# The Human Record — Policy (living document)
*These are the institution's current, deliberately changeable rules.
They implement the Constitution but are not part of it: governance
may revise them as the world and the archive teach us more. The
Constitution is immutable; this is where the institution is allowed
to learn. Every change here should be dated and its reasoning kept.*
Last updated: 2026-07-13.
## Constitutional interpretation — settled readings
The Constitution is immutable (Article IX). Where its wording raises a
reasonable question, the institution records the settled reading here
rather than altering the sealed text.
- **Article I and Registry numbers.** Article I forbids any metric,
ranking, or measure of worth attaching to a human. A Registry
identification number is not such a measure. It is a chronological
identifier — assigned in the order records are approved — that exists
solely to preserve continuity and make each record findable. A lower
number means only "enrolled earlier," never "worth more." Time of
enrollment is the one non-hierarchical distinction the Registry
records, and it cannot be bought, ranked, or gamed. The Registry
displays no popularity, engagement, or ranking metric of any kind.
This clarifies Article I; it does not change it. (Settled 2026-07-07.)
## Eligibility
- **Minimum age: 20 years.** The Registry preserves considered adult
testimony, not childhood snapshots. Revisable by governance.
## Testimonies
- **Count: at most three per human** (First, Second, Final). This
count is fixed by Constitution Article IV and is *not* a policy
choice — listed here only for completeness.
- **Minimum spacing: one year between testimonies.** Rationale: the
reflective questions ("what has changed") are only truthful once a
life has moved; one year is the smallest natural, century-legible
unit that guarantees this, and the least restrictive gate that
still protects the design. Accepted cost: a person with little
time leaves one complete testimony rather than three. Revisable by
governance as real data accrues.
- **Character cap: 400 per answer.** Revisable, but changing it
retroactively is discouraged — old testimonies were written to the
cap of their era.
- **Minimum per given answer: 10 characters** (added 2026-07-09): an
answer a person chooses to give must be at least a few words. This
is not a demand to answer — every question stays optional and a
blank is kept as honest silence — only that an *answered* question
hold something real, not a stray character.
- **The name is capped at 30 characters** (added 2026-07-07): it is a
name, not a message. Enforced at the writing page and at enrollment.
- **All answers optional except the name — but a record needs
substance** (added 2026-07-09): a submission must carry the name and
at least **two answered questions**, any two the author chooses. The
name is identity, not testimony, so it does not count toward the
two. This respects sovereignty (no particular question is ever
required) while ensuring a record is a testimony, not an empty
shell. Enforced at the writing page and at the submission endpoint;
never at enrollment, which spends the number and touches the archive.
## Verification (the standard of this era)
- **Tier 0 (verified email) grants no number.** It is enough to write
and submit a draft, which is held for review — but an unverified
email alone never earns a permanent Registry number. This keeps the
numbers meaningful and protects them from automated and throwaway
sign-ups.
- **A number requires Tier 1 or higher.** Tier 1 (verified phone) or
Tier 2 (vouched by an already-verified human) is what admits a
record and assigns its number; Tier 3 (documented) is opt-in and
never required. During the founding period, before phone machinery
exists, the founder records the granting verification by hand on
each reviewed submission, and the archive assigns a number only to a
sitting already marked Tier ≥ 1. Every record displays the
verification standard under which it was admitted.
- **Tier 2 is site machinery (built 2026-07-12):** an enrolled human
proves their continuity key at invite.html and mints a single-use,
30-day invitation in their own browser. On the site it is called an
invitation; in this policy's vocabulary it is a vouch. Only the
invitation's fingerprint ever reaches the archive. The quota is
three per rolling year, an integrity throttle, never displayed as a
running count anywhere. An invitation is spent the way a number is
spent: only at enrollment. A submission that fails review costs the
inviter nothing; the desk judges the year's three from the custody
edge file. The web machinery merely refuses to hold more than three
live invitations at a time (each lives thirty days). Minting asks the voucher's word on four
things: the candidate is a living human aged twenty or more, known
to them in person, who to their knowledge holds no record. The
candidate enters the invitation when writing their First Testimony;
the archive resolves it to the voucher's number itself, and the desk
still confirms every edge before a number is spent. Who vouched for
whom is recorded number to number in private custody only, never
published on any page, and the invitation carries no number, so
anonymity holds in both directions. The founder's hand-vouch remains
available where no invitation exists; every path binds the same
anchors, so no route leaves holes in uniqueness.
- Higher tiers and the machinery for phone and vouching are described
in `ARCHITECTURE.md` and adopted by governance as the archive grows.
Verification exists to increase trust, never to exclude.
## Privacy and sealing
- **Anonymity is a first-class mode:** a record may be published
under its number and chosen name only.
- **Any answer may be sealed until death** — see "The seal" below for
exactly how, and when, sealed words open.
- **Naming living people:** a testimony holds the author's own truth,
not accusations against named living third parties. This is a
moderation line, applied with care.
- **Other people appear by first name only** (added 2026-07-06, stated
in the entry consent page): a testimony must never include another
person's full name. The author tells their story without exposing
someone else's identity.
- **Others are named by first name only.** Any other person mentioned
in a testimony should be identified by first name alone, never by
full name — enough to tell the story, not enough to expose or
implicate a specific living individual. The review screen flags
apparent full names for a human to check; this is a moderation
judgment, never an automatic block.
## Crisis of the author (crisis-response protocol)
Two of the shared questions — `q_hardest` ("the hardest thing I have
carried") and `q_regret` ("the one thing I regret") — will sometimes
receive disclosures of acute distress, and occasionally of active
crisis. This is the written protocol the founding required to exist
*before* public enrollment opens. Its governing stance is fixed:
humane, private, non-punitive, and non-surveillant. Every rule below
serves an author writing in a hard moment, not the institution's
convenience.
- **Distress is legitimate testimony, not a defect to remove.** Grief,
despair, shame, and pain are part of the human record; they are
never edited, softened, or excluded for being heavy, and no
testimony is ever refused for being dark. This protocol addresses
only the narrow case of *active crisis* — a disclosure of intent to
end one's life, or to harm oneself or another, now. It never
polices sorrow.
- **Resources are offered at the moment of writing.** Alongside the two
heaviest questions, the enrollment interface shows — quietly, for
everyone, with no analysis of what the author has typed — a link to
help. The link points to a maintained international directory
(findahelpline.com, with befrienders.org and the IASP directory as
alternates), never to a single country's line, so the offer works
worldwide and stays honest for anonymous authors whose location the
archive does not know. The actual, changeable list of resources
lives in the interface, not frozen into this policy, so it can never
go century-stale here.
- **The submission gate: two reviews before a number.** A submitted
testimony is *held* — no Registry number assigned, nothing published
— until it passes two reviews: a founder's humane read, and an
automated check against bot and spam submissions. Because numbers
are assigned only on approval, this gate never consumes a permanent
number and never writes to the archive. The review queue is
operational scratch space (see `ARCHITECTURE.md`), not part of the
permanent record.
- **The humane response to active crisis.** When a held testimony
discloses active crisis, the response is twofold: confirm that help
was offered, and give the author a private, unhurried chance to
reconsider or rewrite before their words become permanent — because
a testimony, once numbered, is never modified (Constitution,
Article IV). This pause is care about permanence, not censorship:
the author remains free to submit their words exactly as written,
and approval is never withheld because a testimony is sorrowful.
- **What the protocol never does.** No punitive flag is ever stored on
a record. No report is ever made to authorities or to any third
party. No risk score, label, or crisis classification is ever
attached to a Registry entry — Article I forbids any metric on a
human record, now or ever. The Human Record is an archive, not a monitoring
service and not an emergency service; it says so plainly to authors,
cannot guarantee intervention, and does not surveil.
- **No trace in the permanent record.** Any note made while handling a
crisis submission lives only in the ephemeral review space and is
discarded once the testimony is resolved — approved, revised, or
withdrawn. The permanent archive holds the testimony and the
verification standard of its era, never the fact that it was read
for crisis.
- **Named living third parties.** Where distress involves accusations
against named living people, the existing moderation line applies
with the same care: a testimony holds the author's own truth, not
charges against named living others.
- **Scale-up is a governance decision.** At founding scale the founder
reads every testimony (see `ARCHITECTURE.md`, "Growth path"). As
volume grows, ML-assisted crisis-language screening with a
human-review path may be adopted — but only by governance, and
always subordinate to the principles above: resources, not flags;
care, not surveillance. Any automated reading of testimony text for
crisis, including client-side detection, remains a deliberately
deferred choice, never introduced silently.
## Continuity keys (added 2026-07-06; browser-generated 2026-07-07)
- **The key is generated in the author's own browser** at the moment
their First Testimony is submitted, and shown exactly once — never
again, to anyone. No one else, founder included, ever sees it. The
archive keeps only its SHA-256 fingerprint (format `ah1-…`,
128 bits). Like a wallet seed, keeping it safe is the owner's
responsibility. (A key is generated at the review desk only for
founder-mediated ceremonies conducted without a browser.)
- **Verification is automatic and threefold.** Each record's key
fingerprint is published at `keys/{n}.json`; the return page
verifies the entered key against it instantly (a wrong key opens
nothing), the site's worker re-verifies on submission, and
`tools/testify.py` verifies once more at the ceremony. Founding-era
honesty: the key travels encrypted (TLS) with the return submission
and is discarded after the ceremony — never stored. The planned
upgrade is signature-based proof that never transmits the key (the
version schema reserves the field).
- **The key is the proof of return.** Entering the Second or Final
Testimony, and requesting withdrawal, require presenting it. No one
else — operator and founder included — can add words to a record.
- **Lost keys are not regenerated.** A human who has lost their key
may still withdraw (their strongest protection) through the
founder/governance override after out-of-band identity proof; the
override and its reason are recorded permanently in the log.
Whether a re-keying process should ever exist is a governance
decision, deliberately deferred until real cases teach us.
## The seal (added 2026-07-11)
A sealed answer is kept in the archive but shown to no one. The
promise "until death" is kept without ever collecting the means of
verifying a death — no death certificates, no real names, no
documents, in keeping with the standing privacy commitment. Seals
open in exactly two ways:
- **The trusted door — the Legacy Key.** When an author seals words,
their browser mints a second key: six plain words (from a frozen
public wordlist), shown once, kept by no one. Deliberately unlike
the hex continuity key, so the two can never be confused: one is
code, one is words — words meant to be spoken, written on paper,
and given to a person. The archive stores only a stretched
fingerprint (PBKDF2, 600,000 rounds, salted with the record's
continuity fingerprint) and **never publishes it** — so there is
nothing online or offline to guess against, and each guess at the
six words costs six hundred thousand hashes besides. Whoever the
author trusted brings the words to the Legacy page, attests the
death — no identity, no documents asked — and the report goes to
the steward's desk.
- **The mourning ceremony, before anything opens:** the steward
writes to the record's enrollment email and waits **thirty days**.
A living author simply answers, and nothing happens — the strongest
gate against a false or premature report is the author themself.
Then the ceremony: the record's status becomes **memorialized** (a
completed life), a MEMORIALIZED event enters the public log, and
every sealed answer on the record opens. One report opens all of a
record's seals — death is one event.
- **The time door — the century.** One hundred years after
enrollment, all seals open on their own. The minimum enrollment age
is twenty, so a century later no author can still live: time itself
has reported the death, with certainty, for every record whose key
was lost, never given, or never used. This door is pure arithmetic
at site-build time — it needs no operator, no timer, and no
machinery to survive the decades, and it cannot fail to fire.
- **No third door.** Without the words or the century, seals do not
open — not for the steward, not for governance, not on request.
A sealed answer with no Legacy Key (the email path allows it)
simply waits for time.
*Some are opened by those we trust. The rest are opened by time
itself.*
## Uniqueness — one human, one record (added 2026-07-09)
The Constitution's premise is one light per human. This section is the
machinery of this era that keeps it — and the honest statement of what
no machinery can do.
- **Identity anchors.** Every enrollment binds its durable contact
identifiers — the enrollment email today, a verified phone when that
tier exists — as *anchors*: kept privately, only as one-way keyed
fingerprints (HMAC, `schema/ANCHORS.md`), never published, never in
the archive, never in the repository, never on the web host.
`tools/enroll.py` — the only tool that ever spends a number, in
every era — refuses to enroll while any anchor on a submission
matches the ledger. Anchors outlive verification machinery: dedup is
deliberately decoupled from the tier system, so changing how humans
are verified never resets how they are remembered.
- **A standing privacy commitment: the Registry does not collect birth
identity.** No birth names, no dates of birth, no birthplaces beyond
the coarse optional public field, no government identifiers, no
biometrics. The safest data is data never held; hashing low-entropy
birth facts gives false privacy (they are re-identifiable by brute
force), and it barely stops a determined liar anyway while chilling
exactly the people the archive most owes anonymity. Recognition
stays contact-anchored. If a future era ever truly needs more, the
mechanism must be adopted by open governance, opt-in, hashed at the
desk, never stored raw, never published — and never applied
retroactively. (`entry.v2` reserves a `recognition` field so early
records could attach such a mark later without re-enrolling.)
- **The sworn record.** Enrollment requires affirming: *"This is my
only Registry record — I have never enrolled before, and I
understand that every human may hold exactly one, forever."* A
duplicate is thereby never an accident of the system: it requires a
deliberate false oath.
- **The pepper and the ledger live in custody.** The HMAC pepper is
generated once, lives only in operator custody (paper in the vault,
named in the succession papers), and its SHA-256 fingerprint is
published in `schema/ANCHORS.md` so a successor can prove they hold
the true one. It cannot be rotated (plaintext anchors are never
retained); if pepper and ledger both ever leak, the ledger becomes a
yes/no membership oracle for candidate contacts, blurred to batch
granularity — stated plainly rather than pretended away. Anchors are
sealed into hash-chained batches (never one per enrollment), and
every public checkpoint witnesses the ledger's batch count and tip
hash — integrity provable forever, linkage never created.
- **The desk replies with a way home, not an accusation.** When a
submission's anchor matches an enrolled record, the standing reply
offers the return page and the lost-key path, and never names the
matched record. Honest collisions (a shared family email) are
resolved by a human; overrides are recorded privately in custody.
- **The era-transition rule.** No new verification channel may open
for enrollment until a re-anchoring window has run: every enrolled
human is invited, at their enrollment email, to bind the new
channel's identifier to their existing record via their continuity
key at the return page. Re-anchoring writes no public per-record
event; the anchor enters the ledger silently. Era changes must
narrow the honest floor, never reset it.
- **The retained agreements.** The acceptance records (the signed
agreement, including the enrollment email) are the one linkage the
institution keeps — permanently, on encrypted media, in the same
custody class as the archive — because they are what let a human who
lost everything be routed home, let re-anchoring invitations be
sent, and let a discovered duplicate be resolved without guesswork.
- **Vouch edges are the one deliberately kept private relational
record.** Who vouched for whom is stored as registry number →
registry number only — never names, never contact identifiers —
permanently, least-access, in custody. No timed auto-deletion (a
deletion that silently fails in year 47 is worse than an honest
permanent policy); governance may order minimization or destruction
at the first era transition, and decides withdrawal handling for
edges. Nothing about the vouch graph is ever public: a record shows
only "vouched, to the standard of its era."
- **When a duplicate is found anyway — the remedy is the guarantee.**
Never punitive. The earlier number is the human's number. The later
record receives a public `STATUS_ANNOTATED` event saying only
"consolidated — this human's record is elsewhere," never naming
which (publicly linking two records could deanonymize a pseudonymous
one); the private link lives in custody. Its testimony is withdrawn
under standard withdrawal semantics, the number stays spent forever,
and testimony version counts are thereafter counted jointly across
the consolidated records (three per human, not per number). Enrolling
twice honestly confused is a human thing; the record simply tells
the truth about it, and no one is punished for being human.
- **The floor, plainly.** Without demanding identity documents — which
the Registry will never do — one human, one record cannot be proven,
only kept: every enrollment binds private one-way fingerprints that
make an accidental second number nearly impossible and a deliberate
one a recorded lie against a sworn affirmation, discoverable by time
and always remediable.
## Distribution (ratified by founder 2026-07-06)
- **The repository never contains testimony text.** It holds code,
the Constitution, schemas, the transparency log (fingerprints
only), and verification tools.
- **Testimonies are browsable through the official website only.**
- **Complete archive snapshots go solely to trusted preservation
partners** under formal deposit agreements carrying tombstone
semantics. See `ARCHITECTURE.md`, "Distribution and custody".
## Funding (ratified by founder 2026-07-07)
- **The Human Record is free for every human, always.** No enrollment fee,
no reading fee, and never advertising (Constitution, Article I).
- **The institution is funded by donations only**, received through a
platform with a public ledger (currently Open Collective), so that
every donation and every expense is visible to anyone — the
institution's books are verifiable the same way its archive is.
- **A donation buys nothing.** No donor names or marks on records, no
priority in review, no tiers, no exceptions. A donation never
touches the archive or the order of the Registry in any way. Every
human is equal within the Registry, including the generous ones.
## Change log
- 2026-07-13 — The public name settles: "The Human Record," at
thehumanrecord.earth (see NAMING.md for the two-names doctrine; the
founding record keeps the birth-name "the AllHumans Registry"
forever). The old address allhumans.world is kept and redirects.
- 2026-07-13 — Invitation spending clarified to mirror numbers: spent
only at enrollment (the custody edge file is the law; a submission
that fails review costs the inviter nothing). The web fence holds at
most three live invitations, each expiring in thirty days. Reading
Room gained the public-sharing FAQ.
- 2026-07-12 — Vouching became self-serve (Tier 2 machinery built):
invite.html mints single-use, 30-day invitations, key-proved in the
voucher's browser, fingerprint-only at the archive; the writing page
accepts one; the desk confirms and records every edge in private
custody, never published, so anonymity holds in both directions.
The quota stays three per rolling year.
- 2026-07-11 — The seal: sealed answers now open in exactly two ways —
a six-word Legacy Key, minted in the author's browser and given to
someone they trust, presented with an attestation of death and
followed by a thirty-day mourning ceremony; or the passage of one
hundred years from enrollment, when no author can still live. The
archive keeps only a stretched, never-published fingerprint of the
key; no documents or identity are ever asked to report a death, and
nothing else opens a seal early.
- 2026-07-09 — Front-of-funnel anti-flood gate added to enrollment (it
never assigns a number or touches the archive; a person still reads
every submission). A record now requires the name plus two answered
questions, any two, and a given answer must be at least 10
characters. The submission endpoint enforces a server-timed ceremony
token (too-fast submissions refused), a self-hosted proof-of-work, a
hidden honeypot, and per-IP + global rate limits. Bot defenses target
automation and volume only — never the author's words, feelings, or
language, which stay advisory and human-judged (botscreen.py).
- 2026-07-09 — Uniqueness machinery adopted (one human, one record):
private peppered anchor ledger checked by enroll.py before any
number; seventh (one-record-only) affirmation at consent; standing
privacy commitment against collecting birth identity; era-transition
re-anchoring rule; consolidation remedy for discovered duplicates;
agreements retained in custody; vouch edges kept as number→number
only, permanent unless governance orders otherwise. Self-serve vouch
pages planned and named; founder hand-vouch bridges until they land.
- 2026-07-07 — Funding ratified: free forever, donations only via a
public ledger (Open Collective), donations buy nothing.
- 2026-07-07 — Recorded settled reading of Article I: Registry numbers are
chronological identifiers, never a measure of worth. Clarifies the
Constitution without altering it. Also aligned MISSION verification to
POLICY, and made the 20+ age gate explicit at enrollment.
- 2026-07-07 — Continuity keys now generated in the author's browser
at First Testimony submission (shown once, fingerprint-only
storage); return.html added for Second/Final Testimonies.
- 2026-07-06 — Moderation: other people named in a testimony should be
given by first name only; the review screen (`tools/botscreen.py`)
now advises a human on apparent full names, slurs/hateful terms, and
threats toward others — always flagged for human review, never
auto-rejected, and it never flags an author's own distress or grief.
- 2026-07-06 — Verification: Tier 0 (email) no longer grants a number —
it admits a held draft only; a permanent number now requires Tier 1
(phone) or Tier 2 (vouch), recorded by the founder by hand during the
founding period. Aligns POLICY with `ARCHITECTURE.md` (Tier 0 = draft).
- 2026-07-06 — Crisis-response protocol written (the protocol the
"Crisis of the author" section required before public enrollment):
contextual resources on q_hardest/q_regret, hold-and-two-review
submission gate (founder + bot check) before a number, humane
reconsider/rewrite response, no punitive flags, no authorities, no
trace in the permanent record; automated crisis screening deferred
to governance.
- 2026-07-06 — Distribution policy ratified: repo = transparency
instrument, no testimony text; website = reading room; snapshots =
deposit partners only.
- 2026-07-06 — Continuity keys added (entry schema v2); lights-screen
site with unpadded URLs (allhumans.world/{number}), no search bar.
- 2026-07-05 — Initial policy set alongside Questionnaire v1.