Federation in Practice

What we built

Amberley is a town of 2,500 people in North Canterbury, New Zealand. Residents commute to Christchurch, 50km south. We built a community carpool for them.

The carpool runs at carpool.mysovereignty.digital on Catalyst Cloud infrastructure in Wellington, New Zealand. No data leaves New Zealand. No US services are involved — no AWS, no Google, no Cloudflare.

Members post rides they are offering. Others find rides that suit and join. Pickup points are community-defined locations — the supermarket car park, the school gate, the rugby club.

The koha model

This is not a ride-hailing service. There are no platform fees, no surge pricing, no transaction processing. Fuel contributions are voluntary — a koha between neighbours. The platform never asks for payment details and never takes a cut.

Koha is a Maori concept of reciprocity. A gift given without expectation of exact return. The right model for neighbours sharing rides.

Why this is federation

The Amberley carpool is one tenant on the Village platform. It has its own members, its own pickup points, its own data. No other community can see into it.

When Cheviot (30km north) gets a carpool, it will be a separate tenant. Separate members, separate data, separate control. But a ride from Cheviot to Christchurch passes through Amberley. Federation makes that ride visible to both communities — if both communities agree.

This is the federation model in practice:

• Each community controls its own data
• Cross-community visibility requires a bilateral agreement
• Either community can suspend or terminate at any time
• No centralised authority decides who sees what
• The same infrastructure handles messaging, video calls, and resource sharing

The infrastructure

The federation infrastructure is in production. It is the same system that connects Village communities for messaging and video calls. The carpool is a new application of existing capability.

Component	Status
Bilateral agreements (propose, approve, suspend, terminate)	Production
HMAC-authenticated server-to-server communication	Production
Federation cards (member discovery across communities)	Production
Cross-village direct messaging	Production
Three-tier dispute resolution	Production
Six agreement templates (peer, indigenous sovereignty, family, business, privacy-conscious, full partnership)	Production
Cross-community ride visibility	Next

What comes next

Neighbouring Canterbury towns — Cheviot, Rangiora, Kaiapoi — each get their own carpool tenant. Federation agreements between them enable cross-community ride visibility. A rider in Rangiora can see an Amberley driver's offer to Christchurch and join at a Rangiora pickup point.

The same pattern applies to any community resource. A conservation group in one region can federate with a conservation group in another to share sightings data. A parish in Germany can federate with a parish in France for cross-border events. Each controls its own data. Federation connects them on terms they both control.

Hosting

The carpool runs on Catalyst Cloud, a New Zealand-owned cloud provider. The production server runs on sovereign New Zealand infrastructure. A second server runs on OVH in France for European communities. Both run the same codebase.

Zero US cloud dependencies. No AWS, Azure, Google Cloud, Cloudflare, or any US-headquartered service in the stack. MongoDB with encryption at rest. ALTCHA proof-of-work for bot protection (replacing US-based hCaptcha). ProtonMail for email.

For reviewers

The federation codebase is approximately 2,800 lines of route handlers, 800 lines of service logic, and comprehensive data models including agreement lifecycle, dispute resolution, and federation templates. The carpool adds 520 lines of route handlers with geospatial search, seat management, and the koha model.

The platform runs nine product types (community, family, business, conservation, diaspora, clubs, alumni, whanau, carpool) on the same multi-tenant architecture, with product-specific vocabulary that adapts the interface without separate codebases.