> For the complete documentation index, see [llms.txt](https://ga.orilife.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ga.orilife.io/annex-b.md).

# Annex B

## Legal & Compliance Context

### OriLife Platform: Legal Framework, International Compliance & Intellectual Property

Document: Annex B — Legal & Compliance Context 

Version: v4.1 

Updated: April 2026 

Reference: GS-ORILIFE-GA-01 

Proposer: Nguyen Hung Son— DDC Holdings, Dak Lak 

Status: Public — Attached to Governance Action

Disclaimer: This document is informational, not legal advice. The Proposer is responsible for full compliance with all applicable regulations.

### 1. Overview — Why Legal Context Is OriLife's Advantage

OriLife operates at the intersection of five legal systems directly affecting the Dak Lak durian supply chain for global export: Vietnam, China, the European Union, the United States, and Japan.

Core Thesis: OriLife is not a voluntary solution. It is a solution mandated by at least 4 legal systems simultaneously — with hard deadlines that cannot be extended. No existing market solution addresses all of these requirements on a unified platform.

Significance for dReps: A YES vote means the Cardano community invests in a project that the market is required to adopt — not a startup that can be eliminated by market forces. Legal deadlines create mandatory demand, independent of marketing or voluntary adoption.

### 2. Vietnamese Legal Framework

#### 2.1 Decision 1236/QĐ-TTg — National Blockchain Strategy

<table data-header-hidden><thead><tr><th width="202.4609375"></th><th></th></tr></thead><tbody><tr><td>Field</td><td>Detail</td></tr><tr><td>Number</td><td><a href="https://vanban.chinhphu.vn/?pageid=27160&#x26;docid=211462">1236/QĐ-TTg</a></td></tr><tr><td>Source</td><td><a href="https://vanban.chinhphu.vn/?pageid=27160&#x26;docid=211462">https://vanban.chinhphu.vn/?pageid=27160&#x26;docid=211462</a></td></tr><tr><td>Issuing Authority</td><td>Prime Minister of Vietnam</td></tr><tr><td>Year</td><td>2024</td></tr><tr><td>Scope</td><td>National blockchain strategy for 2024–2030</td></tr></tbody></table>

Relevant Content: Assigns the Ministry of Agriculture and Environment to research and apply blockchain in plantation management and agricultural traceability. Priority deployment in 2024–2026 for key products and OCOP products.

Significance for OriLife: OriLife is executing a mission assigned by the Vietnamese Government — not experimenting with an idea. This is a critical distinction when evaluating adoption risk.

Significance for Cardano: If OriLife is selected as 1 of 5 national strategic platforms, Cardano becomes the blockchain officially used by a government in agriculture — a first-of-its-kind milestone.

####

#### 2.2 Resolution 57-NQ/TW — Politburo Directive

<table data-header-hidden><thead><tr><th width="113.078125"></th><th></th></tr></thead><tbody><tr><td>Field</td><td>Detail</td></tr><tr><td>Number</td><td>57-NQ/TW</td></tr><tr><td>Source</td><td><a href="https://xaydungchinhsach.chinhphu.vn/toan-van-nghi-quyet-ve-dot-pha-phat-trien-khoa-hoc-cong-nghe-doi-moi-sang-tao-va-chuyen-doi-so-quoc-gia-119241224180048642.htm">https://xaydungchinhsach.chinhphu.vn/toan-van-nghi-quyet-ve-dot-pha-phat-trien-khoa-hoc-cong-nghe-doi-moi-sang-tao-va-chuyen-doi-so-quoc-gia-119241224180048642.htm</a></td></tr><tr><td>Authority</td><td>Politburo — Central Committee</td></tr><tr><td>Level</td><td>Highest-level strategic document</td></tr></tbody></table>

Relevant Content: AI and Blockchain are identified as national strategic technologies to be mastered. Agriculture tops the priority list for smart production.

Strategic Significance: Resolution 57 creates a political corridor at the highest level. This is not a ministry-level policy that can change with personnel rotation — it is a Politburo directive, stable across multiple terms.

#### 2.3 Decision 5272/QĐ-BNNMT — Durian Traceability Pilot

<table data-header-hidden><thead><tr><th width="185.36328125"></th><th></th></tr></thead><tbody><tr><td>Field</td><td>Detail</td></tr><tr><td>Number</td><td>5272/QĐ-BNNMT</td></tr><tr><td>Source</td><td><a href="https://mae.gov.vn/Pages/chitietvanbandh.aspx?ItemID=3451">https://mae.gov.vn/Pages/chitietvanbandh.aspx?ItemID=3451</a></td></tr><tr><td>Issuing Authority</td><td>Ministry of Agriculture and Environment</td></tr><tr><td>Date Issued</td><td>December 13, 2025</td></tr><tr><td>Scope</td><td>Durian Traceability Pilot</td></tr><tr><td>Pilot Period</td><td>January 1 – June 30, 2026</td></tr><tr><td>Summary Date</td><td>July 10, 2026</td></tr><tr><td>Expansion</td><td>Nationwide by end of 2026</td></tr></tbody></table>

Relevant Content: On April 4, 2026, the first shipment was exported via the Green Lane process — but still uses physical labels that can be peeled and re-attached. OriLife solves the weakness that the government's current plan has not yet addressed: biological identification directly on the product, no labels needed.

Significance for OriLife: This is an opportunity to demonstrate value superior to the traditional labeling system during the national pilot. If successful, OriLife will be a strong candidate for the nationwide expansion at end of 2026.

#### 2.4 Summary of Vietnamese Legal Documents

<table data-header-hidden><thead><tr><th width="211.3125"></th><th></th><th></th><th></th></tr></thead><tbody><tr><td>Document</td><td>Authority</td><td>Relevant Content</td><td>Impact on OriLife</td></tr><tr><td>Decision 1236/QĐ-TTg (2024)</td><td>Prime Minister</td><td>Blockchain for plantation &#x26; OCOP 2024–2026</td><td>OriLife is the implementation vehicle</td></tr><tr><td>Resolution 57-NQ/TW</td><td>Politburo</td><td>AI + Blockchain as strategic tech, Agriculture priority #1</td><td>Highest political corridor</td></tr><tr><td>Decision 5272/QĐ-BNNMT (2025)</td><td>Ministry of Ag &#x26; Env</td><td>Durian traceability pilot 01/01–30/6/2026, expand end 2026</td><td>OriLife solves physical label weakness</td></tr><tr><td>Circular 11/2026/TT-BCT</td><td>Ministry of Industry &#x26; Trade</td><td>Mandatory traceability connection from 01/12/2026</td><td>Hard legal deadline</td></tr><tr><td>Food Safety Law 55/2010</td><td>National Assembly</td><td>Food traceability responsibility</td><td>Legal foundation</td></tr><tr><td>Product Quality Law 78/2025/QH15</td><td>National Assembly</td><td>Product quality standards revision</td><td>Legal basis for pilot decisions</td></tr><tr><td>Cybersecurity Law 116/2025/QH15 (effective July 1, 2026)</td><td>National Assembly</td><td>Vietnamese user data stored in Vietnam; foreign service providers must establish local presence</td><td>LampNet Sovereign Data Residency — compliant with new law effective during all OriLife deployment phases</td></tr><tr><td>Decree 13/2023/NĐ-CP</td><td>Government</td><td>Personal data protection</td><td>PhoenixKey + end-to-end encryption</td></tr></tbody></table>

***

### 3. Circular 11/2026/TT-BCT — Deadline December 1, 2026

#### 3.1 Document Information

<table data-header-hidden><thead><tr><th width="189.87109375"></th><th></th></tr></thead><tbody><tr><td>Field</td><td>Detail</td></tr><tr><td>Number</td><td>11/2026/TT-BCT</td></tr><tr><td>Source</td><td><a href="https://chinhphu.vn/?pageid=27160&#x26;docid=217126&#x26;classid=0">https://chinhphu.vn/?pageid=27160&#x26;docid=217126&#x26;classid=0</a></td></tr><tr><td>Authority</td><td>Ministry of Industry and Trade, Vietnam</td></tr><tr><td>Date Issued</td><td>February 27, 2026</td></tr><tr><td>Effective Date</td><td>April 16, 2026</td></tr><tr><td>Mandatory Deadline</td><td>December 1, 2026</td></tr><tr><td>Scope</td><td>All commercial food production and business establishments</td></tr></tbody></table>

#### 3.2 Directly Relevant Articles

Article 3 — Traceability Code:

The Circular defines a traceability code as "the final identification code at each stage, encoded in a data carrier." OriLife's Bio-ID is precisely that identification code — but the data carrier is the durian fruit itself (biological skin texture), not a physical label. This approach complies with the Circular's definition while eliminating the possibility of forgery.

The Circular also requires a "one step forward — one step back" principle: each stage must link to the previous and next stages. VeData ensures this continuity: Tree Registration → Cultivation Log → Fruit Registration → Harvest → Transfer → Processing → Export. Each step has a cryptographic link to the step before and after, impossible to break.

Article 5 — Mandatory Stored Information:

| Circular 11 Requirement                | OriLife Delivers Via                         |
| -------------------------------------- | -------------------------------------------- |
| Name, address, facility code           | PhoenixKey DID — decentralized identity      |
| Product name and images                | Bio-ID + raw images on LampNet               |
| Identification code, traceability code | Farm NFT + Bio-ID on Cardano Mainnet         |
| Weight, quantity, batch code           | FarmDatum batch\_sequence + Merkle Tree      |
| Location, event timestamp              | GPS coordinates + digitally signed timestamp |

Article 6 — Record Retention and Provision:

The Circular requires minimum 12-month retention and record provision within 24 hours. OriLife exceeds requirements: Cardano Mainnet stores immutably forever (not 12 months). API Gateway responds in seconds (not 24 hours).

Article 14 — Cross-agency Connection:

The Circular requires the system to connect with domestic and international databases. OriLife's Compliance Adapter SDK exports GS1 EPCIS v2.0 and GACC — standards that Vietnam's Ministry of Public Security, Ministry of Health, Ministry of Agriculture, and Chinese Customs can all read natively.

Article 15 — Hard Deadline December 1, 2026:

All food production establishments must connect to the Traceability System from December 1, 2026. OriLife's timeline completes M7 (Mass Rollout) by October 2026 — operational for at least 2 months before the deadline.

#### 3.3 Consequences of Non-Compliance

| Violation                                  | Consequence                                 |
| ------------------------------------------ | ------------------------------------------- |
| No connection after 01/12/2026             | Product recall ordered                      |
| Failure to provide records within 24 hours | Administrative fines + operations suspended |
| Untruthful traceability data               | Criminal prosecution                        |
| Export without GACC compliance             | Shipment rejected at Chinese port           |

***

### 4. Chinese Standards — GACC

#### 4.1 Overview

The General Administration of Customs of China (GACC) controls all agricultural imports into China. China accounts for >90% of Vietnam's durian export revenue ($3.36 billion USD). Orders 248 & 249 (effective 2022, tightened 2024) govern production facility registration and imported food safety management.

####

#### 4.2 Requirements and OriLife Response

| GACC Requirement                        | OriLife Delivers Via                 |
| --------------------------------------- | ------------------------------------ |
| Registered plantation code verification | Farm NFT on Cardano                  |
| Packing facility code                   | PhoenixKey DID of the enterprise     |
| Certificate of Origin                   | Merkle Proof on-chain                |
| Phytosanitary certificate               | VeData evidence trail                |
| Residue control (Cadmium, Auramine O)   | Immutable cultivation log on LampNet |

#### 4.3 Lessons from the 2025 Scandal

The 2025 durian scandal ([source](https://vnexpress.net/gan-2-000-container-sau-rieng-xuat-khau-mac-ket-vi-tam-ngung-xet-nghiem-4955678.html)) — 17 individuals prosecuted, 55+ plantation codes revoked, 2,000 containers stuck — is direct evidence that the current traceability system (QR labels, paperwork) has completely failed.

Root Cause: Fraud occurred because the data carrier (label) can be separated from the product. DDC Holdings experienced this firsthand with legacy TonFarm (see Annex A, Section 1). When Bio-ID is the fruit's own skin, there is no way to fake the origin.

#### 4.4 Midnight View Key for GACC

Export enterprises share a View Key with Chinese Customs:

<table data-header-hidden><thead><tr><th width="269.23046875"></th><th></th></tr></thead><tbody><tr><td>Chinese Customs with View Key</td><td>Result</td></tr><tr><td>CAN verify</td><td>Origin, harvest date, GACC code, phytosanitary</td></tr><tr><td>CANNOT see</td><td>Contract price, detailed quantities, buyer identity</td></tr><tr><td>CANNOT see</td><td>Information about other shipments from the same company</td></tr></tbody></table>

This is a real-world business requirement — no existing blockchain solution simultaneously provides customs transparency and commercial confidentiality. Midnight on Cardano is the only primitive that solves this.

***

###

### 5. European Union Standards — EUDR & Food Safety

#### 5.1 EUDR — EU Deforestation Regulation

<table data-header-hidden><thead><tr><th width="180.3515625"></th><th></th></tr></thead><tbody><tr><td>Field</td><td>Detail</td></tr><tr><td>Number</td><td>EU 2023/1115</td></tr><tr><td>Applicable From</td><td>Late 2025 (large enterprises), 2026 (SMEs)</td></tr><tr><td>Scope</td><td>Deforestation-risk commodities: timber, cattle, cocoa, coffee, palm oil, rubber, soy</td></tr></tbody></table>

Why Relevant: Dak Lak is Vietnam's coffee capital. Coffee export revenue $8.4 billion USD (2024), EU share 46.7%. While the MVP focuses on durian, OriLife SDK can expand to coffee — EUDR creates a massive B2B SaaS market (see M8 in GA).

| EUDR Requirement                          | OriLife Delivers Via                            |
| ----------------------------------------- | ----------------------------------------------- |
| Geographic coordinates (polygon) per plot | GPS boundary in FarmDatum                       |
| No deforestation after 31/12/2020         | LampNet Sovereign Data Proof + signed timestamp |
| Verifiable due diligence                  | Immutable audit trail on-chain                  |
| Land use legality                         | PhoenixKey DID linked to legal records          |

#### 5.2 EU Food Safety

| Requirement                      | OriLife Response                                    |
| -------------------------------- | --------------------------------------------------- |
| Farm-to-fork traceability        | Full audit trail via VeData                         |
| Record retention ≥12 months      | Cardano Mainnet — immutable forever                 |
| Record provision within 24 hours | API Gateway 24/7, response in seconds               |
| Traceability to batch level      | Traceability to individual fruit (Bio-ID per fruit) |

***

###

### 6. United States Standards — FSMA 204

| Field     | Detail                                      |
| --------- | ------------------------------------------- |
| Full Name | Food Safety Modernization Act — Section 204 |
| Authority | FDA, United States                          |
| Deadline  | January 2026 (large enterprises)            |

#### Core Requirements

Traceability Lot Code (TLC): Each batch must have a unique traceability code throughout all stages.

Critical Tracking Events (CTE): Record events: Harvesting, Cooling, Initial Packing, Shipping, Receiving.

24-hour Rule: When FDA requests, complete CTE records must be provided within 24 hours.

| FSMA 204 Requirement  | OriLife Delivers Via                              |
| --------------------- | ------------------------------------------------- |
| Traceability Lot Code | Bio-ID = natural TLC, impossible to forge         |
| Harvesting CTE        | Harvest module — auto-capture at cutting          |
| Shipping CTE          | Compliance Adapter SDK records transfer events    |
| 24-hour records       | Cardano on-chain + realtime API                   |
| Interoperability      | GS1 EPCIS v2.0 export compatible with FDA systems |

Market Significance: The US is a large untapped durian market, hindered by FSMA barriers. OriLife creates infrastructure for Vietnam to enter the US market.

***

### 7. International Standards — GS1 EPCIS v2.0 & ISO 22005

#### 7.1 GS1 EPCIS v2.0

GS1 EPCIS is the common language for the entire global food supply chain. Used by: Walmart, Carrefour, AEON, Amazon Fresh, and customs agencies in EU/US/Japan/Korea.

Version 2.0 (latest, adoption from 2024) adds:

| New Feature             | Significance for OriLife                           |
| ----------------------- | -------------------------------------------------- |
| JSON-LD alongside XML   | Native REST API, easy web integration              |
| W3C EPCIS Ontology      | Linked Data for cross-system queries               |
| Digital Link (QR → URI) | Scan directly to on-chain data                     |
| Blockchain anchoring    | Official provision supporting blockchain anchoring |

OriLife Compliance Adapter SDK exports GS1 EPCIS v2.0 with blockchain proof verifiable on Cardano Explorer — compatible with GS1's official blockchain anchoring provision.

#### 7.2 ISO 22005 — Food Traceability

| ISO 22005 Principle     | OriLife Mapping                        |
| ----------------------- | -------------------------------------- |
| Object identification   | Bio-ID as unique biological identifier |
| Information recording   | VeData audit trail                     |
| Information linkage     | Merkle Tree on Cardano                 |
| Traceability capability | Cardano API + Compliance SDK           |
| System verification     | IOB milestone review                   |

### 8. Japanese Standards — JAS & MRL

Japan is a high-potential premium durian market. Quality requirements are extremely stringent — higher than EU and US. Japanese consumers are willing to pay the highest premiums for products with transparent traceability.

#### JAS (Japanese Agricultural Standard)

| JAS Requirement                 | OriLife Delivers Via                    |
| ------------------------------- | --------------------------------------- |
| Detailed cultivation log        | VeData evidence trail with photos/video |
| Fertilizer types used           | Immutable cultivation log on LampNet    |
| Pesticides (name, date, dosage) | VeData records, signed at source        |
| Seed origin                     | Farm NFT metadata                       |

#### MRL — Maximum Residue Limits

Japan's MRL thresholds are significantly lower than Codex Alimentarius (e.g., Chlorpyrifos 50× lower, Cypermethrin 40× lower). Immutable cultivation logs on LampNet help farmers prove they did not use restricted substances — rather than just proving "below threshold."

***

### 9. Consolidated Compliance Matrix

#### OriLife Meets 9/9 Standards

<table data-header-hidden><thead><tr><th width="120.7890625"></th><th width="185.19140625"></th><th width="285.51171875"></th><th width="95.28125"></th><th></th></tr></thead><tbody><tr><td>Market</td><td>Standard</td><td>Core Requirement</td><td>OriLife</td><td>Status</td></tr><tr><td>Vietnam</td><td>Decision 1236/QĐ-TTg</td><td>Blockchain for plantations 2024–2026</td><td>✅</td><td>Exceeds</td></tr><tr><td>Vietnam</td><td>Circular 11/2026/TT-BCT</td><td>BCT Portal connection from 01/12/2026</td><td>✅</td><td>Met (M3)</td></tr><tr><td>China</td><td>GACC (Orders 248/249)</td><td>Plantation code, phytosanitary, batch</td><td>✅</td><td>Met (M4)</td></tr><tr><td>EU</td><td>EUDR</td><td>GPS polygon, deforestation-free</td><td>✅</td><td>Met</td></tr><tr><td>EU</td><td>EU Food Safety</td><td>Farm-to-fork, ≥12 months retention</td><td>✅</td><td>Exceeds</td></tr><tr><td>US</td><td>FSMA 204</td><td>Traceability Lot Code, 24h records</td><td>✅</td><td>Met</td></tr><tr><td>International</td><td>GS1 EPCIS v2.0</td><td>ObjectEvent, blockchain anchoring</td><td>✅</td><td>Met (M5)</td></tr><tr><td>International</td><td>ISO 22005</td><td>Food traceability system</td><td>✅</td><td>Met</td></tr><tr><td>Japan</td><td>JAS + MRL</td><td>Cultivation log, ultra-low residues</td><td>✅</td><td>Planned M8 expansion</td></tr></tbody></table>

####

#### Comparison with Existing Solutions

| Solution                             | QĐ 1236 | CT11    | GACC    | EUDR | FSMA    | GS1 v2.0 | ISO     | EU FS   | JAS     | Total |
| ------------------------------------ | ------- | ------- | ------- | ---- | ------- | -------- | ------- | ------- | ------- | ----- |
| OriLife                              | ✅       | ✅       | ✅       | ✅    | ✅       | ✅        | ✅       | ✅       | ✅       | 9/9   |
| Standard QR labels                   | ❌       | Partial | Partial | ❌    | ❌       | Partial  | ❌       | Partial | ❌       | 0–3/9 |
| Blockchain + labels (legacy TonFarm) | ❌       | Partial | Partial | ❌    | Partial | Partial  | Partial | Partial | Partial | 1–4/9 |
| Blockchain without AI                | ❌       | Partial | Partial | ❌    | Partial | Partial  | Partial | Partial | Partial | 1–4/9 |

Conclusion: No existing market solution simultaneously meets all 9 standards on a unified platform. OriLife achieves 9/9 through a combined architecture of AI vision (label-free Bio-ID) + Cardano eUTXO (batch O(1)) + Midnight (commercial privacy) + VeData (5-layer validation).

### 10. Intellectual Property — Protection Portfolio

#### 10.1 Vietnamese Copyright

<table data-header-hidden><thead><tr><th width="171.0390625"></th><th></th></tr></thead><tbody><tr><td>Field</td><td>Detail</td></tr><tr><td>Work</td><td>"Digitizing Agricultural Assets in Vietnam's Central Highlands Using Blockchain Technology"</td></tr><tr><td>Certificate No.</td><td>4420/2025/QTG</td></tr><tr><td>Date Issued</td><td>June 2, 2025</td></tr><tr><td>Authority</td><td>Copyright Office — Ministry of Culture, Sports and Tourism</td></tr><tr><td>Author / Owner</td><td>Nguyễn Văn Chinh (DDC Holdings)</td></tr></tbody></table>

This copyright confirms DDC has been researching and deploying blockchain in agriculture in Vietnam's Central Highlands since 2024 — the knowledge foundation inherited by OriLife.

#### 10.2 USPTO Provisional Patent Applications

Four PPAs protect the entire tech stack. PPAs establish a Priority Date — the date GreenSun Tech formally claims ownership. Within 12 months, a Non-Provisional can be filed for full 20-year protection.

<table data-header-hidden><thead><tr><th width="147.08203125"></th><th width="128.41015625"></th><th width="107.8671875"></th><th></th></tr></thead><tbody><tr><td>Invention</td><td>USPTO #</td><td>Filing Date</td><td>Protection Scope</td></tr><tr><td>OriLife Platform</td><td>#64/030,398</td><td>April 6, 2026</td><td>Label-free biological identification, AI edge, harvest protocol</td></tr><tr><td>PhoenixKey</td><td>#64/031,291</td><td>April 6, 2026</td><td>Hardware key management, app delegation, DID recovery</td></tr><tr><td>LampNet</td><td>#64/031,472</td><td>April 7, 2026</td><td>Distributed storage, data sovereignty, multi-layer encryption</td></tr><tr><td>VeData</td><td>#64/032,593</td><td>Pending</td><td>Multi-tier validation, blockchain batching, trust scoring</td></tr></tbody></table>

Applicant: GreenSun Tech. Filed by: Nguyen Thi Kim Ngan.

Significance for Cardano Treasury: Technology with legal IP protection is original IP. If competitors copy the architecture after the PPA filing date, GreenSun Tech has legal recourse. Cardano Treasury is funding technology with legal protection — not a fork or adaptation.

### 11. Cybersecurity Law — Data Sovereignty

#### Requirements

Cybersecurity Law 116/2025/QH15 (effective July 1, 2026, replacing Cybersecurity Law 24/2018), Article 25.3: Enterprises providing online services in Vietnam must store Vietnamese user data domestically. Foreign enterprises must additionally establish a branch or representative office in Vietnam.

Timing advantage: All OriLife deployment milestones (M4–M8: July–November 2026) operate entirely under this new framework — not the expired 2018 law. OriLife is designed for the current legal environment, not a transitional one.

OriLife data qualifies as "important": farmer identification (DID, biometric hash), agricultural production data (location, yield), export and supply chain information.

#### Two-Layer Solution

Layer 1 — Cardano: Stores only Root Hash (32 bytes) — no personal or production information. Does not violate domestic storage requirements as there is no PII on-chain.

Layer 2 — LampNet: Actual data (images, video, metadata) stored on LampNet nodes with priority for Vietnam-based nodes. Has an on-chain mechanism to prove storage location (Sovereign Data Residency Proof) — compliant with Decision 1236/QĐ-TTg.

LampNet's domestic node priority and Sovereign Data Residency Proof mechanism satisfies both the data localization requirement (Article 25.3) and the traceability requirement (Article 25.2d) of Luật An ninh mạng 116/2025/QH15 — making OriLife fully compliant with the cybersecurity framework in force throughout its entire deployment period.

#### Compliance with Decree 13/2023 — Personal Data Protection

<table data-header-hidden><thead><tr><th width="276.27734375"></th><th></th></tr></thead><tbody><tr><td>Requirement</td><td>OriLife Response</td></tr><tr><td>Consent before collection</td><td>Onboarding flow: explicit consent screen</td></tr><tr><td>Clear collection purpose</td><td>Used only for traceability</td></tr><tr><td>Access / deletion rights</td><td>PhoenixKey manages permissions; soft delete</td></tr><tr><td>Data security</td><td>End-to-end encryption on LampNet; hardware keys</td></tr><tr><td>No overseas transfer</td><td>Sovereign Data Residency policy</td></tr><tr><td>AI-generated content prohibition</td><td>PhoenixKey biometric authentication is not generative — it verifies, not creates. Compliant with Article 7.2g of Cybersecurity Law 116/2025/QH15 prohibiting AI deepfakes</td></tr></tbody></table>

***

### 12. Open Source and IP Protection Strategy

Clear Classification

OPEN SOURCE — MIT License (from M5)

Published for transparency and user asset sovereignty. Any independent party can verify that user keys, data ownership, and recovery mechanisms work as described — no trust required.

* FarmDatum Smart Contract (Aiken) — full source, auditable
* PhoenixKey Key Management SDK — key generation, delegation, and recovery flows only; biometric matching core is excluded
* Wallet recovery tools — seed phrase derivation, DID resolution
* API Gateway Documentation + OpenAPI Spec

OPEN FOR INTEGRATION — Restricted License (from M5)

Interfaces published to enable third-party applications to build on OriLife infrastructure and participate in the MAGIC economy. SDK calls consume MAGIC credits — expanding the ecosystem without exposing core IP.

* OriLife Edge SDK — Bio-ID registration and verification interface (not the underlying algorithm)
* Compliance Adapter SDK — GACC + GS1 EPCIS v2.0 export
* LampNet Storage SDK — CID pinning and retrieval interface
* CID Subscription API — WebSocket push integration

PROPRIETARY — Protected by USPTO PPAs

Core technology retained as competitive moat. Not open-sourced under any license.

* Bio-ID Generation Algorithm — the specific feature extraction method
* AI Model Weights — fine-tuned on Đắk Lắk durian field data
* VeData Protocol Core — validation logic and trust scoring
* LampNet Node Software — distributed storage coordination
* PhoenixKey Biometric Core — matching and liveness detection

If GreenSun Tech ceases operations: MIT-licensed smart contracts and key recovery tools give the community everything needed to continue operating OriLife and recover user assets. The proprietary core affects performance and accuracy — not basic functionality or data access.

Why This Strategy Is Optimal

For the Cardano Ecosystem:

* Smart contracts and key management are fully auditable — no trust required for user asset security
* Integration SDK enables any developer to build on OriLife and participate in the MAGIC economy
* This is a public good infrastructure, not a closed silo

For GreenSun Tech:

* Bio-ID algorithm and AI model weights remain proprietary — the technical moat is intact
* Revenue model: B2B SaaS for VeData and LampNet compute, paid via MAGIC credits
* USPTO PPAs protect the full stack from copying

Common dRep question: "If GreenSun goes bankrupt, what remains?"

Answer: Users can recover all assets via MIT-licensed PhoenixKey recovery tools. Developers can continue running OriLife using open smart contracts and integration SDKs. The proprietary core affects accuracy — not access.

#### Open Source Governance

| Field        | Detail                                       |
| ------------ | -------------------------------------------- |
| Repositories | github.com/OriLifeTrace (Organization)       |
| License      | MIT for SDK · Apache 2.0 for Smart Contracts |
| Contribution | Pull Request via GitHub                      |
| Security     | Responsible disclosure policy                |
| Bug Bounty   | After Mainnet launch (M3+)                   |

***

### 13. Legal Mapping to 9 Milestones

| Milestone          | Related Legal Requirements                              | Compliance Deliverable                       |
| ------------------ | ------------------------------------------------------- | -------------------------------------------- |
| M0 Foundation      | Alliance legal contracts, notarized MOU                 | Public notarized MOU                         |
| M1 Alpha           | No specific legal requirements                          | —                                            |
| M2 Beta App        | Consent flow (Decree 13/2023)                           | Onboarding with explicit consent             |
| M3 Audit + Mainnet | Smart contract audit, BCT Portal API (CT11 Art. 14)     | Audit report + BCT API test                  |
| M4 Pilot           | GACC pilot export (Orders 248/249), GPS boundary (EUDR) | Customs declaration for pilot batch          |
| M5 SDK Open        | MIT License, GS1 EPCIS v2.0 validation                  | GitHub public + GS1 validator pass           |
| M6 Beta Rollout    | Sovereign Data Residency (Cybersecurity Law)            | LampNet VN nodes active                      |
| M7 Mass Rollout    | CT11 deadline readiness (01/12/2026)                    | System operational ≥2 months before deadline |
| M8 Global          | FSMA 204, JAS/MRL, EUDR compliance docs                 | B2B contracts + compliance documentation     |

***

### 14. Compliance Declaration

#### Vietnamese Law:

* Full compliance with Decision 1236/QĐ-TTg and the National Blockchain Action Program
* Full compliance with Circular 11/2026/TT-BCT — system operational ≥2 months before the 01/12/2026 deadline
* Vietnamese user data stored per Cybersecurity Law — LampNet Sovereign Data Residency. Full compliance with [Cybersecurity Law no 116/2025/QH15](https://vanban.chinhphu.vn/?pageid=27160\&docid=216499) (effective July 1, 2026) — the law in force throughout all OriLife deployment phases M4–M8.
* Personal data protection per Decree 13/2023/NĐ-CP

#### International Standards:

* GS1 EPCIS v2.0 compliance in data export (from M5)
* GACC (Orders 248/249) compliance for China export shipments (from M4)
* Compatible with FSMA 204 (US FDA) and EUDR (European Union)
* Meets ISO 22005 food traceability standards
* Meets Japanese JAS and MRL standards

#### Intellectual Property:

* Core technology is original IP of GreenSun Tech, protected by 4 USPTO PPAs
* DDC Holdings copyright No. 4420/2025/QTG
* No infringement of any third-party patents or copyrights
* Open source components released with clear licensing (MIT + Apache 2.0)

#### Cardano Treasury:

* All Alliance members participating in the project — including Duc Tiger and Nguyen Hung Son— receive reasonable compensation from the GA budget, allocated by role and actual contribution
* Duc Tiger is PM, also dRep/SPO TIGER — publicly disclosed, voting ABSTAIN on this GA and all Withdraw Treasury GAs during the voting period of this GA
* No token allocation to voters
* No conflicts of interest beyond those already disclosed
* All information in the GA dossier is truthful and independently verifiable

***

Annex B — Legal & Compliance Context Version: 4.1 · April 2026 Reference: GS-ORILIFE-GA-01 USPTO: #64/030,398 · #64/031,291 · #64/031,472 · #64/032,593

<br>

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ga.orilife.io/annex-b.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.