The Reality Engine.
A six-layer protocol architecture that takes a physical environmental signal from a sensor in the field to a registry-grade carbon credit on chain. Built for global scale, institutional integrity, and a two-chain architecture across Cardano and Base.
Six layers of provable truth.
The DePIN literature describes a five-layer architecture. Mālama extends it with two additional layers because geographic reward scaling and redemption are first-order determinants of network coverage and institutional usability in a hardware-based climate network. They are not details. They are protocol surface area.
Cardano for archival custody. Base for execution.
A climate-data network that serves both institutional archiving and market execution needs two different blockchain property profiles. Mālama separates archival functions from execution and liquidity functions, and runs them on the chain best suited for each. The chains are not bridged at TGE; the protocol does not require them to be.
Cardano
Deterministic eUTXO model and Plutus smart contracts give registry-grade auditability. CIP-68 datum-metadata supports richer asset state than simpler token patterns. 60-second Merkle anchoring with predictable fees.
- · SaveCard CIP-68 issuance
- · Long-horizon integrity anchoring
- · Datum-metadata for richer state
- · Institutional legibility
Base
EVM-compatible L2 for faster, lower-cost execution. Reward distribution, claims, MLMA staking, governance, and market-facing activity for LCO₂ pre-finance instruments. Mature audit ecosystem and broader institutional access for the token side.
- · Reward and claim execution
- · veMLMA staking and governance
- · LCO₂ market-facing activity
- · EVM liquidity access
The two chains do separate jobs and don't need to share state through a bridge for the protocol to function. SaveCards live on Cardano. The MLMA token, staking, and governance live on Base. Operators don't move tokens between chains as part of normal protocol activity. A Cardano-side MLMA mirror is a Phase 2 question contingent on bridge selection, security audit, and market readiness. It is not on the critical path.
H3 hex grid. Coverage follows climate value, not population.
Uniform rewards across all locations create predictable distortions. Dense urban regions saturate quickly because they are easier to access, while frontier zones with the highest climate relevance remain under-supplied. Mālama's reward scaling layer fixes this by partitioning the planet into H3 cells and applying zone-based reward and acquisition cost multipliers.
| Zone Type | Population Range | Max Nodes / Cell | Reward Multiplier |
|---|---|---|---|
| Urban | >1M | 20 | 0.5x |
| Dense Suburban | 100K to 1M | 5 | 1.0x |
| Rural | 10K to 100K | 2 | 1.5x |
| Frontier | <10K | 1 | 2.0x |
| Strategic / Extreme Gap | Sparse or critical | 1 | up to 3.0x |
Approximately 252.9 km² per cell. Approximately 2,016,842 unique cells globally. Resolution 5 balances regional granularity against governance manageability.
Where S = local saturation and Z = zone classification. Acquisition cost follows the same logic so scarce or strategic zones are not priced identically to dense urban cells.
Three primitives. Six layers.
The six-layer architecture is instantiated through three concrete protocol objects. Each one bundles the outputs of multiple layers into a unit that operators, validators, and institutional counterparties can transact with.
The Evidence Object
Practical implementation of hardware signing, verification, and oracle aggregation. A portable, cryptographically secured record pointing to hardware-signed and validated environmental data with a retrievable proof structure. The standard data primitive for the Mālama ecosystem.
The Geographic Right
Practical implementation of blockchain coordination and H3 reward scaling. Encodes non-exclusive geographic operating rights, capacity constraints, reward weighting, acquisition policy, and regional governance for a specific hex cell. Not a collectible. A regional rights and policy object.
The Governance Lock
Vote-escrowed MLMA staking on Base. Aligns long-term protocol commitment with governance weight. Combined with the PONO credential, drives operator claims, treasury distribution, methodology approval, validator parameter changes, and revenue distribution through tiered governance thresholds.
Genesis Hex Node, field-deployed.
The Genesis Hex Node is a reference design, not a single irreplaceable enclosure. The protocol decomposes hardware into six subsystems and is designed to be component-agnostic at the subsystem level so the team can iterate on specific implementations without protocol changes. Reference instantiations target low-power embedded compute with 12+ months of autonomous off-grid uptime.
- · Low-power embedded compute platform
- · Hardware secure element with non-exportable signing keys
- · On-device identity provisioned at manufacture
- · Signing operations performed inside the secure element
- · Private key never leaves silicon
- · High-frequency environmental sensors (soil, atmospheric, optional gas-flux)
- · Configurable per methodology
- · Calibration state tracked in every signature
- · Sensor stack iterates without protocol change
- · Cellular backhaul for primary connectivity
- · Long-range wireless for distributed and rural deployment
- · Local wireless where available
- · Edge buffering for offline operation
- · Sequence continuity checks
- · Solar with multi-day battery reserve
- · 12+ months autonomous uptime
- · Weatherproof outdoor enclosure
- · Tamper-evidence subsystem
- · No grid power required
What gets signed.
Every device packet binds together identity, policy, time, geography, payload, sequence, firmware, and calibration into a single SHA-256 digest, then signs that digest with device-bound key material. The result is a record the protocol can defend on origin, integrity, continuity, and replay grounds.
Legacy audit vs. continuous verification.
| Metric | Legacy Manual | Mālama Reality Engine |
|---|---|---|
| Verification time | 12 to 24 months | Continuous, real-time |
| Verification cost | $5 to $40 per ton | Targeting single-digit dollars per ton at scale |
| Market access | High-cap projects only | Sub-acre and smallholder viability is a protocol target as sensor density grows |
| Data reliability | Subjective and periodic | Objective and continuous |
| Tamper-evidence | Procedural | Cryptographic at the device |
| Coverage logic | Convenience-driven | H3 zone-weighted |
From sensor to proof.
The Mālama dMRV cycle. Four steps from physical reality to on-chain certificate. The same pipeline serves carbon project sites and AI data centers. Hardware signs at the source. Hex Nodes validate. Cardano anchors. Proof of Truth issues.
Four steps. One chain of custody.
01 · Direct Sensor Capture
IoT sensors deployed at the source capture high-frequency environmental data. For carbon: hex nodes at biochar and enhanced rock weathering sites measure soil temperature, moisture, EC, pH, and atmospheric conditions. Forestry, soil carbon, and regenerative agriculture support are roadmap items. For AI compute: rack-form-factor signing devices measure electrical load per workload, plus cooling water and evaporation at the facility.
Every reading is signed inside the device's secure element before transmission. The signature exists before the data leaves the silicon. There is no software path to forge it.
02 · Edge Verification
Raw signed data is processed at the edge before transmission. The verification stack runs cryptographic, protocol, physical, spatial, temporal, and methodology checks in sequence. Statistical anomaly detection flags spoofed and physically implausible readings.
For AI compute, edge verification pairs power draw with real-time grid carbon intensity and cooling water evaporation at the facility. The same kilowatt-hour at 4 AM in Quebec and 4 PM in Texas carries different emissions weight. Edge verification captures that difference at the moment of measurement.
03 · Hex Node Consensus
Verified data is broadcast to the Mālama Hex Node network. Each Hex Node operates within an H3 geographic cell under a non-exclusive license encoded as an NFT-HEX rights object. Nodes perform decentralized validation, checking that the data packet matches protocol standards and that the device signature is valid against the on-chain device registry.
Validated readings are batched by region and methodology, bundled into Merkle trees, and persisted in immutable off-chain storage. Only the Merkle root is anchored to Cardano via a CIP-0068 reference NFT, with off-chain metadata schema aligned to CIP-0026. Validators operate under a PONO credential earned through operational milestones; fraudulent attestations result in PONO revocation and forfeiture of unvested operator rewards. The geographic consensus layer (H3 k-ring BFT attestation) makes the network Byzantine Fault Tolerant by construction.
04 · Proof of Truth
Once verified and committed, the data becomes a Proof of Truth certificate. For carbon: a SaveCard that feeds into LCO₂ pre-finance issuance and eventual VCO₂ verified credit conversion. For AI compute: a hardware-verified disclosure record formatted for SEC climate disclosure, EU CSRD, and SBTi reporting requirements.
Companies use these certificates for transparency and regulatory compliance. Registries integrate them into existing methodology workflows. Buyers verify them on chain without trusting any intermediary. The chain of custody from device signature to ledger record is publicly inspectable and cryptographically continuous.
Open data, open assumptions.
Mālama publishes every assumption that goes into the dMRV cycle with confidence levels. For the AI Energy dashboard at aipower.fyi, this means cited data sources with type badges, model assumptions with confidence ratings, full calculation formulas visible, and an open contribution form for researchers. If our numbers are wrong, the system makes it easy to tell us. That is the entire point.
10+ Data Sources
Every calculation references published research, vendor specifications, or peer-reviewed studies. Type badges identify whether each source is academic, vendor-supplied, regulatory, or community-contributed.
6 Model Assumptions
Each assumption is published with a confidence rating. Low confidence assumptions are explicitly flagged. Researchers can challenge any assumption through the contribution form.
Living Dataset
The aipower.fyi dataset is a public good. The contribution form accepts better data, alternative methodologies, and direct corrections. Improvements are versioned and attributed.