a production installation. The extended v0.18 is preserved as a historical design.
A payment from the Basic Pulse debits the payer’s available basic budget. The recipient receives that amount as Luxury Coin, free to hold, spend or trade. It does not expire at the end of the payer’s day. Existing fund claims move to the recipient: total issuance and the energy reserve stay unchanged. This payment route is not implemented yet.
Place in the design
Inside CBER sit the coin itself, trade, the Basic Pulse and Luxury Coin. The design permits both to be used for goods and services. The coin is tradable, including by people who do not produce or consume energy themselves. The door handles trade against other currencies, such as euros. Federation has its own specification and is not the same as currency exchange.
This reference executes ordinary coin transfers and basic energy delivery. Merchant payments from a Basic Pulse budget are permitted in the design but not implemented yet. The current restriction on freely transferring the fund account protects its accounting; it does not prohibit that future payment function. The core does not need a euro exchange rate.
1. What we are building
A member can contribute measured energy to a shared reserve, hold claims on that reserve, pay another person with claims and use claims for energy delivery.
A claim is a proportional share of usable reserve, not a guarantee of a fixed number of kilowatt-hours. All claims have the same type, including the cooperative's claims.
Posting rules govern accounting, not your spending choices. Ordinary payments require no approved merchant, purchase category or recipient. The system verifies authority, available balance and duplicate processing. Not every permitted use is built yet. This does not change the design rule: no debt or promises of future payment in CBER, but direct payments and gradual purchase of existing ownership are allowed.
This first version has no unbacked emergency issuance, surplus minting, euro conversion facility, credit function or exempt currency classes. Federation has its own specification; the local core works independently. In this reference, the Basic Pulse is funded by existing claims in a dedicated account, as detailed in §4b. It must not silently use other holders' claims.
Shared losses: confirmed storage loss is allocated once through proportional claim retirement. Replacement energy earns ordinary new claims. There is no additional personal recovery levy.
Building ownership without debt
CBER has no debt or promises of future payment. You can buy existing ownership step by step. Each payment immediately purchases an agreed share. You have no obligation to buy the remainder later; it remains the seller’s property.
For example, you buy 10% of a home, then another 5%. You now own 15%. The remaining 85% is not your outstanding debt. Stopping further purchases does not undo the share already bought. Use, management and costs of shared ownership need separate agreements; paying for use does not itself buy ownership.
The currency payment and the ownership transfer are separate actions. The current experiment processes coin payments, but has no registry or settlement for these ownership shares yet.
2. The complete accounting model
| Symbol | Meaning |
|---|---|
R | Audited lower bound on genuinely usable, deliverable reserve, in fixed energy units. |
b[i] | Account i's claims, as an integer number of minimum claim units. |
l[i] | Claims locked for delivery requests that are not yet completed. |
S = sum(b[i]) | All outstanding claims, including locked and cooperative-owned claims. |
B = R / S | Energy per minimum claim unit, defined only when S is positive. |
A request locks claims; it neither creates another claim type nor burns claims. Locked claims remain in S and bear the same reserve loss. This core has no separate kWh debt D.
Energy and claims have predefined units and bounds. Amounts are integer multiples of those units. Posting uses exact integer or rational arithmetic, never binary floating-point monetary amounts. The interface may round for readability; the ledger may not.
3. Six invariants
- No claims from nothing. After the single opening entry, claims arise only against a verified increase in R from authorised contributions. Audit corrections and unexpected overcollateralisation grant no minting right.
- Payments conserve claims. Exactly the amount debited is credited. S and R do not change. A user-supplied distance never authorises a shared-reserve write-off.
- No double use. Always
0 <= l[i] <= b[i]. Payments use free balance only. Delivery batches may spend only their own locked claims. - Every energy change has evidence. R follows measured contributions, measured delivery, established loss or a signed audit correction. Usable capacity ceilings and measurement uncertainty also apply in winter. Positive deviations are recorded as carefully as negative ones.
- One fact, one posting. Persistent event IDs identify physical measurements; request IDs identify commands. Repeating identical content returns the original result without another posting. Reusing an ID with different content is rejected. Balances, journal, deduplication and result are committed durably together before success is reported.
- Recovery belongs to an incident. An audit decision identifies the incident, evidence and exact correction. It cannot clear a later incident. Replaying a completed decision does nothing. No hidden counter may permanently block recovery after its evidenced resolution is posted.
4. Postings and their conditions
Validate the complete pre-state before posting. Invalid commands change nothing. Measurements of events that have physically occurred are never discarded because financial posting failed: they remain in a durable investigation log and block further automatic delivery until resolved.
| Posting | Authority and evidence | Change |
|---|---|---|
| Open, once per ledger, not per restart | Cooperative and independent auditor sign opening balance and ownership allocation. | Start at R=S=0, or with measured existing reserve and matching claims at the agreed opening ratio. Claims go to evidenced contributors. |
| Contribute energy | Contributor's instruction plus a unique authenticated measurement. | For recognised increase e, when R>0 and S>0, credit floor(e*S/R) claims and increase R by e, using the pre-contribution state. |
| Pay | Holder's signature, existing recipient and sufficient free balance. | Move the amount between account balances. R and S remain unchanged. |
| Request delivery | Holder's signature and sufficient free balance. | Lock claims in l under a request ID. R and S remain unchanged. |
| Cancel request | Holder, before the request enters a durably recorded execution batch. | Release unused locked claims. Completed physical delivery is not reversed. |
| Deliver energy | Execution batch, fixed rate and authority limits, plus authenticated delivery measurement. | Per request, debit ceil(E_cumulative*S_batch/R_batch) minus claims already debited from b and l. Reduce R by newly measured energy. Release remaining claims only at definitive closure. |
| Loss or audit correction | Authenticated measurement series or independently signed, classified audit decision. | Adjust R; confirmed losses retire claims proportionally under section 4a. Positive corrections issue no claims. Preserve deviations, incidents and resolutions in the journal. |
At an empty R=S=0 start, the predefined opening ratio applies to the first contribution. At R=0 with S>0, the contribution formula is undefined: no new purchase issuance. Only an evidenced recovery contribution without new claims or a separately signed winding-up can resolve that condition. At S=0 with R>0, residual reserve first requires such a winding-up; a subsequent contributor does not receive it for free.
Contributors see the rate rule and rounding beforehand. A positive contribution yielding less than one minimum claim is not accepted as a paid contribution. Fees are paid separately from existing claims; they do not change the issuance formula.
A delivery batch fixes R_batch and S_batch after preceding reserve changes are processed. Every request in that batch uses the same ratio. Total authorised energy fits R_batch, simultaneous network capacity and locked claims. Rounding is less than one minimum claim per separate request within the batch, favouring remaining reserve. Partial measurements use cumulative energy per request; splitting measurement messages causes no additional rounding. A new reserve deviation before execution invalidates an unexecuted authorisation; already delivered energy remains a real fact that must be posted.
4a. Allocate losses once
Confirmed loss is shared by claim holdings, including locked claims. There is no personal recovery debt or deduction from future solar input. Replacement energy earns ordinary claims.
With no executing batch, adjust reserve and claims atomically. For pre-loss ratio R0/S0 and remaining reserve R1, retain ceil(R1*S0/R0) claims, capped at existing supply. Allocate the retired claims proportionally: floor each share, distribute remaining atoms by largest remainder, and break ties by account ID. Aggregate rounding is less than one minimum claim. Positive reserve retains at least one claim; total loss retires all claims. Measured input can restart an empty R=S=0 pool.
Cancel and log pending requests before reducing balances. Executing requests retain their locks. Book physical loss immediately, but defer claim retirement until every delivery is definitively closed. Payments and new issuance stay blocked. Settle deliveries at the batch rate first, then allocate loss among remaining holders using the ratio before the first deferred loss as reference. Combine further losses during that batch; never charge the same loss twice. Incidents still require individual resolution.
Negative audits and remaining reconciliation deficits follow the same rule. Delivery debits remain capped by authorization; confirmed excess becomes shared loss. Positive audit corrections never mint or automatically restore previously retired claims. Loss evidence must therefore be definitive. Correcting an erroneous historical loss allocation requires a separately reviewed settlement, outside this reference implementation.
Example: 180 kWh and 180 claims become 170 kWh and 170 claims after a 10 kWh loss. A new 10 kWh input earns its producer 10 claims, returning the pool to 180 kWh and 180 claims. Retirement itself creates no energy. Claims do not guarantee a fixed one-kWh value.
4b. Basic Pulse and luxury claims
The Basic Pulse is a personal daily use-right, not another transferable currency. Every registered person has the same target, including people without generation or luxury claims. Unused daily rights expire; unused funding remains in the shared fund. Identity verification must ensure one right per person, even when several people share a connection.
Verified renewable input first funds the gap between the unserved daily basic target and existing fund claims. Already delivered basic energy is not funded again. Only remaining newly issued claims go to the contributor as luxury claims. Total issuance does not increase. Source evidence and owner consent are required. Ordinary non-renewable input does not finance this route. The identity and meter adapters must verify source classification rather than trust a self-selected label.
The dedicated fund cannot transfer claims or use ordinary withdrawal requests. Available fund claims back personal daily budgets. A basic delivery locks fund claims and burns them only against actual delivery, using the ordinary batch and recovery rules. The simulator serves available basic demand before luxury demand; real scheduling and power constraints belong to the execution adapter.
Operator and auditor approve the bank target. It cannot decrease; an increase requires additional verified renewable capacity. Capacity means the sustainable daily contribution available for this service, not peak power. The total target cannot exceed that commitment. A bank decision creates no money. Actual delivery remains limited by funded claims and available energy. The fund shares physical losses as an ordinary claim holder: the target remains while funded availability may fall.
There is no fixed contribution percentage. All new claims may go to the fund during scarcity. Existing private claims remain intact. Delivery still depends on actual energy, available storage space and new input. The browser demo has four people: Anna, Bas, Noor and Sem, with the last two using the community building. It starts with an empty fund. The bank button adds simulated solar panels and raises the target. Evidence strings are fixtures, not real verification. Identity, calendar, renewable evidence, capacity and authority need verified external adapters before real use.
5. Measurement, execution and stopping
Before participation, the cooperative publishes the measurement protocol, units, loss model, capacity at relevant temperatures, power limits, delivery schedule and maximum delivery term. The auditor verifies their basis. This core does not replace the required measurement annex with an assumption.
Execution first durably records delivery authorisation, executes it at most once and links the actual measurement to that authorisation. A measurement exceeding the authorised quantity is not retrospectively charged to the member as ordinary extra redemption: it is an incident that stops automatic execution and requires investigation.
A request in an execution batch can be released only after durable cancellation confirms execution can no longer occur, or actual delivery has been definitively established. Claims remain locked while execution is uncertain; execution is retried only after reconciliation with the device.
An unexplained deviation, missing measurement, storage failure or missed delivery term puts the instance in paused status. No new issuance, payments or automatic deliveries occur. Read access, recording measured facts and cancelling requests outside an execution batch remain available. Batch releases require the evidence described above. Resumption requires authorised resolution of every blocking incident. Public notices identify system status, not affected people.
B is a ratio, not a green seal of approval. Energy can be lost, and delivery requires time and power. Earlier actual delivery can carry less risk than waiting. This core promises neither immunity to runs nor a guaranteed one kWh per claim.
6. Privacy, authority and one implementation
Holders see their own balances, postings and requests. Individual balances, payments, delivery patterns and queue positions are not public. An independent auditor can verify completeness under defined access and retention rules. Operators cannot spend on a member's behalf; an ordinary account holder cannot submit meter facts or audit corrections. Key management, account recovery and data protection must be specified and reviewed before real participation.
Core rules, current system status and periodic audit statements are public. This first version does not require public exact live reserve, account or queue series. Members receive the current rate and their own request data through protected access. That access also requires an inference-risk review before deployment: members are not automatically trusted observers.
There will be one accounting engine used by the API, tests and simulator. No separate financial formulas in public widgets. The new simulator uses the same local accounting engine. The Python reference, old simulator and older TypeScript core belong to the historical design. The old simulator remains available.
The next implementation step starts with conclusive tests for claim conservation, retries, rounding, concurrent requests, actual reserve loss, partial delivery, storage failure and incident-bound recovery. This specification designs that step; it does not claim the step is complete.