Drafted with AI assistance, then checked and revised by the author. The judgements and the errors are the author’s. How this site is written sets out what is declared on every piece, who checks it, and where the per-piece record lives.
What each term means here, and what it decides.
Co-operative company. A company under New Zealand’s Co-operative Companies Act 1996, in which the people who transact with it hold control. Fonterra, Foodstuffs, FMG, Ravensdown and Farmlands are examples. The form is statutory and every lawyer and accountant here understands it.
What it decides: whether the terms can be changed against you by someone whose interests differ from yours.
Transacting member. An organisation that uses the co-operative, as distinct from one that has merely invested in it. Must hold not less than sixty per cent of voting rights.
What it decides: everything else. Without the floor, every other commitment is revisable by whoever accumulates shares.
Member share. In this design, an entitlement to a defined tranche of capability rather than a dollar value. The subscription price moves as hardware cost moves; the entitlement does not.
What it decides: whether membership becomes an investment that prices later members out. It also creates a dependency worth understanding — if hardware prices stop falling, the mechanism stops delivering.
Patronage. Participation in the co-operative. Conventionally this means purchase. Here it means purchase or contribution — accredited hours, expertise, a procedure another member uses — on equal terms.
What it decides: whether an organisation rich in knowledge and short of cash can join at all.
Cluster. A group of members sharing infrastructure. Regional, or organised around a shared purpose. Small enough that members recognise each other; large enough that the hardware is not idle.
Federation. Clusters connected to each other. In this design it enriches clusters and is never a dependency of them — a cluster cut off from the federation continues to work.
Secession. A cluster separating from the federation with its data intact and continuing to operate. Constitutional rather than contractual, exercised annually rather than asserted.
What it decides: whether the other promises are enforceable by the people they were made to. Any organisation can promise the first three. Only one that has demonstrated this has shown the promises hold.
Exit drill. The annual exercise that tests secession. Observed by a member. Result published whether it passes or fails.
Worth knowing: a first drill that passes cleanly means the checks were written to be passed.
Non-extraction. A bar on the co-operative deriving revenue from member data — no advertising, no brokerage, no third party paying for access. Constitutional, amendable only by the members it protects.
Heterogeneity. A requirement that clusters differ in hardware generation and model family. Deliberately more expensive than standardising.
What it decides: whether a single defect can take the whole federation down at once.
Complete state. Everything a cluster needs to operate alone — records, models, grants, provenance, configuration, history. Holding it everywhere costs more than centralising, and that premium is stated as its own line rather than absorbed.
Property, not method. Each capability says what must be true, never how to achieve it. This lets more than one design satisfy the specification and stops a supplier being written into the standard.
Verified by watching. Each is checked by observing it happen, not by reading a description. An assessor may require a demonstration; they may not require disclosure of how it is done.
Default deny. In the absence of an explicit permission, the answer is no. The opposite arrangement — permitted unless forbidden — fails open, which is how most incidents begin.
Failing closed. When a check cannot be performed, the action is refused rather than allowed. A permission system that grants access when its own records are unreachable has no permissions.
Substitutable inference endpoint. The ability to point software written for someone else’s AI service at a system you control instead.
What it decides: whether this addresses the AI you actually have — which mostly arrived inside applications you already bought — or only AI you deliberately chose.
Composition. Assembling a picture of a person from records they did not individually send. Barred here as an operation the operator cannot perform, rather than one it declines to.
Capital, once. What a member pays to install. Owned outright by them.
Sustaining, annually. What it costs to keep working. The line that ends projects, because it is the one nobody budgets.
Cost per site over five years. The figure everything ladders to. Not cost to build, not cost per member per month — five years, because year three is where arrangements like this fail and a one-year figure conceals exactly that.
Escalation rate. The share of work that reaches a person rather than being handled locally. The largest unknown in the design and the number to measure first.
Illustrative. Any figure so marked is invented to show the shape of an arithmetic. It is not an estimate, a quote or a finding. See What it costs, where every number carries the marker.
Not settled. Where the piece says something is a decision for you, it is not being coy. It means the answer depends on your circumstances and we have no standing to choose it.
What this publication does not claim, and what is outstanding against it in the register.
A question this rests on is parked: What counts as complete state for a cluster?
We do not claim a defined completeness boundary for cluster state; we claim the criteria in DEL-06 and nothing beyond them.
A question this rests on is parked: What secession premium will members bear?
We publish no pricing and no affordability claim, and we do not assert that members value the secession guarantee.
A question this rests on is parked: What do we do with an application that refuses to run inside the boundary?
We do not claim that a member's existing applications can be made to run inside the boundary. We claim only that the boundary reveals which ones cannot.
A question this rests on is open: Does secession capability actually convert a buyer?
Alongside: the publication · questions and answers · sources and provenance