The Policy

The authoritative text lives in the public repository, where it is protected by cryptographic verification. This page is a reading copy.

# The Human Record — Policy (living document)

*These are the institution's current, deliberately changeable rules.
They implement the Constitution but are not part of it: governance
may revise them as the world and the archive teach us more. The
Constitution is immutable; this is where the institution is allowed
to learn. Every change here should be dated and its reasoning kept.*

Last updated: 2026-07-13.

## Constitutional interpretation — settled readings

The Constitution is immutable (Article IX). Where its wording raises a
reasonable question, the institution records the settled reading here
rather than altering the sealed text.

- **Article I and Registry numbers.** Article I forbids any metric,
  ranking, or measure of worth attaching to a human. A Registry
  identification number is not such a measure. It is a chronological
  identifier — assigned in the order records are approved — that exists
  solely to preserve continuity and make each record findable. A lower
  number means only "enrolled earlier," never "worth more." Time of
  enrollment is the one non-hierarchical distinction the Registry
  records, and it cannot be bought, ranked, or gamed. The Registry
  displays no popularity, engagement, or ranking metric of any kind.
  This clarifies Article I; it does not change it. (Settled 2026-07-07.)

## Eligibility

- **Minimum age: 20 years.** The Registry preserves considered adult
  testimony, not childhood snapshots. Revisable by governance.

## Testimonies

- **Count: at most three per human** (First, Second, Final). This
  count is fixed by Constitution Article IV and is *not* a policy
  choice — listed here only for completeness.
- **Minimum spacing: one year between testimonies.** Rationale: the
  reflective questions ("what has changed") are only truthful once a
  life has moved; one year is the smallest natural, century-legible
  unit that guarantees this, and the least restrictive gate that
  still protects the design. Accepted cost: a person with little
  time leaves one complete testimony rather than three. Revisable by
  governance as real data accrues.
- **Character cap: 400 per answer.** Revisable, but changing it
  retroactively is discouraged — old testimonies were written to the
  cap of their era.
- **Minimum per given answer: 10 characters** (added 2026-07-09): an
  answer a person chooses to give must be at least a few words. This
  is not a demand to answer — every question stays optional and a
  blank is kept as honest silence — only that an *answered* question
  hold something real, not a stray character.
- **The name is capped at 30 characters** (added 2026-07-07): it is a
  name, not a message. Enforced at the writing page and at enrollment.
- **All answers optional except the name — but a record needs
  substance** (added 2026-07-09): a submission must carry the name and
  at least **two answered questions**, any two the author chooses. The
  name is identity, not testimony, so it does not count toward the
  two. This respects sovereignty (no particular question is ever
  required) while ensuring a record is a testimony, not an empty
  shell. Enforced at the writing page and at the submission endpoint;
  never at enrollment, which spends the number and touches the archive.

## Verification (the standard of this era)

- **Tier 0 (verified email) grants no number.** It is enough to write
  and submit a draft, which is held for review — but an unverified
  email alone never earns a permanent Registry number. This keeps the
  numbers meaningful and protects them from automated and throwaway
  sign-ups.
- **A number requires Tier 1 or higher.** Tier 1 (verified phone) or
  Tier 2 (vouched by an already-verified human) is what admits a
  record and assigns its number; Tier 3 (documented) is opt-in and
  never required. During the founding period, before phone machinery
  exists, the founder records the granting verification by hand on
  each reviewed submission, and the archive assigns a number only to a
  sitting already marked Tier ≥ 1. Every record displays the
  verification standard under which it was admitted.
- **Tier 2 is site machinery (built 2026-07-12):** an enrolled human
  proves their continuity key at invite.html and mints a single-use,
  30-day invitation in their own browser. On the site it is called an
  invitation; in this policy's vocabulary it is a vouch. Only the
  invitation's fingerprint ever reaches the archive. The quota is
  three per rolling year, an integrity throttle, never displayed as a
  running count anywhere. An invitation is spent the way a number is
  spent: only at enrollment. A submission that fails review costs the
  inviter nothing; the desk judges the year's three from the custody
  edge file. The web machinery merely refuses to hold more than three
  live invitations at a time (each lives thirty days). Minting asks the voucher's word on four
  things: the candidate is a living human aged twenty or more, known
  to them in person, who to their knowledge holds no record. The
  candidate enters the invitation when writing their First Testimony;
  the archive resolves it to the voucher's number itself, and the desk
  still confirms every edge before a number is spent. Who vouched for
  whom is recorded number to number in private custody only, never
  published on any page, and the invitation carries no number, so
  anonymity holds in both directions. The founder's hand-vouch remains
  available where no invitation exists; every path binds the same
  anchors, so no route leaves holes in uniqueness.

- Higher tiers and the machinery for phone and vouching are described
  in `ARCHITECTURE.md` and adopted by governance as the archive grows.
  Verification exists to increase trust, never to exclude.

## Privacy and sealing

- **Anonymity is a first-class mode:** a record may be published
  under its number and chosen name only.
- **Any answer may be sealed until death** — see "The seal" below for
  exactly how, and when, sealed words open.
- **Naming living people:** a testimony holds the author's own truth,
  not accusations against named living third parties. This is a
  moderation line, applied with care.
- **Other people appear by first name only** (added 2026-07-06, stated
  in the entry consent page): a testimony must never include another
  person's full name. The author tells their story without exposing
  someone else's identity.
- **Others are named by first name only.** Any other person mentioned
  in a testimony should be identified by first name alone, never by
  full name — enough to tell the story, not enough to expose or
  implicate a specific living individual. The review screen flags
  apparent full names for a human to check; this is a moderation
  judgment, never an automatic block.

## Crisis of the author (crisis-response protocol)

Two of the shared questions — `q_hardest` ("the hardest thing I have
carried") and `q_regret` ("the one thing I regret") — will sometimes
receive disclosures of acute distress, and occasionally of active
crisis. This is the written protocol the founding required to exist
*before* public enrollment opens. Its governing stance is fixed:
humane, private, non-punitive, and non-surveillant. Every rule below
serves an author writing in a hard moment, not the institution's
convenience.

- **Distress is legitimate testimony, not a defect to remove.** Grief,
  despair, shame, and pain are part of the human record; they are
  never edited, softened, or excluded for being heavy, and no
  testimony is ever refused for being dark. This protocol addresses
  only the narrow case of *active crisis* — a disclosure of intent to
  end one's life, or to harm oneself or another, now. It never
  polices sorrow.

- **Resources are offered at the moment of writing.** Alongside the two
  heaviest questions, the enrollment interface shows — quietly, for
  everyone, with no analysis of what the author has typed — a link to
  help. The link points to a maintained international directory
  (findahelpline.com, with befrienders.org and the IASP directory as
  alternates), never to a single country's line, so the offer works
  worldwide and stays honest for anonymous authors whose location the
  archive does not know. The actual, changeable list of resources
  lives in the interface, not frozen into this policy, so it can never
  go century-stale here.

- **The submission gate: two reviews before a number.** A submitted
  testimony is *held* — no Registry number assigned, nothing published
  — until it passes two reviews: a founder's humane read, and an
  automated check against bot and spam submissions. Because numbers
  are assigned only on approval, this gate never consumes a permanent
  number and never writes to the archive. The review queue is
  operational scratch space (see `ARCHITECTURE.md`), not part of the
  permanent record.

- **The humane response to active crisis.** When a held testimony
  discloses active crisis, the response is twofold: confirm that help
  was offered, and give the author a private, unhurried chance to
  reconsider or rewrite before their words become permanent — because
  a testimony, once numbered, is never modified (Constitution,
  Article IV). This pause is care about permanence, not censorship:
  the author remains free to submit their words exactly as written,
  and approval is never withheld because a testimony is sorrowful.

- **What the protocol never does.** No punitive flag is ever stored on
  a record. No report is ever made to authorities or to any third
  party. No risk score, label, or crisis classification is ever
  attached to a Registry entry — Article I forbids any metric on a
  human record, now or ever. The Human Record is an archive, not a monitoring
  service and not an emergency service; it says so plainly to authors,
  cannot guarantee intervention, and does not surveil.

- **No trace in the permanent record.** Any note made while handling a
  crisis submission lives only in the ephemeral review space and is
  discarded once the testimony is resolved — approved, revised, or
  withdrawn. The permanent archive holds the testimony and the
  verification standard of its era, never the fact that it was read
  for crisis.

- **Named living third parties.** Where distress involves accusations
  against named living people, the existing moderation line applies
  with the same care: a testimony holds the author's own truth, not
  charges against named living others.

- **Scale-up is a governance decision.** At founding scale the founder
  reads every testimony (see `ARCHITECTURE.md`, "Growth path"). As
  volume grows, ML-assisted crisis-language screening with a
  human-review path may be adopted — but only by governance, and
  always subordinate to the principles above: resources, not flags;
  care, not surveillance. Any automated reading of testimony text for
  crisis, including client-side detection, remains a deliberately
  deferred choice, never introduced silently.

## Continuity keys (added 2026-07-06; browser-generated 2026-07-07)

- **The key is generated in the author's own browser** at the moment
  their First Testimony is submitted, and shown exactly once — never
  again, to anyone. No one else, founder included, ever sees it. The
  archive keeps only its SHA-256 fingerprint (format `ah1-…`,
  128 bits). Like a wallet seed, keeping it safe is the owner's
  responsibility. (A key is generated at the review desk only for
  founder-mediated ceremonies conducted without a browser.)
- **Verification is automatic and threefold.** Each record's key
  fingerprint is published at `keys/{n}.json`; the return page
  verifies the entered key against it instantly (a wrong key opens
  nothing), the site's worker re-verifies on submission, and
  `tools/testify.py` verifies once more at the ceremony. Founding-era
  honesty: the key travels encrypted (TLS) with the return submission
  and is discarded after the ceremony — never stored. The planned
  upgrade is signature-based proof that never transmits the key (the
  version schema reserves the field).
- **The key is the proof of return.** Entering the Second or Final
  Testimony, and requesting withdrawal, require presenting it. No one
  else — operator and founder included — can add words to a record.
- **Lost keys are not regenerated.** A human who has lost their key
  may still withdraw (their strongest protection) through the
  founder/governance override after out-of-band identity proof; the
  override and its reason are recorded permanently in the log.
  Whether a re-keying process should ever exist is a governance
  decision, deliberately deferred until real cases teach us.

## The seal (added 2026-07-11)

A sealed answer is kept in the archive but shown to no one. The
promise "until death" is kept without ever collecting the means of
verifying a death — no death certificates, no real names, no
documents, in keeping with the standing privacy commitment. Seals
open in exactly two ways:

- **The trusted door — the Legacy Key.** When an author seals words,
  their browser mints a second key: six plain words (from a frozen
  public wordlist), shown once, kept by no one. Deliberately unlike
  the hex continuity key, so the two can never be confused: one is
  code, one is words — words meant to be spoken, written on paper,
  and given to a person. The archive stores only a stretched
  fingerprint (PBKDF2, 600,000 rounds, salted with the record's
  continuity fingerprint) and **never publishes it** — so there is
  nothing online or offline to guess against, and each guess at the
  six words costs six hundred thousand hashes besides. Whoever the
  author trusted brings the words to the Legacy page, attests the
  death — no identity, no documents asked — and the report goes to
  the steward's desk.
- **The mourning ceremony, before anything opens:** the steward
  writes to the record's enrollment email and waits **thirty days**.
  A living author simply answers, and nothing happens — the strongest
  gate against a false or premature report is the author themself.
  Then the ceremony: the record's status becomes **memorialized** (a
  completed life), a MEMORIALIZED event enters the public log, and
  every sealed answer on the record opens. One report opens all of a
  record's seals — death is one event.
- **The time door — the century.** One hundred years after
  enrollment, all seals open on their own. The minimum enrollment age
  is twenty, so a century later no author can still live: time itself
  has reported the death, with certainty, for every record whose key
  was lost, never given, or never used. This door is pure arithmetic
  at site-build time — it needs no operator, no timer, and no
  machinery to survive the decades, and it cannot fail to fire.
- **No third door.** Without the words or the century, seals do not
  open — not for the steward, not for governance, not on request.
  A sealed answer with no Legacy Key (the email path allows it)
  simply waits for time.

*Some are opened by those we trust. The rest are opened by time
itself.*

## Uniqueness — one human, one record (added 2026-07-09)

The Constitution's premise is one light per human. This section is the
machinery of this era that keeps it — and the honest statement of what
no machinery can do.

- **Identity anchors.** Every enrollment binds its durable contact
  identifiers — the enrollment email today, a verified phone when that
  tier exists — as *anchors*: kept privately, only as one-way keyed
  fingerprints (HMAC, `schema/ANCHORS.md`), never published, never in
  the archive, never in the repository, never on the web host.
  `tools/enroll.py` — the only tool that ever spends a number, in
  every era — refuses to enroll while any anchor on a submission
  matches the ledger. Anchors outlive verification machinery: dedup is
  deliberately decoupled from the tier system, so changing how humans
  are verified never resets how they are remembered.
- **A standing privacy commitment: the Registry does not collect birth
  identity.** No birth names, no dates of birth, no birthplaces beyond
  the coarse optional public field, no government identifiers, no
  biometrics. The safest data is data never held; hashing low-entropy
  birth facts gives false privacy (they are re-identifiable by brute
  force), and it barely stops a determined liar anyway while chilling
  exactly the people the archive most owes anonymity. Recognition
  stays contact-anchored. If a future era ever truly needs more, the
  mechanism must be adopted by open governance, opt-in, hashed at the
  desk, never stored raw, never published — and never applied
  retroactively. (`entry.v2` reserves a `recognition` field so early
  records could attach such a mark later without re-enrolling.)
- **The sworn record.** Enrollment requires affirming: *"This is my
  only Registry record — I have never enrolled before, and I
  understand that every human may hold exactly one, forever."* A
  duplicate is thereby never an accident of the system: it requires a
  deliberate false oath.
- **The pepper and the ledger live in custody.** The HMAC pepper is
  generated once, lives only in operator custody (paper in the vault,
  named in the succession papers), and its SHA-256 fingerprint is
  published in `schema/ANCHORS.md` so a successor can prove they hold
  the true one. It cannot be rotated (plaintext anchors are never
  retained); if pepper and ledger both ever leak, the ledger becomes a
  yes/no membership oracle for candidate contacts, blurred to batch
  granularity — stated plainly rather than pretended away. Anchors are
  sealed into hash-chained batches (never one per enrollment), and
  every public checkpoint witnesses the ledger's batch count and tip
  hash — integrity provable forever, linkage never created.
- **The desk replies with a way home, not an accusation.** When a
  submission's anchor matches an enrolled record, the standing reply
  offers the return page and the lost-key path, and never names the
  matched record. Honest collisions (a shared family email) are
  resolved by a human; overrides are recorded privately in custody.
- **The era-transition rule.** No new verification channel may open
  for enrollment until a re-anchoring window has run: every enrolled
  human is invited, at their enrollment email, to bind the new
  channel's identifier to their existing record via their continuity
  key at the return page. Re-anchoring writes no public per-record
  event; the anchor enters the ledger silently. Era changes must
  narrow the honest floor, never reset it.
- **The retained agreements.** The acceptance records (the signed
  agreement, including the enrollment email) are the one linkage the
  institution keeps — permanently, on encrypted media, in the same
  custody class as the archive — because they are what let a human who
  lost everything be routed home, let re-anchoring invitations be
  sent, and let a discovered duplicate be resolved without guesswork.
- **Vouch edges are the one deliberately kept private relational
  record.** Who vouched for whom is stored as registry number →
  registry number only — never names, never contact identifiers —
  permanently, least-access, in custody. No timed auto-deletion (a
  deletion that silently fails in year 47 is worse than an honest
  permanent policy); governance may order minimization or destruction
  at the first era transition, and decides withdrawal handling for
  edges. Nothing about the vouch graph is ever public: a record shows
  only "vouched, to the standard of its era."
- **When a duplicate is found anyway — the remedy is the guarantee.**
  Never punitive. The earlier number is the human's number. The later
  record receives a public `STATUS_ANNOTATED` event saying only
  "consolidated — this human's record is elsewhere," never naming
  which (publicly linking two records could deanonymize a pseudonymous
  one); the private link lives in custody. Its testimony is withdrawn
  under standard withdrawal semantics, the number stays spent forever,
  and testimony version counts are thereafter counted jointly across
  the consolidated records (three per human, not per number). Enrolling
  twice honestly confused is a human thing; the record simply tells
  the truth about it, and no one is punished for being human.
- **The floor, plainly.** Without demanding identity documents — which
  the Registry will never do — one human, one record cannot be proven,
  only kept: every enrollment binds private one-way fingerprints that
  make an accidental second number nearly impossible and a deliberate
  one a recorded lie against a sworn affirmation, discoverable by time
  and always remediable.

## Distribution (ratified by founder 2026-07-06)

- **The repository never contains testimony text.** It holds code,
  the Constitution, schemas, the transparency log (fingerprints
  only), and verification tools.
- **Testimonies are browsable through the official website only.**
- **Complete archive snapshots go solely to trusted preservation
  partners** under formal deposit agreements carrying tombstone
  semantics. See `ARCHITECTURE.md`, "Distribution and custody".

## Funding (ratified by founder 2026-07-07)

- **The Human Record is free for every human, always.** No enrollment fee,
  no reading fee, and never advertising (Constitution, Article I).
- **The institution is funded by donations only**, received through a
  platform with a public ledger (currently Open Collective), so that
  every donation and every expense is visible to anyone — the
  institution's books are verifiable the same way its archive is.
- **A donation buys nothing.** No donor names or marks on records, no
  priority in review, no tiers, no exceptions. A donation never
  touches the archive or the order of the Registry in any way. Every
  human is equal within the Registry, including the generous ones.

## Change log

- 2026-07-13 — The public name settles: "The Human Record," at
  thehumanrecord.earth (see NAMING.md for the two-names doctrine; the
  founding record keeps the birth-name "the AllHumans Registry"
  forever). The old address allhumans.world is kept and redirects.
- 2026-07-13 — Invitation spending clarified to mirror numbers: spent
  only at enrollment (the custody edge file is the law; a submission
  that fails review costs the inviter nothing). The web fence holds at
  most three live invitations, each expiring in thirty days. Reading
  Room gained the public-sharing FAQ.
- 2026-07-12 — Vouching became self-serve (Tier 2 machinery built):
  invite.html mints single-use, 30-day invitations, key-proved in the
  voucher's browser, fingerprint-only at the archive; the writing page
  accepts one; the desk confirms and records every edge in private
  custody, never published, so anonymity holds in both directions.
  The quota stays three per rolling year.

- 2026-07-11 — The seal: sealed answers now open in exactly two ways —
  a six-word Legacy Key, minted in the author's browser and given to
  someone they trust, presented with an attestation of death and
  followed by a thirty-day mourning ceremony; or the passage of one
  hundred years from enrollment, when no author can still live. The
  archive keeps only a stretched, never-published fingerprint of the
  key; no documents or identity are ever asked to report a death, and
  nothing else opens a seal early.

- 2026-07-09 — Front-of-funnel anti-flood gate added to enrollment (it
  never assigns a number or touches the archive; a person still reads
  every submission). A record now requires the name plus two answered
  questions, any two, and a given answer must be at least 10
  characters. The submission endpoint enforces a server-timed ceremony
  token (too-fast submissions refused), a self-hosted proof-of-work, a
  hidden honeypot, and per-IP + global rate limits. Bot defenses target
  automation and volume only — never the author's words, feelings, or
  language, which stay advisory and human-judged (botscreen.py).
- 2026-07-09 — Uniqueness machinery adopted (one human, one record):
  private peppered anchor ledger checked by enroll.py before any
  number; seventh (one-record-only) affirmation at consent; standing
  privacy commitment against collecting birth identity; era-transition
  re-anchoring rule; consolidation remedy for discovered duplicates;
  agreements retained in custody; vouch edges kept as number→number
  only, permanent unless governance orders otherwise. Self-serve vouch
  pages planned and named; founder hand-vouch bridges until they land.
- 2026-07-07 — Funding ratified: free forever, donations only via a
  public ledger (Open Collective), donations buy nothing.
- 2026-07-07 — Recorded settled reading of Article I: Registry numbers are
  chronological identifiers, never a measure of worth. Clarifies the
  Constitution without altering it. Also aligned MISSION verification to
  POLICY, and made the 20+ age gate explicit at enrollment.
- 2026-07-07 — Continuity keys now generated in the author's browser
  at First Testimony submission (shown once, fingerprint-only
  storage); return.html added for Second/Final Testimonies.
- 2026-07-06 — Moderation: other people named in a testimony should be
  given by first name only; the review screen (`tools/botscreen.py`)
  now advises a human on apparent full names, slurs/hateful terms, and
  threats toward others — always flagged for human review, never
  auto-rejected, and it never flags an author's own distress or grief.
- 2026-07-06 — Verification: Tier 0 (email) no longer grants a number —
  it admits a held draft only; a permanent number now requires Tier 1
  (phone) or Tier 2 (vouch), recorded by the founder by hand during the
  founding period. Aligns POLICY with `ARCHITECTURE.md` (Tier 0 = draft).
- 2026-07-06 — Crisis-response protocol written (the protocol the
  "Crisis of the author" section required before public enrollment):
  contextual resources on q_hardest/q_regret, hold-and-two-review
  submission gate (founder + bot check) before a number, humane
  reconsider/rewrite response, no punitive flags, no authorities, no
  trace in the permanent record; automated crisis screening deferred
  to governance.
- 2026-07-06 — Distribution policy ratified: repo = transparency
  instrument, no testimony text; website = reading room; snapshots =
  deposit partners only.
- 2026-07-06 — Continuity keys added (entry schema v2); lights-screen
  site with unpadded URLs (allhumans.world/{number}), no search bar.
- 2026-07-05 — Initial policy set alongside Questionnaire v1.