Collect only bounded content needed to review an artifact. V1 collects no contact information; the owner capability is the only contributor control channel.
Governance before collection · reasons before counting
The Artifact Review Method
Publication means the source, scope, evidence, tests, limits, privacy, consent, and correction path passed a declared process. It does not crown a person or declare universal truth.
COUNT WHAT EXISTS.
EXPOSE HOW THE COUNT WAS EARNED.
KEEP THE RECORD OPEN TO CORRECTION.
Submission consent opens private review. Publication consent permits only an approved public projection. Neither transfers ownership.
Machine may validate and suggest. Two distinct active human reviewers must carry the acceptance and publication decisions.
The ledger counts eligible artifacts, never people, followers, loyalty, rank, or Machine confidence.
Explicit lifecycle
EVERY TRANSITION HAS A NAME, AN ACTOR, A REASON, AND A RECORD.
Local draft remains on the contributor’s device. Server states are narrow and invalid jumps fail closed.
- local_draftBrowser only
- submitted_privateDeliberate private intake
- triageHuman review begins
- needs_changesDefects returned with reasons
- resubmittedContributor correction enters review
- accepted_for_projectionFirst human accepts a privacy-safe projection
- publication_approvedA distinct human approves publication
- published_reviewedPublic, inspectable, and countable only if every threshold passes
Other governed states: disputed, correction_pending, superseded, withdrawn, expired, rejected, and deleted_private_record. Appeal returns a rejected record to triage as a visible event; it does not invent an unreviewable side channel.
Public threshold
REVIEWED DOES NOT MEAN INFALLIBLE. COUNTABLE DOES MEAN INSPECTABLE.
An artifact contributes to public totals only when every gate remains true.
Something exists
The classification is a real artifact—not reference, demo, fixture, template, draft, promise, registration, download, or page view.
Authority and consent exist
The contributor asserts authority to submit; submission consent and current publication consent are separate and explicit.
Evidence and limits exist
The public record states evidence, testing or observation, failures, limits, uncertainty, and the claim lane.
Privacy review passed
The projection excludes concealed personal information, exact vulnerable locations, credentials, and unnecessary third-party data.
Two humans are visible in custody
Distinct authenticated human reviewers accept the projection and approve publication. No self-approval and no Machine approval.
The record is current
State is published_reviewed and not disputed, superseded, withdrawn, expired, or past its declared review deadline.
THE DIGEST GATE IS LAST, NOT SUPREME. SHA-256 is calculated from the privacy-safe public projection only. It detects byte changes. It does not prove truth, usefulness, consent, legitimacy, safety, or success.
What reviewers must decide
A REVIEWER IS A TEMPORARY CUSTODIAN OF A DECISION.
No permanent reviewer rank. No founder exemption. No inherited office. No secret emergency power.
Evidence and scope
Compare the private record and proposed projection. Validate links and claimed observations. Separate observed record, primary source, historical analogy, qualified guidance, scientific inference, theological interpretation, AMIANISM cosmology, hypothesis, speculation, fiction, dispute, and unknown.
Privacy and authority
Remove exact locations, contact routes, credentials, vulnerable inventories, medical or immigration data, genetic information, unnecessary legal names, and third-party records. Confirm authority and current publication consent.
Failure and correction
Require limits, failed tests, unresolved questions, reproduction or inspection instructions, accessibility notes, review date, correction route, withdrawal route, and public reasons.
Hazardous medical, structural, electrical, agricultural, water, emergency, or other life-critical guidance requires appropriately qualified review. Historical armed-insurrection analysis may remain direct and honest, but this intake does not publish tactical instruction, targets, clandestine organization, sabotage, weapons guidance, or vulnerability maps.
Rights after submission
NO PUBLICATION WITHOUT EXIT.
Correction is not recantation. It is evidence that the record answers to truth rather than ego.
- Correction and resubmission
- A contributor can answer needs_changes. A correction to a published record creates a separately credentialed successor, never a silent overwrite.
- Appeal
- A rejected record or reviewer administrative concealment may return to triage with the appeal reason preserved. The same unsupported claim does not become true through repetition.
- Dispute
- A public dispute stops counting while humans review the challenge. Disagreement remains attached to lineage.
- Owner withdrawal
- Owner withdrawal revokes publication consent, removes the public body when required, stops counting, and leaves only the minimum non-sensitive tombstone needed to prevent false history. Reviewer concealment is a separate appealable administrative decision and does not speak for contributor consent.
- Supersession
- A replacement receives a new public ID. Parent and successor remain connected. Only the current eligible artifact may count.
- Expiration
- Stale artifacts stop counting until renewed review establishes currency. A deadline is not silently ignored.
- Permanent deletion
- When retention is neither required nor justified, private snapshots are erased and only a content-free tombstone remains.
Operational governance
PROTECT THE PRIVATE RECORD. MAKE PUBLIC POWER VISIBLE.
The implementation enforces the following controls. The durable governance and threat-model specifications travel with the source package.
Minimize and separate
Private submissions, public projections, audit events, and tombstones occupy separate protected stores. Public IDs are unrelated to private IDs. V1 collects no contact information; the owner capability is the only contributor control channel.
Bound access and retention
Reviewer credentials come only from the environment. Roles rotate operationally. Access is logged without storing secret values. Expiration, withdrawal, deletion, backup, and restoration preserve the smallest justified record.
Respond to abuse and breach
Bounded JSON-only writes, CSRF defense, same-origin checks, rate limits, path-safe atomic writes, link controls, and direct-storage denial reduce abuse. A breach freezes publication, rotates credentials, preserves minimal evidence, assesses exposure, notifies when the owner channel remains available, and deletes unjustified copies.