The model

The shape

No matter what happens to the messy thing in the middle, it always falls back to the members of the organisations that meet the trust's definition. That's where the power lies.

There's no central membership body to capture. If the middle collapses, the system falls back to its two ends and rebuilds from there.

The trust: dull on purpose

The trust holds the asset and is bound by its deed. The trustees control the property but can never benefit from it. The trust is designed to need no judgement at all: anywhere it might have to decide something, the deed gives it a rule that applies automatically when an objective condition is met.

• A sealed core that nobody can change: the asset never leaves the trust, and nobody profits from it.
• A bounded power to extend the operating rules around the core.
• A supremacy clause: nothing added can weaken the core.
• No special powers for anyone, the founder included.

The test for every clause: is there any single person whose coercion or capture would change the outcome? If there is, spread the power out until there isn't.

Kanecta's draft trust deed is a worked example.

Member organisations

• Anyone can start one, anywhere. Registration is notification, not permission: publish rules that meet the criteria and the trust lists you. It can't refuse.
• They're non-profit, democratic and worker-majority. Nobody may ever be refused membership.
• They employ the people who build and support the software, collect members' dues, and run the annual declaration.
• They hold nothing precious. The code is in the trust, the price is set by members, the principles are locked. That's why it's safe to let anyone start one.
• They are the maintainers. There's no separate maintainer class.

A side effect we like: every employer in the ecosystem is, by definition, non-profit, democratically run and worker-majority.

Who decides what gets built

The member organisations. Each decides how it works and what it ships, and members vote with their feet by choosing which one to belong to.

The main version isn't a throne. It's a commons the organisations choose to pool their work into, because duplicating effort is wasteful. Ideally they all work on it together, but they don't have to. A group that thinks the main line is going wrong doesn't have to lose a vote and live with it; it can pool into its own line, and if that's better, others will pull from it until it becomes the main line. Main because it's good, not because it's official.

The trust holds the copyright and the licence, not editorial control.

Who decides the price

The members, directly. Each year's declaration carries one extra line: "The current price is X. What do you think it should be?" Each member organisation counts its own members' answers and publishes the tally. The trust adds the tallies up by a fixed rule and records the result.

• No special election, no proposer, nobody who decides when to vote.
• Weighting: people who've worked on the software in the last year carry two-thirds of the weight; other members, one-third.
• The leading candidate rule is the weighted median, so extremes cancel out.
• Every tally is published, so a dishonest count is visible.
• If nobody votes, the current price continues.

The member organisations have no say in the price and never agree it among themselves. They compete on being good to belong to.

Three kinds of decision, three places

1. Licence matters (the price, the terms) are held by the trust and voted directly by members.
2. The code belongs to the people building it, governed openly like any open-source project.
3. Values, such as the criteria for member organisations, are argued out in whatever assembly members organise. The outcome goes to the trust to record. Heat in the assembly; recording in the dull trust.

A forum can host the members but can never stand between them and a result. Capture a forum's leadership and you've bought nothing.

Use is anonymous; governance is identified

Running the software needs no identity check. That stays open and honour-based. Holding a legal interest — voting, or being drawn as a trustee — means being an identified, accountable person. That isn't surveillance; it's how owning something works.

When it all goes wrong

Every obligation only applies while there's a working way to meet it. If the member organisations all disappear, nobody has to pay. If the trust is wound up, the licence's conditions end and the software becomes permissive. There's no single trigger an attacker can pull, and nothing to gain by pulling it: the moment the software could be taken, it's already free to everyone.