# AllHumans — Policy (living document)
*These are the institution's current, deliberately changeable rules.
They implement the Constitution but are not part of it: governance
may revise them as the world and the archive teach us more. The
Constitution is immutable; this is where the institution is allowed
to learn. Every change here should be dated and its reasoning kept.*
Last updated: 2026-07-06.
## Eligibility
- **Minimum age: 20 years.** The Registry preserves considered adult
testimony, not childhood snapshots. Revisable by governance.
## Testimonies
- **Count: at most three per human** (First, Second, Final). This
count is fixed by Constitution Article IV and is *not* a policy
choice — listed here only for completeness.
- **Minimum spacing: one year between testimonies.** Rationale: the
reflective questions ("what has changed") are only truthful once a
life has moved; one year is the smallest natural, century-legible
unit that guarantees this, and the least restrictive gate that
still protects the design. Accepted cost: a person with little
time leaves one complete testimony rather than three. Revisable by
governance as real data accrues.
- **Character cap: 400 per answer.** Revisable, but changing it
retroactively is discouraged — old testimonies were written to the
cap of their era.
- **The name is capped at 30 characters** (added 2026-07-07): it is a
name, not a message. Enforced at the writing page and at enrollment.
- **All answers optional except the name.**
## Verification (the standard of this era)
- **Tier 0 (verified email) grants no number.** It is enough to write
and submit a draft, which is held for review — but an unverified
email alone never earns a permanent Registry number. This keeps the
numbers meaningful and protects them from automated and throwaway
sign-ups.
- **A number requires Tier 1 or higher.** Tier 1 (verified phone) or
Tier 2 (vouched by an already-verified human) is what admits a
record and assigns its number; Tier 3 (documented) is opt-in and
never required. During the founding period, before phone or vouching
machinery exists, the founder records the granting verification by
hand on each reviewed submission, and the archive assigns a number
only to a sitting already marked Tier ≥ 1. Every record displays the
verification standard under which it was admitted.
- Higher tiers and the machinery for phone and vouching are described
in `ARCHITECTURE.md` and adopted by governance as the archive grows.
Verification exists to increase trust, never to exclude.
## Privacy and sealing
- **Anonymity is a first-class mode:** a record may be published
under its number and chosen name only.
- **Any answer may be sealed until death**, revealed only on verified
memorialization.
- **Naming living people:** a testimony holds the author's own truth,
not accusations against named living third parties. This is a
moderation line, applied with care.
- **Other people appear by first name only** (added 2026-07-06, stated
in the entry consent page): a testimony must never include another
person's full name. The author tells their story without exposing
someone else's identity.
- **Others are named by first name only.** Any other person mentioned
in a testimony should be identified by first name alone, never by
full name — enough to tell the story, not enough to expose or
implicate a specific living individual. The review screen flags
apparent full names for a human to check; this is a moderation
judgment, never an automatic block.
## Crisis of the author (crisis-response protocol)
Two of the shared questions — `q_hardest` ("the hardest thing I have
carried") and `q_regret` ("the one thing I regret") — will sometimes
receive disclosures of acute distress, and occasionally of active
crisis. This is the written protocol the founding required to exist
*before* public enrollment opens. Its governing stance is fixed:
humane, private, non-punitive, and non-surveillant. Every rule below
serves an author writing in a hard moment, not the institution's
convenience.
- **Distress is legitimate testimony, not a defect to remove.** Grief,
despair, shame, and pain are part of the human record; they are
never edited, softened, or excluded for being heavy, and no
testimony is ever refused for being dark. This protocol addresses
only the narrow case of *active crisis* — a disclosure of intent to
end one's life, or to harm oneself or another, now. It never
polices sorrow.
- **Resources are offered at the moment of writing.** Alongside the two
heaviest questions, the enrollment interface shows — quietly, for
everyone, with no analysis of what the author has typed — a link to
help. The link points to a maintained international directory
(findahelpline.com, with befrienders.org and the IASP directory as
alternates), never to a single country's line, so the offer works
worldwide and stays honest for anonymous authors whose location the
archive does not know. The actual, changeable list of resources
lives in the interface, not frozen into this policy, so it can never
go century-stale here.
- **The submission gate: two reviews before a number.** A submitted
testimony is *held* — no Registry number assigned, nothing published
— until it passes two reviews: a founder's humane read, and an
automated check against bot and spam submissions. Because numbers
are assigned only on approval, this gate never consumes a permanent
number and never writes to the archive. The review queue is
operational scratch space (see `ARCHITECTURE.md`), not part of the
permanent record.
- **The humane response to active crisis.** When a held testimony
discloses active crisis, the response is twofold: confirm that help
was offered, and give the author a private, unhurried chance to
reconsider or rewrite before their words become permanent — because
a testimony, once numbered, is never modified (Constitution,
Article IV). This pause is care about permanence, not censorship:
the author remains free to submit their words exactly as written,
and approval is never withheld because a testimony is sorrowful.
- **What the protocol never does.** No punitive flag is ever stored on
a record. No report is ever made to authorities or to any third
party. No risk score, label, or crisis classification is ever
attached to a Registry entry — Article I forbids any metric on a
human record, now or ever. AllHumans is an archive, not a monitoring
service and not an emergency service; it says so plainly to authors,
cannot guarantee intervention, and does not surveil.
- **No trace in the permanent record.** Any note made while handling a
crisis submission lives only in the ephemeral review space and is
discarded once the testimony is resolved — approved, revised, or
withdrawn. The permanent archive holds the testimony and the
verification standard of its era, never the fact that it was read
for crisis.
- **Named living third parties.** Where distress involves accusations
against named living people, the existing moderation line applies
with the same care: a testimony holds the author's own truth, not
charges against named living others.
- **Scale-up is a governance decision.** At founding scale the founder
reads every testimony (see `ARCHITECTURE.md`, "Growth path"). As
volume grows, ML-assisted crisis-language screening with a
human-review path may be adopted — but only by governance, and
always subordinate to the principles above: resources, not flags;
care, not surveillance. Any automated reading of testimony text for
crisis, including client-side detection, remains a deliberately
deferred choice, never introduced silently.
## Continuity keys (added 2026-07-06; browser-generated 2026-07-07)
- **The key is generated in the author's own browser** at the moment
their First Testimony is submitted, and shown exactly once — never
again, to anyone. No one else, founder included, ever sees it. The
archive keeps only its SHA-256 fingerprint (format `ah1-…`,
128 bits). Like a wallet seed, keeping it safe is the owner's
responsibility. (A key is generated at the review desk only for
founder-mediated ceremonies conducted without a browser.)
- **Verification is automatic and threefold.** Each record's key
fingerprint is published at `keys/{n}.json`; the return page
verifies the entered key against it instantly (a wrong key opens
nothing), the site's worker re-verifies on submission, and
`tools/testify.py` verifies once more at the ceremony. Founding-era
honesty: the key travels encrypted (TLS) with the return submission
and is discarded after the ceremony — never stored. The planned
upgrade is signature-based proof that never transmits the key (the
version schema reserves the field).
- **The key is the proof of return.** Entering the Second or Final
Testimony, and requesting withdrawal, require presenting it. No one
else — operator and founder included — can add words to a record.
- **Lost keys are not regenerated.** A human who has lost their key
may still withdraw (their strongest protection) through the
founder/governance override after out-of-band identity proof; the
override and its reason are recorded permanently in the log.
Whether a re-keying process should ever exist is a governance
decision, deliberately deferred until real cases teach us.
## Distribution (ratified by founder 2026-07-06)
- **The repository never contains testimony text.** It holds code,
the Constitution, schemas, the transparency log (fingerprints
only), and verification tools.
- **Testimonies are browsable through the official website only.**
- **Complete archive snapshots go solely to trusted preservation
partners** under formal deposit agreements carrying tombstone
semantics. See `ARCHITECTURE.md`, "Distribution and custody".
## Change log
- 2026-07-07 — Continuity keys now generated in the author's browser
at First Testimony submission (shown once, fingerprint-only
storage); return.html added for Second/Final Testimonies.
- 2026-07-06 — Moderation: other people named in a testimony should be
given by first name only; the review screen (`tools/botscreen.py`)
now advises a human on apparent full names, slurs/hateful terms, and
threats toward others — always flagged for human review, never
auto-rejected, and it never flags an author's own distress or grief.
- 2026-07-06 — Verification: Tier 0 (email) no longer grants a number —
it admits a held draft only; a permanent number now requires Tier 1
(phone) or Tier 2 (vouch), recorded by the founder by hand during the
founding period. Aligns POLICY with `ARCHITECTURE.md` (Tier 0 = draft).
- 2026-07-06 — Crisis-response protocol written (the protocol the
"Crisis of the author" section required before public enrollment):
contextual resources on q_hardest/q_regret, hold-and-two-review
submission gate (founder + bot check) before a number, humane
reconsider/rewrite response, no punitive flags, no authorities, no
trace in the permanent record; automated crisis screening deferred
to governance.
- 2026-07-06 — Distribution policy ratified: repo = transparency
instrument, no testimony text; website = reading room; snapshots =
deposit partners only.
- 2026-07-06 — Continuity keys added (entry schema v2); lights-screen
site with unpadded URLs (allhumans.world/{number}), no search bar.
- 2026-07-05 — Initial policy set alongside Questionnaire v1.