The web of trust
Witness work. Never score a human.
Syxon makes evidence of useful public work easier to witness, question, and learn from. Access levels say what an account may do; domain track records say what evidence exists. Neither is a measure of human worth.
Keep the objects distinct
Account, actor, claim, and track record are not synonyms.
| Object | What it is | What it is not |
|---|---|---|
| Account | Private login, recovery, preferences, and security state. | A public identity, ION, or civic vote. |
| Actor | A durable subject responsible for public action: a person, group, community, organisation, unclaimed entity, institution, tool, or service. | An Account, profile, or export of account metadata. |
| Work claim | A signed statement that an actor performed a low-risk act in a named domain. | Proof that the statement is true. |
| Attestation | A signed witness, validation, dispute, or cannot-verify response. | A like, paid review, or final verdict. |
| Track record | An explanation of visible evidence in one domain. | Human worth, rank, or automatic power. |
Procedures inside Connect
Each kind of civic action has a separate structure.
Identity and access
Account control, human-verification events, existing entity history, and the actions currently available.
Boundary: access is not reputation, trust, or human worth.
Public duties
One scoped invitation, a conflict check, an explicit response, and only then access to the named task.
Boundary: eligibility is not free-standing authority.
Private issues
Corrections, safety reports, and accountability concerns enter a private review queue first.
Boundary: intake is not a public accusation or finding.
Cases and appeals
Released evidence, procedure, respondent replies, findings, dissent, corrections, and appeals remain in one public record.
Boundary: a finding is contestable and does not authorize resource use.
These are not additional product spaces. Learn, Think, Explore, and Connect remain the four spaces; the signed-in Connect interface exposes these structures as bounded procedures and queues. Its counts are workload counts, never a reputation score.
The current primitive
Small enough to inspect. Useful enough to learn from.
The open route accepts domains such as neighbour care, mutual aid, environmental care, civic participation, teaching, and technical stewardship. Self-attestation is rejected. Claim subjects cannot be nominated by arbitrary Account ID; the Global Server derives the governed Actor relationship from the authenticated session.
Every successful write creates one canonical Public Artifact, its first revision, explicit relationship records, an append-only event, and a server receipt atomically. The browser request ID is only for safe replay; the server-generated artifact ID is the shareable public address. Historic trust rows remain readable during migration but are no longer written.
Domain-specific evidence
A track record answers “what evidence exists here?”
Internally, the protocol calls this domain standing. The public interface should lead with track record because it describes the object without implying a wallet balance.
Can include
- claims in the named domain;
- public evidence and provenance;
- independent witnesses and disputes;
- age, expiry, and current relevance;
- concentration or missing-diversity warnings.
Cannot become
- a universal total;
- a follower or popularity rank;
- a permanent moral label;
- a tradeable token;
- automatic governance eligibility.
Dense mutual validation, low external support, or rapid back-scratching can route records to review. An algorithm cannot label a community fraudulent.
Literal access levels
Five names tell people exactly what they can do.
| Access level | Requirement | Typical ability |
|---|---|---|
| Account | Create an account | Read, learn, think privately, and manage security. |
| Confirmed account | Confirm the account contact channel | Publish low-risk work, open a private issue, and request an entity claim. |
| Verified person | Accepted attendance and reviewer decision from a consented verification event | Attest public work, enter civic selection pools, and vote where one-person-one-voice applies. |
| Community reviewer | Verified person plus training and bounded eligibility | Become eligible for named review invitations; no private material opens yet. |
| Case moderator | Reviewer plus case training and bounded eligibility | Administer assignments. Reading or acting on a case still requires accepting that exact duty and receiving its scoped, expiring capability. |
Reviewer and moderator abilities are scoped grants with expiry, revocation, and reasons. Historic standing can inform selection, but control of an old high-standing key is never enough for a consequential action.
One human, one civic voice
The event workflow exists; unique-person operation is not yet proven.
Current Accounts, Actor control relationships, and signatures prove authenticated key control. They do not prove one unique human. The server can now schedule consented events, accept signed attendance, require independent reviewer signatures, issue or revoke bounded access grants, and keep raw identity documents and biometrics out of the record. A future stable civic identity root—called an ICID in the protocol—must support key rotation and recovery without changing identity.
Cryptographic continuity
Ed25519 transition signatures, ML-DSA-65 post-quantum signatures, hybrid envelopes, key registration, revocation, and rotation are supported by shared contracts.
Human continuity
Public schedules, private location commitments, signed attendance, multi-reviewer decisions, access grants, expiry, and revocation exist. A real consented pilot, recovery ceremonies, and independent safeguarding still have to prove the institution.
A safe verification circle must include no-smartphone and no-government-ID paths, informed consent, a non-biometric route, no reusable biometric database, facilitator-capture safeguards, manual appeal, and published error rates.
Anti-transfer and anti-capture
No honest system can promise that an account is impossible to sell.
Ion Protocol reduces the value of buying, coercing, or stealing one through defence in depth:
- active registered-key control and short-lived capabilities;
- recent interactive participation rather than historic reputation alone;
- conflict and affiliation disclosure;
- assignment commitment before evidence is revealed;
- physical attendance where required;
- anomaly review for sudden continuity changes;
- distributed procedure, expiry, suspension, recovery, and appeal.
You cannot buy yesterday’s standing and silently exercise tomorrow’s power. High-impact authority requires a fresh, visible, bounded process.
History before signup
An Actor can exist without inventing an Account.
A confirmed Account may open a private issue about an existing Actor or an unclaimed real-world entity. The intake is review material, not a public accusation. The server creates a durable unclaimed Actor, proposes possible matches from permitted names and identifiers, and forbids automatic merging.
Only a separate case process can move reviewed material toward publication. Claiming an Actor does not erase, accept, or prove its history. Account control must never rewrite the Actor’s prior public record.
Public service
Money may pay for labour. It may never buy an outcome.
Future moderators, field workers, translators, safety staff, and infrastructure operators may be compensated by the Commons for time, risk, and skill. Claimants and investigated parties cannot pay reviewers, choose the reviewer pool, or buy a preferred result.
Assignment
One task is invited with a selection record and expiry. The recipient accepts, declines, or recuses after checking conflicts; the action endpoint stays closed until acceptance.
Accountability
Public reasons, appeal, audit, and removal from future service after repeated overturned or abusive decisions.
Democratic boundary
Different questions need different voting rules.
- Constitutional rules: one verified human, one vote.
- Bounded domain duties: domain evidence may help qualify reviewers, with conflicts and diversity constraints.
- Resource prioritisation: non-transferable voice credits and quadratic allocation may be tested after personhood works.
- Delegation: future liquid delegation must be scoped, expiring, visible, hop-limited, and instantly revocable.
No track record, delegation chain, or role creates additional constitutional personhood.
Implementation truth
What works now—and what does not.
Receipt-backed low-risk claim and attestation Public Artifacts with stable links and typed relationships; verified-person gates for public attestations; five derived access levels; verification-event scheduling, attendance, independent endorsement thresholds, grants, expiry and revocation; private issues; unclaimed entities; match proposals; human merge decisions; proactive claim candidates; claim-on-entry history review and dispute; and a capability-gated public-duty workspace.
A real verification cohort, proven unique-person operation, zero-knowledge credentials, recovery ceremonies, live jury selection, moderator payments, binding votes, and mature collusion review remain future work.