The protocol

HU enters existence only through over-collateralised Vaults. A user locks collateral and may draw HU whose MCI-denominated value is at most the locked value divided by the collateral class's minimum ratio. Collateral is unrestricted in kind but tiered by risk.

The third class is the design's distinguishing feature, available only to a metabolically-defined unit: collateral correlated with the very quantity the MCI tracks. A rise in food or energy prices that lifts the MCI also lifts the value of the leg backing it. The correlation is partial, not perfect, and the leg's share of the Reserve is a governable band — initially targeted at one fifth to two fifths.

The Reserve is protocol-held, diversified backing. Because HU denominates a fixed energy quantity, the Reserve can hold energy- and dietary-commodity-linked claims, so it tends to strengthen exactly when the obligation it must meet grows. System-wide over-collateralisation is maintained above the sum of the per-class minima and widened automatically under stress, so the continuous invariant holds with room to spare:

HU outstanding × MCI ≤ Reserve value

The Metabolic Cost Index is the delivered market cost of the Functional Availability of one RHBD: the basal requirement rendered actually consumable at the point of human use. That bundle is the Metabolic Reference Basket, whose composition is fixed like the kilogram's; only its priced value floats.

The MCI is produced by a decentralised oracle network rather than a single feed, because control of the index is control of the unit. Reporters submit priced observations; the protocol takes the median; the basket and computation are published so any party can reproduce the figure and challenge a deviant report. If reporters diverge beyond a threshold or a feed goes stale, the index freezes at its last valid value and new minting tightens.

Two mechanisms hold the market price of HU to the MCI. The first is open mint-and-redeem arbitrage. The second is a non-discretionary redemption-rate controller, of the kind proven by the RAI reflexer asset. Let the error be the fractional deviation of market price from index, e = (P_market − MCI) / MCI. The controller sets a redemption rate:

$$r=-(K_p·e+K_i·\int e\mathrm{dt}+K_d·\frac{\mathrm{de}}{\mathrm{dt}})$$ r equals minus, open parenthesis, K sub p times e, plus K sub i times the integral of e with respect to t, plus K sub d times the derivative of e with respect to t, close parenthesis.

When HU trades persistently above the index the rate turns negative; when it trades below, the rate turns positive and the incentives reverse. The gains are governable parameters, not monetary policy. There is no uncollateralised issuance and no algorithmic seigniorage; capital efficiency is deliberately traded for solvency.

Optional metabolic demurrage. Because the reference human dissipates 82.3 W whether or not money moves, the protocol may levy a small carrying charge on idle balances. It is disabled by default.

If a Vault breaches its minimum ratio it is liquidated: its collateral is auctioned for HU, the drawn HU is burned to retire the debt, and the liquidation penalty is added to the surplus buffer. Auctions are permissionless.

Three reserves of strength stand behind the peg, drawn upon in order:

1. Per-Vault over-collateralisation absorbs ordinary price moves.
2. The surplus buffer — accumulated stability fees and penalties — absorbs liquidation shortfalls before any holder is touched.
3. The HMG recapitalisation backstop: HMG is minted and sold, diluting governance holders rather than HU holders.

This aligns the people who govern the parameters with the people who bear the tail risk of getting them wrong. The residual risk is stated plainly here →

Every tunable parameter lives on-chain and changes only when voting conditions are met; there is no foundation key and no upgrade dictator. The parameters that define the unit itself are walled off at the highest threshold, because they are the meaning of every HU in existence.