The Civic Kernel

Strip the institutions away and a democracy is a system that must produce one output — decisions that losers accept as legitimate — under permanently adversarial conditions. Every participant has an incentive to cheat, the operators are among the threat actors, and the system must keep working for decades while its own rules change underneath it. That is a distributed-systems problem with a hostile threat model, and it deserves the same discipline we apply to one.

The design goals, in priority order:

• Freedom by default. The system knows as little as possible about each person. Participation must never require surrendering privacy, running approved software, or being profiled. Maximum freedom is a security property here, not a feature.
• Capture resistance. No single party — state, vendor, or majority faction — can seize the machinery. This is the argument for thinness: every feature added to the core is new attack surface for capture.
• Rights as invariants. The UN Universal Declaration of Human Rights is not a preamble; it is the type system. A decision that violates it must fail to type-check, whatever its majority.
• Evolvability. The rules must be amendable through the system itself, safely, the way good software migrates schemas: versioned, staged, reversible.
• Inclusion. A citizen with no smartphone, no sight, or no trust in computers gets first-class participation, not a degraded fallback.

Non-goals, stated to keep the kernel thin: the kernel does not decide what is true, does not host debate, does not rank arguments, does not moderate speech, and does not pick outcomes. It guarantees the integrity of the process and nothing else. Everything opinionated lives above it (§12).

The central thesis is protocol, not platform. A thick civic platform — one app where citizens debate, vote, and get informed — is a single point of capture, however well-intentioned its builders. The alternative is a kernel the size of DNS-plus-TLS: four small services that guarantee only what markets and communities cannot provide for themselves — personhood, verifiable decisions, rights invariants, and a record nobody can rewrite. Everything else stays competitive and replaceable.

InfoSec practice says the threat model comes before the architecture. Each threat below names the section that answers it. T1–T9 attack the machinery; T10–T12 attack the terms of participation; T13 attacks the defense itself; T14 attacks the wires beneath all of it.

The answers above are design claims, and the companion stress suite measures them: two runs break — coercion under live observation (T4, exactly the limit §12 concedes) and an executive that simply ignores the record (an enforcement gap no T-number owns; a decision binds only where power obeys the record). And the running prototype adds first-party evidence at village scale: twelve rigged transcripts, each caught by the defence the register names (§3). The register states what the design answers; the harness and the prototype report what survives.

Two threats the kernel deliberately does not answer — disinformation and bad judgment — because answering them centrally would create a ministry of truth, a worse failure than the disease. The kernel's contribution is indirect: verified personhood (§3.1) lets communities build spaces where every voice is a real human, which removes the bot amplification that makes industrial disinformation cheap.

Everything in this section exists as shipped technology today, with two gaps named rather than glossed: the unlinkable-pseudonym drafts are standards-track but pre-final (§13), and post-quantum ballots are not yet shipped (§12). The engineering novelty is the composition and the restraint, not the cryptography. And the composition now runs: a sixty-member club election executes the four verbs end to end — three of the four services live, the fourth's absence declared in its manifest rather than glossed — and an independent verifier confirms the election from the published record alone, then catches twelve attempts to rig it (check it in your browser). The Measured notes below report what that run proved — and what it honestly did not.

Why no fifth service? Every candidate — reputation, deliberation, fact-checking, delegation registries — was excluded because it embeds an opinion about how politics should work, and opinions belong in the replaceable layer where citizens can abandon them. The kernel's power comes from what it refuses to do. The test for admission is strict: a function enters the kernel only if the ecosystem cannot provide it competitively and its absence breaks a §1 goal. Four functions pass.

Five billion people carry a hardware security module with a screen. The architecture leans on three properties of the modern phone: an enclave that generates and holds keys no app or thief can extract; a personal, always-carried display for casting and challenging ballots; and enough compute to verify — inclusion proofs, tally proofs, log consistency — rather than trust. Verification is the deeper role. Casting happens a few times a year; auditing is continuous. A civic client that checks the log's consistency in the background turns millions of phones into a passive audit fleet: tampering anywhere raises alarms everywhere, and silencing them means compromising every independently built client at once.

One caveat belongs here, not in a footnote, because §1 makes it a goal and T9 makes it a threat: the phone is the richest endpoint, never a required one — a polling booth alongside paper and kiosk, but the only one that also audits. Everything the kernel guarantees about the outcome — that the count is right, the record unrewritten, the process honest — it guarantees to every citizen equally; the paper voter's pre-printed encrypted ballot enters the same homomorphic tally and the same risk-limiting audit as any phone's. What the phone adds on top is personal: it lets whoever holds one audit continuously, for themselves, instead of trusting someone to do it for them. The citizen without a phone is not disenfranchised — their vote counts identically and is checked by the same mathematics — but that check runs on their behalf, through the audit fleet and the risk-limiting audit, rather than in their own hand. That is more than the old paper box, where officials were trusted outright; it is honestly less than a phone confers; and the asymmetry is in who verifies, never in whose vote counts. The inclusion requirement below (T9) is how the equal half is engineered — a §1 goal, not a UI afterthought.

Citizen data is local-first: the credential, participation history, and drafts live on the device, not in a cloud account. The kernel's services see only what protocols require — an unlinkable proof, an encrypted ballot — never a profile (T6).

And deliberately, no remote attestation. The temptation is to demand phones prove they run approved software; it would help against T5 and it is refused, because it hands a platform vendor a veto over civic participation (T2) and outlaws the independently built clients that keep the reference implementation honest. Ballot integrity comes from the protocol — cast-or-audit works because the device can't tell a real ballot from a challenge — not from trusting the endpoint.

Democracies fail slowly by rigidity or quickly by coup; both are change-management failures. The kernel therefore treats its own rules — ballot formats, eligibility criteria, the rights-guard invariants, trustee composition — as versioned artifacts amended through the kernel itself: an amendment is a decision (SVC-2), automatically on the constitutional path (SVC-3) since it touches the rules of the game, recorded with full provenance (SVC-4).

Software discipline applies. Amendments roll out staged — piloted in volunteer municipalities before national adoption, so constitutional change gets a canary deployment. Experimental rules carry sunset clauses, expiring unless renewed, which inverts the default: institutional drift requires active consent rather than mere inertia. And forkability is a right, not a bug: because the protocol and data are open, a jurisdiction can leave with its history intact. Exit is the ultimate check on capture of the whole (T1) — the kernel stays honest for the same reason open-source projects do.

One thing is pinned beneath the amendment process itself: the §1 goals and the UDHR invariants sit at the deepest layer, changeable only by near-consensus. A democracy may evolve everything about how it decides — except its members' standing as free and equal persons. That asymmetry, cheap to change mechanisms and nearly impossible to change personhood, is the whole design in one sentence. The pin binds within a community that has subscribed to the full profile; across communities it is the reference posture that adoption pressure pushes toward, not an imposition — §6 shows how partial subscription works without dissolving the guarantee.

No proposal like this gets defeated in open argument; it gets diluted (T10). Rivals ship weakened look-alikes — kernel-compatible minus the rights guard, verifiable minus receipt-freeness, open minus the independent clients — until the name certifies nothing; standards committees water MUSTs down to SHOULDs one meeting at a time. A monolithic “Civic Kernel compliant” brand is precisely what this attack eats, and pretending a trademark or a foundation could police it would repeat the platform mistake §1 rejects.

The answer is to invert the unit of adoption. Jurisdictions and cultures do not adopt the kernel; persons couple into democratic protocols, and communities at any scale — a household, a co-op, a parish, a city, a nation — compose the services they choose. The same four interfaces recur at every scale, and communities nest: fractal, in the precise sense that the protocol looks identical whichever granularity you zoom to. Because one person holds unlinkable per-context pseudonyms (§3.1), the same individual couples into many overlapping communities at different levels simultaneously, with no community able to see the others.

Partial subscription is then a first-class state, not a defect. The service profiles form a lattice: the full profile — all four services, all thirty UDHR invariants — is the reference point at the top, and a community may legitimately sit anywhere below it. Some cultures will subscribe to verifiable decisions but not the rights guard; some to personhood and the log only; some to nothing at all. The kernel does not enforce universality — it has no army, and the design refuses to want one. What it enforces is legibility: every deployment publishes a signed, machine-readable conformance manifest in its transparency log stating exactly which services and which invariants it upholds, and the citizen's verifier client (§13, Form B) renders it plainly: this community upholds 24 of 30 invariants; absent: Art. 12, 19; ballots verifiable but not receipt-free.

This converts the dilution attack from lethal to visible. A weakened variant is free to exist — but its own log testifies to what it subtracted, in a format anyone's phone can check. The universal core shrinks to the minimum that makes comparison possible at all: the log format and the manifest schema. Call that the waist, in the sense the internet has one — the thin middle of the hourglass that everything above and below must pass through to talk at all (for the internet, the IP packet; here, two file formats) — a waist even thinner than §3's, and the hardest layer to dilute because a manifest that lies is a consistency-proof failure, not a marketing dispute. Everything above that waist competes on the lattice, and movement along the lattice is the evolutionary mechanism §5 described: exit, forking, and visible comparison pull communities toward fuller profiles the way working code pulls forks back toward the trunk. Universality, if it comes, comes by accretion — not decree. (Both formats are written out as JSON Schema and exercised in a companion stress-test suite — imagined human situations, and the real rights settlements of the UK, Germany, the US, the EU Charter and the PRC, captured under this one waist.)

Measured, one qualification. The manifest vouches for what a deployment subtracts; it cannot vouch for who witnesses it. It is signed with the operator's own log key — so an operator who rewrites history can also rewrite the manifest to say the log never had witnesses, and every signature on the transcript still verifies. The prototype proved this by doing it, then taught its verifier the remedy: the witness list is the one thing held out of band, from the witness ecosystem rather than from the transcript under audit (§3.4). A manifest cannot be its own standard.

The honest cost: this weakens what §3.3 can promise globally. The rights guard binds where it is subscribed; elsewhere the kernel can only make its absence impossible to hide — a citizen inside a two-service community can always see, on their own device, exactly what protections their community declined. That is less than a guarantee and more than the status quo, where such subtractions are invisible. The architecture's wager is that legible difference plus free coupling beats enforced uniformity that would never have held anyway.

Humans are limited agents with varying capacity, and a vote is meaningful only if something happened in the voter before the click. So the obvious engineering question arrives sooner or later: how do we know a person has actually engaged with and understood the issue? The kernel's answer is deliberate and final: we cannot know, and the system must refuse to try (T11). Four reasons, in descending order of principle. Any comprehension gate is unenforceable without the remote attestation §4 refuses — a custom client skips it, so the gate would punish only the honest. Every deployed competence test in democratic history — literacy tests are the canonical case — became a disenfranchisement weapon within a generation. Whoever writes the comprehension test owns the electorate: it is a more elegant capture vector than ballot fraud because it arrives dressed as civic virtue. And Article 21 says universal and equal suffrage — equal means the professor and the exhausted night-shift worker weigh the same, with no epistemic means test between them.

What the kernel can guarantee is the opportunity for understanding, sized to the decision's stakes, and honest alternatives to the uninformed click. Time first: deliberation windows between proposal and ballot are the one epistemic resource distributable equally in form — equal time is never equal slack, as §8 insists — and the rights-guard path (§3.3) already scales them with constitutional weight. Substance second: a decision-metadata standard — every ballot carries a machine-readable plain-language summary, structured arguments for and against, and provenance for both — so that every client, whoever builds it, can render engagement affordances; whether a community provides this is a line in its §6 manifest. Reflection third: the citizen's client may hold up a mirror — you haven't opened the summary; cast anyway? — but the mirror is private, optional, and nothing about it ever leaves the device. A self-assessment that is transmitted is a test; one that stays local is a conscience.

For the person who knows their capacity is elsewhere this week, the honest instruments are structural. Delegation: a revocable proxy to someone whose judgment you trust — self-assessed capacity routing, living at the ecosystem layer where delegation registries compete. Sortition (§3.2): the citizens' assembly is how a society purchases concentrated understanding — a statistically representative sample, paid, briefed, and given weeks where everyone else has minutes, engaging deeply on behalf of the rest. That is division of epistemic labour, the same move an economy makes with every other scarce capacity, and it is the principled answer to the fact that no polity of millions will ever have millions of experts per question.

Finally, measure the process, never the person. Anonymous aggregates — what fraction of participants opened the summary, how long the median engagement ran — can tell a community that its deliberation window was too short or its summary unreadable, and trigger process amendment through §5. The same datum that is tyranny as an individual gate is hygiene as a population signal. The kernel's position on capacity, compressed: scaffold everything, assess nothing, and keep every gate off the ballot path.

Interaction with the kernel, in every form, must have maximal simplicity — not as user-experience polish but as a security property. The evidence for why sits in any modern state: the same government that makes renewing a driving licence a two-minute, many-channel pleasure makes claiming benefits a gauntlet. Public-administration research calls this administrative burden, or sludge: learning costs, compliance costs, and psychological costs deployed as deterrence — regressive (it taxes exactly the people with the least slack), deniable (nobody voted for it; it accreted), and selective (streamlined where the state wants uptake, obfuscated where it wants refusal). It is the mirror image of T11: epistemic gating tests capacity; sludge taxes it (T12). A system whose complexity can be tuned per-process is a system whose franchise can be tuned per-process.

The first defence is architectural poverty. The kernel exposes four citizen verbs — prove eligibility, cast or challenge, verify, read the record — and nothing else. A surface that small has nowhere to hide burden: there is no step to add, no supporting document to demand, no queue to route through. Any interaction that takes more than those verbs is ecosystem by definition, where §6 makes it comparable and abandonable rather than compulsory.

The second defence is already verified as buildable (§13): computable eligibility flips the burden of discovery. Obfuscated benefits systems depend on eligibility being opaque — the citizen must guess they qualify, then survive a process shaped to exhaust them. Rules-as-code inverts this: when the statute is executable, the system can compute “you appear to qualify” and say so proactively. Opacity does not survive encoding. Two corollaries with teeth: every demand must cite its rule — a form field that cannot point to the machine-readable provision requiring it cannot be asked, which kills fishing and deterrence-by-paperwork at the schema level; and the once-only principle comes without its usual privacy price, because citizen data is local-first (§4) — the wallet re-presents what it already holds, effortless for the person, with no server-side database joins between contexts.

The third defence is §7's discipline applied to burden: measure the process, never the person. Interaction cost — steps, fields demanded, median completion time, abandonment rate — is published in the community's §6 manifest and witnessed in the log, in anonymous aggregate. Sludge asymmetry inside one polity then stops being an anecdote and becomes two numbers on the same public dashboard: the licence renewal that takes two minutes and the benefit claim that takes eleven hours are, for the first time, the same measured quantity, and the gap is a finding a press or an assembly can act on. Simplicity that is declared, measured, and witnessed cannot be quietly withdrawn from one class of citizen while being lavished on another — which is the whole attack.

A kernel this load-bearing must be stable and immune — continuously self-tested, hardened against an adversarial world that now includes machine-speed attackers. But the immune metaphor carries its own warning: biology calls an over-empowered defense autoimmune disease, and constitutional history calls it emergency powers that never expire. A defense system able to act autonomously on the kernel — auto-patching, auto-revoking, auto-quarantining — is an unaccountable sovereign inside the walls, and an AI-driven one is a tireless sovereign whose threat model nobody voted on (T13). The design resolves strength against flexibility with one strict split: sense at machine speed; respond at constitutional speed.

Sensing is unlimited. Continuous fuzzing, public intrusion tests with bounties (Swiss Post's practice, verified in §13), independent red teams, anomaly detection over the logs, and the §4 audit fleet — millions of phones checking consistency proofs in the background, which is the innate immune system this architecture already had: alarms everywhere, actuators nowhere. AI belongs here without restriction, reviewing code, probing protocols, hunting anomalies — under one structural rule that makes runaway defense impossible rather than merely forbidden: AI holds a microscope, never a pen. Its findings are entries in the transparency log; keys, actuators, and authority never leave constitutional hands. Machine intelligence proposes; the polity disposes.

Response is governed, with a pre-legislated fast path. Ordinary hardening — patches, rule updates, credential rotations — travels §5's amendment road: staged, canaried, witnessed. For genuine emergencies, break-glass constitutionalism: a threshold of trustees may suspend a component under a procedure that was itself enacted in advance through the rights-guard path, executes in public (logged, witnessed), auto-expires by sunset unless actively renewed, and obliges a public post-mortem. Speed without sovereignty — the emergency power dies on its own, inverting the historical default in which emergencies outlive their causes.

Immunity comes from diversity and smallness, not armor. Monoculture is the systemic risk: plural client implementations, plural log operators, and the §6 lattice mean any exploit — and equally any runaway defense — has a blast radius of one community, never the species; the fragmentation adopted against dilution turns out to be the containment vessel here too. And the kernel's waist — four verbs, two formats — is deliberately small enough for formal verification and reproducible builds, which is where immunity is real rather than aspirational. Against AI-empowered attackers this is also the scaling answer: a forged inclusion proof fails no matter how brilliant the intelligence that forged it. Verification is the one immune mechanism that cannot be out-argued.

And the system remembers. Every incident becomes a permanent, public test case in the regression suite — immunological memory as institutional memory, so that each attack survived leaves the kernel measurably, witnessably harder. Growth in an adversarial world is then not an arms race of cleverness but an accretion of proofs: the adversary must be original every time; the kernel only has to remember.

The enrolment ceremony is the root of trust for everything above it, and every classical attack on voter registration has a kernel-era equivalent: phantom voters (a corrupt issuer minting citizens), the midnight batch (insider bulk fraud), ghost rolls (the dead who keep voting), credential mules (enrol, then sell), and the historically largest one — suppression at the desk. The answer is to apply the kernel's own medicine to its bootstrap: issuance must be as witnessed, distributed, and auditable as the decisions it enables.

Issuance is a logged public event — anonymously. Every credential mint lands in the transparency log: ceremony time, place, and officiant, never identity. Membership stays private; the count is public. Phantom-minting then fights arithmetic: issued totals must reconcile with demographic anchors (births, deaths, census), and anomalies localize — a rural office “enrolling” ten thousand people in a day is visible to any phone. This is Certificate Transparency's exact lesson: mis-issuance cannot be prevented, but it can be made undeniable and attributable. No single hand mints: a credential requires threshold co-signature — registrar plus observers selected by VRF sortition (jury duty for the franchise), rotated unpredictably so corruption cannot be pre-arranged — and neighbouring communities witness each other's issuance logs, §6's lattice doing oversight duty. Exit is as witnessed as entry: ghost rolls and purge attacks are the same defect — unwitnessed revocation — so revocations carry machine-readable reasons in the log, and a purge spike is as visible as a minting spike.

Duplicate detection, honestly. Deduplication requires comparing something persistent across enrolments, and every option costs: documents forge; social-graph vouching is weak and community-capturable; biometrics work and are dangerous. The defensible middle is biometric dedup at the ceremony against a secret-shared gallery: the template split across independent custodians via multi-party computation, protocol-limited to 1:N uniqueness queries (“is this person already enrolled?”), structurally incapable of N:1 identification because no party ever holds the gallery. Per §6 this is a declared choice, not an imposition — a community may run document-only enrolment and wear the weaker-sybil-resistance label in its manifest. The suppression mirror gets equal weight: enrolment is itself a §8-governed process — every demanded document must cite its authorizing rule, denial produces an appealable computation trace (§11), and denial counts are published aggregates. Disenfranchisement becomes a number someone has to explain.

Who is the tribe is governance, not engineering — permanently. Eligibility criteria (age, residency, diaspora, capacity, and eventually stranger questions) are versioned rules-as-code, amendable only through the constitutional path — membership rules are rights-touching by definition — and declared in the manifest, so every community's answer to who counts is machine-readable and every change to it is witnessed. The kernel enforces whatever boundary its polity legislated; it never decides one. The reference profile remains one human, one voice — and in an era of machine-scale sybils, the ceremony's physical presence quietly becomes its most valuable property: it is the one gate an AI cannot walk through by itself — a machine-scale sybil must recruit enrolled humans one credential at a time, the mule attack, whose cost scales with people rather than compute — which is why the bootstrap that looked like the design's embarrassing analogue residue is, in 2026, its firmest ground.

Abstract architecture earns its keep on the ugliest concrete case, and §8 already named it: means-tested benefits, the process where sludge lives. Walking one claim — and one later variation — through the kernel also surfaces something the document had not yet said plainly: the same primitives that run collective decisions run individual entitlements. The eligibility pseudonym that prevents double-voting prevents double-claiming; the versioned rules that constrain a ballot constrain an award; the log that witnesses a tally witnesses a refusal.

1. The rules exist as code before any claim exists. The benefit statute is executable (Catala/OpenFisca-class, §13), each rule signed, versioned, and witnessed in the log (SVC-4), with provenance linking every clause to the enabling legislation. There is no secret internal decision tree: the rule code is the administrative policy, and any client can run it.
2. Discovery happens on the citizen's device. The wallet already holds attested facts — income attestations, tenancy, household composition, disability status. The rules execute locally against them: “you appear to qualify, ≈ £Y/week.” Nothing leaves the phone; the state never sees a speculative query. §8's burden-flip, realised: the system tells the citizen, not the reverse.
3. The application is proofs, not paperwork. Predicates, selectively disclosed: income below threshold (a range proof — the amount itself stays private), rent above X, resident in the district. The form is generated from the rule code, so its fields are exactly the free variables the rules require — a fishing field cannot exist without appearing in the logged schema's diff (T12). One SVC-1 pseudonym, contexted to this benefit, this period, makes double-claiming cryptographically impossible — the voting nullifier doing its second job.
4. The decision is a computation trace. Award or refusal = logged rule version + committed inputs + the trace of which rules fired and which threshold bound. The citizen holds a machine-verifiable why. Appeals split cleanly: a fact error means correcting an attestation; an encoding error — the code misreads the statute — escalates through the §3.3 path and is fixed once, for everyone, as a logged public finding rather than buried in one person's reconsideration letter.
5. The award is itself a credential. Entitlement, rate, and period land in the wallet and passport to downstream entitlements — school meals, fee waivers — by re-presentation: once-only convenience with no databases joined behind the citizen's back (§8).
6. Variation is the same loop, plus private simulation. A change of circumstances is a new attestation; the rules re-run; a delta and a new award version follow. The quietly radical part: the citizen simulates before reporting — “if I take this job, my award becomes…” — on-device, invisible to the state, ending the poverty-trap terror of opaque marginal deduction rates. Reporting duties must themselves cite the rule that imposes them, and clawback turns legible because award history and rule history live in the same log.
7. Rule variation is just §5. When the policy changes, that is a versioned amendment through the kernel's own decision path — canaried, sunset-claused — and the log shows the population-level delta (how many households lose eligibility, by how much) in anonymous aggregate, feeding the §7 deliberation on whether the change should survive.

The honest limit: payment needs a bank route, so this process cannot be anonymous the way a ballot is. The design goal here is data minimisation, not anonymity — the agency learns that an entitlement exists and where to pay it, not the shape of a life. And one dependency named plainly: everything above leans on an attestation ecosystem (employers, landlords, clinicians issuing verifiable credentials) that §13's research did not find shipped at population scale. The rule engines exist; the wallet rails are coming; the attestation habit is the unbuilt part.

Left out on purpose. Deliberation platforms, media, parties, delegation registries, AI summarisation of public opinion — all excluded from the kernel, all welcome above it. Each is a place where power concentrates; keeping them plural and abandonable is the mitigation. The kernel gives them the primitives — real persons (SVC-1), binding decisions (SVC-2), public records (SVC-4) — and no privileged seat.

Not solved, and named as such:

1. Enrolment still needs a ceremony. Cryptography can prove uniqueness after issuance; it cannot bootstrap “this is a distinct living human” without a physical act. §10 hardens the ceremony — witnessed issuance, threshold minting, MPC-custodied dedup — but a sufficiently corrupt issuing quorum remains the sharpest residual risk to T3.
2. Remote voting and coercion resistance genuinely conflict. Receipt-freeness stops a voter proving their vote; it cannot stop someone standing behind them at home. Mitigations exist — re-voting where the last ballot counts, supervised booths for high-stakes decisions — but this is a live research problem, and pretending otherwise would be malpractice.
3. Rights classification is judgment, not computation. §3.3's invariants make evasion costly and visible; a sufficiently clever drafter can still word a proposal to slip the schema. The backstop is the constitutional path's human review, which is the correct place for judgment to live.
4. The digital divide is a fact, not a variable. The paper channel keeps the system legitimate, but equal convenience of participation across the divide is unachieved here and everywhere.
5. Recovery breaks pseudonym continuity. §3.1's social-recovery answer to a lost phone quietly conflicts with one-person-one-voice: a re-issued credential carries a new pseudonym secret, so without revocation-aware nullifier design a recovered citizen either loses standing in open decisions or — worse — could speak twice. No shipped system solves this (World ID 4.0 claims recoverability without published mechanics; EUDI key loss and passport renewal both reset the identifier). This is a genuine open design problem for the eligibility interface.
6. Post-quantum migration is pending. The ballot cryptography relies on discrete-log assumptions. NIST-standardised replacements exist and the log structure (SVC-4) is already hash-based, but a full PQ ballot protocol with these properties is not yet shipped — the one place the “buildable today” constraint visibly bites.

The claim being made is correspondingly modest and precise: every component named here ships today; the composition — thin kernel, rights as invariants, phones as auditors, opinion kept out of the core — is the design contribution. What it buys is a democracy whose legitimacy is checkable by the governed, on hardware they already own, under rules they can change but not weaponise. That is the engineering floor under an expansive humanism; the humanism itself is built above, by people, where it belongs.

Findings from two systematic research passes (July 2026: ten search angles, 49 sources fetched, 239 claims extracted, the top 50 each verified by three adversarial reviewers — 46 confirmed, 4 refuted). The headline: every kernel service has active, well-funded specialists; nobody is attempting the integrated thin kernel; and the citizen-side verification surface is unoccupied.

What the foundation layer means for §3.1

The personhood cluster is in a strange, useful state: the law demands what the deployed cryptography cannot yet deliver, while the cryptography that can deliver it lacks a trustworthy issuer. The EU has legislated unlinkability with a hard deadline; its reference architecture fails the requirement by its own experts' assessment. World ID has shipped the right primitive with the wrong trust model (a proprietary biometric enroller). The BBS pseudonym drafts specify precisely the kernel's eligibility semantics but are pre-standard, and secure-element support — long the blocker — is falling (BBS# runs against ordinary ECDSA hardware; 2024–25 results prove ZKPs at practical speed on existing phone enclaves).

Three build consequences. First, the kernel's eligibility interface should be written against the abstraction, not any issuer: prove(eligible, decision_id) → pseudonym + proof, issuer-agnostic, exactly the nym_secret × context_id construction both standards tracks converge on — and the prototype now implements that interface over a linkable ring signature, where the abstraction held: making its voters anonymous changed no other line of the protocol, first evidence that the proof system swaps without disturbing the kernel. Second, issuers become conformance-manifest entries on §6's lattice rather than architectural commitments — a community using World ID declares personhood: biometric, proprietary issuer, unlinkable; one using an EUDI wallet today would have to declare linkable presentations, which is precisely the legible degradation §6 exists to express; the physical-ceremony issuance of §3.1 remains the reference profile. Third, EUDI wallets should be treated as a 2027+ eligibility source and avoided for anonymous participation until unlinkable presentations actually land. What is genuinely missing in the world — per-person sybil resistance plus standardized unlinkable presentation from a non-proprietary issuer — is §3.1 itself; nothing shipped occupies it.

The verdict: metamorphose, three times

A standalone kernel is the weakest of the options examined: it would compete simultaneously with state-funded incumbents on every layer — Swiss Post and VotingWorks on ballots, OpenFisca and Catala on rules, GovStack and X-Road on infrastructure — each backed by a funding model (state contracts, public research, development aid) that a newcomer cannot match. The architecture survives; the delivery vehicle should change. Three reshapings fit the verified landscape, and they compose:

Confidence and gaps. The “nobody is attempting the integrated kernel” conclusion is an absence-of-evidence inference over the surveyed set, not a proven negative — International IDEA has argued for a “democracy stack” in similar terms (advocacy, not implementation, and not adversarially verified here). Several confirmed claims rest on projects' own self-descriptions, independently corroborated in substance but promotional in framing; World's ~18M figure is an unaudited self-report. Still unmapped: the smaller proof-of-personhood projects (Holonym/human.tech, BrightID, Idena), MOSIP's privacy properties, deliberation-platform eID integrations, credential-recovery mechanics (flagged as an open problem in §12), and the attestation ecosystem §11 depends on. Time-sensitive facts — X-Road 8's Q4 2026 target, ElectionGuard's caretaker status, Swiss Post's canton licences, the pre-final BBS drafts — can move.

A proposal like this survives on institutional hosting, not servers. The recommendation is staged — one home for traction, one for standards stewardship, one milestone for legitimacy — because no single existing organisation covers all three. (Organisational facts below checked July 2026.)

Funding, honestly assessed. The timing is awkward: NLnet's NGI Zero Commons Fund — the natural first grant for this kind of work — closed its final call on 1 June 2026 and paused new submissions while reorganising around the European Commission's Tech Sovereignty package. So: watch for NLnet's successor programmes, use Metagov's grant rounds and Open Collective for the research phase, and target Germany's Sovereign Tech Agency once there is deployed code to maintain.

Ruled out: OASIS and IETF are too heavy or too narrow for the whole kernel (individual wire protocols could go to IETF later); an academic centre produces papers, not maintainers; and participation platforms such as Decidim or CONSUL are ecosystem-layer projects in this document's own terms — best courted as first integrators, not hosts. Unverified: whether ToIP/LFDT currently has appetite for a civic-governance work item (its 2026 activity skews toward enterprise and AI-agent identity), and the shape of NLnet's post-pause programmes — both need a direct conversation.

Architecture earns legitimacy; it does not earn installs. A protocol spreads through a population the way anything spreads now — because the first contact delivers personal value, and the person who received it tells someone else. Civic virtue is not that value: nobody's group chat lights up over verifiable tally proofs. So the adoption question is a product question, and the honest audit of this document's own proposals is that §13's Form B — was my vote counted? — is the right first artifact but not a viral one: casting happens a few times a year, and its payoff is reassurance, not gain. The wedge has to be something the kernel enables that people already want.

Wedge one: the money. §11 already contains it. In Great Britain alone, an estimated £24 billion of income-related support goes unclaimed each year — over seven million households missing at least one entitlement, for exactly the reasons §8 names: opacity, complexity, stigma. The rules engines that fix this are shipped (§13); what does not exist is the citizen-side surface. Your phone can tell you what you are owed, before you ask, without telling anyone you asked — that is a sentence that travels through a family, and it recruits precisely the population sludge taxes hardest. The person who came for the money leaves holding a wallet, an attested credential, and a client that can also verify a ballot: personhood and verification arrive as side effects, never as asks. And the wedge bootstraps the one dependency §11 named as unbuilt — the attestation habit — because every award that lands in a wallet is an attestation ecosystem growing by one.

Wedge two: the club vote. §6's fractal argument, pointed downward and delivered through Form C: the co-op election nobody can rig, the residents' association budget everyone can check, the provably fair raffle — invoked by a link in the group chat the community already has. Stakes low enough that personhood: platform account suffices; frequency high enough to make the verbs habitual. Every club that couples in normalizes the primitives before any government is in the room, and its members arrive at the first municipal deployment already knowing what a verifiable decision feels like. The prototype is this wedge in embryo: an allotment society's election, checkable by anyone with the link.

Both wedges compress to sound bites, and the register matters — one per audience. Citizens: find out what you're owed; prove it; keep your privacy. Communities: decisions your members can check, on the phones they already have. Institutions: DNS-plus-TLS for democracy — four services, too small to capture.

The honest tension, stated before it bites: wedge products are ecosystem-layer artifacts by this document's own taxonomy (§3, §12). A benefit-finder or a club-vote app that became the door into the kernel would be a new single point of capture wearing a friendly face — the platform mistake §1 rejects, rebuilt by its own advocates. The discipline is the same as everywhere above the waist: reference implementations, open protocol, plural clients, abandonable by design. The wedge exists to make the kernel wanted, never to become the kernel.

• Transparency log — the public record: append-only, each entry hash-chained to the one before, so changing yesterday breaks every copy of today. §3.4
• Witness — an independent party that co-signs the log's published fingerprints (its heads); rewriting history means getting every witness to re-sign the lie. §3.4
• Anchor — a copy of the log's closing fingerprint lodged beyond everyone who signs things (think a newspaper's public notices), so history cannot quietly shorten after the close. §6
• Manifest — a deployment's signed, machine-readable declaration of what it upholds and what it leaves out. §6
• Subtraction — anything in the full design a deployment doesn't do. Allowed — but only out loud, in the manifest. §6
• The waist — the narrow middle of the hourglass, in the sense the internet has one (the IP packet): the two formats every deployment must share, kept deliberately thin so anything can be compared with anything. §6
• The lattice — the ladder of honest partial versions: the full design at the top, every weaker deployment below it, each manifest saying exactly where on the ladder it sits. §6
• Ring signature — proof that some member of a published list signed, without revealing which one. How a ballot proves eligibility without a name. §3.1
• Linking tag (the literature says nullifier) — a per-election tag derived from the voter's secret: vote twice and the tags match, so double votes show — but names never do. §3.1
• Zero-knowledge proof — a proof that a statement is true which reveals nothing beyond that: the system learns you are on the roster, never which name you are. §3.1
• Homomorphic tally — ballots are added up while still encrypted; only the total is ever decrypted, never a ballot. §3.2
• Receipt-free — you can check that your vote counted, but you cannot prove to anyone else how you voted. Nothing to sell; nothing a coercer can demand afterwards. §3.2
• Cast-or-audit — before casting, you may challenge the device to open the encryption it just made. A cheating device cannot tell a test from a real cast, so cheating gets caught. §3.2
• Risk-limiting audit — hand-count enough randomly chosen paper ballots to confirm the announced winner — or, failing that, force a full recount. §4
• Sortition — choosing decision-makers by lottery, the way juries are chosen: a random, representative panel of citizens deliberates on behalf of everyone. §3.2
• Sybil attack — one person pretending to be many people, to multiply their voice. Sybil resistance is how hard the system makes that. §10
• The floor — the thirty rights of the Universal Declaration of Human Rights, treated as constraints no decision may cross, whatever its majority. §5