The Story of the Tests

A note before we start: I'm not an economist. I'm one person who couldn't shake the feeling this could work — and couldn't prove it. The honest way to answer that wasn't a better argument; it was to try as hard as I could to break the idea, and to show you every place it broke. So that's what this is. When I say "we" on this page, I mean the effort this is becoming — I built it, but it gets sharper every time someone else attacks it, and you're invited into that "we."

Why you crash-test an economy

You can't crash a real airplane to find out where it's weak. So aerospace engineers build flight simulators and fly them into every storm they can imagine — engine out, ice on the wings, both at once — until the design either breaks or earns trust. We did the same thing to EDEN. We built a small artificial world inside a computer — a hundred thousand simulated people earning, creating, spending, and living under EDEN's rules — and then we spent months trying to make it crash. Droughts. Market collapses. Waves of fraud. Bank-run panics. Greedy heirs. Lazy incentives. A hostile auditor.

This is the story of those crashes — including the ones we caused, the ones we survived, and the places we had to redesign the plane.

Calling the shot

Crash №1
The bathtub — and our first failure

Picture the money supply as a bathtub. EDEN's original design had a faucet that never turns off — every hour anyone spends engaging with digital work mints new coins for its creator — and only a tiny drain (coins vanish when someone dies). Faucet always on, drain barely open: the tub fills. More money chasing the same groceries means grocery prices climb about 10% a year, forever. Meanwhile the poorest people's incomes climbed much slower. In the very first simulation, the bottom tenth couldn't afford essentials by month sixteen — and never recovered.

That was our design. Our baby. And the honest test broke it in a year and a half of simulated time. This is why you test.

Crash №1 in one picture — and the thermostat that fixed it.

The fix
The thermostat — and the rule that anchors everything

The repair matters because of what it isn't: it isn't a person, a committee, or a government office. It's a thermostat on the faucet. Nobody decides the temperature of your house each hour — a dumb, honest rule nudges the furnace. Same here: a formula written once into the system's constitution slows the coin-per-hour rate slightly whenever money is being created faster than real goods, and eases it back when it isn't. No chairman. No votes. In testing, this held grocery-price inflation at roughly zero for fifteen simulated years — through every storm we threw.

One more rule completes the core: humans mint, machines pay. When a person spends an hour with someone's work, new money is created for the creator — human attention is the only thing that prints. When an AI company or institution consumes a million people's data, it doesn't print anything; it must buy coins from people and pay them. Robots don't get free tickets to the show; they buy them from the audience. This one rule keeps the money supply tied to something no server farm can fake — human time — and turns every ordinary person's data into something institutions must pay them for.

Crash №2
Won't everyone just stop working?

Every guaranteed floor in history has faced this question, and it deserves a real answer, not a slogan. So we let our simulated people choose — work or don't, based on what actually pays.

Here we found our second real design flaw. The original floor "topped everyone up" to the line — which sounds generous until you notice what it does to a struggling musician earning 70% of the line: whether she keeps playing or quits entirely, she ends up at exactly the line. Her effort buys nothing. Imagine a bartender who fills every glass to the same height — anything you pour in yourself, he just pours that much less. Why pour? In the simulation, when essentials were expensive, half the lower earners rationally quit, and the economy lost up to a quarter of its output.

The fix is old, boring, and proven: the ramp instead of the cliff. Your guarantee at zero stays exactly the same — but every coin you earn adds half a coin on top of it, always. Pouring always raises your glass. Same dignity, and the simulated economy kept essentially all of its output. That's now the ratified design: effort is never, ever pointless.

Crash №2: same promise, different shape — the shape turned out to be everything.

The dead water the gardens

The oldest rule here — no one inherits a money machine — grew into something more beautiful under testing. When a creator dies, their work stays free for everyone, forever. It keeps earning when people use it — but the dead don't collect. Those earnings flow toward the people who have least. Every hour someone spends with the works of those who came before becomes bread for the living. In testing, this "ancestral dividend" turned out to be the safety net's single strongest funding source.

And the no-money-machine rule itself? We tested the sneaky version: what if heirs simply bought income streams with inherited cash? In a world where that's allowed, the grandchildren of today's winners are still on top five generations later about two-thirds of the time — nearly the same as today's economy (79%). Under EDEN's rule — income streams can be earned, never bought or inherited — that number falls to 10%, which is what a fair deck looks like: being born lucky stops predicting where you end up. We even tested the corporate loophole — hiding a dynasty inside an immortal company — and the defenses held there too. Since then it's been closed in ratified canon, down to the registry that enforces it: a company holds nothing without a living, accountable human anchored to it, the registration itself is the deed, and splitting into shells just gets you counted as one. One rule, and the escalator that automatically carries the same families upward becomes a staircase everyone can climb — the ones already high up keep their footing by continuing to contribute, not by coasting on an inheritance. Success stays wide open to newcomers instead of being locked to birth.

One rule carries the whole anti-dynasty result — so we attacked exactly that rule, from every angle we could invent.

Crash №3
The heist tests

Then we stopped playing defense and hired ourselves as thieves. Fake identities. Bot farms watching their own AI-generated videos to print money. Whole rings of rented accounts.

Two findings, one comforting and one that forced our third redesign. The comforting one: the floor never broke. Even in the absurd worst case — half of all identities fake, with zero fraud detection — the poorest real people stayed safely above the essentials line. The system fails gracefully: attackers steal from the system's efficiency, never from the poorest's bread.

The uncomfortable one: a smart thief — rotating freshly AI-generated content and "watching" it — could earn almost six times the floor per fake identity, and at scale, rings like that could capture a third of all new money, quietly bleeding honest creators. Our first fraud analysis had only imagined lazy thieves. The audit caught it; we redesigned.

Two locks closed the vault. First, the recipe punch card: the system already paid less each time you re-watched the same thing — but thieves just renamed the thing. Now near-identical content is recognized as the same recipe, no matter what it's called, and shares one shrinking payout. A xerox farm with a serial-number stamper gets paid like one asset, not ten thousand. Second, the security deposit: earning at scale requires posting a stake, and getting caught burns it — cheating stops being "free if undetected" and becomes a bet you lose. On top sits the quietest deterrent in the whole design: in EDEN you get one identity for life, and it's the most valuable thing you'll ever own. Renting it to a fraud ring risks permanent exile of your only economic self. When we re-ran the thief's business plan against all three locks, it didn't pay in a single tested case. The tunnel costs more than the vault holds.

The bank-run test

Could EDEN death-spiral like the infamous Terra collapse — a currency that fell to zero in a week when confidence broke? We simulated the same panic against both designs. Terra-style money was a sandcastle: its only value was everyone believing in it, so when belief ran, nothing remained. EDEN's coin has something underneath: machines and institutions must buy it to pay people for data. In the panic test, EDEN dipped about a quarter and climbed back. The honest fine print: that resilience holds while most coins are held by people using them; if EDEN's coin ever became mostly a casino chip — held overwhelmingly by speculators — it too could crater. Keeping real use dominant isn't a nice-to-have; it's a survival requirement, written into the design goals.

What it costs, honestly

Three numbers we will always say out loud. At launch, a floor can't pay for itself — a young network is like a lemonade stand promising pensions; in the closed-world models it needed outside funding for its first years, tapering as the network grew. Hiding that number is how projects die of embarrassment later; ours is on the label. Self-funding has a boundary: in those same models it held while essentials cost up to about 60% of a typical member's income — about 75% once the ancestral dividend matured — and beyond that it needed help. And whether people hoard the coin matters: our anti-hoarding levers work in the model, but how strongly they nudge real humans is something only a real pilot can measure. We wrote that down too.

The audit — or, why the scars are the proof

Near the end of the first wave, we did the thing advocacy projects never do: we handed everything to the most adversarial reviewer available with one instruction — break it. The audit re-ran every model from scratch (every number reproduced), then found what it was hunting for: a reserve fund coded eight times larger than its own description, a welfare model accidentally built on a too-equal world, fraud tests that had only imagined dumb attackers, and summary headlines rounder and prettier than the results beneath them. Every one of those is now fixed in the open — the flawed originals archived beside the corrections, like a captain's log that keeps the storm entries. Three claims came out weaker and truer. Two came out stronger than before. That's what earned trust looks like: not a spotless record, but a public record of every dent and every repair.

The second wave — the tests got harder

The audit was not the end; it was the moment the tests got harder. Everything above ran inside one closed world with prices we controlled. The second wave tore the roof off and let the real world in.

Real prices, and a job market nobody expected. We rebuilt the economy with actual market prices instead of our own — real data-licensing rates, real software spend, a real exchange rate that could crash. Most of the reassuring old numbers shrank, and the design got stronger for it, because now it was claiming less and proving it better. One genuinely new thing appeared: at even a fraction of what the world already spends on software, paying the people who maintain open-source tools becomes a real living — the unglamorous, unpaid backbone of modern software turning into a paycheck. That "builder economy" is now EDEN's strongest single result, because it fixes a problem that documentably exists today. Its honest dependency is also on the label: it holds only if institutions actually pay at plausible rates — the exact question the field experiment exists to settle.

The safety net, sold honestly. The harder tests retired the old "it pays for itself" story: across a realistic range of real-world demand, no floor activated without real outside funding. What replaced it is better because it's true — the floor doesn't need a magic funding source; it needs a customer. Delivering guaranteed basics through EDEN's rails came out about a quarter cheaper than traditional welfare, and — crucially — when we simulated the government funder walking away, nobody was left stranded: everyone landed back where they'd have been without it, never worse. That single result changes the ethics of ever running a real pilot. We also found the fragility: lean the whole net on one sponsor and their exit crashes the currency 92%. So we tested the fix — five sponsors, no one over 40%, each posting a deposit — and the 92% cliff became a 10% ripple nobody fell through. (Honest catch: "a quarter cheaper" is a calm-weather price; whoever agrees to catch a collapse should be paid for that promise.)

We stopped testing against dumb attackers. The adversarial wave threw smart, adapting attackers at the design. Three reassuring old claims died and were rewritten truer. Our "effort score" that supposedly tamed addictive content fell apart against an optimizing content farm — replaced by paying creators only when their work proves genuinely useful, backed by surprise audits that make cheating pay worse than honesty. Our claim that the currency only dips gently in a panic died against a leveraged attack across multiple exchanges — replaced by an honest new posture: under a determined financial assault the price can crash, but people's groceries are still delivered every single month, because the net is anchored to real essentials, not to the coin's price. Protect the people; concede the price. And the nightmare that a stolen fingerprint is forever? We ran the breach as a fire drill and found it survivable by design — compartments stay small, essentials keep flowing, and the real owner out-argues the thief because they have the body, the history, and the guardians they named on day one.

Then we scaled it to the whole planet. Forty regions, richest to poorest, one shared net. The scariest scenario — the poorest quarter of humanity joining in three years — held with zero breaches and zero printing, because an hour of attention mints the same money everywhere, so newcomers arrive as contributors, not just claimants. The wall the world hits first isn't money; it's consent — whether well-off regions will keep funding a net they rarely draw on. That's a political problem, not a math one, and we named it rather than hiding it.

And finally, the machine underneath. The newest tests stopped asking "do the rules work?" and started asking "does the engine that runs them hold?" We designed the ledger to be guarded not by whoever owns the most coins but by a lottery of verified people, like jury duty — and tried to pack the jury: the cheapest attack we could build costs about twenty times the scariest attacker we'd ever budgeted, and unlike ordinary crypto it doesn't get cheaper to attack when the price crashes, because real people don't go on sale. We tested the "notaries" who bundle everyone's activity and found that a one-week hold on fresh money plus occasional spot-checks makes cheating them a losing bet. We priced the heavy math that keeps it all honest and found it's a rounding error. And — keeping the tradition — where a test's own trustworthiness check failed, we filed it as provisional, not proof, and said so out loud.

We tried to bribe the price gauge. Everything above leans on one number: the measured price of essentials. So we priced corrupting it. The gauge reads three independent channels — bonded human reporters, bonded merchants, and the actual flow of grocery-lane commerce — and faking two of the three costs about $100 million to steal about $1 million: spend a hundred to take one. That flips the threat from thief to vandal — someone might pay to break the gauge, but nobody profits from it. Even when we granted the attacker the capture for free, the emergency brakes kept 96% of essentials flowing. Two bars failed honestly and taught us the real lesson: the weak point isn't the attack, it's how quickly we re-check the gauge. The live, prize-funded attempt to fool it for real remains a launch requirement, not a formality.

One crook in every uniform. Every heist test so far attacked one layer at a time — but a real adversary would wear every hat at once: fake registrar, fake validator, fake notary, fake price-reporter, all built on one pool of fake identities. Composed, the numbers move the wrong way: the combined attack costs a third less than the sum of the separate ones, and the damage from a stolen-identity breach compounds past the safety gate once downstream leverage counts. The fix was then measured, not assumed: one joint cap — no actor above 15% combined across all roles — pulls the compounded damage back inside the line. That cap is now proposed as its own live gate.

Can money buy the steering wheel? The house of governance that weights votes by contribution — can a whale just buy it? As designed, votes grow like the square root of contribution and hard-stop at 5% per actor: a whale holding 30% of all contribution ends up with about 1% of the vote, and a majority takes roughly 1,600 colluders, each of whom is still just one person among millions in the person-house next door. The run also caught a real flaw in our own rule as first written — under extreme concentration the cap leaked to 9.4% — and the corrected version holds it at exactly 5.00%. One honest wrinkle stays on the label: even governance ultimately leans on the identity keystone.

Then we checked the checkers. A fresh session with no memory of building any of this re-ran the whole vault: 49 of 54 programs regenerate their published numbers to the sixth decimal, and the handful that don't are explained down to the individual value — including one real bug that would have tripped an outside replicator, found, fixed, and re-verified in public. Every failed bar mentioned above is recorded in the files as a failure. The wind tunnel doesn't just claim its results; it hands you the keys to regenerate them.

What the second wave left open — on the label

Whether institutions will really pay for data and code (the true hinge — a field experiment, not a simulation). Whether a machine can reliably tell a live human from a convincing fake (the keystone under everything). Whether the price gauge survives a funded live attacker — the design-level attack is now priced at unprofitable-by-80×, but the real-world red-team is still owed. And the honest meta-point the audit taught us: everything here is still our machine checking our machine — every simulation so far was produced and checked by AI models from the same family. The one test we can't run on ourselves is a hostile outside expert trying to break all of it, which is why we built a replication kit to hand them — it's here, free to download: every model, every registered pass/fail bar, every archived original, and one command that re-runs the lot.

What these tests are — and aren't

A wind tunnel is not the sky. These models prove that EDEN's logic holds — that the rules, working together, produce the promised outcomes even under storms, thieves, and human nature, and that removing any one piece brings back a specific, nameable failure. They cannot prove that real humans will adopt it, that the identity technology performs at scale, or that the price-measuring system survives real-world manipulation. Those questions have names, published pass/fail criteria, and a pilot designed to answer them. We are not asking anyone to believe a forecast. We are showing them a machine that has survived every storm we could invent — and inviting them to invent a worse one.