# Eldersafe Pilot — Technical Blueprint & Scale Proof

## Time window

4 months to build and launch. 12 months of pilot operation (100 members).
Total runway: 24 months guaranteed on 50,000 DKK seed (40,000 DKK ops + 10,000 DKK BSV treasury).

---

## What the pilot proves

| Claim | How the pilot proves it |
|-------|------------------------|
| A membership number can become a cryptographic identity | 100 members activate, each gets a BSV wallet, life signals fire daily |
| Daily life signals work at scale economics | Measure actual satoshi cost per signal. Project to 365M/year. |
| Smart contract breach cascade works | Simulate missed signals. Verify contract transitions. Measure SMS escalation. |
| BSV can handle Eldersafe's volume | 36,500 signals/year at pilot. Project to 365M. Teranode handles 100B/day. Headroom: 274,000×. |
| The 50 DKK economics hold | Track every satoshi. Reconcile treasury vs. actual costs. Prove the 40 DKK fund is sustainable. |
| Members actually use it | Retention rate, signal streaks, channel preferences, feedback from 100 Danish seniors. |

---

## The Activation Contract — 1,000 Guaranteed Events

### What happens when a member activates

```
Member requests digitalization of membership number
  │
  ├─ Step 1: Ældre Sagen zero-knowledge validation
  │    Eldersafe sends:   member_number
  │    Ældre Sagen returns: ✓ valid, active, dues-paid
  │    Ældre Sagen returns: ✗ name, CPR, address — NEVER
  │
  │    This is a one-bit proof: "this number belongs to a real,
  │    KYC/AML-verified human who is a member in good standing."
  │    Nothing else. No PII crosses the wire.
  │
  ├─ Step 2: BSV wallet generated
  │    Keypair derived from: hash(salted_member_number)
  │    Wallet address registered on-chain
  │
  ├─ Step 3: Activation contract broadcasts to BSV
  │    Contract terms:
  │      • 1,000 guaranteed smart contract events
  │      • 365 life signal slots (1 per 24h)
  │      • 12 × 30-day bonus triggers (5 sat each)
  │      • SMS emergency escrow (3 events/year)
  │      • Remaining events: distress, safe word, verification, partners
  │
  └─ Step 4: Member receives confirmation
       "Your membership number is now a digital identity.
        1,000 events guaranteed. Daily life signal ready.
        Your first check-in is waiting."
```

### The KYC/AML bridge

Ældre Sagen already performed KYC when the member joined — identity verified against CPR, address confirmed, dues collected through the Danish banking system. Eldersafe inherits this verification without ever touching the underlying PII.

| Layer | Who holds it | What it proves |
|-------|-------------|---------------|
| Physical identity | Ældre Sagen (CPR, name, address) | This is a real Danish human |
| Membership validity | Ældre Sagen API (boolean) | This human is an active member |
| Digital identity | Eldersafe (member_number → BSV key) | This wallet belongs to a verified member |
| On-chain trace | BSV blockchain (public) | This wallet performed these events |
| Identity revelation | 3-of-3 Shamir (Court + Eldersafe + Ældre Sagen) | Only a Danish court order can bridge wallet → human |

The member is **KYC/AML traceable at source** (Ældre Sagen knows who they are), **pseudonymous on-chain** (BSV shows a wallet, not a human), and **legally identifiable only through the notary protocol** (court order → 3-of-3 → identity revealed).

### What "Swiss-like" means in this context

| Property | How Eldersafe delivers it |
|----------|--------------------------|
| No party can unilaterally change protocol | Smart contract on BSV. Immutable once deployed. No admin keys. |
| No party can freeze or seize | Multisig treasury. No single-actor control. |
| Maximum online security | 2-of-3 channel auth. JWT + session. Caddy TLS. PostgreSQL encrypted at rest. |
| Maximum offline security | 3-of-3 Shamir identity map. Air-gapped notary HSM. Functional erasure by key destruction. |
| Traceable pseudonymous value | Every satoshi movement is on-chain, timestamped, auditable. No human name attached. |
| Chain of events immutable | BSV blockchain. Append-only. No court can undo a recorded signal. No bank can reverse a reward. |

### The 1,000 event allocation

```
1,000 guaranteed smart contract events per member per year

  ├─ 365  → Life signals (1 per day, mandatory for heartbeat)
  ├─  12  → 30-day completion bonuses (5 sat each)
  ├─   3  → SMS emergency escrow (distress, safe word, recovery)
  ├─ 620  → Remaining events:
  │          • Partner service verifications (F-Secure, YouSee)
  │          • Sponsor/gift transfers
  │          • Channel verifications (2-of-3 auth)
  │          • Contract state transitions (breach cascade)
  │          • Headroom for future services
  └───────
   1,000 events, pre-funded by the 50 DKK membership
```

Each event = 1 satoshi minimum on-chain record. The member never pays per event. The 40 DKK public fund pre-allocates the satoshis. The member simply uses the service — the contract handles the accounting.

### Why this matters to Ældre Sagen

Ældre Sagen currently holds 1,000,000 verified human identities that do almost nothing digitally. By providing a zero-knowledge validation layer — "yes, this number is real" without saying who — Ældre Sagen becomes the trusted KYC/AML bridge for an entirely new class of digital services. They don't build the services. They don't hold the keys. They don't touch the blockchain. They simply vouch: *this member is a real person.* 

The membership number transforms from a cost-center database row into the root of a digital identity tree — and Ældre Sagen is the root of trust.

---

## Pilot Architecture

Same architecture as production, scaled down:

```
PILOT (100 members)

  Caddy (TLS, 2 subdomains: app + status)
    │
    └─ Gunicorn (4 workers, single instance, :8000)
         │
         └─ Flask app
              ├─ PostgreSQL (SQLite acceptable for pilot)
              ├─ Redis (queue, optional for 100 members)
              └─ BSV Worker (batch broadcast, 60s interval)

PRODUCTION (1,000,000 members)

  Caddy (8-15 subdomains)
    │
    ├─ Tier 1: Gunicorn 8 workers (:8001) — app, api
    ├─ Tier 2: Gunicorn 4 workers (:8002) — pay, wallet
    ├─ Tier 3: Gunicorn 3 workers (:8003) — mail, help, partners
    └─ Tier 4: Static files

    PostgreSQL 17 + Redis 7 + BSV Worker (batched)
```

The pilot runs on the existing VPS (2 vCPU, 8 GB RAM). The gap between pilot and production is measured and documented — not guessed.

---

## Measurable KPIs (collected continuously)

### Blockchain layer

| KPI | Pilot measurement | Scale projection | Teranode ceiling |
|-----|------------------|------------------|-----------------|
| TX per signal | 25 sats (250 bytes @ 0.1 sat/byte) | 25 sats | 0.1 sat/byte minimum |
| TX cost per signal (DKK) | Measured at actual BSV price | Scaled linearly | <$0.000001/tx at scale |
| Daily TX volume | 100 signals/day | 1,000,000 signals/day | 100,000,000,000/day |
| Batch efficiency | 100 signals/batch → 1 TX | 100 signals/batch → 10,000 TX | Teranode: 1,000,000 TPS |
| Confirmation time | Time from signal → on-chain TXID | Same | Sub-second at any volume |
| Reward payout accuracy | 1 sat per signal, 5 sat per 30-day streak | Same | Atomic per TX |

**Headroom proof:** 1M signals/day = 11.6 signals/second. Teranode demonstrated 1,000,000 TPS sustained over 14 days. Eldersafe at peak uses 0.00116% of Teranode's capacity.

### Application layer

| KPI | Target | Why |
|-----|--------|-----|
| Signal completion rate | >95% of member-days | Daily habit must form |
| Average streak length | >14 days | 30-day bonus must be achievable |
| Channel preference | App > Email > SMS | Optimize cheapest channel |
| SMS escalation triggers | <5 per pilot | SMS is cost; validate it only fires when needed |
| Breach cascade correctness | 100% correct state transitions | Smart contract must never misclassify |
| Auth success rate | >99% (2-of-3 channels) | Seniors must be able to log in |
| Member-reported ease of use | "Nem" or "Let" from >80% | Danish seniors are the real QA |

### Financial layer

| KPI | Pilot | 1M members projection |
|-----|-------|----------------------|
| BSV fees paid | ~0.0095 BSV/year | ~95.50 BSV/year |
| Rewards paid | ~0.0004 BSV/year | ~4.25 BSV/year |
| Treasury drawdown | Tracked per block | Auditable by anyone |
| Infra cost per member | 1,440 DKK/mo ÷ 100 = 14.40 DKK/mo | 1,440 DKK/mo ÷ 1,000,000 = 0.0014 DKK/mo |
| SMS cost per member | Measured per actual use | Projected from pilot |
| Cost per life signal (all-in) | (infra + BSV + rewards) ÷ signals | Must stay under 40 DKK/year/member |
| BSV price volatility impact | Tracked weekly | Sensitivity model validated |

---

## BSV / Teranode Technical Appendix

### What Teranode is

Teranode is the BSV Association's next-generation node software, built in collaboration with AWS and Aerospike. It replaces the legacy SVNode with a horizontally scalable architecture designed for global transaction volume.

### Documented benchmarks

| Benchmark | Value | Source |
|-----------|-------|--------|
| Sustained throughput | 1,000,000+ TPS | AWS blog (2025), BSV Association |
| Duration | 14 days continuous | Demonstrated on AWS infrastructure |
| Daily capacity | 100 billion transactions | BSV Association + Aerospike (2025) |
| Transaction cost | <$0.000001 at scale | BSV fee market; 0.1 sat/byte minimum relay fee |
| Architecture | Horizontally scalable, microservices-based | AWS blog — sharded UTXO store, parallel validation |

### Why BSV over alternatives

| Requirement | BSV (Teranode) | Ethereum L2 | Solana | Cardano |
|-------------|---------------|-------------|--------|---------|
| Sub-cent fees at scale | ✓ (inherent) | ✗ (L2 adds complexity) | ✓ | ~ |
| 1M+ TPS demonstrated | ✓ (Teranode) | ✗ (theoretical) | ~ (claimed, unstable) | ✗ |
| Fixed supply / sound money | ✓ (21M cap) | ✗ (inflationary) | ✗ (inflationary) | ~ (45B cap) |
| UTXO model (auditable) | ✓ | ✗ (account model) | ✗ | ✗ |
| 1 satoshi micropayments | ✓ (native) | ✗ (gas costs) | ~ | ~ |
| Danish/EU legal clarity | ✓ (commodity, like BTC) | ~ (security questions) | ~ | ~ |
| No foundation control | ✓ (protocol locked) | ✗ (foundation governance) | ✗ | ✗ |

### Eldersafe's volume vs. Teranode's capacity

```
Eldersafe at 1,000,000 members:
  Daily signals:   1,000,000
  Daily batched TX: 10,000 (100 signals/batch)
  Peak signal rate: 11.6/second
  Peak TX rate:     0.12/second

Teranode demonstrated:
  Sustained TPS:    1,000,000/second
  Daily capacity:   100,000,000,000

Eldersafe uses:     0.00000000012% of daily capacity
Headroom:           8,600,000×
```

Even if every member fired 1,000 signals per day (impossible under the 1-per-24h contract), Eldersafe would use 0.012% of Teranode's capacity. The blockchain layer is not the bottleneck — it is effectively infinite at Eldersafe's scale.

---

## Pilot Deliverables (Month 4 checkpoint)

| Deliverable | Format | Audience |
|-------------|--------|----------|
| Live pilot running | eldersafe.cloud with 100 members | Ældre Sagen board |
| KPI dashboard | Real-time web page, public | Technical reviewers |
| Cost analysis report | PDF, per-member breakdown | CFO / finance |
| BSV treasury audit | On-chain address + reconciliation | Any skeptic |
| Teranode scale proof | Technical appendix (this document) | Engineering |
| Member feedback summary | Danish-language report | Board / member advocacy |
| Production architecture | Deployable config, not theoretical | IT operations |
| 40M DKK ARR projection | Financial model, pilot-data-backed | Strategy |

---

## The Rational Chain

```
1. Teranode exists. 1M TPS demonstrated. Sub-$0.000001 fees. Public record.
   ↓
2. Eldersafe needs 0.0000012% of that capacity. Even at 1000× growth: 0.012%.
   ↓
3. 100-member pilot proves: life signals work, members engage, contracts fire correctly.
   ↓
4. Pilot data projects: 40 DKK/member/year covers all costs with enormous headroom.
   ↓
5. 1,000,000 members × 40 DKK = 40,000,000 DKK ARR.
   ↓
6. Infrastructure cost: 0.08% of revenue. BSV fees: 0.02% of treasury.
   ↓
7. The math is not speculative. It is pilot data projected onto documented infrastructure.
```

---

## Risk Register

| Risk | Likelihood | Mitigation |
|------|-----------|------------|
| Members don't engage daily | Medium | 30-day bonus incentive. SMS reminder as escalation. Danish-language UX testing. |
| BSV price spikes 10,000× | Low | Treasury holds 109 BSV. Sensitivity model shows fund survives to $68,500/BSV. Batching reduces exposure 85%. |
| Ældre Sagen API changes | Low | Contractual API stability clause. Versioned integration. |
| Danish regulatory shift | Low | GDPR-by-design architecture. DPO appointed. DPIA completed. Functional erasure built in. |
| Key ceremony fails | Low | Rehearsed, witnessed, attested on-chain. All three parties present. |
| Teranode not production-ready at pilot launch | Low | SVNode (current BSV node) handles pilot volume trivially. Teranode is future-proofing, not a dependency. |