One person, and nobody needs your name

Here is a sentence that sounds like a technicality and decides everything.

One person can be ten.

Every system that scores people by what they contributed has that hole underneath it. Spin up eleven accounts, do a small thing in each, collect eleven scores. Do it with software and collect a thousand. At that point a measure of contribution has quietly become a measure of who could be bothered to automate, and the people it was built for, the ones actually doing the work, are outcompeted by a script.

Every clause in our constitution that says per human rests on solving this. Contribution credit is capped per human. Governance weight is aggregated per human. The capital cap binds per human. Take away the ability to tell one person from a hundred and every one of those sentences becomes decoration.

The usual fix makes it worse

So you ask for a passport. Or a selfie. Or a phone number, which is a passport with extra steps.

Now the system holds a database of real identities, and that database is instantly the most valuable thing it owns and the first thing worth stealing. It is also the thing that gets subpoenaed, sold in an acquisition, leaked by a contractor, or handed over by whoever runs the company after the people who wrote the privacy policy have left.

And it excludes exactly the people the system was built for. Ask for government ID and you have quietly removed the undocumented, the stateless, the person whose government would rather they did not organise, and anyone who has learned that giving their name to an institution costs them more than it costs the institution.

A system for the people who were never counted cannot require papers.

The other way round

Umahn separates two things that are almost always confused: proving you are a person and saying which person you are.

The aim is to check distinct personhood without publishing someone’s name. A pseudonymous commitment can keep identity details separate from a participation record. The strength of the result still depends on the enrolment process, proof provider and resistance to collusion. A cryptographic membership proof alone does not establish that every member is a unique human.

On top of it sits the cap. One human may operate at most five Ottos, and contribution credit and governance weight are capped and aggregated across all of them. The ceiling binds the person, not the account, so there is nothing to gain by multiplying yourself. Handle Wars, the namespace where a name is won by what you have actually done, and can be contested by somebody who has done more, only works because the layer underneath can count people.

What is actually built, and where it is weak

The commitment scheme is written. The per-human cap is written. The handle registry, the scoring, the contention and the transfer are written. None of it has been used: zero rows.

And the proof provider is the weak part, deliberately. Today it is vouched: somebody with standing of their own asserts that you are a distinct person. That is weak by construction, and we would rather have weak-and-recorded than a provider that accepts anything.

There is also a stub provider, and it is worth naming plainly: it is not a provider, it is the absence of one. While it is selected, every verified-human guard in the system is vacuous. It exists for local development and it should never be anywhere else.

The next step is a real provider, built on open source rather than a vendor, so that no company sits between a person and their own personhood.

Why this is the first thing an attacker would go for

It is the least visible organ here. Nobody arrives at a movement excited about sybil resistance. But every claim we make about measuring contribution honestly is downstream of it, and an attacker who defeats the identity checks could become a thousand people and vote.

Which is why it is worth saying out loud, before anyone has to ask: this is the part we are least finished on, and it is the part that matters most.