# Worked Example 2: The Meridian Collective DAO

A 4,800-member online collective pooling a treasury to fund open infrastructure. Where the family example stressed the kernel's small-n edge cases, this one stresses the canonical DAO failure modes documented in `docs/research/comparative/02-nonstate-systems.md`: whale capture, sybil flooding, voter apathy, governance raids, and the multisig that quietly became a monarchy. Every parameter below is positioned against one of those.

The structural headline: **this is a DAO with no tokens-as-votes.** Capital weighting is unrepresentable in the schema (`one_person_one_vote: const true`), so Meridian's defense problem inverts from the typical DAO's. The standard DAO fears whales; a one-person-one-vote DAO fears *sybils*. The whole membership block is the sybil defense.

## membership — the sybil perimeter

- **Sponsor admission, two sponsors, 30-day probation.** Each new member must be vouched by two existing members, and every sponsorship lands in the public ledger — so a sybil farm is a visible, attributable graph structure, not an anonymous flood. Probationary members participate fully in discussion but cannot vote or claim fork assets, which means a raid must be financed 30+ days ahead against a public paper trail. This is the cheapest sybil resistance that doesn't price out genuine newcomers (the `open` + identity-verification route was rejected as both more invasive and weaker).
- **Expulsion: 0.75 threshold, 0.30 quorum, 14-day review.** The quorum is the load-bearing number: at 4,800 members, expelling someone requires ~1,440 ballots — an expulsion can never be a quiet act of a clique. XC-03/04 hold (0.75 ≥ 0.67; 0.30 ≥ 0.25): a faction cannot purge its way to an amendment supermajority, because purging *costs more* than amending. Sponsors of an expelled sybil cluster are not auto-sanctioned in v0.1; that's a userland policy Meridian can add by MINOR amendment, and a scenario the test suite should attack.

## suffrage — liquid democracy, caged

- **Secret ballots.** At n=4,800 with real money flowing, vote buying is the live threat, and a secret ballot makes a bought vote unverifiable — the buyer can't confirm delivery. (Contrast the family's reasoned choice of `public`; same kernel, opposite parameter, both defensible *at their scale*.)
- **Delegation enabled, chain depth 2, 90-day expiry, instant revocation.** This is the apathy treatment: 10% ordinary quorum is achievable because passive members can delegate to active ones. The cage matters more than the feature: depth 2 stops delegation-of-delegations from accreting into shadow whales; 90-day expiry forces annual-ish active reconfirmation four times over; instant revocation (a kernel `const`) means a delegate who goes rogue mid-vote loses the votes mid-vote. The test suite's standing assignment: build a delegation cartel inside these bounds and measure how far it gets.

## quorum and thresholds — apathy vs. capture

0.10 ordinary / 0.25 amendment quorum reflects observed online-collective participation rates (single digits for routine business is normal; pretending otherwise just means nothing ever binds). The risk accepted: ordinary decisions can bind with ~480 voters. The mitigations are the threshold ladder (0.55 ordinary — a 50.5% squeaker doesn't carry), the seven-day voting window (no snap votes while a hemisphere sleeps), and crucially the commons tiers below, which prevent the low-quorum lane from ever touching serious money. Amendment at 0.67/0.25 means changing the rules takes a real supermajority of a real turnout (~1,200 members minimum).

## timing

Five-day review, seven-day vote: a full proposal cycle is ~12 days, fast by constitutional standards (the project's release-cadence counter will enjoy the comparison to 203 years) yet slow enough that the membership in every timezone has seen it twice. The 30-day resubmission cooldown blunts attrition raids — re-running a treasury proposal weekly until the defenders burn out is a documented governance-raid pattern.

## emergency — the pause button that can't become a throne

Stewards hold `emergency_hold`: any steward can freeze treasury execution and pending votes for 24 hours (the classic legitimate use: a live exploit against the treasury). Membership confirms at 0.6 for up to 7 days; one renewal at 0.75 (XC-05's escalation); total worst case 336 hours, under the kernel's 720 ceiling (XC-06); auto-sunset always. What the comparative research found, encoded: the difference between a circuit breaker and a coup is whether ending the emergency requires *action* or *inaction*. Here, inaction restores normalcy — and no emergency, ever, suspends a vote tally, an exit, or the ledger.

## offices — execution without authorization

- **Stewards (elected, 180-day terms, max 2 consecutive)** execute authorized spending and hold the pause button. They *authorize nothing* — `execute_spending` is by-definition execution of already-passed tiers. Recall at 0.55 is cheaper than amendment at 0.67 (XC-07), so an officer is always easier to remove than the rules are to change: the anti-court-capture invariant in miniature.
- **Recordkeeper and Moderator by sortition, short non-renewable terms.** The two roles most dangerous when captured (who writes the record; who silences whom) are deliberately *not* elected — election concentrates them in the popular, and popularity is what moderation power must be independent of. Sortition with a 90-day, non-consecutive term means moderation is a rotating civic duty, not an identity.

## commons — where XC-10 earns its keep

The tier ladder: 2% of treasury at 0.55/0.10 (routine grants), 10% at 0.62/0.15 (major grants), 25% at 0.67/0.25 (strategic moves — note this top tier requires exactly amendment-grade consensus and turnout).

Three structural facts:

1. **No proposal can move more than 25% of the treasury.** There is no higher tier, and XC-12 pins the top tier to the drain cap.
2. **No 90-day window can move more than 25% cumulatively** (`drain_cap`). A captured 55% faction passing tier-1 spends back-to-back hits the cap after ~12 of them; a captured supermajority hits it after one tier-3 spend. The faction must then hold its majority *and its secrecy* across multiple quarters under a public ledger — the attack doesn't become impossible, it becomes slow, expensive, and loud, which is what constitutional design can actually buy.
3. **Every spend above 2% carries a worst-off impact statement**, graded in scenario testing. For Meridian this concretely means: what happens to the smallest funded projects and the members in the weakest currency positions if this passes — written down, before the vote, in the ledger, forever.

## forks — the credible exit

5% of members (~240 people) can fork with a pro-rata asset claim: each departing member takes an equal share, because contributions never weighted their votes and so don't weight their exit. 60 days' notice governs the asset reconciliation only. This is the clause that disciplines everything above it: a majority that abuses the 55% lane knows the minority can leave *funded*. Exit is what makes voice honest.

## disputes & records

Nine jurors by sortition from the full membership, recusal enforced, one appeal (to a fresh panel). Elected tribunals were rejected on the court-capture evidence; nine is large enough to survive two recusals and a no-show. The ledger is fully `public` — this module spends pooled money, and Meridian takes the dogfooding position that pooled money plus private books is how every co-op scandal in the corpus started.

## Validation trace

Schema: all conditionals satisfied (sponsor → `sponsors_required`; delegation enabled → depth/revocable/expiry present; emergency enabled → all fields; commons exists → all fields; juror_panel → count 9 ∈ allowed odd set, selection sortition).
Cross-constraints: XC-01 (0.67 ≥ 0.55 ✓), XC-02 (0.25 ≥ 0.10 ✓), XC-03 (0.75 ≥ 0.67 ✓), XC-04 (0.30 ≥ 0.25 ✓), XC-05 (0.75 ≥ 0.60 ✓), XC-06 (168 × 2 = 336 ≤ 720 ✓), XC-07 (0.55 ≤ 0.67 for all three offices ✓), XC-08 (0.02 < 0.10 < 0.25 ✓), XC-09 (0.55/0.62/0.67 and 0.10/0.15/0.25 nondecreasing ✓), XC-10 (no tier exceeds 0.25, vacuously ✓ — and the top tier voluntarily meets 0.67 anyway), XC-11 (0.10/0.15/0.25 all ≥ 0.10 ✓), XC-12 (0.25 ≤ 0.25 ✓). **Conformant.**

## What the two examples prove together

Same kernel, same schema, same twelve cross-constraints — and the resulting documents are unrecognizable as siblings until you look at the bones: in both, amendment outranks ordinary business, expulsion outranks amendment, recall undercuts amendment, emergencies sunset by clock, big money moves at constitutional cost, and anyone can leave. That shared skeleton under opposite parameterizations is the userland thesis, demonstrated.