The Reality Engine.
A six-layer protocol architecture that takes a physical environmental signal from a sensor in the dirt to a registry-grade carbon credit on chain. Built for global scale, institutional integrity, and dual-chain coordination across Cardano and Base.
Six layers of provable truth.
The DePIN literature describes a five-layer architecture. Mālama extends it with two additional layers because geographic reward scaling and redemption are first-order determinants of network coverage and institutional usability in a hardware-based climate network. They are not details. They are protocol surface area.
Cardano for archival custody. Base for execution.
A climate-data network that serves both institutional archiving and market execution needs more than one blockchain property profile. Mālama separates long-horizon archival functions from faster execution and liquidity-facing functions. LayerZero OApp coordinates state across the two environments.
Cardano
Deterministic eUTXO model and Plutus smart contracts give registry-grade auditability. CIP-68 datum-metadata standards support richer asset state than simpler token patterns. CIP-25 covers media token metadata where useful.
- · SaveCard NFT minting
- · Long-horizon integrity anchoring
- · Datum-metadata for richer state
- · Institutional legibility
Base
EVM-compatible L2 for faster, lower-cost execution. Rewards distribution, claims, market-facing activity, and DeFi composability for LCO₂ pre-finance instruments. Bridges to the broader EVM liquidity layer.
- · Reward and claim execution
- · LCO₂ market-facing activity
- · EVM liquidity access
- · Faster transaction settlement
LayerZero's OApp interface coordinates state across Cardano and Base. Device data is anchored on Cardano. Economic state (rewards, claims, conversions) updates on Base. Acknowledgement and reconciliation flow back through the messaging layer. The two chains operate as a single coordinated state machine without forcing every protocol function into a single chain's tradeoff envelope.
H3 hex grid. Coverage follows climate value, not population.
Uniform rewards across all locations create predictable distortions. Dense urban regions saturate quickly because they are easier to access, while frontier zones with the highest climate relevance remain under-supplied. Mālama's reward scaling layer fixes this by partitioning the planet into H3 cells and applying zone-based reward and acquisition cost multipliers.
| Zone Type | Population Range | Max Nodes / Cell | Reward Multiplier |
|---|---|---|---|
| Urban | >1M | 20 | 0.5x |
| Dense Suburban | 100K to 1M | 5 | 1.0x |
| Rural | 10K to 100K | 2 | 1.5x |
| Frontier | <10K | 1 | 2.0x |
| Strategic / Extreme Gap | Sparse or critical | 1 | up to 3.0x |
Approximately 252.9 km² per cell. Approximately 2,016,842 unique cells globally. Resolution 5 balances regional granularity against governance manageability.
Where S = local saturation and Z = zone classification. Acquisition cost follows the same logic so scarce or strategic zones are not priced identically to dense urban cells.
Three primitives. Six layers.
The six-layer architecture is instantiated through three concrete protocol objects. Each one bundles the outputs of multiple layers into a unit that operators, validators, and institutional counterparties can transact with.
The Evidence Object
Practical implementation of hardware signing, verification, and oracle aggregation. A portable, cryptographically secured record pointing to hardware-signed and validated environmental data with a retrievable proof structure. The standard data primitive for the Mālama ecosystem.
The Geographic Right
Practical implementation of blockchain coordination and H3 reward scaling. Encodes geographic rights, capacity constraints, reward weighting, acquisition policy, and regional governance for a specific hex cell. Not a collectible. A regional rights and policy object.
The Governance Lock
Vote-escrowed MLMA staking. Aligns long-term protocol commitment with governance influence. Enables operator claims, treasury distribution, methodology approval, and validator set changes. Connects economic logic to operator and staker outcomes.
Genesis 300, field-deployed.
The Genesis 300 is a reference design, not a single irreplaceable enclosure. The protocol decomposes hardware into six subsystems. Specific sensor components are in active flux as field deployment evolves. Reference instantiations target ARM-based low-power compute with 12+ months of autonomous off-grid uptime.
- · ARM-based low-power compute (Pi class)
- · ATECC608B secure cryptographic co-processor
- · EEPROM-provisioned Device DID
- · Burned-in private key (manufacture-time)
- · Non-exportable from secure enclave
- · High-frequency environmental sensors (soil, atmospheric, optional gas-flux)
- · Configurable per methodology
- · Calibration state tracked in every signature
- · Cellular (LTE-M)
- · LoRaWAN long-range mesh
- · Wi-Fi where available
- · Edge buffering for offline operation
- · Sequence continuity checks
- · Solar UPS, multi-day battery reserve
- · 12+ months autonomous uptime
- · IP67 weatherproof enclosure
- · Tamper-evidence subsystem
- · No grid power required
What gets signed.
Every device packet binds together identity, policy, time, geography, payload, sequence, firmware, and calibration into a single SHA-256 digest, then signs that digest with device-bound key material. The result is a record the protocol can defend on origin, integrity, continuity, and replay grounds.
Legacy audit vs. continuous verification.
| Metric | Legacy Manual | Mālama Reality Engine |
|---|---|---|
| Verification time | 12 to 24 months | Continuous, real-time |
| Verification cost | $5 to $40 per ton | $2 per ton |
| Market access | High-cap projects only | Sub-acre and smallholders viable |
| Data reliability | Subjective and periodic | Objective and continuous |
| Tamper-evidence | Procedural | Cryptographic at silicon |
| Coverage logic | Convenience-driven | H3 zone-weighted |