What the identity and reputation layer can never do to a person — and the standing institution that hears you when something goes wrong anyway.
This page is the constitutional floor under every account: what this program's identity and reputation layer can never do to a person, and the standing institution that hears the appeal when something goes wrong anyway. It exists because an independent review observed, correctly, that these protections were already built and ratified but scattered across simulation results and red-team documents where no rights reviewer would find them. Every clause below is backed by an already-tested mechanism or a ratified rule — nothing here is aspiration — and where the source charter flags a gap, this page flags it too. Full clause-by-clause citations live in the replication kit and the project canon.
Each right below is the plain sentence, then the mechanism that enforces it. In the source charter every clause also carries its evidence citation — a tested simulation result or a ratified invariant. One definition used throughout: the floor is the essentials guarantee, a separately funded module rather than a self-paying promise; where it is active, nothing in this charter's mechanism set ever switches it off.
Your body is the uniqueness check — used only at enrollment and recovery ceremonies — never the stored credential. What gets stored is a salted, non-invertible transform (a one-way scramble the original cannot be recovered from) that can be retired and re-issued so a stolen copy goes worthless; daily life runs on ordinary revocable keys, and biometrics never leave your own device.
Value flows are public; persons are protected pseudonyms; institutions and major owners are named. No per-person trust or intent score exists in the protocol — verdicts attach to claims and bonds to acts, never scores to persons; a detection flag can only re-weight audit sampling, never touch a payout directly; and reading and watching are not logged.
A registrar or a state can stop vouching for you; it can never delete you. Revocation is a multi-party, timelocked act — a government revoking 40,000 dissidents in a week is a statistical fire alarm, not a quiet administrative act — and a betrayed cohort can re-anchor at a constitutional fallback registrar without its issuer's consent.
During any compromise or dispute, essentials keep paying while above-floor activity pauses until body-present re-verification. A compromised cohort is never disabled — it drops to floor-capped trust, which also puts a computable ceiling on what any attacker can take.
Notice, evidence, adjudication, appeal, and independent review — penalties are proportional and adjudicated, never automatic social death. No algorithm ever executes a penalty by itself, an accusation can be answered without joining the system, adjudication speed is a funded target so that accusation cannot function as punishment — and the standing institution this right was missing is now specified and ratified (provisional): the appeals ladder below.
Every penalty in every ratified class is a bond, a clawback, a pause, or a reputational consequence above the floor. Nothing you are accused of, or found to have done, switches essentials off — quarantine keeps paying through mass compromise, and a lending default discharges against the floor, never through it.
Getting your account back is a contest the true owner wins: a fresh body-present ceremony plus your continuity web — tenure, contribution history, device fleet, guardians named at enrollment — the things no thief can exfiltrate as a file. For the coerced there is a duress-capable veto (a distress code that looks like consent and silently flags the coercion), timelocks that scale with the value at stake, and notification on every registered channel — so a forced takeover must persist implausibly long, in public.
Your identity gets safer with tenure: the evidence gap between owner and impostor widens every year, and a stolen credential matches nothing once its scrambling era is retired. Cohort caps — no registrar or credential era above roughly 15% of active minting weight — keep any breach a slice of the population, never the whole.
The platform cannot confirm whose account made a conduct claim — by architecture, not policy, and at constitutional class. What the system could be compelled to reveal, it is built unable to reveal; suspicion divided across everyone who could have known is the retaliation defense.
Participation is optional at every step, and leaving forfeits nothing already earned. Export and portability are conformance requirements, any borrower can walk away to the floor rather than be held, and attribution is permanent — the record of what you made survives your departure.
Behind these rights sits a ratified sanctions-and-recovery matrix covering every violation class — engagement fraud, identity rental, conduct-claim abuse, lending default, governance abuse. Its reading rule: penalties are denominated in bonds, clawbacks, pauses, and reputation — the things a person stakes — never in essentials, erasure, or silence. The floor, recovery rights, due process, and pseudonymity are never sanction surfaces, in any class.
Every adverse action the protocol can take against a person — an identity denial, a fraud slash, a quarantine, a payout ruling, a conduct verdict — has a route to review that does not run through the party that took the action. The standing institution below was ratified July 31, 2026 (v0.1, decision record DR-27), closing the gap the charter itself flagged as its largest. Constitutional design questions are not appealed here — that is the amendment process — and nothing here waives anyone's right to ordinary courts: decisions export as evidence packets on request.
A second look by a different operator team than the one that acted, plus automated consistency checks. No forms beyond “I contest this,” and skippable — going straight to a panel is always allowed. This tier catches clerical error, which is most of the volume.
Five members drawn by civic lottery from verified participants — bonded, country-capped, conflict-screened, the same jury machinery the protocol already prices — plus a trained neutral facilitator who does not vote. Everything is reviewed fresh, new evidence allowed, and the burden of justifying the action sits on the party that took it, not on you. Written reasoning, with any minority note, is published pseudonymized. Speed is funded as a target, because adjudication speed is the only lever that bounds harm in the meantime.
Three lottery members on longer, staggered terms plus two named independent professionals with rights or arbitration backgrounds — publicly named, conflicts disclosed, confirmed by both governance houses, removable only for cause by supermajority. It hears rights-class questions, split panels, systemic grievances (a pattern harming a class of participants, no single named decision required), and emergencies — and it publishes precedential rationales, a growing public casebook that lower panels must consult. Its budget is a fixed formula line, multi-year, so whoever it embarrasses cannot defund it. The actor never judges its own act: operator and registrar staff are structurally excluded from Tiers 1 and 2, and reviewers see case evidence only — never behavioral profiles or global scores, which do not exist.
When an adverse action threatens essentials access, identity survival, or otherwise irreversible harm, it pauses on filing, with a formal decision inside a published 72-hour target. The only exception is an active-fraud certification made in writing — and that certification is itself reviewable. Essentials never needed the stay: the floor already keeps paying through quarantine; the stay extends that protection to the rest of a person's economic life.
First appeals are always free for individuals — a grievance channel that costs money measures wealth, not error, a lesson taken from World Bank grievance-redress practice. Only a filer twice ruled abusive by a panel faces a small refundable bond on further filings, and that ruling is itself appealable once; institutional parties pay cost-based fees. Language, disability, and offline assistance are a service standard, not a courtesy. Remedies run from reversal and repayment of anything wrongly withheld, through bounded compensation from the operator's bond where the error caused loss, to systemic-fix orders — and a wrong mark is corrected by visible annotation, never silent deletion, because the ledger is append-only and corrects itself in public.
The Review Board owns a quarterly, machine-readable publication: reversal rates by tier, by decision class, and by demographic group; median resolution times against every published target; stay grants and outcomes; cost per case; repeat-grievance rates; and wrongful-denial counts. The identity pilot separately commits to publishing false-accept and false-reject rates by demographic group, median enrollment and recovery times, appeal and reversal rates, and cost per verified participant — because a system that stops fraud by locking out legitimate people is a failure even if the fraud numbers look great.
A system that publishes its own error rates is the difference between due process and its costume.
The ratified charter ends with its own limits, and so does this page. These are stated as limits in the source document — disclosed there, not discovered by critics later.
The wrench. Physical coercion is bounded — the duress veto, value-scaled timelocks, and every-channel notification make it slow, public, and flaggable — but not solved. A patient, private coercer of a low-profile victim can still win.
The liveness arms race. Every identity guarantee above leans on ceremonies telling live bodies from fakes. That is the program's single load-bearing open assumption: the simulations price the design around it, and only a live identity pilot prices the assumption itself.
Population-scale recovery is logistics, not magic. A mass breach or mass political revocation is a months-long operation — about five months worst-case at full re-verification capacity, ten at half. Quarantine economics are what make months survivable; nothing makes them instant.
Off-ledger life is invisible by construction. The system sees only its own flows; off-protocol income and positions cannot be seen or garnished, so enforcement is partial and lenders price the residual. The disclosure protections likewise carry named limits: very small anonymity sets remain frightening, and off-protocol retaliation cannot be ruled out.
Six evidence gaps remain disclosed in the source charter — ratification adopted them as flagged, not resolved. The largest concerns this page's second half: the appeals institution is newly specified and untested. Its time targets (14 days, 60 days, 72 hours) are published targets, not demonstrated performance; its case-volume, cost, and capture-resistance numbers are named successor work, deliberately left unregistered until the current body of work clears external review.
Ratified July 31, 2026 — provisional per the program's convention: everything on this page remains open to revision under external review (economist, out-of-family, and human-rights). The controlling texts are the Rights Charter & Sanctions-Recovery Matrix (v1.0) and the Appeals & Grievance Body Spec (v0.1, DR-27); clause-by-clause citations to the tested simulation results and ratified decision records travel with the replication kit. · Independent reviews · The paper · Evidence