blocksmith.
jonathan ledgard's thesis: markets price nothing wild, so wild things die. his fix is to let animals hold money — a gorilla's digital twin holds funds, human proxies spend on its behalf, and local people earn it by doing verifiable conservation work. blocksmith ran the blockchain workstream for the first pilot. this is that work.
rwanda pilot · volcanoes national park · shipped aug 2024
a poetic monetary idea had to survive a feature phone, a declined bank transfer and a governance stack that could not do arithmetic. i designed the identity, the payment rails and the governance that let it.
volcanoes national park
The work
identity & preference
four signals to one id — noseprints, faecal dna, tracker data, camera traps. dids for family structure, token-linked wallets for settlement.
payments & settlement
a three-rung settlement ladder ending in mobile money on a feature phone. payment off-chain, receipt on-chain.
governance minimisation
two tiers. below a threshold no vote at all; above it, a timelock a resourced expert panel can veto.
post-pilot concepts
tokenised land, a biodiversity-linked currency, parametric insurance — each tested against its comparison class.
case 01 / 08
a central-bank proposal built on crypto rails
the problem
an animal enters this economy at the moment a ranger, a camera trap or a tracker records it. everything downstream — the identity model, the governance design, the payment rails — begins there, and the scope held eight deliverables with one framing the rest: a recommendation for how the central bank of rwanda could hold a share of gorilla licence fees on the gorillas' behalf.
what i did
january: desk research on identity primitives, decentralised-identifier standards and dao voting mechanisms, then fieldwork in rwanda with rangers, trackers and co-operatives. february: architecture revised after the trip, with the three governance inputs split into separate channels instead of one weighted score. april: preference verification, governance minimisation and a payments review as one sprint. may: delivery locked to the october naming ceremony.
outcome
the pilot design settles into one shape — a single observation feeding three parallel tracks, with governance accepting or rejecting each payment proposal and rejected ones returning to the preference queue.
case 02 / 08
what the pilot had to prove
the problem
the public goal was economic agency for another species. the working goal was narrower: around 200 transactions moving money from a gorilla's wallet to a person's phone, each one technically and ethically sound.
what i did
treated it as a payments and verification problem. global conservation spending runs to $24bn a year and almost none reaches the people living beside the biodiversity, so the engineering question was the gap between those two goals.
outcome
the animal-as-account-holder frame earns its complexity in one specific way: it ties every payment to an observed biological state. a budget attached to a named gorilla resists mid-year re-scoping. two problems went on the record early and stayed open: the preference layer runs on human judgment, and rwandan law bars communities from the park, so rangers performed and verified every service — the pilot tested the payment infrastructure, not the behaviour change.
case 03 / 08
what belongs on-chain
the problem
a pay-for-nature system decomposes into seven parts — reference, custody, trigger, verification, authorisation, settlement, legibility. putting all of it on a ledger is a decision nobody had actually argued for.
what i did
placed two of the seven on the ledger, the identity reference and the audit trail, and kept the rest off it. three independent strands reached the same answer: field notes favoured minimal on-chain surface, the pitch architecture specified off-chain payments with on-chain receipts, and a survey of governance vendors found no tool that could evaluate a payment threshold on-chain.
outcome
identity carried the hard tension. the economic unit is the family, because preferences in gorilla society operate at family level, yet payment execution demands an individual wallet. the design settled on both — dids for structure, token-linked wallets for settlement.
case 04 / 08
where the design met physics
the problem
one line in the field notes set the entire upstream architecture: two of the seventy co-operatives around the park owned a laptop. network coverage clusters over the towns and thins toward the park boundary, which is exactly where the verification happens.
what i did
designed for a ussd session on a feature phone, where the phone number is the wallet address — no app, no browser, no seed phrase. evidence commits at the edge and reconciles later: hash each photo on the ranger's device, log the sync delay as part of the record, re-verify on upload, cross-check with a ranger from another district. the threat model is collusion radius, not individual honesty.
outcome
live testing exposed the real constraint. a bank declined transfers, two payments into wise bounced, and locating the failed leg took a swift confirmation from the sending bank. moving dollars into rwanda proved harder than any part of the on-chain design.
case 05 / 08
the unsolved problem
the problem
distribution past the co-op. device constraints forced payouts through one or two administrators per co-operative, and the existing tourism revenue share already reached only around half of co-op members, with amounts set by co-op density rather than need.
what i did
recorded it rather than closed it. an intermediated payout inherits the distribution of whatever intermediates it, and nothing in the pilot's device constraints removed the intermediary.
outcome
coverage clusters over the towns and thins toward the park boundary, which is where the verification happens — the map is the reason the design hashes evidence on the device and reconciles later.
case 06 / 08
less governance, by design
the problem
january's research surveyed the full dao voting toolkit — quadratic, conviction, futarchy, holographic consensus, reputation weighting. by april the productive question had changed: not which voting mechanism, but how little voting the system could run on.
what i did
built for credible neutrality through governance minimisation. two tiers — below a threshold, payment executes with no proposal, no vote, no signature; above it, the proposal passes after a timelock unless an allowlisted expert panel vetoes it. proposal creation is allowlisted too, closing the open-proposal attack surface. vendor diligence across four governance platforms confirmed threshold-conditional execution sat outside all of them, so policy checks moved to an external service.
outcome
conservation finance withholds payment until a claim is approved, putting the burden of proof on the party least equipped to carry it. this design pays first and gives a resourced panel the burden of objection — with two costs stated up front: the veto window only protects the fund while someone is watching, and neutrality covers execution alone.
case 07 / 08
the extension concepts, tested against the evidence
the problem
the post-pilot concepts specified minting in detail and contraction in a single sentence. no document designed the burn side. without automatic burn on degradation, driven by sensing outside the issuer's control, a biodiversity-linked currency inflates in one direction.
what i did
tested each concept against its comparison class rather than its pitch, then wrote the sequencing the evidence actually supports: ecological data products first — real buyers, no monetary mechanism required — then subsidised parametric insurance with index-decoupling risk priced in, then land tokenisation, and the currency last.
outcome
the incidence argument is the one that decided it. carbon-credit fraud dilutes the buyer; fraud in a mint-on-measurement currency dilutes every holder, including the communities whose staked land backs it.
case 08 / 08
what shipped
the problem
the 2021 concept imagined a new central bank, a purpose-built currency and an nft endowment. shipping meant deciding which of those a first pilot actually needed.
what i did
what launched is a trustee plus a payments api — execution off-chain, receipts on-chain, settlement over mtn mobile money, the architecture this workstream specified.
outcome
the pilot launched as tehanu nº.1 in august 2024, with around 20 gorillas enrolled in the first cohort. the first transaction paid a ranger for removing a snare from an infant gorilla named gisubizo. the design's own caveats reached print too: published critiques argue per-gorilla wallets exceed what micropayment routing requires, which is the tension the preference research recorded before launch.
research
the extension concepts were sold on forecasts, so i checked the forecasts
two evidence reviews behind the post-pilot recommendations: whether nature-based credit markets measure what they claim, and whether the instruments proposed as alternatives have ever cleared a real market.
whether carbon credits measure anything
what the meta-analysis found
the integrity gap is not a rounding error:
- under 16% of close to a billion credits studied in a 2024 meta-analysis represented real emission reductions
- redd+ claimed 10.7x more avoided deforestation than independent estimates support, and the gap came from counterfactual selection rather than satellite data
- the counterfactual is the product. you are not selling a measurement, you are selling a claim about a world that did not happen
why the reforms did not fix it
- each anti-gaming reform relocated discretion instead of removing it — jurisdictional baselines moved it into emission factors, edna moved it into sampling choices
- california's buffer pool spent a century of wildfire insurance in a decade, which is what a mispriced reserve looks like from the inside
- nobody in the market profits from finding the error. standard-setters earn fees per credit issued, so revenue rises with the quantity certified
why it mattered here. tokenised land and a biodiversity-linked currency both inherit this measurement problem, and a token makes it worse rather than better — fraud in a mint-on-measurement currency dilutes every holder, not just the buyer who chose to trust it.
whether the alternatives have ever cleared a market
biodiversity credits
the closest cousin to tokenised land, and the numbers do not meet:
- forecasts projected $2bn a year by 2030; under $1m had actually transacted by late 2024
- australia's statutory scheme reached year three with one methodology, two projects and zero certificates issued
- a statutory scheme with a government behind it is the best case, not the worst — which is what makes the number informative
parametric insurance
the instrument proposed as the near-term alternative, and its failure mode is specific:
- no unsubsidised smallholder index product has cleared the market in africa
- malawi's 2016 drought policy paid nothing during a declared famine, because the index tracked long-cycle maize while farmers had planted short-cycle
- index decoupling is the whole risk. the product pays on a proxy, so the proxy drifting from reality is not an edge case, it is the thing to price from day one
why it mattered here. this is what moved parametric insurance to second in the sequencing rather than first, and attached "subsidised, with index-decoupling risk priced from the start" to it — a recommendation the pitch deck would not have produced on its own.