Annex B
Legal & Compliance Context
OriLife Platform: Legal Framework, International Compliance & Intellectual Property
Document: Annex B — Legal & Compliance Context
Version: v4.1
Updated: April 2026
Reference: GS-ORILIFE-GA-01
Proposer: Nguyen Hung Son— DDC Holdings, Dak Lak
Status: Public — Attached to Governance Action
Disclaimer: This document is informational, not legal advice. The Proposer is responsible for full compliance with all applicable regulations.
1. Overview — Why Legal Context Is OriLife's Advantage
OriLife operates at the intersection of five legal systems directly affecting the Dak Lak durian supply chain for global export: Vietnam, China, the European Union, the United States, and Japan.
Core Thesis: OriLife is not a voluntary solution. It is a solution mandated by at least 4 legal systems simultaneously — with hard deadlines that cannot be extended. No existing market solution addresses all of these requirements on a unified platform.
Significance for dReps: A YES vote means the Cardano community invests in a project that the market is required to adopt — not a startup that can be eliminated by market forces. Legal deadlines create mandatory demand, independent of marketing or voluntary adoption.
2. Vietnamese Legal Framework
2.1 Decision 1236/QĐ-TTg — National Blockchain Strategy
Field
Detail
Number
Issuing Authority
Prime Minister of Vietnam
Year
2024
Scope
National blockchain strategy for 2024–2030
Relevant Content: Assigns the Ministry of Agriculture and Environment to research and apply blockchain in plantation management and agricultural traceability. Priority deployment in 2024–2026 for key products and OCOP products.
Significance for OriLife: OriLife is executing a mission assigned by the Vietnamese Government — not experimenting with an idea. This is a critical distinction when evaluating adoption risk.
Significance for Cardano: If OriLife is selected as 1 of 5 national strategic platforms, Cardano becomes the blockchain officially used by a government in agriculture — a first-of-its-kind milestone.
2.2 Resolution 57-NQ/TW — Politburo Directive
Field
Detail
Number
57-NQ/TW
Authority
Politburo — Central Committee
Level
Highest-level strategic document
Relevant Content: AI and Blockchain are identified as national strategic technologies to be mastered. Agriculture tops the priority list for smart production.
Strategic Significance: Resolution 57 creates a political corridor at the highest level. This is not a ministry-level policy that can change with personnel rotation — it is a Politburo directive, stable across multiple terms.
2.3 Decision 5272/QĐ-BNNMT — Durian Traceability Pilot
Field
Detail
Number
5272/QĐ-BNNMT
Issuing Authority
Ministry of Agriculture and Environment
Date Issued
December 13, 2025
Scope
Durian Traceability Pilot
Pilot Period
January 1 – June 30, 2026
Summary Date
July 10, 2026
Expansion
Nationwide by end of 2026
Relevant Content: On April 4, 2026, the first shipment was exported via the Green Lane process — but still uses physical labels that can be peeled and re-attached. OriLife solves the weakness that the government's current plan has not yet addressed: biological identification directly on the product, no labels needed.
Significance for OriLife: This is an opportunity to demonstrate value superior to the traditional labeling system during the national pilot. If successful, OriLife will be a strong candidate for the nationwide expansion at end of 2026.
2.4 Summary of Vietnamese Legal Documents
Document
Authority
Relevant Content
Impact on OriLife
Decision 1236/QĐ-TTg (2024)
Prime Minister
Blockchain for plantation & OCOP 2024–2026
OriLife is the implementation vehicle
Resolution 57-NQ/TW
Politburo
AI + Blockchain as strategic tech, Agriculture priority #1
Highest political corridor
Decision 5272/QĐ-BNNMT (2025)
Ministry of Ag & Env
Durian traceability pilot 01/01–30/6/2026, expand end 2026
OriLife solves physical label weakness
Circular 11/2026/TT-BCT
Ministry of Industry & Trade
Mandatory traceability connection from 01/12/2026
Hard legal deadline
Food Safety Law 55/2010
National Assembly
Food traceability responsibility
Legal foundation
Product Quality Law 78/2025/QH15
National Assembly
Product quality standards revision
Legal basis for pilot decisions
Cybersecurity Law 116/2025/QH15 (effective July 1, 2026)
National Assembly
Vietnamese user data stored in Vietnam; foreign service providers must establish local presence
LampNet Sovereign Data Residency — compliant with new law effective during all OriLife deployment phases
Decree 13/2023/NĐ-CP
Government
Personal data protection
PhoenixKey + end-to-end encryption
3. Circular 11/2026/TT-BCT — Deadline December 1, 2026
3.1 Document Information
Field
Detail
Number
11/2026/TT-BCT
Authority
Ministry of Industry and Trade, Vietnam
Date Issued
February 27, 2026
Effective Date
April 16, 2026
Mandatory Deadline
December 1, 2026
Scope
All commercial food production and business establishments
3.2 Directly Relevant Articles
Article 3 — Traceability Code:
The Circular defines a traceability code as "the final identification code at each stage, encoded in a data carrier." OriLife's Bio-ID is precisely that identification code — but the data carrier is the durian fruit itself (biological skin texture), not a physical label. This approach complies with the Circular's definition while eliminating the possibility of forgery.
The Circular also requires a "one step forward — one step back" principle: each stage must link to the previous and next stages. VeData ensures this continuity: Tree Registration → Cultivation Log → Fruit Registration → Harvest → Transfer → Processing → Export. Each step has a cryptographic link to the step before and after, impossible to break.
Article 5 — Mandatory Stored Information:
Circular 11 Requirement
OriLife Delivers Via
Name, address, facility code
PhoenixKey DID — decentralized identity
Product name and images
Bio-ID + raw images on LampNet
Identification code, traceability code
Farm NFT + Bio-ID on Cardano Mainnet
Weight, quantity, batch code
FarmDatum batch_sequence + Merkle Tree
Location, event timestamp
GPS coordinates + digitally signed timestamp
Article 6 — Record Retention and Provision:
The Circular requires minimum 12-month retention and record provision within 24 hours. OriLife exceeds requirements: Cardano Mainnet stores immutably forever (not 12 months). API Gateway responds in seconds (not 24 hours).
Article 14 — Cross-agency Connection:
The Circular requires the system to connect with domestic and international databases. OriLife's Compliance Adapter SDK exports GS1 EPCIS v2.0 and GACC — standards that Vietnam's Ministry of Public Security, Ministry of Health, Ministry of Agriculture, and Chinese Customs can all read natively.
Article 15 — Hard Deadline December 1, 2026:
All food production establishments must connect to the Traceability System from December 1, 2026. OriLife's timeline completes M7 (Mass Rollout) by October 2026 — operational for at least 2 months before the deadline.
3.3 Consequences of Non-Compliance
Violation
Consequence
No connection after 01/12/2026
Product recall ordered
Failure to provide records within 24 hours
Administrative fines + operations suspended
Untruthful traceability data
Criminal prosecution
Export without GACC compliance
Shipment rejected at Chinese port
4. Chinese Standards — GACC
4.1 Overview
The General Administration of Customs of China (GACC) controls all agricultural imports into China. China accounts for >90% of Vietnam's durian export revenue ($3.36 billion USD). Orders 248 & 249 (effective 2022, tightened 2024) govern production facility registration and imported food safety management.
4.2 Requirements and OriLife Response
GACC Requirement
OriLife Delivers Via
Registered plantation code verification
Farm NFT on Cardano
Packing facility code
PhoenixKey DID of the enterprise
Certificate of Origin
Merkle Proof on-chain
Phytosanitary certificate
VeData evidence trail
Residue control (Cadmium, Auramine O)
Immutable cultivation log on LampNet
4.3 Lessons from the 2025 Scandal
The 2025 durian scandal (source) — 17 individuals prosecuted, 55+ plantation codes revoked, 2,000 containers stuck — is direct evidence that the current traceability system (QR labels, paperwork) has completely failed.
Root Cause: Fraud occurred because the data carrier (label) can be separated from the product. DDC Holdings experienced this firsthand with legacy TonFarm (see Annex A, Section 1). When Bio-ID is the fruit's own skin, there is no way to fake the origin.
4.4 Midnight View Key for GACC
Export enterprises share a View Key with Chinese Customs:
Chinese Customs with View Key
Result
CAN verify
Origin, harvest date, GACC code, phytosanitary
CANNOT see
Contract price, detailed quantities, buyer identity
CANNOT see
Information about other shipments from the same company
This is a real-world business requirement — no existing blockchain solution simultaneously provides customs transparency and commercial confidentiality. Midnight on Cardano is the only primitive that solves this.
5. European Union Standards — EUDR & Food Safety
5.1 EUDR — EU Deforestation Regulation
Field
Detail
Number
EU 2023/1115
Applicable From
Late 2025 (large enterprises), 2026 (SMEs)
Scope
Deforestation-risk commodities: timber, cattle, cocoa, coffee, palm oil, rubber, soy
Why Relevant: Dak Lak is Vietnam's coffee capital. Coffee export revenue $8.4 billion USD (2024), EU share 46.7%. While the MVP focuses on durian, OriLife SDK can expand to coffee — EUDR creates a massive B2B SaaS market (see M8 in GA).
EUDR Requirement
OriLife Delivers Via
Geographic coordinates (polygon) per plot
GPS boundary in FarmDatum
No deforestation after 31/12/2020
LampNet Sovereign Data Proof + signed timestamp
Verifiable due diligence
Immutable audit trail on-chain
Land use legality
PhoenixKey DID linked to legal records
5.2 EU Food Safety
Requirement
OriLife Response
Farm-to-fork traceability
Full audit trail via VeData
Record retention ≥12 months
Cardano Mainnet — immutable forever
Record provision within 24 hours
API Gateway 24/7, response in seconds
Traceability to batch level
Traceability to individual fruit (Bio-ID per fruit)
6. United States Standards — FSMA 204
Field
Detail
Full Name
Food Safety Modernization Act — Section 204
Authority
FDA, United States
Deadline
January 2026 (large enterprises)
Core Requirements
Traceability Lot Code (TLC): Each batch must have a unique traceability code throughout all stages.
Critical Tracking Events (CTE): Record events: Harvesting, Cooling, Initial Packing, Shipping, Receiving.
24-hour Rule: When FDA requests, complete CTE records must be provided within 24 hours.
FSMA 204 Requirement
OriLife Delivers Via
Traceability Lot Code
Bio-ID = natural TLC, impossible to forge
Harvesting CTE
Harvest module — auto-capture at cutting
Shipping CTE
Compliance Adapter SDK records transfer events
24-hour records
Cardano on-chain + realtime API
Interoperability
GS1 EPCIS v2.0 export compatible with FDA systems
Market Significance: The US is a large untapped durian market, hindered by FSMA barriers. OriLife creates infrastructure for Vietnam to enter the US market.
7. International Standards — GS1 EPCIS v2.0 & ISO 22005
7.1 GS1 EPCIS v2.0
GS1 EPCIS is the common language for the entire global food supply chain. Used by: Walmart, Carrefour, AEON, Amazon Fresh, and customs agencies in EU/US/Japan/Korea.
Version 2.0 (latest, adoption from 2024) adds:
New Feature
Significance for OriLife
JSON-LD alongside XML
Native REST API, easy web integration
W3C EPCIS Ontology
Linked Data for cross-system queries
Digital Link (QR → URI)
Scan directly to on-chain data
Blockchain anchoring
Official provision supporting blockchain anchoring
OriLife Compliance Adapter SDK exports GS1 EPCIS v2.0 with blockchain proof verifiable on Cardano Explorer — compatible with GS1's official blockchain anchoring provision.
7.2 ISO 22005 — Food Traceability
ISO 22005 Principle
OriLife Mapping
Object identification
Bio-ID as unique biological identifier
Information recording
VeData audit trail
Information linkage
Merkle Tree on Cardano
Traceability capability
Cardano API + Compliance SDK
System verification
IOB milestone review
8. Japanese Standards — JAS & MRL
Japan is a high-potential premium durian market. Quality requirements are extremely stringent — higher than EU and US. Japanese consumers are willing to pay the highest premiums for products with transparent traceability.
JAS (Japanese Agricultural Standard)
JAS Requirement
OriLife Delivers Via
Detailed cultivation log
VeData evidence trail with photos/video
Fertilizer types used
Immutable cultivation log on LampNet
Pesticides (name, date, dosage)
VeData records, signed at source
Seed origin
Farm NFT metadata
MRL — Maximum Residue Limits
Japan's MRL thresholds are significantly lower than Codex Alimentarius (e.g., Chlorpyrifos 50× lower, Cypermethrin 40× lower). Immutable cultivation logs on LampNet help farmers prove they did not use restricted substances — rather than just proving "below threshold."
9. Consolidated Compliance Matrix
OriLife Meets 9/9 Standards
Market
Standard
Core Requirement
OriLife
Status
Vietnam
Decision 1236/QĐ-TTg
Blockchain for plantations 2024–2026
✅
Exceeds
Vietnam
Circular 11/2026/TT-BCT
BCT Portal connection from 01/12/2026
✅
Met (M3)
China
GACC (Orders 248/249)
Plantation code, phytosanitary, batch
✅
Met (M4)
EU
EUDR
GPS polygon, deforestation-free
✅
Met
EU
EU Food Safety
Farm-to-fork, ≥12 months retention
✅
Exceeds
US
FSMA 204
Traceability Lot Code, 24h records
✅
Met
International
GS1 EPCIS v2.0
ObjectEvent, blockchain anchoring
✅
Met (M5)
International
ISO 22005
Food traceability system
✅
Met
Japan
JAS + MRL
Cultivation log, ultra-low residues
✅
Planned M8 expansion
Comparison with Existing Solutions
Solution
QĐ 1236
CT11
GACC
EUDR
FSMA
GS1 v2.0
ISO
EU FS
JAS
Total
OriLife
✅
✅
✅
✅
✅
✅
✅
✅
✅
9/9
Standard QR labels
❌
Partial
Partial
❌
❌
Partial
❌
Partial
❌
0–3/9
Blockchain + labels (legacy TonFarm)
❌
Partial
Partial
❌
Partial
Partial
Partial
Partial
Partial
1–4/9
Blockchain without AI
❌
Partial
Partial
❌
Partial
Partial
Partial
Partial
Partial
1–4/9
Conclusion: No existing market solution simultaneously meets all 9 standards on a unified platform. OriLife achieves 9/9 through a combined architecture of AI vision (label-free Bio-ID) + Cardano eUTXO (batch O(1)) + Midnight (commercial privacy) + VeData (5-layer validation).
10. Intellectual Property — Protection Portfolio
10.1 Vietnamese Copyright
Field
Detail
Work
"Digitizing Agricultural Assets in Vietnam's Central Highlands Using Blockchain Technology"
Certificate No.
4420/2025/QTG
Date Issued
June 2, 2025
Authority
Copyright Office — Ministry of Culture, Sports and Tourism
Author / Owner
Nguyễn Văn Chinh (DDC Holdings)
This copyright confirms DDC has been researching and deploying blockchain in agriculture in Vietnam's Central Highlands since 2024 — the knowledge foundation inherited by OriLife.
10.2 USPTO Provisional Patent Applications
Four PPAs protect the entire tech stack. PPAs establish a Priority Date — the date GreenSun Tech formally claims ownership. Within 12 months, a Non-Provisional can be filed for full 20-year protection.
Invention
USPTO #
Filing Date
Protection Scope
OriLife Platform
#64/030,398
April 6, 2026
Label-free biological identification, AI edge, harvest protocol
PhoenixKey
#64/031,291
April 6, 2026
Hardware key management, app delegation, DID recovery
LampNet
#64/031,472
April 7, 2026
Distributed storage, data sovereignty, multi-layer encryption
VeData
#64/032,593
Pending
Multi-tier validation, blockchain batching, trust scoring
Applicant: GreenSun Tech. Filed by: Nguyen Thi Kim Ngan.
Significance for Cardano Treasury: Technology with legal IP protection is original IP. If competitors copy the architecture after the PPA filing date, GreenSun Tech has legal recourse. Cardano Treasury is funding technology with legal protection — not a fork or adaptation.
11. Cybersecurity Law — Data Sovereignty
Requirements
Cybersecurity Law 116/2025/QH15 (effective July 1, 2026, replacing Cybersecurity Law 24/2018), Article 25.3: Enterprises providing online services in Vietnam must store Vietnamese user data domestically. Foreign enterprises must additionally establish a branch or representative office in Vietnam.
Timing advantage: All OriLife deployment milestones (M4–M8: July–November 2026) operate entirely under this new framework — not the expired 2018 law. OriLife is designed for the current legal environment, not a transitional one.
OriLife data qualifies as "important": farmer identification (DID, biometric hash), agricultural production data (location, yield), export and supply chain information.
Two-Layer Solution
Layer 1 — Cardano: Stores only Root Hash (32 bytes) — no personal or production information. Does not violate domestic storage requirements as there is no PII on-chain.
Layer 2 — LampNet: Actual data (images, video, metadata) stored on LampNet nodes with priority for Vietnam-based nodes. Has an on-chain mechanism to prove storage location (Sovereign Data Residency Proof) — compliant with Decision 1236/QĐ-TTg.
LampNet's domestic node priority and Sovereign Data Residency Proof mechanism satisfies both the data localization requirement (Article 25.3) and the traceability requirement (Article 25.2d) of Luật An ninh mạng 116/2025/QH15 — making OriLife fully compliant with the cybersecurity framework in force throughout its entire deployment period.
Compliance with Decree 13/2023 — Personal Data Protection
Requirement
OriLife Response
Consent before collection
Onboarding flow: explicit consent screen
Clear collection purpose
Used only for traceability
Access / deletion rights
PhoenixKey manages permissions; soft delete
Data security
End-to-end encryption on LampNet; hardware keys
No overseas transfer
Sovereign Data Residency policy
AI-generated content prohibition
PhoenixKey biometric authentication is not generative — it verifies, not creates. Compliant with Article 7.2g of Cybersecurity Law 116/2025/QH15 prohibiting AI deepfakes
12. Open Source and IP Protection Strategy
Clear Classification
OPEN SOURCE — MIT License (from M5)
Published for transparency and user asset sovereignty. Any independent party can verify that user keys, data ownership, and recovery mechanisms work as described — no trust required.
FarmDatum Smart Contract (Aiken) — full source, auditable
PhoenixKey Key Management SDK — key generation, delegation, and recovery flows only; biometric matching core is excluded
Wallet recovery tools — seed phrase derivation, DID resolution
API Gateway Documentation + OpenAPI Spec
OPEN FOR INTEGRATION — Restricted License (from M5)
Interfaces published to enable third-party applications to build on OriLife infrastructure and participate in the MAGIC economy. SDK calls consume MAGIC credits — expanding the ecosystem without exposing core IP.
OriLife Edge SDK — Bio-ID registration and verification interface (not the underlying algorithm)
Compliance Adapter SDK — GACC + GS1 EPCIS v2.0 export
LampNet Storage SDK — CID pinning and retrieval interface
CID Subscription API — WebSocket push integration
PROPRIETARY — Protected by USPTO PPAs
Core technology retained as competitive moat. Not open-sourced under any license.
Bio-ID Generation Algorithm — the specific feature extraction method
AI Model Weights — fine-tuned on Đắk Lắk durian field data
VeData Protocol Core — validation logic and trust scoring
LampNet Node Software — distributed storage coordination
PhoenixKey Biometric Core — matching and liveness detection
If GreenSun Tech ceases operations: MIT-licensed smart contracts and key recovery tools give the community everything needed to continue operating OriLife and recover user assets. The proprietary core affects performance and accuracy — not basic functionality or data access.
Why This Strategy Is Optimal
For the Cardano Ecosystem:
Smart contracts and key management are fully auditable — no trust required for user asset security
Integration SDK enables any developer to build on OriLife and participate in the MAGIC economy
This is a public good infrastructure, not a closed silo
For GreenSun Tech:
Bio-ID algorithm and AI model weights remain proprietary — the technical moat is intact
Revenue model: B2B SaaS for VeData and LampNet compute, paid via MAGIC credits
USPTO PPAs protect the full stack from copying
Common dRep question: "If GreenSun goes bankrupt, what remains?"
Answer: Users can recover all assets via MIT-licensed PhoenixKey recovery tools. Developers can continue running OriLife using open smart contracts and integration SDKs. The proprietary core affects accuracy — not access.
Open Source Governance
Field
Detail
Repositories
github.com/OriLifeTrace (Organization)
License
MIT for SDK · Apache 2.0 for Smart Contracts
Contribution
Pull Request via GitHub
Security
Responsible disclosure policy
Bug Bounty
After Mainnet launch (M3+)
13. Legal Mapping to 9 Milestones
Milestone
Related Legal Requirements
Compliance Deliverable
M0 Foundation
Alliance legal contracts, notarized MOU
Public notarized MOU
M1 Alpha
No specific legal requirements
—
M2 Beta App
Consent flow (Decree 13/2023)
Onboarding with explicit consent
M3 Audit + Mainnet
Smart contract audit, BCT Portal API (CT11 Art. 14)
Audit report + BCT API test
M4 Pilot
GACC pilot export (Orders 248/249), GPS boundary (EUDR)
Customs declaration for pilot batch
M5 SDK Open
MIT License, GS1 EPCIS v2.0 validation
GitHub public + GS1 validator pass
M6 Beta Rollout
Sovereign Data Residency (Cybersecurity Law)
LampNet VN nodes active
M7 Mass Rollout
CT11 deadline readiness (01/12/2026)
System operational ≥2 months before deadline
M8 Global
FSMA 204, JAS/MRL, EUDR compliance docs
B2B contracts + compliance documentation
14. Compliance Declaration
Vietnamese Law:
Full compliance with Decision 1236/QĐ-TTg and the National Blockchain Action Program
Full compliance with Circular 11/2026/TT-BCT — system operational ≥2 months before the 01/12/2026 deadline
Vietnamese user data stored per Cybersecurity Law — LampNet Sovereign Data Residency. Full compliance with Cybersecurity Law no 116/2025/QH15 (effective July 1, 2026) — the law in force throughout all OriLife deployment phases M4–M8.
Personal data protection per Decree 13/2023/NĐ-CP
International Standards:
GS1 EPCIS v2.0 compliance in data export (from M5)
GACC (Orders 248/249) compliance for China export shipments (from M4)
Compatible with FSMA 204 (US FDA) and EUDR (European Union)
Meets ISO 22005 food traceability standards
Meets Japanese JAS and MRL standards
Intellectual Property:
Core technology is original IP of GreenSun Tech, protected by 4 USPTO PPAs
DDC Holdings copyright No. 4420/2025/QTG
No infringement of any third-party patents or copyrights
Open source components released with clear licensing (MIT + Apache 2.0)
Cardano Treasury:
All Alliance members participating in the project — including Duc Tiger and Nguyen Hung Son— receive reasonable compensation from the GA budget, allocated by role and actual contribution
Duc Tiger is PM, also dRep/SPO TIGER — publicly disclosed, voting ABSTAIN on this GA and all Withdraw Treasury GAs during the voting period of this GA
No token allocation to voters
No conflicts of interest beyond those already disclosed
All information in the GA dossier is truthful and independently verifiable
Annex B — Legal & Compliance Context Version: 4.1 · April 2026 Reference: GS-ORILIFE-GA-01 USPTO: #64/030,398 · #64/031,291 · #64/031,472 · #64/032,593
Last updated
Was this helpful?