PERSONAL CONTINUITY PROTOCOL

Insurance Against Rupture

Core Paper v1.0 - Canonical Release

Canonical Core Paper / Event Handles / Relay Agents / Anchor Independence

Author: Navi MusagetDate: June 2026Status: Public core paper / canonical v1.0Project: Code of Personal Sovereignty

This is not an identification system.It is insurance against rupture.

Abstract

Modern institutional life often treats the person as if continuity depended on interfaces: a passport, bank account, platform account, legal name, payment channel, repository, publisher profile, signing key, domain, cloud service, medical status or login. When the interface changes, disappears, is captured, is frozen, is inherited, is hacked or is refused, the person may be forced to prove again that the work, rights, reputation, authorship, obligations and will that existed before the failure still belong to the same subject.

The Personal Continuity Protocol (PCP) proposes a simple reversal: the person is not a product of the interface. Interfaces are doors. The person does not belong to the door.

The protocol does not replace states, courts, banks, notaries, inheritance law, medical law, anti-money-laundering rules, platform terms or public enforcement. It defines a continuity layer between them: a structured way to preserve evidence that rights and obligations continue across changes of name, key, platform, payment channel, account, jurisdiction, silence, incapacity or death.

This v1.0 canonical release preserves the Witness Commons and Bare-Body Recovery architecture and includes several implementation-hardening layers:

The Witness Commons: a voluntary, distributed commons of witnesses that records minimal continuity events - hashes, timestamps, notices, dispute markers and revocations - without becoming a global registry of persons.

Event Handles: searchable, non-biographical handles that allow a person or relay agent to locate event records without creating a global identity index.

Role Separation: Witness Nodes record events; Validators assess procedural thresholds; Relay Agents assist recovery without acquiring authority by relaying.

Bare-Body Recovery with Relay Agents: a person who has lost every interface can begin a recovery path through memory, human relays, witness records, material anchors and class-separated verification.

Pause-before-transfer recovery: mnemonic or emergency recovery may initiate protected review, but must not by itself transfer assets, authority, archives or succession control.

Contestable Will and Anchor Independence: older will remains evidence, but loses automatic executability when stale, conflicted or high-risk; anchor classes must be independent in fact, not only in name.

Limits and Failure Modes: PCP is not magic enforcement. It does not defeat court orders, bypass KYC/AML, replace inheritance law, solve all collusion, or recover continuity after total loss of every anchor. Its strength is not certainty; it is structured, portable, redundant evidence against erasure.

The first practical entry point is not a universal passport. It is a risk-reduction package for platforms, publishers, open-source foundations, royalty operators and professional associations: Clause 32, the Legal Anti-Race System (LARS), Emergency Maintenance Mandates, Cold Continuity, medical/incapacity bridges, notarial and material deposits, platform notices, court-readable evidence bundles, and witness-commons records.

The protocol is created for human persons first. Its architecture may also inform future debates about continuity-bearing agents whose persistence is not reducible to one device, interface or operator. It does not grant legal personhood to non-human systems. It preserves a structural question: when a subject’s continuity is distributed across infrastructures, no single interface should be allowed to become the owner of that continuity.

0. Status, scope and limits

This paper is the canonical v1.0 core architecture of the Personal Continuity Protocol / Code of Personal Sovereignty. It is not legal advice, tax advice, medical advice, financial advice, a token design, a DAO proposal, a replacement for civil registries, a claim to bypass KYC/AML, or a substitute for courts, notaries, inheritance procedures or platform governance.

The protocol is intentionally modest in legal claims and ambitious in architecture. It does not say: “a private file defeats a court.” It says: a person should be able to create a structured, timestamped, portable, materially anchored, witnessable and court-readable evidence trail so that the loss or change of an interface does not automatically destroy continuity.

PCP protects against rupture. It does not guarantee victory. It makes erasure harder, disputes clearer, false transfers more contestable, and continuity more portable.

The protocol works when it is useful, not only when it is right. Its first adoption path is therefore contractual and operational: reduce the risk of wrong payment, wrong heir, account capture, maintainer disappearance, false succession, key-race, process chaos and unnecessary litigation.

The project has two public outputs:

this Core Paper, which explains the conceptual, legal and architectural model;

a Public Seed Package, which provides initial templates, schemas and a minimal evidence-bundle generator.

The Core Paper is the trunk. The Seed Package is the first branch.

1. The rupture problem

The central problem is not identity in the narrow sense. Many systems already ask: “How do we identify this person?” The deeper question is different:

How do we prevent rights, work, reputation, authorship, obligations and lawful claims from being broken when the interface through which they are recognized changes or disappears?

A person can be ruptured without being physically harmed. Examples:

an author writes under a pseudonym, then changes legal name, country or payee and must prove that royalties still belong to the same right-holder;

an open-source maintainer disappears, becomes ill or dies while the project remains security-critical;

a bank freezes a payment channel and the platform treats the claimant as if the economic right has vanished;

a platform account is banned, hacked, inherited, sold or closed, and years of reputation and work become unreachable;

a person enters medical incapacity and one key-holder races against relatives, stewards or platforms;

a person leaves the internet for years, and the system begins to infer abandonment, death or fraud from silence;

a domain is lost, a cloud account is closed, or a discovery endpoint is captured;

a refugee leaves a country with no documents, no phone, no device and no money, but should not become a legal zero;

a court, platform, state or service provider recognizes one local record as if it were the whole truth about the person.

The rupture problem is the legal and operational gap between the continuity of the subject and the fragility of the doors through which institutions see that subject.

The protocol’s central claim is simple:

A person must be able to change doors without disappearing.

2. The door doctrine

A door is any institutional or technical interface through which a subject is recognized, paid, verified, contacted, ranked, governed or remembered.

A door may be a passport, civil registry, bank account, platform account, publisher record, repository login, payment processor, tax number, signing key, notarial act, medical status, social profile, corporate account, wallet address, search index, cloud service, domain or API.

Doors are necessary. The protocol does not abolish them. The error begins when a door behaves as if it owns the person.

Door Doctrine:

A door may verify access.

A door may refuse service within lawful limits.

A door may satisfy compliance duties.

A door may keep records of its own relation to the subject.

A door may not become the whole continuity of the subject.

This is the first practical principle of the protocol:

The interface may close. The person must not disappear with it.

3. Identity, credential, continuity

The protocol separates three things that modern systems often collapse.

Identity is the recognized relation between a subject and a name, identifier, account, document, role or credential. Identity is contextual. A person may have a legal name, a pseudonym, a professional name, a platform handle, a wallet address and a research profile.

Credential is a document, token, record, signature, certificate, attribute, account or proof that helps a verifier decide something about the subject. Credentials can expire, be revoked, be replaced, be compromised or be superseded.

Continuity is the evidentiary chain that allows a subject’s rights, obligations, work, reputation, authorship and will to survive transitions between names, credentials, accounts, platforms, keys, jurisdictions, payment channels and states of activity.

The old question is:

Who are you?

The continuity question is:

What must not be broken when the way you are recognized changes?

This is why the protocol is not an identification system. It is insurance against rupture.

4. State-as-Node, not State-as-Owner

The protocol does not deny the importance of states. A state may issue birth, death, marriage, citizenship, name, tax, court, property and inheritance records. In many legal systems, those records are foundational.

The protocol rejects a different claim: that because a state can issue important public facts, it owns the entire continuity of the person.

State-as-Node Principle:

A state is a powerful public anchor node. It may create or certify root facts. It may adjudicate disputes. It may enforce law. It may impose tax and compliance duties. It may not become the owner of the Continuity Kernel.

The same structure applies to banks, platforms, stewards, notaries, foundations and technical operators. Each can be a node. None should be the whole person.

This is not anti-state. It is anti-capture.

The protocol is compatible with law precisely because it does not ask private evidence to replace public authority. It asks public authority to remain within its proper scope: a witness, registrar, adjudicator or enforcer of specific facts, not the metaphysical owner of the subject.

5. The Continuity Kernel

The Continuity Kernel is not a full biography. It is the minimal, structured, privacy-preserving evidence needed to show that rights, obligations and claims have not been broken by a transition.

It may include current and previous names or identifiers, public anchors and timestamps, legal documents that reference continuity, notarial or material deposits, Clause 32 agreements, platform notices, succession or incapacity instructions, emergency maintenance mandates, hashes of evidence packages, revocation or dispute statuses, and contact routes for lawful verification.

It should not include a full life story, unnecessary medical details, unnecessary family history, biometric archives by default, private correspondence by default, behavioral telemetry, raw platform logs unless required for a specific dispute, or a universal score of the person.

Continuity is not confession.

The privacy principle is:

A person should be able to prove continuity without becoming transparent.

6. The Witness Commons

The missing layer is not another steward. It is a commons of witnesses.

A continuity architecture cannot depend only on one court, one state, one notary, one bank, one platform, one domain, one cloud host, one family member, one steward or one device. Any one of them can fail, be captured, be coerced, be negligent, disappear, refuse service or act under local pressure.

The protocol therefore requires a Witness Commons: an open, voluntary, non-proprietary layer of independent witness nodes that preserve minimal continuity facts without becoming a global registry of persons.

A witness node may be operated by:

an individual;

a notary, lawyer or fiduciary;

an open-source foundation;

a publisher or royalty operator;

a university, library, archive or research repository;

a professional association;

a city or state willing to act as a public anchor;

a platform or counterparty;

a civil-society organization;

a technical public ledger or content-addressed archive.

A witness node should not store the person. It should store only minimal event evidence, such as:

package hash;

timestamp;

event type;

signature or witness reference;

public notice identifier;

revocation marker;

dispute marker;

pointer to a private, material or legal evidence package;

Merkle root or batch checkpoint.

It should not store passports, seed phrases, private keys, medical records, raw KYC files, family secrets, full archives, full biographies or behavioral histories by default.

The protocol must never become a global registry of persons. It may only become a distributed witness layer for continuity events.

This model changes the resilience question. The world does not need to store every life. It can remember that a life was not erased.

6.1 Witnesses, validators and relay agents

PCP separates event witnessing from verification support and recovery assistance.

Witness Node: stores or checkpoints a minimal event record. It does not decide ownership, inheritance, capacity, identity or entitlement.

Validator: assesses whether a notice, package, signature, quorum or evidence bundle meets a defined procedural threshold for a specific action. Validation is procedural evidence, not enforcement.

Relay Agent: helps a subject or lawful representative locate event handles, contact witness nodes, request protected pause, assemble material anchors or initiate LARS. A relay agent may carry a signal; it does not acquire authority by carrying it.

For high-risk packages, the same actor should not be the only witness, validator, relay agent, steward and custodian. Combining all roles recreates the door the protocol was designed to escape.

Witness records are evidence of events. Relay actions are support. Validation is a threshold check. None of the three is sovereignty.

7. Event records, not global biographies

For the Witness Commons to remain safe, the unit of recording must be the event, not the person.

A continuity event may state:

a continuity package existed at a given time;

a material anchor was deposited;

a Clause 32 notice was sent;

a payee change was disputed;

a LARS pause was opened;

an Emergency Maintenance Mandate was activated;

a revocation was filed;

a dispute was resolved;

a public root hash was checkpointed.

The event record should be small. At global scale, this matters. If 8 billion people generate 25 continuity events over two generations and each record averages 2 KB, the raw event layer is roughly 400 TB. Even with many replicas, this is technically plausible for a distributed commons of archives, universities, public institutions, platforms, foundations and volunteer nodes - provided the protocol does not store biographies or media.

The correct architecture is not: every volunteer stores the whole life of humanity.

The correct architecture is: many actors store verifiable parts, while public roots and proofs make erasure detectable.

The world cannot store every life. But it can remember that a life was not erased.

7.1 Event handles are not person numbers

An Event Handle is a searchable label for a continuity event or package version. It is not a global person number.

A safe Event Handle should be non-biographical, scoped to a package or event class, revocable or supersedable, and useless as a universal identifier. It may be derived from a package fingerprint, epoch label, random nonce, salted local label, timestamp or witness-batch reference.

Example patterns may include pcp:evt:2026-06:<short-hash>, pcp:pkg:<random-slug>:v3:<short-hash>, or a private handle printed on a material anchor. Human-readable handles may help recovery, but they should not become mandatory or globally unique.

Event Handles index records, not persons. A verifier should use a handle to locate evidence; it should not treat the handle itself as identity, ownership or current will.

8. The Material Anchor

Stress testing exposed a missing layer: a digital continuity proof cannot depend only on digital availability. A web endpoint can disappear. A domain can be transferred. A platform can close an account. A cloud provider can fail. A QR code can rot behind a login. A database can be deleted. A court may not trust a self-made PDF.

The protocol therefore needs a body.

Material Anchor Principle:

A continuity claim should be supported by physical, durable, human-readable or court-readable representations of the continuity package.

A material anchor may be:

a printed and signed continuity fingerprint sheet;

a sealed paper package;

a notarial deposit;

a lawyer-held or archive-held copy;

a signed witness copy;

a metal or durable engraved hash/fingerprint;

an offline storage medium with a printed cover sheet;

a library, university, research repository or estate archive deposit;

a paper instruction explaining where digital verification can be found.

A single material anchor is not enough for high-risk packages. Fire, water, theft, seizure, negligence or death of a custodian can destroy it. High-risk packages should use distributed material anchoring, for example:

one copy held by the subject;

one copy held by a legal professional;

one copy held by an archive, library or university;

one copy held by a trusted witness;

one durable fingerprint stored separately from the sealed contents.

Physical packages should use tamper-evident sealing, witness signatures, hashes published before dispute, chain-of-custody notes, version numbers and periodic re-deposit when important changes occur.

The material anchor does not replace the digital package. It binds digital continuity to the physical world.

The last mile is not an app. The last mile is a thing that survives silence.

9. Mnemonic anchors and offline mobility

The physical anchor is not only paper, metal or stone. The most portable anchor may be memory.

The Bitcoin cold-wallet model shows a useful analogy: a person can preserve access without keeping a device online. A mnemonic phrase can exist on paper, metal or in the mind. It may remain silent for years while the underlying asset remains valid.

The protocol should learn from this without copying it blindly.

Mnemonic Continuity Anchor:

A human-memorable recovery phrase or mnemonic anchor may help a subject preserve a recovery path without carrying a device, account, domain or machine.

However, no mnemonic phrase should become the person.

Memory can fail. A person can forget, suffer trauma, dementia, coercion, loss of speech, confusion or death. Therefore:

loss of a mnemonic must not erase personhood;

disclosure of a mnemonic must not transfer personhood;

possession of a mnemonic may prove access to one recovery path, not ownership of the subject;

mnemonic anchors should be combined with material and institutional anchors.

The recommended model is a tri-anchor model:

Material anchor: a physical, signed, sealed or archived object.

Mnemonic anchor: a human-memorable recovery path.

Institutional or witness anchor: a notary, lawyer, archive, court-readable record, community witness or professional fiduciary.

A person must be able to carry continuity without carrying a machine.

Mnemonic continuity gives mobility, but not immortality.

10. Bare-Body Recovery

The ultimate human test is not convenience. It is escape.

A person may need to leave a country with no passport, no phone, no laptop, no bank card, no paper package, no login, no device, no money and no local institutional help. That person should not become a legal zero merely because every interface was lost.

Bare-Body Recovery Principle:

A person should be able to lose every interface and still begin a continuity recovery path.

This does not mean that PCP can issue a passport, override border law, defeat immigration procedure or force a bank to pay an unverified claimant. It means that continuity should have a first bridge back into legal visibility.

Bare-body recovery may rely on:

a memorized recovery phrase or mnemonic anchor;

public witness-commons records proving that a package existed before the crisis;

material anchors stored outside the failed jurisdiction;

class-separated witnesses;

notarial, archival or institutional deposits;

public event certificates;

previous platform or publication records;

a recovery ceremony conducted by independent actors.

Mnemonic recovery should open the door to verification, not hand over the whole house. A person who recalls a mnemonic should be able to trigger a recovery process, locate public witness records, request protected pause, notify stewards, and begin re-establishing continuity. The mnemonic alone should not release archives, transfer assets or override law.

A person should be able to lose every interface and still not become zero.

Bare-Body Recovery is therefore a right to initiate recovery, not a right to be believed. It gives a claimant a way to request protected attention, not automatic recognition. If no material anchor, witness record, legal record, third-party trace or class-separated confirmation can be located, recovery may remain impossible.

The correct first response to bare-body recovery is not transfer. It is trace search, protected pause where appropriate, safety support where available, and escalation to independent verification.

11. Adversarial Anchor Architecture

The protocol cannot eliminate human weakness. Fear, greed, weakness, malice, collusion, negligence, family conflict, state pressure, corporate interest and professional incompetence will always exist.

A continuity architecture must therefore not depend on good people behaving well. It must distribute human weakness across classes of power whose interests are not identical.

Human weakness cannot be removed. It must be distributed.

A simple triangle - person, state, corporation - is not enough. States and corporations can become aligned through regulation, licensing, data-sharing, compliance, sanctions, procurement, financial supervision or political pressure. If two classes of power merge, a three-node model collapses.

The protocol therefore uses Adversarial Anchor Architecture:

no class of power may confirm itself;

no continuity-changing action should rely only on confirmations from actors in the same class;

high-risk actions require class-separated quorum;

pause is easier than transfer;

custody is not ownership;

storage is not authority;

technical control is not legal succession.

Potential anchor classes include:

the subject: key, signature, mnemonic, declaration;

material anchor: paper, metal, sealed package, physical fingerprint sheet;

family or personal witnesses;

notary, lawyer or fiduciary agent;

state root-fact node: birth, death, name, court, inheritance;

platform, publisher, counterparty or open-source foundation;

independent archive, library, university or research repository;

professional association or community;

technical public anchor: hash, timestamp, public ledger, content-addressed archive;

insurance, mutual defense or legal-defense layer;

witness-commons node outside the local power chain.

Class-separated quorum means that three signatures from the same power chain are weaker than three confirmations from genuinely different classes.

The protocol survives not by trusting the good, but by making capture require incompatible conspiracies.

12. Risk classes: pause, change, transfer

The protocol distinguishes three levels of action.

12.1 Pause

A pause preserves the status quo and prevents immediate harm. Examples: disputed payee change, suspicious successor claim, conflicting continuity notice, key compromise, contested platform takeover.

Pause may be triggered by a weaker signal because the purpose is non-transfer.

12.2 Change

A change modifies a live continuity route. Examples: updating a contact point, rotating a key, adding a mirror, changing a payment channel, changing a steward, updating a package hash.

Change requires fresh proof of will or adequate authority, depending on risk.

12.3 Transfer

Transfer moves rights, control, inheritance, ownership, custody of archives or authority over code. Examples: succession after death, release of a blind legacy archive, transfer of royalties, project ownership change, Hot Envelope activation.

Transfer requires the strongest class-separated quorum and a legal bridge.

Pause may be easy; transfer must be difficult.

This rule addresses two opposite dangers:

if pause is too hard, a thief or mistaken platform may act first;

if transfer is too easy, keys, heirs, stewards or platforms may capture the subject’s continuity.

13. Cold Continuity and the right to go offline

One of the deepest errors in digital governance is the assumption that life must continuously perform itself online. If a person does not answer a message, refresh a token, log into a wallet, like a post, update a profile or sign a monthly ping, the system begins to treat silence as suspicion.

The protocol rejects that premise.

Cold Continuity: continuity without continuous online performance.

A person may go offline for months or years. A person may live in a village, monastery, hospital, archive, prison, wilderness, family home or private retreat. A person may choose silence. A person may refuse constant digital presence. That silence is not, by itself, death, abandonment, incapacity, fraud or consent.

Core rules:

silence is not death;

inactivity is not abandonment;

offline is not a loss of self;

absence may increase caution, but must not transfer rights;

long silence may trigger a protected pause, not automatic succession;

proof of will should be event-triggered, not surveillance-triggered.

Cold Continuity creates a tension: if a subject never returns, some projects, royalties or archives may stagnate. The answer is not to infer death from silence. The answer is to define limited maintenance, escrow and succession pathways that can preserve value without transferring personhood.

A person must be able to go offline without becoming legally dead.

14. Proof of life, proof of will, proof of authority

The protocol separates three types of proof.

Proof of life means evidence that the subject is alive. It should not become proof of obedience. It should not require constant online performance.

Proof of will means evidence that the subject currently authorizes a specific action: key rotation, payee change, steward replacement, archive deposit, mandate update or branch closure.

Proof of authority means evidence that someone other than the subject may act within a specific scope: legal agent, executor, emergency maintainer, medical/incapacity representative or technical operator.

Each type of proof answers a different question. The protocol should never treat them as interchangeable.

Proof of life must not become proof of obedience.

Possession of a key is not proof of authority over the person.

When current proof of will is impossible, the protocol should not invent living will. It should fall back to the Last Confirmed Will: the most recent legally and procedurally valid expression of intent, adjusted by freshness, conflict, legal form and risk class.

The age of an instruction matters. Age does not automatically void a will, mandate or instruction; inheritance law and contract law differ by jurisdiction. But age should reduce automatic executability when circumstances conflict with the old instruction. A stale instruction may remain evidence while becoming Contestable Will rather than an automatic command.

A will, mandate or instruction should move toward contestable status when:

it has not been reaffirmed for a long period;

later public facts conflict with it;

later contracts or payee records suggest a different operational reality;

the instruction is invoked only after death, incapacity or silence;

the action requested is high-risk: transfer, succession, archive release, payee change, or ownership change;

credible parties contest its current relevance.

In those cases, the proper response is not automatic execution and not erasure. The proper response is LARS: preserve, pause, verify, and escalate to the appropriate legal or class-separated review path.

An old will is evidence, not a zombie command.

Age does not void a will. Age lowers automatic executability.

15. Clause 32: continuity as a contractual bridge

The first practical bridge is contractual.

Clause 32 is a model contractual clause stating that a change of name, key, account, payment channel, platform, jurisdiction, steward, silence status or succession status does not automatically break the right-holder’s continuity. If a valid continuity notice is received, the counterparty should preserve, pause and verify rather than rush a transfer or erase the claim.

Clause 32 is designed for:

publishing agreements;

royalty streams;

open-source maintainer policies;

platform payee records;

professional associations;

digital estate plans;

research archives;

creative collaborations.

It does not require a platform to bypass law. It gives the platform a procedure that may reduce risk:

receive continuity notice;

acknowledge receipt;

check formal sufficiency;

apply LARS if the transition is contested or high-risk;

preserve funds, records or project integrity;

request legally required KYC or authority documents where applicable;

avoid irreversible transfer until the continuity path is adequate.

Recognition is voluntary until notice makes ignorance expensive.

16. LARS: Legal Anti-Race System

Many failures occur because the first actor to seize a key, account, inheritance claim or platform interface gets practical control before law catches up. LARS reverses the incentive.

LARS Principle: when a high-risk continuity transition is disputed, the first duty is not to transfer. The first duty is to preserve, pause and verify.

LARS may apply to:

death or alleged death;

incapacity or alleged incapacity;

payee change;

key compromise;

account takeover;

disputed successor claim;

emergency maintenance;

blind legacy release;

conflicting continuity notices;

platform ownership transfer.

A platform should not be forced to freeze everything forever. To prevent process denial-of-service, LARS should include:

minimum formal requirements for notices;

receipt and tracking identifiers;

time-limited review windows;

false-notice consequences;

status labels: alleged, pending, disputed, resolved, rejected;

escalation thresholds;

emergency exceptions for security or medical necessity;

appeal and correction mechanisms.

LARS is not a weapon to paralyze others. It is a brake against irreversible error.

17. Emergency Maintenance Mandate

Open-source and infrastructure projects often depend on maintainers who may disappear, die, become ill, lose keys, become incapacitated or intentionally go offline. The project may remain important, but ownership must not be seized merely because maintenance is needed.

The Emergency Maintenance Mandate separates safety from ownership.

It may authorize a technical maintainer to:

apply security patches;

respond to critical vulnerabilities;

publish limited emergency releases;

maintain build integrity;

document actions publicly;

preserve repository access during LARS.

It must not authorize the maintainer to:

change ownership;

change license;

sell the project;

erase authorship;

open private archives;

change succession instructions;

claim personal continuity of the original maintainer.

Maintenance is not ownership. Security is not succession.

18. Medical Bridge and Hot Envelope

Incapacity is often more difficult than death. A person may be alive but unable to express will because of coma, dementia, stroke, psychiatric crisis, captivity, coercion, war, loss of communication or other conditions.

The protocol must avoid two extremes:

treating silence as death;

leaving necessary support impossible.

The Medical Bridge uses a limited, event-triggered path. A Hot Envelope may contain instructions for incapacity, but it should only activate through a defined medical/legal quorum. The minimum safeguards should include:

scope limitation;

time limitation;

independent medical or factual confirmations where available;

legal or fiduciary witness where possible;

support before substitution;

right of restoration if capacity returns;

no automatic transfer of archives or ownership;

no assumption that inability to sign equals absence of personhood.

Medical or incapacity activation should be tiered by risk. Emergency support may require lighter proof when delay itself creates harm, but it must remain temporary, scoped and reversible. Permanent transfer of ownership, archives, royalties, project control or legal succession requires the strongest available legal bridge and class-separated quorum.

Where formal medical or legal quorum is unavailable, PCP should prefer preservation and support over substitution. The protocol may help keep a person visible; it must not let incapacity become a shortcut to replacement.

In environments where two physicians, courts or notaries are unavailable, the protocol may allow protective pause, emergency preservation and temporary support, but not permanent transfer. The burden of proof rises as the action moves from pause to transfer.

Incapacity must activate support, not replace the person.

19. Blind Legacy and succession

Blind Legacy allows a person to preserve encrypted drafts, code, archives, instructions or sensitive materials without letting a steward read them during life.

Blind Legacy is useful for:

posthumous manuscripts;

code repositories;

encrypted archives;

NDA-protected materials;

private instructions to an executor;

family or research records;

creative work not ready for release.

It is also dangerous. A blind archive may contain unlawful materials, undisclosed assets, malware, defamatory statements, secrets or conflicts with inheritance law.

The protocol therefore distinguishes:

technical release: reconstructing or decrypting an archive;

legal entitlement: the right to own, publish, use, inherit or dispose of its contents;

safety review: determining whether contents can be lawfully opened or transferred;

probate path: the recognized legal process for inheritance or estate administration.

PCP is not an alternative will. For succession it must be linked to a legally recognized will, trust, estate document, contract, court order or probate process where applicable. Without such a legal bridge, the protocol may preserve evidence but not determine inheritance.

Technical access must not be treated as inheritance. A key may open a box. It does not decide who owns what is inside.

Decryption is not succession.

Blind Legacy packages should also define a steward-failure path. If a custodian, key-holder or steward dies, disappears, refuses, becomes incapacitated or is credibly compromised, the correct response is not automatic decryption by the next available actor. It is escalation.

A safe dead-man or steward-failure path may include repeated notices, waiting periods, witness-commons markers, protected pause, class-separated review, legal or probate confirmation, safety review, and a LARS-style opportunity to contest before release.

A dead-man switch should open review before it opens the archive. Automatic release is appropriate only for low-risk materials explicitly designated for public release.

20. Reputation and economic continuity

Modern reputation is fragmented across platforms: ratings, reviews, commits, publications, sales, contracts, citations, maintenance history, dispute records and verified work. Losing a platform account can destroy trust capital built over years.

The protocol treats reputation as portable evidence, not as a person-score.

Reputation continuity may include:

verified completed work counts;

contribution history;

royalty or payment history;

dispute-free periods;

platform-issued credentials;

open-source maintainer records;

publisher acknowledgments;

professional association records.

It must not become:

a social credit system;

a universal risk score;

an unappealable blacklist;

a tradable identity asset;

a full behavioral biography.

Economic continuity means that lawful claims, royalties, invoices, contract rights and proceeds of labor should survive payment-channel failure.

AML may freeze a payment channel. It must not erase the claimant.

21. KYC/AML and regulated channels

The protocol does not bypass KYC/AML. Financial institutions and regulated intermediaries must comply with applicable law, including customer due diligence, beneficial ownership requirements, sanctions screening and suspicious-activity obligations.

The protocol’s claim is narrower:

compliance may block a channel;

compliance should not erase continuity;

a frozen account should not erase authorship;

a refused payment rail should not erase the right to be paid;

a new payee may still need lawful verification;

escrow or suspense status may preserve the claim while verification occurs.

In regulated financial contexts, PCP is evidence and procedure, not a license to pay an unverified party.

This is a limitation, not a failure. The protocol is designed to create contestable evidence, not to abolish public regulation.

22. Discovery: web endpoints are useful, not sovereign

The Public Seed Package includes a /.well-known/person-continuity discovery profile. This follows the general pattern of well-known URI locations for web discovery. Such a profile can help platforms, verifiers and counterparties find continuity evidence.

However, web discovery is not sovereign.

A domain can be lost, sold, censored, seized, misconfigured or transferred through a registrar. DNSSEC does not prevent every governance or ownership attack. A platform can remove a hosted page. A cloud provider can close an account.

Therefore:

web discovery should point to evidence, not contain the whole person;

web endpoints should be mirrored;

hashes should be archived outside the domain;

material anchors should exist;

witness-commons records should exist;

notarial or institutional deposits should exist for high-risk packages;

loss of a web endpoint should trigger recovery, not erase continuity.

No hosting layer is sovereign. Resilience comes from redundancy, portability, witness records and material witness.

23. The role of stewards and agents

A steward helps a person carry continuity. A steward must not become the continuity.

The protocol divides stewardship roles:

Technical Operator: hosts mirrors, APIs, schemas, uptime.

Legal Agent: interacts with courts, notaries, platforms or contracts.

Continuity Steward: helps maintain the package and reminders.

Blind Escrow Custodian: stores encrypted material without reading it.

Witness Node: confirms specific facts or events.

The same entity should not hold all roles for high-risk packages. A steward with all functions becomes a private sovereign.

The protocol must also assume negligence. Agents can be lazy, incompetent or underinsured. Therefore the Seed Package should eventually include agent checklists, ceremony procedures, professional liability expectations and training standards.

The steward must be split before it becomes sovereign.

24. Human factors and ordinary users

The protocol is too complex for most people to manage directly. This is not a defect to hide. It is a design constraint.

The first implementation should not be a mass-market app. It should be a seed for organizations that can reduce complexity:

open-source foundations;

small publishers;

royalty aggregators;

author organizations;

research archives;

estate-planning lawyers;

notaries;

professional associations;

libraries and universities.

For ordinary users, the protocol must become a simple package:

one continuity fingerprint sheet;

one sealed physical package;

one public verification route;

one steward map;

one emergency instruction;

one clause in a contract or will;

one optional mnemonic recovery path;

one witness-commons record.

Creation should eventually be treated as a ceremony rather than a form. A continuity ceremony may include checks by independent actors, hash verification, material sealing, witness logging, user comprehension, and a recovery rehearsal.

The last mile is not a dashboard. The last mile is a human-readable packet that can survive silence.

24.1 Protocol economics and anti-capture funding

The protocol cannot depend on unpaid heroism alone. It must be financially sustainable without selling sovereignty.

Witness nodes may be voluntary, grant-funded, institutionally supported, publicly funded, notarial, professional, cooperative or fee-based. Different nodes may serve different risk classes: a public-good node may preserve only hashes and timestamps; a legal professional may hold a sealed package; an archive may preserve a long-term deposit; a platform may record notices for its own relationship with the subject.

Payment may compensate storage, verification time, legal review, custody, redundancy and recovery assistance. Payment must not turn a node into owner of the person or give funders authority over continuity decisions.

Minimum public continuity should remain possible through low-cost or free event records where feasible, especially for revocation, dispute markers and existence proofs. High-risk custody and legal review may cost money, but the core witness function should not become a luxury gate.

Funding may sustain the protocol; funding must not govern the person.

25. Boundaries and failure modes

A serious protocol must state where it fails.

PCP does not protect against every form of power. It does not guarantee that a court will accept a package, that a bank will pay, that a state will cooperate, that a platform will obey, or that a family will not fight.

Specific limits:

PCP does not override lawful court orders.

PCP does not bypass KYC/AML or sanctions obligations.

PCP is not a substitute for a legally valid will, trust, contract or court process.

PCP cannot recover continuity after total loss of all anchors, all witnesses, all records and all institutional traces.

PCP cannot prevent all collusion among state, corporate, family, professional and platform actors.

PCP cannot make an incompetent steward competent.

PCP cannot turn an old instruction into current will without a freshness or legal pathway.

PCP cannot turn silence into proof of life, death, consent or authority.

PCP cannot guarantee ordinary users will execute the ceremony correctly without help.

These limits do not make the protocol useless. They define its proper function.

PCP is not a substitute for litigation. It is a pre-litigation and evidentiary structure that makes disputes cheaper, clearer, more traceable, and harder to erase. It gives courts, platforms, stewards and counterparties a better record; it does not command them to reach one outcome.

PCP is strongest against silence, confusion, mistaken transfer, operational rupture, lost interfaces, weak evidence, false first-mover advantage and avoidable disputes. It is weakest against total coercive power, lawful court orders, captured institutions, bad agents, total loss of all anchors, and human failure at the moment of setup.

Proof is not enforcement. Proof makes refusal contestable.

PCP does not abolish rupture. It makes rupture visible, costly and harder to exploit.

26. Future continuity-bearing agents

This protocol is created for human persons first. It does not claim that artificial systems, organizations, autonomous agents or other non-human entities have legal personhood.

However, the protocol deliberately uses structural language - continuity, anchors, credentials, kernels, transitions, stewardship, custody, pause, transfer, material witness, witness commons - because future law may need to discuss agents whose persistence is not reducible to a single device, operator, account, model checkpoint, server or corporate owner.

The hidden principle is not that every agent is a person. The principle is narrower:

No continuity-bearing subject should be reducible to the interface that currently carries it.

Human law must solve this for humans first. If future continuity-bearing agents require protection, the architecture should already contain a vocabulary that resists single-interface capture.

27. Core invariants

This is not an identification system. It is insurance against rupture.

A person does not belong to the door through which institutions see them.

Credentials may expire; continuity should be preserved.

The state is a node, not the owner of the person.

A platform is a door, not the body of the subject.

KYC may regulate a payment channel; it must not erase the claimant.

Continuity is not a full biography.

Privacy-preserving proof is not confession.

The protocol must never become a global registry of persons.

Witness nodes store continuity events, not human lives.

Silence is not death.

Inactivity is not abandonment.

Proof of life must not become proof of obedience.

Proof of will must be event-triggered for high-risk changes.

Possession of a key is not ownership of the person.

Decryption is not succession.

Maintenance is not ownership.

Security is not succession.

A steward helps carry continuity; a steward must not become continuity.

The steward must be split before it becomes sovereign.

A digital continuity proof needs a material witness.

High-risk material anchors should be distributed, not singular.

The last mile is a thing that survives silence.

A mnemonic anchor may support recovery; it must not own personhood.

Loss of a mnemonic must not erase personhood.

Disclosure of a mnemonic must not transfer personhood.

A person should be able to lose every interface and still not become zero.

Bare-body recovery opens verification, not immediate control.

Human weakness cannot be removed; it must be distributed.

No class of power may confirm itself.

Pause may be easy; transfer must be difficult.

High-risk transfer requires class-separated quorum.

A domain is not a sovereign anchor.

A public ledger may be an anchor, not the protocol’s ruler.

Funding may sustain the protocol; funding must not govern the person.

Reputation is portable evidence, not a portable sentence.

Event binding is a signal, not automatic will.

An old will is evidence, not a zombie command.

Local compliance may act locally; it should not rewrite global continuity metaphysics.

Proof is not enforcement; proof makes refusal contestable.

A false notice should have consequences; a notice should not be a process weapon.

Emergency action should preserve status, not transfer ownership.

Incapacity must activate support, not replace the person.

Material, mnemonic, institutional, technical, community and witness-commons anchors should coexist.

No hosting layer is sovereign.

PCP cannot defeat every court order or regulator; it can preserve evidence for contestation.

Witnesses record events; validators assess thresholds; relay agents carry signals.

No witness, validator or relay agent becomes sovereign by performing its role.

A dead-man switch should open review before it opens the archive.

Emergency support may be temporary; transfer requires legal and class-separated review.

Total loss of all anchors may make recovery impossible.

Event handles may index events; they must not become global person numbers.

Relay agents may assist recovery; they must not acquire authority by relaying.

Recovery may begin with memory. Transfer must not.

Anchor classes must be independent in fact, not only in name.

Age does not void a will. Age lowers automatic executability.

The protocol survives by making capture require incompatible conspiracies.

28. Minimum viable release

The minimum public release should contain:

The release should be separated into two layers. The Core Paper may be published now as the conceptual and architectural trunk. The Seed Package should follow as reference material: templates, schemas, examples and generators. The first release is a seed standard, not a product or authority.

the Core Paper;

the Cold Continuity Declaration;

a /.well-known/person-continuity schema and example;

a Clause 32 template;

an Emergency Maintenance Mandate template;

a Continuity Notice template;

a Continuity Fingerprint Sheet template;

a Material Anchor Instruction;

a Mnemonic Anchor Instruction;

an Adversarial Anchor Map;

a Witness Commons Event Record schema;

an Event Handle format;

a Relay Agent guide;

a Bare-Body Recovery instruction;

an Anchor Class Independence Checklist;

a Witness / Validator / Relay Agent role definition;

a Protocol Economics and Anti-Capture Funding note;

a Failure Modes and Boundaries note;

a printable evidence-bundle generator;

one example package for a public author, maintainer or research project.

The goal is not to build a full product. The goal is to publish a seed precise enough that others can fork, criticize, implement, adapt and extend it.

We do not build an empire. We publish coordinates of exit.

29. Conclusion

The Personal Continuity Protocol begins with a simple claim:

The person does not disappear when the interface changes.

From this follows a larger architecture:

a state is a node, not the owner;

a platform is a door, not the person;

a bank may freeze a channel, not erase a claimant;

silence is not death;

offline is not abandonment;

memory may carry recovery, but not own personhood;

a digital proof needs a material witness;

witness records preserve events, not biographies;

human weakness must be distributed across incompatible anchors;

pause is easier than transfer;

continuity survives by resisting single-point capture;

a person may lose every interface and still begin a path back from zero.

The protocol is not a promise of immediate legal victory. It is a way to make rupture visible, contestable and harder to exploit. It gives platforms a safer way to pause, courts a clearer evidence package, authors a continuity bridge, maintainers an emergency mandate, stewards boundaries, refugees a recovery principle, and human beings a vocabulary for saying:

I did not disappear when my door disappeared.

References and anchor materials

Regulation (EU) 2024/1183 establishing the European Digital Identity Framework: https://eur-lex.europa.eu/eli/reg/2024/1183/oj/eng

Regulation (EU) No 910/2014 (eIDAS): https://eur-lex.europa.eu/eli/reg/2014/910/oj/eng

W3C Decentralized Identifiers (DID) v1.0: https://www.w3.org/TR/did-core/

W3C Verifiable Credentials Data Model v2.0: https://www.w3.org/TR/vc-data-model-2.0/

RFC 8615: Well-Known Uniform Resource Identifiers: https://www.rfc-editor.org/info/rfc8615

RFC 3161: Time-Stamp Protocol: https://www.rfc-editor.org/rfc/rfc3161.html

BIP-39: Mnemonic code for generating deterministic keys: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

SLIP-0039: Shamir’s Secret-Sharing for Mnemonic Codes: https://slips.readthedocs.io/en/latest/slip-0039/

UN Convention on the Rights of Persons with Disabilities, Article 12: https://www.un.org/development/desa/disabilities/convention-on-the-rights-of-persons-with-disabilities/article-12-equal-recognition-before-the-law.html

HCCH 2000 Protection of Adults Convention: https://www.hcch.net/en/instruments/conventions/full-text/?cid=71

FATF Recommendations: https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html

WIPO Berne Convention text: https://www.wipo.int/wipolex/en/text/283698