One person, one citizenship: why we won't hash your name to get there

Our thesis rests on a single claim: a verified human voice is becoming the scarcest asset of the decade. Underneath that claim is a load-bearing assumption most people never look at: that one human cannot quietly become two. If a person can hold two citizenships, the votes are inflatable, the currency is mintable from nothing, and "verified" means nothing at all. Sybil resistance isn't a feature of the stack. It's the floor the whole thing stands on.

So the honest question is the uncomfortable one: how do you make sure a person is counted once, without building the surveillance apparatus we exist to avoid?

One at a time, not for life

First, what "one citizenship" does not mean. It does not mean a citizenship for life. It means one at a time: you cannot quietly hold two at once. Joining is open, and leaving is the easiest thing in the system. You can walk away whenever you want, for any reason or for none, and the door stays open if you want to come back.

The asymmetry is deliberate. It is hard for other people to remove you, a two-thirds supermajority, precisely so no clique can strip your citizenship against your will. But leaving on your own is trivial: stop taking part and the credential lapses into dormancy by itself, no ceremony, and renouncing it outright is a one-person act by design, never a vote. The right to leave is not something a community should be able to veto. A place you cannot leave is not a community, it is a trap. Citizenship here is meant to work the way a free association does, and the way a market does: open to enter, open to exit, with no reason owed to anyone.

The cheap answer, and why it's wrong

The obvious move is to take something every person has, a name and a birthdate, hash it, and reject any second registration that produces the same hash. One line of code. Done. We're not going to do it, and it's worth saying why, because the reasons are the philosophy.

A name and a birthdate are not unique. Across a single small town you might get away with it. Across a federation of towns you will not: the system would eventually turn away a real person because someone, somewhere, shares their name and their birthday. A Sybil defense that excludes real humans is worse than the attack it prevents.

A name and a birthdate are not secret. There are only so many birthdays, and names are guessable, especially the names of people in a place you already know. A hash of low-entropy facts is reversible by anyone patient enough to guess. "Hashed" is not "hidden." The protection lasts exactly as long as a server-side secret stays secret, and a town's identity is not something we'd stake on that.

And a permanent fingerprint of who you are fights your right to be forgotten. You cannot both promise erasure and keep an indelible hash of a person on file. We would rather not hold the fingerprint at all.

Building a foundation on weak personal data is the kind of mistake that doesn't improve as you grow. It gets worse: more people, more collisions, a bigger prize for whoever cracks the secret.

What actually works right now: people

At Röbel's scale, the strongest Sybil defense isn't cryptography. It's that the people vouching for you know you. Citizenship is granted by attestation: existing members confirm a real person they recognize. One human cannot become two, because the humans doing the verifying would notice. It is document-free, it is human, and at this scale it is close to perfect.

It is also honest about its limit: it works while everyone knows everyone.

The honest scaling problem

Past that point, past the town where every face is known, the social gate alone isn't enough, and you need a technical layer beneath it. This is exactly where the temptation to hash a birthday comes back, dressed as pragmatism: we're collecting names anyway, so fingerprint them while we're here.

We're declining that. The convenience of collecting something is not a reason to make it the foundation of a person's identity. Doing the wrong thing cleanly is still the wrong thing.

The primitive we're aiming at

The right tool is not a hash of your name, and it is not a state-run identity wallet either. It is a proof you carry yourself. With the Self protocol, you scan the chip already in your passport, and your own phone produces a zero-knowledge proof that the document is genuine, emitting a service-specific nullifier: a value that is the same for you every time on our app, reveals nothing about who you are, and cannot be linked to the one you use anywhere else. Same person, same nullifier, so duplicates are caught, without a name, a birthdate, a photo, or anything reversible ever being stored.

The seed is a government document, but everything after it is yours. There is no identity system to enrol in, no operator who can watch where you use it, no platform that can switch you off. That is the half the EU's digital identity wallet leaves out: it can be made private, but it still lives inside an apparatus someone else administers. For a project about digital self-government, that sovereignty is not a detail, it is the point.

Uniqueness without identity, and without a wall in the middle that a state or a company can move. That is the shape of a Sybil layer we'd be willing to build a town on.

And the check itself has to meet the same bar as the rest of the stack. We encrypt every ballot; we split the key that decrypts them across a federation, so no single operator can read a vote. It would be incoherent to then let a single server quietly decide "is this a new human?", or to keep a brute-forceable hash that one breach unwinds. So when the technical layer arrives, the uniqueness check runs across the same federation that already guards the ballot box: a threshold, not a lone secret. The guarantee that you are one person becomes as trustless as the guarantee that no one can read your vote.

Why the stakes just went up

There is a new reason to get this exactly right. The same credential that grants a vote is about to grant the ability to hold the town's money. A duplicate citizen used to mean one extra ballot. Soon it would mean currency minted from nothing by a person who exists only on paper, twice. The cost of a weak uniqueness layer is no longer measured in votes. All the more reason not to pour the foundation out of sand.

What we're doing, plainly, so we can be held to it

• Today, the attester social layer is the Sybil gate, and at our scale it is strong.
• We are honest that the system still stores more personal data than it should, names included. We treat that as a debt to pay down, not a foundation to build on, and we are working to minimize it.
• We are not baking a weak fingerprint of your name into the system just because there's a convenient moment to collect it.
• When we scale past "everyone knows everyone," the uniqueness layer will be a self-custodied proof of personhood (the Self protocol), checked across the federation, not a hash sitting on a server and not an identity you have to rent from a state.

We are not at the destination yet, and we would rather name the gap than paper over it. But the direction is fixed: a system that proves you are real should not have to know who you are, and a citizenship worth holding is one you are always free to put down. Those are the lines we're holding.