Leja — The Witnessing Model
The Philosophy Behind Africa’s Residential Identity Infrastructure
Status: FOUNDATIONAL — Read before any product or technical decision.
1. The Problem Nobody Named
Africa’s property markets do not have a memory problem. They have a witnessing problem. A memory problem means records exist somewhere but are hard to find. A witnessing problem means events happen — payments made, agreements signed, tenants move in and out, properties maintained or neglected, disputes raised and resolved — and nothing credible saw any of it. No one with institutional standing was present. Nothing permanent was created. The next person in the transaction starts from zero — not because the records are lost, but because no credible record was ever made. This is the pattern across Africa’s property markets. Every transaction is unwitnessed. Every payment is trapped in private proof. Every agreement is a scanned PDF nobody can verify. Every tenancy ends the same way it began — with both parties having no institutional standing with each other. Nobody saw it. Nobody with standing witnessed it. Leja is the witness.2. What Witnessing Means
A witness is not a filing cabinet. A witness is not a database. A witness is not a receipt printer. A witness is present when an event happens. The witness’s record carries credibility because the witness was there — not because they generated a formatted document, but because they saw, recorded, and can testify. When Leja witnesses an event, three things happen simultaneously:- The event becomes an immutable entry in the witnessed record layer
- The event becomes part of the involved person’s permanent residential identity
- The event feeds the institutional understanding of that person’s housing behavior over time
3. What Leja Witnesses — The Full Taxonomy
Leja witnesses every significant event in a person’s residential and property-related economic life.Financial Events
- Rent payments (amount, timing, method, consistency)
- Charges (service fees, utilities, penalties, advance rent)
- Deposits (amount, conditions, return or deduction at exit)
- Agency fees and legal fees (per transaction)
- Service job payments (provider-to-requester, on completion)
- Short-let booking payments, security holds, refunds
Behavioral Signals
- Response to payment requests (cooperative / delayed / disputed)
- Response to late notices (immediate / pattern of excuses / negotiation)
- Response to maintenance requests (timely / reluctant / ignored)
- Response to inspection requests (cooperative / avoidant)
- Dispute initiation (who raised it, on what basis, how quickly)
- Notice compliance (proper notice before moving, honor periods)
- Service job conduct (showed for scheduled service, communicated clearly)
Physical Care Signals
- Maintenance requests logged (what reported, when, response time)
- Property condition at move-in vs. move-out
- Security incidents, unauthorized alterations
- Deposit reconciliation (returned / deducted with evidence / withheld)
Relational Events
- Lease start and end (clean exit / early termination / overstay)
- Renewal decisions (voluntary / declined / renegotiated)
- Seller attestations (written confirmation of behavior)
- Short-let stay behavior (check-in/out, property condition, ratings)
- Service job outcomes (completion, rating, repeat hire)
Trust Escalations
- Identity verification tier upgrades (phone → NIN → document)
- Score tier changes (Bronze → Silver → Gold → Platinum)
- Fraud flags raised, investigated, resolved or cleared
Life Transitions
- First rental, subsequent rentals, geographic mobility
- Role transitions (buyer → owner → landlord)
- Price band progression (reflects financial growth or distress)
- Professional record events (new firm, departure, attestation)
4. The One-Line Feature Test
Before any feature ships:“Does this add a verified event to someone’s permanent residential identity, or does it only make an operator’s work more convenient?”Features that only do the second thing are supporting features. They must not be the lead narrative. Features that do the first thing are ecosystem-loop features. They can lead a milestone because they create durable evidence, but they are not Leja’s whole product identity.
5. The Witnessing Contract
When a Professional operator uses Leja to process a tenancy agreement, they implicitly enter a witnessing contract with three parties: With the landlord: “The events in this tenancy will be permanently and credibly recorded.” With the tenant: “Your behavior in this tenancy will be witnessed and added to your permanent residential identity. Good behavior follows you forward. So does poor behavior.” With Leja: “The testimony I contribute to this record is accurate to the best of my knowledge. My confirmed events carry my professional credibility.” This creates accountability that did not previously exist. Over time, agents who have contributed thousands of accurate witnessed events become more trusted — not just by their own landlords, but by the market. Because the market can check.6. What Leja Is NOT Replacing
Leja is not replacing private chat. Agents will continue to use private channels or leja p2p private chat to communicate. What Leja does is witness the outcomes of those conversations — the payment confirmed, the dispute raised, the exit negotiated — and make them permanent. Leja is not a personal tracking tool. Private notes and ad hoc ledgers have no institutional standing. Leja creates witnessed records that private logs cannot — because they have no immutability, no cryptographic guarantee, and no connection to anyone’s permanent residential identity. Leja is not about evidence-submission demos. AI review of payment signals and supporting evidence is a mechanism — one of many ways payment events get witnessed. It is a useful mechanism. It is not the product category. The witnessed event is the compounding unit. Supporting evidence is evidence. The witnessing is what matters. Leja is not a receipt printer. A receipt by itself is a document. A receipt generated by Leja is testimony — connected to a permanent record layer, linked to a RIN, timestamped and immutable.7. The Three-Layer Architecture — Witnessed · Permanent · Sovereign
Layer 1: Witnessed Leja Professional
The event happens. A human confirms it. AI assists the confirmation process but never replaces the human. Trust assumption: you trust the witness — that the person confirming was present, acted in good faith, and attested to what they believe is true. Layer 1 preserves attested truth, not objective truth. If a corrupt agent witnesses a false payment, that lie is permanent. The infrastructure makes fraud attributable and detectable — not impossible.Layer 2: Verified Permanence
The confirmed record is cryptographically anchored. Anyone can verify any record without asking Leja’s permission. Tamper detection is mathematical, not policy-based. Leja Professional records survive a Relvor LTD shutdown. Trust assumption: you trust math — that the cryptographic signature is valid and the merkle root was published before the record in question.Layer 3: Sovereignty
The RIN holder owns their identity. Consent gates all third-party access. Revocation is immediate. Location is always approximate. Access is always logged and visible to the user. Trust assumption: you trust the architecture — that Leja’s design prevents surveillance even when Leja’s database is accessed.8. The Residential Digital Footprint
The record Leja creates is a person’s residential digital footprint — their proof of participation in the residential economy. This footprint is:- Their livelihood (service income witnessed)
- Their journey (housing trajectory mapped over time)
- Their proof (witnessed, tamper-evident, institutionally credible)