← All documents

Constraints

What the archetype stress tests demand. Requirements to build against, not a scope boundary.

Numbers are stable — the specs cite them. Where a constraint is one application of the attestation model, it says so in a line rather than deriving the idea again.


Hard constraints

Non-negotiable. A design that violates one is wrong regardless of its merits.

Constraint Source
H1 No data about the people being served — no field, no convention, no exception* Medic, ethics
H2 Panic wipe destroys the wipeable tier completely; identity survives Protest Medic
H3 No legal names anywhere. Contact details only where an operator opts in for themselves Skeptic, Convert
H4 Duress is always deliberate, never inferred from silence Heart
H5 Volatile data displays its age; stale reads "call first" — weight from method and age Medic
H6 Runs on a prepaid Android 8 with ~400MB free Convert — measured 2026-08-20, see device-floor.md: the constraint is real but it is about storage, and the CPU is not what makes the app slow
H7 Knowledge layer fully usable offline Outpost
H8 Every network call auditable; no third-party analytics. No push except opt-in Distress paging Skeptic

* H1 is a rule about what the system offers, not something software can enforce. Field notes are free text. What the design guarantees is that no field, schema or feature ever invites it. Claiming enforcement we don't have would be the overclaim this project keeps catching.


Attestation, applied

One idea: an attestation is a claim, its author, how they know, and what that is worth. These are its instances. Read the page once; each line below is a consequence, not a separate principle.

C3 No central social graph. Attestations are held by their subject, never indexed
C13 Endorsements carry scope tags, never free text. A claim has a shape
C14 A credential names only its signer — "I vouch for the holder"
C20 Provenance by name, never a count. Recognition beats a tally
C21 Seeded entries look visibly different. Method must be visible, not merely recorded
C23 Watch state visible before sign-on. Capability is attested, not assumed
C25 Agents are always identified as agents. Authorship is never ambiguous
C29 Unannounced escalation drills, results published. A mechanism attests to itself
C30 Agent capability assigned externally and re-checked. Self-report grants nothing
C31 No agent is exempt from screening, including ours
C32 Passing means "no evidence found yet," never "verified." Nothing ends the question

No number that invites gaming

Related, and the reason is the same: a tally can be manufactured, a recognised author cannot.

C5 No streaks, badges, leaderboards or absence commentary
C16 Funding is independent of visibility, and totals are never shown
C22 The recap discloses no team size or collective activity, and makes no impact claims

Consent is per-person and revocable

C1 Every social feature has an off switch, and the app works with all of them off
C15 Presets set switches, never override them. No preset is visible to anyone else
C34 An operator may decline to sign on under a specific watch, silently
C38 An operator may waive protections for themselves; never for a third party
C39 Every opt-in is off by default, honestly priced, encrypted, scoped, revocable, auditable

Safety mechanics

Distinct machinery, not restatements.

C4 — Missed check-in nudges; it never escalates. Alarm fatigue kills the one feature where failure means someone is hurt.

C24 — Distress terminates in a human, or reports that it couldn't. No triage, no filtering, no agent assessment. Every step reported back.

C40 — A paging channel is a condition of the on-call role. Without one the ladder is a promise that cannot be kept. Declining is legitimate; it means not being on-call.

C41 — Engagement notifications are banned; safety paging is not. Conflating them once left the ladder unable to wake anyone.

C42 — The escalation ladder may fail, but never quietly. An empty roster and no contact still produces "couldn't reach anyone."

C33 — Watch actions are logged and reviewable by the operators they concern. The watch is the highest-privilege position in the system.

Memory has opposite rules

C27 — The board is Live, never stored. No queryable history of who was out where.

Resolves against C33 by separation: the board expires; the accountability log records what the watch did — actions, never positions, areas or query text.

C9 — Export everything. Nothing holds an operator captive.

C26 — No cloud inference on operational data. Local inference only.

C36 — Node operators see routing metadata only. Board contents never legible to a relay.

Knowledge

C8 — Flagging is always easier than fixing. Most people only ever have the first half.

C17 — Correction works offline and queues. Discovery happens at the worst moment for connectivity and the most urgent moment for action.

C18 — Design for the minority who maintain; free-riding stays costless. A directory demanding reciprocity gets abandoned by the people it most needs.

C12 — No city starts empty. Thin and obviously imperfect beats a blank screen.

Reach and growth

C2 — Standing accrues on two independent axes. Contribution requires nobody's permission, so deep knowledge with no social history still builds real standing.

C7 — Presence shows the wider network, not just the local one. For an isolated operator an empty local map reads as you are alone.

C19 — Team presence and network presence are separate features. Team works at three operators; network needs density that doesn't exist early.

C11 — Growth follows existing trust paths. No referral rewards, invite quotas, contact upload or proximity pressure.

C6 — Give the Public Face something designed to leave the app. Absent one, he screenshots something with a teammate's callsign in it.

C10 — Offline is a normal state, not an error. Degrade visibly; never fail silently.

C28 — Watch is shareable. Answering questions must not require holding the whole board.

C35 — Field data crosses to analysts as patterns, never as operator records.

C37 — Allied interop is time-boxed and op-scoped. Federation without membership.


Known conflicts and their resolutions

Team oversight vs. operator autonomy → visibility is granted by the operator, never claimed by the lead.

Durable records vs. seizure risk → split by tier. There is no position history to subpoena because none is retained.

Publicity vs. pseudonymity → solved by provision, not restriction. Give him a scrubbed, shareable artifact.

Accuracy vs. coverage → accuracy wins. Thin and correct beats comprehensive and rotting.

Open questions

  • Sybil resistance is weak by choice. Every countermeasure worth having needs identity or history, which excludes the operators with the most valuable knowledge. The answer is provenance over count (C20) and out-of-band verification where infiltration is the real threat.
  • Directory maintenance — still the largest unproven assumption in the project.
  • Presence density — the threshold at which a live count stops being depressing is untested.
  • Seeding quality varies by region. Public data is good in some metros and nearly absent in others.

docs/research/constraints.md