Consent,
never asked.
Every state on Earth rests on a claim it cannot demonstrate: that the governed consent.
Sixteen chapters · about an hour · one narrative, by design.
Locke supplied the workaround that still runs the world — tacit consent: by remaining in the territory, you agree. Hume demolished it in 1748 with an image no philosopher has repaired: a man carried aboard a ship in his sleep does not consent to the captain's command merely by declining to leap into the sea. No one signs. Citizenship arrives like a blood type — by birth, without a question — and every exit on offer presupposes another state willing to receive you. There is no outside. Spooner pushed the logic to its honest conclusion in 1870: if consent is the foundation, no constitution binds anyone who did not personally sign it — a conclusion as irrefutable as it is ungovernable, which is exactly why every state ignores it.
The objection cuts in every direction, and we say so plainly. A new order born tomorrow from a 65% referendum still governs the 35% who explicitly said no, and governs the children born the day after, who signed nothing. Expressed consent outranks presumed consent — that asymmetry is real, and it is the moral crack in the wall of every order that never asked — but it reduces the problem; it does not solve it. Jefferson proposed constitutions that expire with each generation, because the earth belongs to the living; Madison answered that a perpetually renegotiable pact stabilises nothing, and history sided with Madison. Renan found the only honest formulation in 1882: the nation is a daily plebiscite — and he could offer it only as metaphor, because a literal daily plebiscite was impossible.
It was impossible. It no longer is. Serious theory long ago relocated legitimacy from original consent, which never exists, to consent that is continuous, organised, and revocable — not did you sign? but can you leave, and can you be counted? Every mechanism below is an answer to that pair of questions at infrastructure grade.
What states presume, HPP measures. That single verb-change is the whole project.
The failure patterns of history,
cured in the architecture
Every constitutional order in history has hidden its structural flaws behind ceremony. The flaws surfaced anyway — usually decades later, usually at the expense of the weakest party.
The Human Potential Protocol took the opposite path, for a reason that is philosophical before it is tactical: a system founded on consent cannot ask for consent while concealing how its hardest questions were answered. Informed consent requires informing. We hunted the failure patterns of every federated system in history inside our own drafts, and cured them upstream — before launch, before asking anyone's trust.
What follows names the four deepest inherited failure patterns and the cure built into the design for each — then completes the architecture at world scale. The diagnoses stay published even though the cures are built in, because a protocol that asks for trust must show its work, not just its conclusions.
The Federation does not judge
its own cause
A council that holds three powers at once — setting the rules, enforcing them, and adjudicating the disputes arising from that enforcement — is the default architecture of every federated system ever built, and the one every government on Earth still lives inside. When a periphery contests the centre's sanction, the body that hears the appeal answers to the body that issued it. Early drafts of our own constitution reproduced this default without noticing. We caught it. This is how it was removed.
History is unambiguous about how it ends. Sicily's 1946 Statute of Autonomy created a paritary constitutional court — half state-appointed, half regional — precisely to prevent the centre from judging its own disputes with the periphery. Within a decade, the national Constitutional Court declared that paritary body absorbed into itself, deciding the question of its own jurisdiction in its own favour. Every erosion of Sicilian autonomy over the following seventy years flowed from that single structural capture: whoever controls the forum eventually controls the interpretation, and whoever controls the interpretation controls the implementation. No clause was ever repealed. None needed to be.
The exit right mitigates but does not cure it: exit is the right remedy when a hub no longer wants membership, and the wrong remedy when a hub wants membership and justice. Telling the wrongly sanctioned to leave is not adjudication; it is constructive expulsion.
The Paritary Arbitral Layer
Composition — parity, with the balance held by chance
Five arbitrators per Panel: two nominated by the disputant hub from other hubs' Trustee pools, two nominated by the Council, and one presiding arbitrator drawn by verifiable random sortition from a standing roster of arbitrators who hold no Federation office. Parity between the parties, with the tiebreak held by chance rather than by either of them — because a presider chosen by negotiation can be lost to deadlock, and delay always serves the enforcing side. That is how the Alta Corte was actually lost: not by repeal, but by time. Sortition cannot deadlock.
Sortition integrity — commit, then reveal
The eligible pool is committed on-chain before the random seed is revealed, and the seed is drawn from a public beacon. Exclusion from the pool is only for direct economic exposure to the outcome above a published de minimis threshold — never for pending proceedings of a hub's own, which would let the enforcing organ shape the pool simply by opening them, excluding precisely the hubs most motivated to check it.
Jurisdiction
Contested quarantines, de-recognitions and interventions; contested health-metric determinations, reviewed de novo against the published raw data; claims that a Federation organ exceeded its constitutional powers; engine-conformance review; partition disputes; campaign-standards breaches; and — new in v5.5 — Foundation accreditation, revocation, and veto-compliance findings. Panels apply the literal text and the Natural Law standard: was there harm, was there a valid agreement, what remedy restores balance. A Panel cannot amend the Constitution; it can only hold every organ, including the Council, to it.
The clock, because delay is how courts are lost
Panel formed within 28 days of filing, hearing concluded within 90, decision within 120. If the Layer misses its own deadline, the contested sanction lapses. A quarantine that stands for eighteen months while a forum assembles is a de facto de-recognition.
Finality and asymmetry of appeal
Panel decisions bind the Federation immediately. The Federation may not appeal; the hub — or the member class, where one has intervened — may request one review by a fresh panel. The asymmetry is textual, not sentimental: Federation authority is enumerated and exceptional, and exceptional authority is construed narrowly. Asymmetric appeal follows from asymmetric authority.
The self-limitation clause
The clause guaranteeing impartial adjudication sits in Article I, so the hardest amendment path applies to it automatically — and both it and the Arbitral Layer's jurisdiction over Federation acts are listed among the unamendable provisions. This matters more than it sounds: a jurisdiction clause parked in an ordinary Article would be repealable by an ordinary vote, which is the exact death the clause promises to prevent. The forum that protects the periphery must not be dissolvable by the centre it checks — nor by itself.
A community accused of failure is not a defendant before a superior; it is a party before an equal. Paritary adjudication expresses, in institutional form, the first line of the Constitution — that sovereignty is original in humans and their communities, and delegated, revocably, to the Federation. The Federation is the creature of the hubs. Creatures do not judge their creators; peers judge peers.
The physical world
does not divide
A ledger divides in one block. A grain silo does not divide at all. Hubs that provision their economies with physical capital — grain stores, renewable generation, workshops, land under cooperative title — meet a problem the ledger never has: physical capital is indivisible, immovable, and territorial.
This is where peaceful separations turn ugly. Czechoslovakia's velvet divorce was velvet everywhere except in the division of the army and federal property, which took years of bitterness; Serbia and Montenegro litigated state real estate long after the flags changed. The pattern is constant: intangibles part cleanly, tangibles become hostages. So the rules are written now, before any specific silo is at stake — because partition rules drafted during a partition are drafted by the stronger party.
The Asset Partition Protocol
Registration at acquisition, not at crisis
Every asset provisioning a hub currency is registered on-chain at acquisition with three attributes: its valuation method (an oracle formula agreed in advance — audited replacement cost for infrastructure, rolling market price for commodity stores), its divisibility class, and its default partition track. Communities choose the rules of division behind a veil of ignorance, before anyone knows which side of a future split they will stand on. Rawls, rendered as a smart contract. The veil covers the class of rule, never the outcome — and that is exactly enough.
Three partition tracks by divisibility class
Grain, fuel, inventory: divide in kind, proportionally, at the recorded quality grade. The simple case, handled automatically.
A mill, a solar field, a workshop. Money is never the discriminator. The default is divide-and-choose over bundles: the departing community partitions the indivisible-asset set into two bundles; the remaining community picks one. Envy-free by construction, no oracle, no money, unwinnable by wealth — the proposer must be willing to live with either half. Where a single asset dominates and bundling fails, dependency allocation: title to the community with the larger recorded share of use over the trailing 52 weeks, compensation to the other at the registered oracle valuation, payable over up to three years against the asset's own output. Ties break by sortition, never by price.
An aqueduct, a grid interconnect, the only harbour crane — anything either successor needs to remain viable. These convert by preference, not by fallback, to a Commons Trust: a minimal joint-governance DAO holding title, usage rights and maintenance obligations apportioned by recorded historical use, reciprocal easements encoded so neither community can strangle the other's access. The Trust's charter is deliberately boring — fixed formulas, no discretion, deadlocks broken by sortition — because shared infrastructure between recently separated communities must run on rules, not on the goodwill the separation has just consumed.
Why not an auction?
Earlier drafts sent indivisible assets to a buyout auction in gCP, with payment deferrable over three years so a poorer successor would not be structurally condemned to lose. It does not work, and the reason is worth naming. Deferred payment raises the poorer side's feasible bid to roughly the asset's net present value — but the richer side bids that same NPV plus its outside wealth, and wins every time. Financing changes liquidity, not willingness to pay. A wealth auction with a financing clause is still a wealth auction. That is why the default is divide-and-choose, which no amount of money can win.
Liabilities, and the denominator
Partitions fight over debts more than assets. Obligations — insurance-fund exposure, reinsurance commitments, formation stakes, reconstruction loans — divide by the same weights as the assets; external creditors hold both successors jointly and severally; Federation loans follow the assets they financed. A partition that divides assets and is silent on liabilities hands the weaker successor the obligations. And every proportional division uses contribution-weighted membership over the 52 weeks trailing the notice, frozen at filing: members joining after filing hold full personal rights and zero partition weight, because a count that can be moved until the moment of the split will be.
Enforceability, honestly
Ledger divisions self-execute. Physical title lives under host-jurisdiction law and does not move because a Panel says so. Every hub electing physical provisioning therefore embeds these partition rules in its legal wrapper as a binding arbitration agreement — seat, governing law, and scope named — so that Panel awards are enforceable in external courts as commercial arbitral awards. Members are told at joining which of their protections are ledger-deep and which are paper-deep. Unglamorous, and the difference between a remedy and a statement.
All partition disputes go to the Arbitral Layer, never the Council — and member classes have standing, because a partition is where a minority is most likely to be traded away by both leaderships at once.
The deepest injury in historical partitions was never the lost value; it was the humiliation of dependency — one community left holding the harvest while the other holds the mill. The governing principle is that no partition may create a hostage: every successor exits a split with the assets, the compensation, or the guaranteed access it needs to remain viable. Separation without subjugation. That two communities disagreed enough to part is precisely why the protocol owes both of them a whole and independent future.
Judgment runs on a clock and an equal-standing panel — not on rank or patience.
See where this court livesJudgment runs on a clock and an equal-standing panel — not on rank or patience.
See where this court lives No protocol commands
the state's coercion
The Protocol's ultimate sanction is exclusion: de-recognition, trade isolation, reputational exile. Against any actor who needs the network, this is powerful. Against an actor who does not — an external predator, a host state that ceases to tolerate the infrastructure, a violent defector indifferent to reputation — the Protocol has no instrument, and its non-aggression principle is a commitment its members make, not a shield the network provides.
Some projects in this space answer with fantasy: parallel courts that will somehow bind non-members, natural-law theories that will somehow stop a bailiff. We refuse the fantasy, because a protocol that promises protection it cannot deliver commits the gravest possible breach of the consent principle — it obtains membership on false pretenses.
The Honest Layer
A parallel layer, not a rival sovereign
The Protocol operates within existing legal orders and complies with generally applicable law. It does not contest the state's monopoly on coercion; it makes that monopoly progressively less load-bearing in members' lives by providing, consensually, what states provide coercively: economic dignity, dispute resolution among the willing, community, meaning. The strategy is not confrontation but relevance displacement — one service at a time, one member at a time. The medieval merchant guilds and the Hanseatic web built functioning trans-state economic law for centuries not by defeating princes but by becoming too useful to destroy, and by scrupulously avoiding the direct challenge that would have justified their destruction.
Three refusals — a closed list, not a posture
Compliance is general; refusal is enumerated and exhaustive. Exactly three things are refused: (1) mass identity disclosure to any external party; (2) discretionary seizure or freeze of member holdings; (3) lawful-intercept backdoors in member communications. Nothing else is refused. An unqualified claim of full compliance would contradict all three — and would also be contradicted by our own Compliance Ladder, which ends in evacuation, something a fully compliant actor never needs. The closed circuit shrinks the surface these refusals must defend: a system with no fiat rails is not a money transmitter, lists on no exchange, and holds nothing a financial regulator can freeze. The identity and interception refusals stand regardless of rails.
What members are promised — and what they are not
Every member receives the boundary at onboarding in plain language, per jurisdiction, because a member in Frankfurt and a member in Buenos Aires are not taking the same risk and a single global disclosure serves neither. The Protocol guarantees your voice, your exit, and fair adjudication within the network. Your dignity income it guarantees as a right, and pays through one geographic home hub — so a member whose only community is an operational or company hub, or who lives where no hub has formed yet, holds the right and is owed the income by nobody until a cell forms where they live. The Registry, the voice and the exit work at zero density; the income arrives with the neighbours. It does not and cannot protect you from state power, and it will never ask you to break your jurisdiction's law as a condition of membership. A hub facing state pressure follows the Compliance Ladder: transparency first, funded legal defence second, graceful infrastructure migration third, orderly member evacuation last. No hub is left to face that alone, and no member is recruited into an undisclosed risk.
Defence of the layer is legal, informational, architectural
Multi-jurisdiction redundancy — at least seven legal jurisdictions on four continents, operational under the simultaneous shutdown of any three. Open-source everything. Radical transparency of collective finances, so there is nothing hidden to raid. And the refugee system as the ultimate resilience: a network whose communities can fail gracefully cannot be decapitated. Talos, the first hub, takes its name from the bronze guardian who circled the island — protection as vigilance and presence, not as violence.
Every empire of the mind that promised total protection delivered total disillusion. A protocol that knows its boundary and says so treats its members as sovereign adults capable of weighing real risks — which is the only treatment consistent with the first line of the Constitution. The limit of the layer, honestly drawn, is not a weakness of the design. It is the design: consent is only meaningful between parties who both know exactly what is on the table.
The engine enforces
but never authors
This is the newest of the four failure patterns and the least discussed, because it belongs to constitutions enforced by code — which, historically, is only this generation's. It is also the one that voids the other three if it is left open, which is why it is stated last and weighs most. A constitution enforced by bytecode has an author of that bytecode.
Our own drafts held two clauses that, read together, made the situation unanswerable: one made the engine “the ultimate constitutional court”; the other forbade every admin key, kill switch and pause function. The Protocol had made the engine sovereign while forbidding anyone to hold the key to it — and both horns of that dilemma are dead ends. If the engine is truly immutable, the Constitution's own machinery cannot run: no thirteen-week basket recalculation, no annual review of the jurisdictional floor, not even the amendment path — and every defect it shipped with is frozen permanently. If it is upgradeable, whoever holds the upgrade authority is an admin key, and is simultaneously the supreme interpreter of the text, because under bytecode enforcement the meaning of a clause is whatever the deployed code does. That office was nowhere named, elected, term-limited, or reviewable. Literalism without a named literalist is unexamined delegation to the implementer.
The Constituted Engine
Engine changes are constitutional acts
A change to enforcement semantics is an amendment of the clause it enforces, and takes that clause's amendment path — ordinary, foundational, or none at all where the provision is unamendable. Pure implementation fixes form a maintenance class that still requires publication, the full delay, and a conformance attestation. Nothing semantic ever ships as a “technical update.”
Execution is distributed, never unitary
Deployment requires a threshold signature — at least two thirds of at least nine keyholders, spread across the same jurisdictional and continental range the infrastructure mandate imposes, each a Trustee ratified by hub majority. Its only permitted act is deploying what has already been ratified. Every artefact is published as source with a reproducible build for the full discussion period of its tier, and the implementation delay runs from build publication, not from the vote. Anything touching an anti-capture ceiling or an unamendable provision additionally requires two independent audits published in full and a formal proof of the invariant claimed.
Conformance review — the narrowest judicial power there is
Whether a deployed artefact corresponds to the ratified text is a question of fact, and it belongs to the Arbitral Layer: not whether the amendment was wise, which belongs to the Council and the hubs, but whether what shipped is what was agreed. A bytecode constitution cannot do without this, and it needs nothing more than this. And the record must stay open: full state snapshots are published weekly, in a documented format sufficient for any member, hub or auditor to reconstruct and verify the Federation's state without the incumbent's cooperation (§14.7). A check that requires the incumbent's help is not a check; it is a favour.
It cannot pause, blacklist, or originate
The deployment keys cannot touch a holding, cannot pause, cannot blacklist, and cannot originate a change — which is precisely why they are not an admin key in the prohibited sense, and the Constitution now says so explicitly. The emergency lane exists for active security failures only: it restores the ratified semantics, auto-sunsets in seven days unless ratified, is scope-barred from altering any ceiling or unamendable provision, and logs every action publicly as it happens. There is no pause function anywhere in the stack: a breaker that needs a human hand is an admin key pointed at everyone at once.
A protocol that tells its members “no one can change the rules” while someone plainly can is not protecting them — it is misinforming them, which by this document's own standard is the gravest breach available. The dignity is in naming the office, binding it, publishing what it did, and letting a forum it does not control check that the code matches the promise. An unamendable clause is only as unamendable as the process that compiles it. That process now has a name.
The circuit is closed by design. What it cannot do is begin without people — ten neighbours are enough.
Join the movementThe circuit is closed by design. What it cannot do is begin without people — ten neighbours are enough.
Join the movement Nothing here
is for sale
There is no pre-sale, no ICO, no investor allocation, no exchange listing, and no fiat or stablecoin gateway — in either direction, at any token level. No token in the system can be bought with external money, and no token in the system can be sold for it. This is not a launch-phase posture to be relaxed once the project is respectable: it is unamendable, and not even a foundational-tier amendment reaches it. There is no supermajority, no emergency, and no procedural route that opens this boundary later. A boundary a supermajority can open is not a boundary; it is a delay.
Value enters in exactly two ways: recognition (UBD, to every verified human) and creation (CP, minted only on real transactions between real members). Value leaves in exactly two ways: spending — on the goods, services, and skills of the network, which is what an economy is for — and migration, carrying balance and reputation to another hub. Exit is consumption and movement, not conversion. There is no cash-out, because there is no cash-in.
Three reasons closed beats convertible
Political credibility
Every mechanism on this page — the paritary arbiter, the neutral consent index, the no-exemption firewall, the Foundation's one-way valve — rests on one currency: trust. “No amount of money can buy entry, voice, or advantage in this system” is the most credible sentence a dignity protocol can pronounce, and only a closed circuit makes it true. A convertible system can promise that capital won't capture it; a closed system doesn't have to promise.
Monetary sovereignty
A token convertible into an external currency is denominated by that currency — priced by it, arbitraged against it, drainable into it at every crisis of confidence. And monetary substitution never happens by converting out to the old money; it happens when the new unit comes to denominate growing shares of real life — goods first, then services, then wages — until the old money is simply needed less. The closed circuit is not a ceiling on that ambition. It is its precondition.
Structural simplicity of defence
Closing the boundary deletes chapters of the threat model rather than mitigating them. No bank run where there is nothing to run to. No pump-and-dump where there is nothing to dump into. No whale entry where there is nothing to buy. What survives is precisely the machinery aimed at internal markets and inter-hub flows; what was aimed at external curves and external sales is gone rather than retuned. A defence with no attack surface is not caution — it is a claim that the surface still exists.
Hub reserves of grain, energy, and committed labour are things available for purchase within the network, giving the currency real things to buy. They are not a peg. No token here promises stable value, guaranteed redemption in any external asset, or reference to any commodity price. The distinction is substantive rather than presentational: a community instrument redeemable in the community's own goods is a different object, economically and legally, from a financial product promising stability against an external benchmark — and the Protocol is, deliberately and permanently, the former.
Provisioning depth, not a coverage ratio
This is also why the health metric changed in v5.5. A coverage ratio is meaningless without a redemption claim. “60% coverage” answers the question 60% of what promise? — and in a closed circuit there is no promise. So we do not relabel the ratio; we replace it with the only honest question: what can this money buy?
Provisioning Depth = (purchasable real value this quarter × 4) ÷ token value in active circulation — a rate, in × per year
Depth is published weekly with its raw numerator, its raw denominator, and its dormancy share — including the two properties that are not flattering: the numerator is quarterly and therefore lags a sudden loss of provisioning, and excluding dormant balances means a dormancy wave can improve the reading without anything real improving. Both are published rather than smoothed. A falling reading also means something different from falling coverage, and points at a different remedy: not defend the vault but register more provisioning, or mint less.
Non-convertibility leaves nothing to arbitrage — and costs one thing: this Protocol may never publish a rate, so its businesses file without a single number.
What it buys and what it costs, in full →
Non-convertibility leaves no arbitrage to run and no value to drain: with no pair to sell on, nothing inside the circuit can be drained against an outside currency. It has two consequences, and only the first is a choice. The first is horizon: HPP begins complementary — no member is asked to leave the existing economy — and is built to deepen, phase by phase, from unused capacity toward essential needs, toward wages, toward whatever share of life its members freely bring inside. The mechanism imposes no ceiling. Only the depth of the real economy does. The second is not a choice and runs the other way: a circuit that published one credit as one unit of national currency would give its businesses a single number to file with, and this Protocol may never publish a rate at all — the parity that would make the accounting simple is the one thing a closed circuit forbids.
How the Protocol
touches the world
A ledger cannot hold a deed, sign a lease, hire a teacher, or stand in court. Until v5.5 the Protocol had no lawful hands anywhere on Earth — and one word was doing two jobs at once.
Three layers, three names, one job each
The rulebook and its organs: the constitution, the Federation Council, the Arbitral Layer, the Registry, gCP. It touches no external money.
National nonprofit legal entities in whatever form national law provides for asset-locked, non-distributing purpose entities. They give the Protocol the capacity to own land, receive donations, hire, build, and stand in court. An instrument of execution, never a layer of governance.
The communities themselves, living the closed economy and voting.
Terminology, binding on every material we publish
The Federation is the Protocol's global governance layer — Council, Arbitral Layer, inter-hub coordination. A Foundation is a national legal entity. No page, spec, statute, or translation may use the terms interchangeably, in any language. Confusing the two words is how an instrument becomes a government.
The one-way valve
The Closed Circuit forbids external money from ever buying a token. The Foundation Layer is how external money serves the mission anyway, through a valve that flows in exactly one direction: donations in, physical commons out, and nothing else. A Foundation receives fiat or crypto, holds it transparently, and converts it as fast as responsibly possible into the real, collective, unsellable world — community solar, agricultural land and greenhouses, gathering and teaching spaces, off-grid infrastructure, housing for those who have none, clinics, workshops, tools. Those assets become the community provisioning that gives hub currencies their substance: the grain and the kilowatt-hours are born here. Donated money becomes matter; matter becomes what dignity income can actually buy; and at no point does a euro or a dollar ever touch a token.
Four prohibitions — statutory, not promissory
Nothing a Foundation holds is ever converted back into money for any private party. Assets may be transformed — land into greenhouse, sun into kilowatts — never liquidated for distribution.
No dividends, no distributions, no benefit to founders, donors, or officers. Operational compensation only, capped and published to the cent. In most jurisdictions this is already the law of the form; the charter states it anyway, in its own voice, because a rule you wrote yourself is one you cannot claim you did not know.
A donation buys nothing, mints nothing, and touches no token: no UBD, no CP, no gCP, no reputation, no tier, no governance weight, now or later, in any amount. No Foundation holds gCP. The donor receives gratitude, radical transparency, the sight of the thing built, and whatever charitable-tax treatment national law grants — which we claim openly and frame for what it is: the legal order itself certifying, receipt by receipt, that what the community builds is public benefit. Never as draining a treasury. We win by building. A single crack in this wall and every regulator, every tax authority, and every critic on Earth would be right at the same time.
Money does not vote. The use of every donated unit is decided by the verified members of the Foundation's hubs — one human, one voice — never by donation size. A donor who is also a member votes as a member. A donor who is not a member watches, in public, what the community builds.
The members command through the Assembly, the board executes as fiduciary
The legal problem must be named rather than wished away: a nonprofit board carries personal fiduciary duties to its statutory purpose and to national law, and no charter can oblige directors to perform an unlawful act — and equally, no charter can strip directors of the powers and duties the law itself gives them. So the digital assembly architecture is written into every Foundation's statute. The Assembly is sovereign and the platform is its instrument: deliberations are acts of registered members, tallied on-chain, valid when convocation, quorum and majority are met. Voting rights follow registration, not wallets — one registered person, one vote; no balance, donation or tier buys deliberative weight. The board holds every power the law gives it, execution foremost among them, and refuses the unlawful as a duty — publicly motivated on-chain within 21 days, naming the law or purpose clause, appealable to the Arbitral Layer. Execution is deliberate, never automatic: a passed deliberation is ratified by board resolution before anything moves, and the signatories of every account are identified directors. Directors are elected and recallable by member vote, serve fixed terms, and their compensation is published to the cent.
And the appeal is actually enforceable
An appeal a board can ignore is a letter, not a remedy — and a Panel cannot bind a national nonprofit director by constitutional fiat. So the gap is closed as a condition of accreditation: every Foundation's statute must contain a binding arbitration clause naming the Arbitral Layer — seat, governing law, and scope named — so that findings on veto compliance, prohibition breach, accreditation, and devolution are enforceable in external courts as commercial arbitral awards. A Foundation whose statute lacks the clause cannot be accredited; one that removes it forfeits accreditation on the day of the amendment.
Treasury: transparency, not speculation
The multisig exists so every member — and every sceptic — can watch every unit of value from arrival to the moment it becomes matter. It does not exist to run a position. Liquidity is held conservatively and specifically: insured bank deposits and short-term sovereign instruments. If any tokenised stable instrument is held at all, the Protocol's concentration ceilings apply by analogy (≤15% single counterparty, ≥20% issuer-less) — because a Foundation holding a community's donations in one issuer's token has recreated, inside the legal layer, exactly the seizure surface the closed circuit was built to remove. The health metric is conversion velocity, not size — the time between donation received and asset deployed, published quarterly. A growing war chest is a temptation and a target; a flowing stream is a mission. And everything is published: balances, flows, contracts, invoices, votes, vetoes. A Foundation with nothing hidden is a Foundation with nothing to raid.
Donors and signers, unlinkable even by us
Foundations receiving donations must perform genuine custodial identity checks through regulated processors — anti-money-laundering law requires it. That silo shares not one identifier with the Consent Registry: not a hash, not a salt, not a timestamp join key. A Foundation that linked the two would be in breach of its accreditation.
Monopoly by default, never by right
How many Foundations per country? We govern neither the number nor the market, but the accreditation. A legal monopoly by right would create the perfect chokepoint — one board whose capture, corruption, or administrative dissolution takes a whole country's land and homes hostage, and one target for any hostile state. Unlimited competition fails the opposite way: in the nonprofit world rivalry disciplines poorly and wastes much, and one badly run Foundation poisons the name of all.
Minimum requirements, endorsements, a probation period, statutory conformity to the four prohibitions, to on-chain transparency, and to the arbitration clause.
Never by the Foundation itself, never by the Council, never by any organ that is party to the dispute.
The first to accredit serves as primary, and while it serves its hubs well nobody has reason to charter a second. Where a primary is captured or stops executing its members' deliberations, that jurisdiction's hubs may petition the Arbitral Layer for revocation, for re-chartering, or for a second Foundation alongside it. This is Hirschman at the institutional layer: contestability, not actual competition, is what disciplines it — and the standing threat of losing primacy does the work of competition without paying its wastes.
Where nonprofit and property law lives at sub-national level, regional Foundations coordinated by a national one arise under the same rule — which scales unchanged from a microstate to a federation.
This matters more than any numerical cap. The real danger was never too many accredited Foundations; it is impostors collecting donations in the Protocol's name, and a register anyone can check in one click is the antidote.
Bound devolution
Every Foundation's statute must provide that upon revocation or dissolution, all assets pass to the accredited successor Foundation — or, failing one, to another Protocol Foundation designated by the Arbitral Layer — never into liquidation, never into private hands. In most third-sector regimes bound devolution to charitable purposes is already the law; we merely point it at the network. Not even the death of an institution can scatter what a community has built.
How the network
reaches the isolated
The circularity, named
A person joins in a city with no hub. Under a single-threshold rule — five hundred members, ten thousand gCP staked, three endorsements — they receive nothing, possibly for years, because the threshold that guarantees a serious hub also guarantees that no hub can ever start. Worse, the stake requirement is circular on its own terms: gCP is obtained only by converting earned CP, and a community with no hub has earned none. A network that can only be joined where it already exists does not spread; it ossifies. The threshold was doing work that must be divided: it gated existence, when it should gate only full sovereignty.
Why the instinctive fix fails
The reflex is to let the Protocol itself mint UBD for the unaffiliated. It is wrong, and understanding why is what makes the rest correct. UBD has value because a local market must accept it — food stores, artisans, services. Dignity income minted for an isolated individual would be a number on a screen that buys nothing. The binding constraint was never who holds the minting authority; it is the depth of the real economy behind the token. So the cure is not to move issuance upward. It is to let communities begin small and grow, with the honesty to say what a small community can and cannot yet guarantee.
Three hub types, and which of them may be a home hub
Three types of hub exist, each with its own obligations — and only one of them is a place.
The three types, in full →
A hub is not necessarily geographic, and until this amendment there were four kinds of it — Geographic, Affinity, Diaspora, Experimental — none of which changed a single obligation. There are now three, cut along the only line that has economic consequences: does a local market have to accept this hub's dignity income? Geographic hubs declare a boundary, and they alone may be a member's home hub — so they alone mint dignity income. Operational hubs are organised around work rather than around a place: a co-operative, a translators' collective, a guild that ships. Company hubs are firms, inside the Protocol, on the Protocol's terms. Neither of the last two mints dignity income, because a hub with no territory has no local market obliged to accept what it would mint and no single basket to price it against — which is the finding above, arriving from the other direction. Both still pay their people for work actually done: CP minted on real sales, a share of the commons, published bounties. And the principle behind the split is one sentence — who benefits decides who capitalises it. The commons funds what serves the commons; a company's own members fund what serves themselves. A company hub draws no protocol allocation of any size, and that is the clause at which the Protocol stops being able to subsidise for-profit activity.
Three stages — one threshold, split into three
Forms anywhere, immediately, with no stake of its own — and no currency of its own. A community is not a currency: from day one it records CP on a shared circuit it joins, not a token it issues. A geographic cell also pays dignity income, sized to real productive capacity; an operational or company cell pays none and records earned value alone. Full internal market, local assemblies, reputation accrual. No Federation vote, no currency of its own, no gCP convertibility, cannot charter further cells — but full standing before the Arbitral Layer in its own name, because a stage with no vote must not also be a stage with no forum.
Unlocked when an internal market demonstrably functions, on published evidence rather than headcount: recurring transactions across multiple weeks, more than one provisioning source, assemblies that resolve what they take up. It still mints no currency of its own and keeps transacting on the shared circuit. Gains limited gCP convertibility for Steward-tier members on that shared unit, inter-hub trade rights, and full party standing before the Arbitral Layer.
The existing standard, now gating exactly what it should: Federation Council vote, full convertibility, its own arbitration bodies, and the right to sponsor new Seed Cells. It is the first stage at which a hub mints its own CP and receives the full gCP bridge — its own currency zone — because a currency of one's own is worth having only where an economy is deep enough to sustain it. On promotion, members' shared-circuit balances re-denominate into the hub's own CP on a published one-time basis, creating and destroying nothing; the full UBD sufficiency triggers bind, and the size and gCP-balance health metrics begin to be computed.
The declared-capacity rule — the honest promise
A hub is founded by declaration, posted for anyone to read before joining — not grown into existence.
Declared founding, in full →
A fifteen-person Seed Cell that honestly guarantees bread but not rent would, under a single standard, be in permanent constitutional violation from the day it was born. That is a defect of the yardstick, not of the community. So the sufficiency triggers bind Full Hubs, and Seed Cells and Nascent Hubs operate under a declared-capacity rule: the cell publishes what its UBD actually covers — the categories, the quantities, the sources — updates it quarterly, and may never overstate it. Overstatement, not smallness, is the violation. A cell that says bread, not rent and delivers bread is in good standing; a cell that promises rent it cannot deliver is in violation on the day it promises. Every prospective member sees the statement before joining. Twenty people with a garden and three trades sustain a small dignity income, and we will not inflate that number to flatter anyone.
The nursery model — adoption, not exemption
A Seed Cell posts no stake of its own: a nursery sponsors it, mentors it, and the Reserve stands surety.
The nursery rules, in full →
The stake circularity is resolved by adoption rather than exemption. Every Seed Cell is sponsored by a nursery — an established Full Hub or, more often, the jurisdiction's Foundation — which supplies the endorsement, provides mentorship and initial provisioning, and stands surety for the cell until its promotion to Full Hub. The sponsor and the source of the stake are not the same party, and conflating them is how a legal entity ends up appearing to hold a token it may never hold. The stake is the Federation Reserve's. Where the nursery is a Full Hub it may post from its own holdings and recover on promotion; where the nursery is a Foundation the stake is posted from the Federation Reserve, on the Reserve's behalf, against that Foundation's sponsorship, and returns to the Reserve on promotion — because no Foundation ever holds, receives, or is allocated gCP. Surety is an obligation, not a holding: a Foundation nursery answers for abuse before the Arbitral Layer and may lose its sponsorship, and it owes no gCP because it may hold none. Either way the stake is issuance from a named and bounded pool, the conservation identity is untouched, and a failed cell's stake is forfeited to the refugee fund whoever posted it. The nursery is also the circuit the cell joins: a cell adopted by a Full Hub transacts in that hub's own CP, joining an existing circuit rather than founding a rival one; a cell incubated by a Foundation — which holds no tokens and can mint none — transacts on a single shared seed unit, one pre-sovereign, CP-class unit common to every cell with no Full Hub in reach, operated as neutral nursery infrastructure exactly as the Consent Registry is. It is never the Foundation's, and no external money ever buys it. Sponsorship is public and recorded on-chain, capped at twelve concurrent cells per nursery against shell-cell farming, and terminable by the Arbitral Layer for abuse. A nursery holds no governance power over its cells: it mentors, provisions, and stands surety; it does not instruct, and it cannot condition provisioning on how a cell votes. The network reproduces by budding, not by spontaneous generation — a thousand cells add a thousand assemblies, not a thousand incompatible monies — and Foundations gain their operational vocation as incubators of cells across their jurisdiction. A person in a city with no hub does not wait for five hundred strangers. They find twelve neighbours, and the Foundation adopts them.
The genesis advance — what pays the first believers
An operational hub's allocations begin at zero — the Federation advances the payroll against delivered work, and never to companies.
The advance mechanism, in full →
Adoption answers what a cell must post to exist. It does not answer what pays the people who make it exist — and for an operational hub, that second question has the harder answer. Read the allocation formula on such a hub and every term of it is zero: the floor and population shares both scale on members whose home hub is geographic, and an operational hub is not one. The commons share belongs to a different formula, and it fares no better — it divides a mint that fires on a sale, and a hub that has not begun has made none. The total is not small. It is zero — and since the activity term was struck it is zero on every day rather than only the first, because the circle that used to close with time no longer closes at all. That is the stake circularity again in different clothes, answered from the same place though no longer on the same terms: by a grant from the Federation Reserve, never by a mint — and, unlike the nursery stake above, never recovered. Minting is foreclosed four times over here, and one of the four names this very case — no hub treasury is ever funded by minting, not at any threshold, not for any purpose, and not for a bootstrap. So the Reserve grants up to 10,000 gCP — the same figure a Full Hub stakes, taken by reference so the Protocol keeps one number for what standing up a sovereign hub is worth and never two — in four tranches across a single year, once per hub ever, against a surety who owes answerability and never money. What releases a tranche is delivered work with strangers, and never a quantity of value — settled escrow with three unique counterparties, none of them above a third of the counted work-order value; or one asset registered at acquisition with its valuation method filed; or a Seed Cell this hub sponsored coming alive. That concentration bound enters as a qualifying test and never as a magnitude: it decides whether the delivery is diverse enough to count, not how much it was worth. Each milestone is a count of counterparties, completions or filings. Volume is excluded deliberately, because it is the one figure this Protocol has measured to be manufacturable — measured thoroughly enough that the allocation term which paid on it was struck rather than re-weighted. Roster size is excluded because indexing anything to headcount monetises fake members; and any finding that a hub is contributing is excluded because that is how a treasury captures itself — the people who govern the spending decide who counts as a contributor, and reliably conclude that they do. Nothing is recovered, and the reason is arithmetic rather than generosity: the sum used to be charged back against the hub's own allocation, and there is no longer an allocation to charge. The Reserve carries it, in one direction, and says so. Company hubs are excluded absolutely — at any stage, on any surety, in any amount. The commons funds what serves the commons.
Two doors that need no territory
A hub need not be geographic. A hub of translators, developers, therapists, or artists provisions itself with services rather than grain, and services cross borders. An isolated member can belong to such a hub from day one, earn CP there, be paid from its commons, and grow a geographic Seed Cell at home meanwhile — multi-hub membership working as a bootstrap bridge rather than a luxury. What that hub may not do is pay dignity income, because it has no local market obliged to accept it and no basket to price it against. This door was opened wide once; it is narrowed here from a home to a livelihood — a cost this amendment pays, not a clarification it discovered.
From the first minute, with no hub anywhere near them, a new member already holds two real things: identity within the Protocol, and full access to the Consent Registry, which is global by construction and requires no local infrastructure whatsoever. They can sign, be counted, receive Bridge notifications, and join Foundation programmes while their cell grows.
The Registry is what works where the economy has not yet arrived; the economy is what arrives with density. And no stage is a lesser membership: a member of a Seed Cell holds every right in full — dignity income to the extent their home hub honestly declares, voice in their assembly, exit at any time, due process, the Registry, impartial adjudication. Where a member's cell is not their home hub — a cell of the operational or company kind — every other right on that list stands undiminished, and what the exception costs them is recorded rather than described away. What the stages ration is a community's authority over others, never a human being's dignity. Staging sovereignty is prudence; staging dignity would be the inversion this whole architecture exists to refuse.
From presumed consent
to measured consent
States answered Hume by not measuring consent at all: legitimacy is presumed between elections, and elections measure preference among parties, never consent to the order itself. The Registry is the wager that consent can instead be continuous, expressed, and revocable — Renan's daily plebiscite made literal infrastructure rather than metaphor.
Its primary act is the one no political order has ever had to face: the formal, cryptographically signed, on-chain affirmation or withdrawal of consent toward the order one was born into. Not a vote, not an exemption, not a legal challenge — a standing political declaration, individually signed and collectively counted, that converts the oldest unspoken fact of politics (nobody was ever asked) into a public, unfalsifiable, continuously updated index. Within the network the same instrument applies reflexively, toward hub and Federation — because a protocol that hands the world a mirror must be able to stand in front of it.
A global instrument, not a members-only feature
Toward the world, it is open to every human being: any person holding a validly signed state identity document — member or not, on any continent — can affirm or revoke consent concerning their own jurisdiction, because eligibility derives from their state's own signatures, not from HPP membership. Any hub may open and steward a campaign for its region; any group of residents above a published threshold may petition a hub to host one. Within the network, the same instrument is how every member affirms or revokes consent to their hub and to the Federation.
The lever belongs to no one
The index is neutral civic infrastructure: any peaceful party, movement, or association may cite the curve of its territory as evidence of mandate, and none may claim ownership of it or exclude others from invoking it. This neutrality is not modesty — it is what makes the instrument politically indestructible. An index owned by one faction is that faction's problem; an index owned by no one is everyone's fact.
A signature exempts no one
A recorded affirmation or revocation is a political declaration and nothing else. It creates no exemption from any law, tax, or obligation of the existing legal order, and the Registry states this on its face, at signature time, in every language it serves, in every jurisdiction. We will never suggest otherwise, because every movement that confused declared withdrawal with legal immunity destroyed its members and then itself, in that order. The power lies not in the legal effect of any signature — which is zero — but in the number, persistence, and verifiability of all of them together.
Architecture: the treasure that is never created
The privacy guarantee is not encryption. It is categorically stronger: the personal data never comes into existence outside the signer's device.
The chip, read by your own phone
Your phone reads the cryptographic chip of your passport or national eID over NFC — the same tap as a contactless payment. The chip carries your data signed by the issuing authority under ICAO 9303, the standard every border on Earth uses.
The proof, generated on the device
On the device — never on any server — a zero-knowledge proof is generated attesting only: a genuine, unexpired document signed by authority X, held by a unique adult, together with a nullifier.
Only the proof and the nullifier reach the chain
Name, document number, photograph, birth date: they never leave the phone, exist on no server, and exist on-chain in no form — not even encrypted. A rule of principle, not of configuration: immutable ledgers cannot honour erasure, keys leak, and today's strong ciphertext is next decade's plaintext archive.
The only true answer to a demand for the data
A treasure is not protected — it is made impossible to constitute. Any authority demanding “the signers' data” receives the only true answer: it was never held. The implementation is open source. Verify it.
The nullifier, and the residual we declare
One nullifier per person per campaign, derived one-way from the document and the campaign identifier — stable within a campaign, carrying an updatable consent bit. The holder can re-prove ownership and flip their bit at any time, without limit. That single construction delivers all three things the instrument needs: a monotonic distinct-signer curve, a live current-state tally (affirmed / revoked / not expressed), and genuine revocability — a write-once nullifier would mean nobody could ever change their mind, which is not a consent instrument at all.
And the residual, declared rather than hidden: a stable per-campaign nullifier is a pseudonym. It is linkable to itself within one campaign — that is what makes revocability possible — unlinkable across campaigns, and never nominative in any campaign. Mapping a pseudonym back to a person requires that person's own document and their own device; we hold neither and can be compelled to produce neither. A list of pseudonyms is not a proscription list. We say this plainly rather than implying an unlinkability stronger than the one we actually have — overclaiming a privacy property is how people get hurt by systems that meant well.
What is published, and what never is
Every figure states three quantities against a named public denominator — affirmed, revoked, not expressed — drawn from cited census data. Never a single headline number: an instrument that can be reduced to one number can be captured by whoever chooses the number. Two shapes only, on a 13-week cadence: a current-state cross-section, which can move in both directions, and a monotonic distinct-signer curve, which counts participation and never agreement — and says so on every publication. What is never published: no nominative record in any shape, and no cross-campaign linkage.
The coverage limit, stated as a number
The trust anchor is the sovereign's own public-key infrastructure, which is a genuine irony and not an unlimited resource. ICAO PKD participation is well under half of issuing states. Others distribute certificates bilaterally or via published master lists; some publish nothing at all. Verification is available for a large share of the world's documents and unavailable for the rest; keys rotate; participation is discretionary and can lapse. So every campaign publishes its verifiable-document coverage as a number, before it opens — “a large share” is an honest phrase in a constitution and a dishonest one in a campaign. Two further limits: dual-document holders could generate two nullifiers (percentage-level noise, mitigated by admitting one document class per campaign, disclosed in every methodology), and a compromised device is the weak perimeter of any system ever built. The mathematics protects the signature; it does not protect a searched phone.
Evidentiary standing: what the curve proves, and what only a ballot box can
Campaigns will be attacked on exactly this, so we answer before anyone asks. An official referendum — state-sanctioned, universal census, secret booth — remains the gold standard, and nothing built without the state equals it. The booth's secrecy defeats coercion in a way provable participation cannot, and official convocation makes the sample the electorate rather than the self-selected. An official referendum outranks the Registry, always. We do not claim that rank and never will.
Our claim is different and, for its purpose, sufficient: the strongest political evidence attainable without the state's cooperation — and immune to precisely the attacks that destroyed every predecessor. Those deaths deserve names, because every future campaign will be attacked with the same weapons.
2.3 million people participated in a self-organised consultation — volunteer stations, no official census, no verifiable register — and Madrid's dismissal wrote itself: only the convinced showed up, and anyone could have voted twice. The number, unanswerable in the streets, evaporated politically within days. The only lasting legal consequences fell on the officials who had lent public means to it.
An online self-organised consultation claiming over two million adhesions — contested within hours on duplicates, foreign participation, and unverifiable methodology. The headline number died under scrutiny it could not survive.
The oldest genre of all, never defensible at scale: signatures no one can verify, names no one can check, duplicates no one can exclude.
Verification was the epitaph of every one of them. The Registry inverts the weakness into the foundation: every signature anchored to the state's own keys, every duplicate mathematically excluded, every count publicly recomputable by hostile auditors, and the whole growing monotonically for years instead of evaporating in an evening. Where the official referendum cannot be obtained — which is the Registry's entire reason for existing — the comparison is not registry versus referendum; it is registry versus paper petitions and online polls that no opponent need take seriously. And the curve carries one form of force no referendum possesses: a referendum is a photograph that ages from the day it is taken; the curve is a film that has not ended.
The Bridge: from the curve to the ballot box
Every petition in history shares one defect: it ends. Signatures are delivered, the base disperses, and there is no channel to recall it — because the recall channel is a mailing list, which is precisely the treasure this architecture forbids. The Bridge closes the loop without creating the list.
The server never knows whom to notify, because it never addresses signers. It publishes to broad geographic channels, and each device, holding locally the witness of its own participation, decides alone whether to surface them. Personalisation is entirely on-device. For high-risk jurisdictions a fetch-based mode replaces push entirely — the app periodically reads a public bulletin board, leaving no token topology and no metadata at all.
The Registry never reads device location — not GPS, not network positioning, not inference from addresses. Movement data is the worst treasure of all, and an architecture that refuses to hold names will not hold coordinates. The prohibition is unamendable.
Each user declares locally the zones they belong to or care about, and may declare several — because belonging is not singular. The emigrant, the dual citizen, and the passport-holder abroad carry territories in the plural, and a diaspora that declares its homeland is a force every homeland has historically wasted. Where a campaign needs verified eligibility rather than declared interest, the document supplies it cryptographically: citizenship from the passport's issuing authority, residence from national eIDs that carry it. Every campaign states whose consent it measures.
Triggers are objective: formally called referendums, officially registered signature collections, consultations convened under law — whoever promoted them. Neutral informational wording only (date, question, procedure), never endorsement, all qualifying initiatives notified alike. The neutrality that makes the index indestructible would die the day the app amplified one party's initiative over another's.
The first span is already built — by a state
Since 2021, signatures for referendums and popular-initiative laws in Italy can be collected digitally, with full legal validity, through public-platform identity (SPID/CIE). Follow the chain: the anonymous curve proves the consent exists → a political actor, de-risked by the curve, opens a formal collection → the app announces the official channel → and the same person who signed anonymously with a passport chip places the legally valid signature with their state identity, on the state's own platform. From non-binding signal to perfect legal act, without the Registry ever touching a datum. Methodology declares in advance what the curve is and is not: cumulative self-selected consent, not a turnout prediction. The Bridge exists to maximise conversion, never to guarantee it.
The Registry measures consent for as long as the state refuses to ask — and the day the state asks, it walks its people to the answer.
Campaign standards, binding everywhere
- Symmetric question — affirming and revoking always both available, always equally prominent. A question that admits one answer is not a measurement.
- Published methodology before launch: eligibility rule, document class, verifiable-document coverage, denominator source, cadence.
- Self-selection disclosed on the face of every publication, in the same type size as the numbers.
- The no-exemption firewall in every served language, at the moment of signing.
- A jurisdiction legal opinion, commissioned by the national Foundation, before launch. Truth before recruitment, country by country — and in some places the honest answer will be not safely, not yet.
- A public per-jurisdiction risk classification. In democracies signing is protected expression; under authoritarian rule it can cost liberty or life. We protect maximally, disclose honestly, and never promise what cryptography cannot deliver.
- Multi-jurisdiction redundancy with independent verifiers, so no single legal order can end a campaign by ending its hosting.
The Registry is constitutionalised alongside the exit right it operationalises: the right to affirm or revoke through it, the prohibition of any nominative record, the architecture that holds no personal data in any form, the no-exemption firewall, and the ban on geolocation are all among the unamendable provisions. A protocol whose foundation is consent must make the measurement of consent as untouchable as consent itself. And because no personal data exists, there is no data residency to negotiate, no production order to fear, nothing to localise across two hundred legal orders. Mathematics has no jurisdiction.
The legal reality,
stated without discount
Before the theory of leverage, the terrain — because a methodology that misdescribes the world destroys the people who trust it. Three facts govern every consent campaign on Earth, and we state them to every community before a single signature is collected.
There is no legal pathway to statehood. The modern record shows four doors — dissolution of the parent state, decolonisation, negotiated separation, and unilateral secession that succeeds politically and wins recognition — and international law's role in all four is the same: it arrives afterward, to ratify what political weight has already decided. Self-determination, in settled doctrine, belongs to colonial and occupied peoples, not to regions of functioning democracies, where territorial integrity prevails. And historical statehood, however ancient and however real, generates no living title: effectiveness and acquiescence extinguish old claims. Scotland's centuries as an independent kingdom counted for nothing at law. Texas's republic did not survive Texas v. White. Even Hawaii, whose annexation the United States has formally admitted to be unlawful, received an apology and no remedy. The one apparent exception proves the rule: the Baltic states returned in 1991 only because the world had never recognised their annexation — a dormant legal personality existed to restore. Where recognition was universal, there is nothing to revive.
The doctrine of remedial secession legitimates unilateral exit only where the internal political road is blocked. A functioning democracy that lets you found a party, win elections, measure consent, and negotiate has, by that very openness, delegitimised the forced route — and simultaneously guaranteed the legality of the long one. This is not a consolation prize; it is the strategic map. Everything built here — the hub, the Registry, the curve — lives entirely on the open road, needs no one's permission, and can be declared inadmissible by no court, because a functioning economy is not a referendum and a signed declaration is not a vote.
Constitutional indivisibility clauses do not prevent change. They prevent change by judicial or administrative route. When a community's measured will becomes overwhelming, sustained, and organised, no article stops it: a solution is negotiated, or a constituent moment arrives — exactly as every existing state was itself born from an act its predecessor never authorised. The binding constraint was never the text. It was always the weight.
Anyone who promises statehood by decree, by petition to a court, by proclamation, or by legal ingenuity is not merely mistaken. They are spending credibility that belongs to the people they are recruiting.
A circuit can hold a business. It can never hold a rate.
Nothing about commerce breaks the circuit. The closed boundary was never a rule against trade — it is a rule against convertibility, and the two are opposites. A bakery that takes CP for bread has been spent at: no external counterparty, no ramp, no pair, no redemption desk. A legally constituted enterprise may supply goods and services into a hub's economy and be paid in circuit tokens, through a verified human member acting in the course of that business — this Protocol verifies personhood and admits no company to membership, so none of it creates corporate voice, corporate membership, or a second dignity income. But there is one convenience a circuit with a published parity has that we cannot copy. Where a circuit publishes one credit as one unit of national currency, its businesses file at that parity: the invoicing and the tax treatment follow a single published number. It is the load-bearing beam of that kind of legal design, and we may not lay it. No hub, no Foundation, no campaign, and no material of this Protocol in any language may publish, endorse, adopt, cite as authoritative or imply an exchange rate between any token here and any external currency — no official rate, no indicative rate, no “for accounting only” rate, no reference rate computed from a basket, and no table whose columns invite the reader to divide one by the other. A published rate is the external benchmark the circuit forbids, arriving through the accounting door instead of the exchange door, and that door is unamendable: repealing the clause would not open it, because the boundary that forbids it cannot itself be amended. The convenience is not one vote away. It is not any number of votes away.
So the treatment is barter — which is the older and better-tested body of law anyway. Payment in kind is not exotic: revenue authorities have assessed it for as long as they have existed, and the rule is almost everywhere the same. The taxpayer determines fair market value under their own law and reports it. That duty is unchanged, undischarged by this Protocol, and not this Protocol's to discharge. What we supply is evidence, never valuation: the transaction record, its timestamp, the quantities, the hub's published listings and its quarterly basket recalculation, and the raw metric inputs already published weekly — from which a taxpayer or their adviser can construct a valuation their own law accepts. Records, yes. Rates, never. And the settlement is the part a business should plan around rather than discover: tax is paid in ordinary money, outside the circuit, out of the enterprise's own ordinary-money revenue. The Protocol collects nothing, withholds nothing and remits nothing on anyone's behalf — so a business whose token-denominated income outgrows its ordinary-money income can face a bill in a currency its receipts are not in. Complementary first is not modesty. It is solvency. Valuing a thing is not pricing the unit: a peg is a promise about what a token is worth, and a taxpayer's assessment is a statement about what a sack of flour is worth. The first creates a claim and the second creates none — and a number written on a tax return is not a promise this Protocol made. Before mandatory acceptance binds any enterprise in a jurisdiction, that jurisdiction's Foundation commissions and publishes a full tax opinion, reviewed every year and on any material change of law; where the honest answer is not safely, not yet, the opinion must say so on its face and commercial acceptance does not open there. And the cost is named rather than smoothed: a business inside this circuit will do more paperwork than a business inside a circuit with a published parity and will do it without the single number that would make the paperwork trivial. Some enterprises will decline on that basis, some jurisdictions will stay closed until an opinion says otherwise, and the economy will deepen more slowly than it would with a rate. The Protocol prefers a slower numerator to an amended boundary, and says so here rather than discovering it later under pressure.
How measured consent
becomes political power
The Registry measures. This is what the measurement is for — in any country, for any people — because an index that never becomes leverage is a monument, and we do not build monuments.
The theorem
Across every peaceful territorial renegotiation of the modern era, one mechanism recurs: borders and charters move when a persistent majority makes the cost of denial exceed the cost of concession. Scotland obtained its 2014 referendum because the movement had won an outright majority in a system designed to prevent one — at which point refusing the vote cost London more than granting it. Czechoslovakia separated without a single referendum, when both leaderships concluded the marriage cost more than the divorce. Montenegro negotiated the very rules of its own vote. Never arms — weight. The armed path is, statistically, the losing one; the weighted path is how it is actually done.
The four conditions
Majority will that persists
Not an emotional spike a state can wait out, but a generation that does not change its mind.
Demonstrated capacity for self-governance
What theorists call state capacity in waiting: a community that visibly already governs, administers, and provides for itself.
The window
The moment the centre needs something from the periphery — through economic, constitutional, or political crisis.
The table
Where entrenchment clauses are not overthrown but consensually bypassed, because constituent power can rewrite a pact when both seated parties want it rewritten.
The lesson of every negotiated exit is the same: consent is revoked between equals — and the entire game is becoming weighty enough to be treated as one.
What this changes: the first two conditions stop requiring decades
Persistent majority, which history could prove only through twenty years of electoral hegemony, becomes a public, verifiable, cumulative curve — signatures that, unlike votes, do not expire at the end of a legislature. Thresholds are definable for any territory as ratios to its own politics, and each territory publishes its own: a curve exceeding the local referendum-petition threshold enters the national conversation; a curve exceeding the real vote count of the territory's largest party becomes negotiating mass no political actor can ignore, because it represents more measured consent than any of them holds; a curve approaching a majority of the electorate is a constitutional fact in waiting. And demonstrated capacity is precisely what a hub is: an economy that functions, assemblies that decide, disputes that resolve, dignity that is guaranteed.
The Hirschman multiplier
Voice is only as strong as the credibility of exit. The signature of someone who declares withdrawal weighs one. The signature of someone who declares withdrawal while already living partly inside an alternative economy weighs ten — because it is not an opinion, it is a move already begun. This is why the economy and the Registry are one design and not two: each is what makes the other credible.
On rupture, named honestly
Every legal order was born from an act the previous order did not authorise — Sieyès's constituent power — and legality always arrives afterward, to certify what weight has already decided. But history is equally clear about which ruptures get certified and which get crushed. Certified are the separations that arrive negotiated or peacefully irresistible: the velvet divorce, the Baltic chain of hands, Scotland at the table. Crushed are those forced without the weight. So the Registry prepares exactly one kind of rupture: the moment when the curve, the economy, and the demonstrated capacity make a community an interlocutor more valuable to hear than to repress. The lever is never swung at the table — it is built until the table sets itself.
The firewall, restated where it matters most. None of the above alters what a signature is: a political declaration with zero individual legal effect. It exempts no one from any law, tax, or obligation of any existing order, anywhere, and every campaign in every jurisdiction states this at the moment of signing. A signature here is a declaration, not an exemption: it changes what is counted, never what you owe. Keep meeting your commitments in full — the strength of this instrument is in how many of us sign, not in what any single signature could excuse. The power has never resided in what one signature does — which is nothing — but in what a million persistent, verifiable signatures make undeniable. Not a key out of the law, but a lever into the negotiation — the first in history that any citizen of any country can begin building today, one verified signature at a time.
Five principles that bind
every hub and every campaign
The instrument is global; so is the discipline. Every hub, every campaign, every community that raises this name anywhere on Earth is bound by five principles — not as etiquette, but as the operating conditions without which the entire architecture stops working.
Absolute nonviolence and legality of means
Not from timidity — from strategy and coherence at once. The historical record is unambiguous: in democracies the violent path is the losing path, and a movement founded on consent cannot be built on coercion without refuting itself. No campaign asks any member to break the law of their jurisdiction, ever — and any group that does forfeits this Protocol's name and is delisted.
Truth before recruitment
Every community is told the legal reality in full, before joining — what the law permits, what it forbids, what the Protocol guarantees, and what it cannot protect anyone from. A Seed Cell publishes what its UBD actually covers before anyone joins it, and may never overstate it. Every campaign commissions a jurisdiction legal opinion before it opens. Informed consent is not a slogan here; it is the validity condition of every signature collected.
Exit always survivable
From every hub, from every campaign, from the Protocol itself — with one's balance, reputation, and dignity intact. A consent movement that trapped its members would be a walking contradiction. This is the most sacred constraint in the system, and it is unamendable.
Consent asked, never presumed — at every level
In the Federation, in the hub, in the assembly, in the Registry. What we reproach states for — never asking — is what we could never forgive ourselves. The daily plebiscite applies first of all to us.
Dignity is recognised, not earned
Every human being has value by existing. UBD is the economic translation of that sentence, no metric or reputation can touch it, and no campaign — however urgent its politics — may subordinate a member's dignity to its goals. The movement exists for the people, never the reverse.
Phase discipline
The principles imply a tempo, and the tempo is published rather than improvised. Every hub begins complementary — no member is asked to abandon the existing economy — deepens toward essential needs as its real capacity grows, and advances toward substitution only at the speed its members freely choose, measured by public thresholds, never decreed by ambition. Patience is not a compromise of the vision. It is the vision's proof of seriousness.
One protocol, many currencies,
three roles
To remove a persistent ambiguity: the Protocol defines classes; hubs deploy instances; exactly one token is global — and communities share a circuit before they issue one.
A constitutional guarantee — one per verified human, non-multipliable, non-convertible, inalienable. UBD is how the right is paid, not what the right is. You cannot hold two of them, sell one, or lose one by behaving badly.
UBD-Talos, UBD-Lagos, UBD-Berlin — spendable only within the issuing hub and made real by that hub's own provisioning. A member receives UBD from exactly one home hub, however many hubs they belong to, because the underlying right is singular and no two communities should allocate grain for the same human being. The home hub must be a geographic hub: an operational or company hub may hold a member's work, their CP and their voice in its own assembly, and may never hold their dignity income — a hub with no territory has no local market obliged to accept what it would mint, and no single basket to price it against. Home-hub changes are permitted on a published cooldown, waived entirely for anyone displaced involuntarily, and waived again for a member devolving into a denser geographic hub that formed inside the one they were already in: a cooldown is friction against changing one's mind, and there is no mind to change about an option that did not exist. When a city hub forms inside a region hub, the member has not shopped — the map has been subdivided beneath them.
SIC at Talos, CP-lagos at Lagos — each hub naming its own, under Protocol-defined minting, anti-wash, and decay rules, but a hub mints its own CP only once it reaches Full Hub. Below that, a community is not a currency: Seed Cells and Nascent Hubs transact on a shared circuit — the CP of their nursery Full Hub, or, for cells a Foundation incubates where no Full Hub is in reach, one pre-sovereign shared seed unit, CP-class, held by no Foundation and bought in from nowhere. The Protocol itself mints no CP. A member creating value in several Full Hubs earns several CP currencies, legitimately, because minting follows real sales. But onboarding grants and creator stipends are per person, not per hub — otherwise multi-hub membership becomes a printing press.
The only token fungible across the whole network — and the only one whose issuance is power rather than a record of local work, which is why it alone is Protocol-minted and hard-capped. Local CP converts at Steward tier, and inter-hub value moves through that deliberate bottleneck — hub-and-spoke, never mesh. The bottleneck is the point: it prevents speculative arbitrage between local economies, keeps monetary policy local, and gives the Federation one surface to observe instead of N² exchange pairs. The shared seed unit that nurses new cells is none of these things — CP-class, outside the cap entirely — so it adds interoperability at the nursery layer without adding a second network-wide money.
One human, one voice — an anti-multiplication rule, not a voting method
Governance follows the same asymmetry, and v5.5 states it precisely, because the loose version contradicted the constituted Council. Council votes are cast by hub delegates — one hub, one vote. That stands. One human, one voice is a distinct rule at a distinct layer: no person's Federation-level influence is multiplied by the number of hubs they belong to. It binds hub-ratification votes, Foundation member deliberations, and any future instrument that counts people rather than hubs; it is enforced by proof of personhood, never by identity. Without it, multi-hub belonging is a legalised Sybil attack wearing a membership card. Inside each hub, governance remains quadratic voting weighted by experience and contribution. The layers do different work and are not in tension.
In migration, each role behaves according to its nature
- The dignity right
- Continues — the destination hub's UBD from day one.
- Reputation
- Transfers in part, because trust is earned in a community, not carried as a title.
- Earned CP
- Converts through gCP.
Nothing about a person's standing is destroyed by moving, and nothing is duplicated by belonging twice.
We did not invent our problems.
We inherited them.
Three centuries of political philosophy, and we are honest about our ancestors.
David Hume
Demolished the fiction that residence implies consent — the man carried aboard a ship in his sleep does not consent to the captain. Every state since has governed on the fiction anyway. Our answer is not a better fiction but a different mechanism: consent that is asked, continuously, and revocable.
Emmanuel-Joseph Sieyès
Distinguished constituted power — everything operating inside an order — from constituent power, the force that creates orders and necessarily stands outside them. No system contains a legal procedure for its own transcendence, which is why we do not petition existing orders to authorise us: we exercise constituent power in the only domain where doing so harms no one — the voluntary association of consenting humans, built beside the old order, not against it.
Lysander Spooner
Pushed the logic to its honest end: if consent is the foundation, no constitution binds anyone who did not personally sign it. Irrefutable and ungovernable — which is why every state ignores it, and why we treat it as a design constraint rather than an embarrassment.
Ernest Renan
Defined the nation as a daily plebiscite — consent renewed every day — but could only mean it as metaphor. The Registry, and the exit right it operationalises, make it infrastructure: here, the daily plebiscite has a block height.
Albert Hirschman
Showed that voice is only as strong as the credibility of exit: those who cannot leave cannot truly negotiate. Every choice that makes exit survivable — UBD continuity, reputation transfer, the refugee protocol — is Hirschman applied. And so is the institutional layer: a Foundation's primacy is disciplined by contestability, not by competition.
John Rawls
Taught that rules are fairest when chosen behind a veil of ignorance, before anyone knows their position. The Asset Partition Protocol encodes this literally: communities agree the rules of division before any division is imaginable.
Elinor Ostrom
Proved empirically what we wager structurally: communities govern commons successfully without state coercion or privatisation — given clear boundaries, local rule-making, graduated sanctions, and accessible conflict resolution. Her design principles are, recognisably, the anatomy of a hub.
The lineage converges on a single proposition: legitimacy is not inherited, presumed, or seized — it is measured, and it is only as real as the freedom to withdraw it.
One question. Four cures.
One closed economy, lawful hands,
one instrument, one lever, one method.
The pattern across every section is the same, and it is the deepest principle applied to itself: power must never certify itself. The Federation does not judge its own disputes. The stronger party does not write the partition rules. The layer does not promise what it cannot deliver. Money buys nothing and votes never. The Foundations execute what the members decide, and cannot be dissolved into private hands. No community is asked to be five hundred people before it is allowed to exist. And consent is not presumed by anyone — it is asked, measured, and honoured, every day, for as long as it is given, and not one day longer.
Every human has value. Every community has sovereignty.
Nothing about us, without us — and nothing above us that we did not consent to.