# OATH — Continuous Candidate Integrity and Public Accountability **Working proposal, conceptual specification, and review dossier** **Version:** 0.1 (discussion-derived draft) **Prepared:** 13 October 2026 **Status:** For independent critique, feasibility assessment, alternative design, and expansion **Scope:** Candidate-led political integrity mechanism; policy-neutral as to the candidates' substantive legislative agendas > **Document convention** > **[CORE]** = central objective or design principle expressed by the proposer. > **[PREFERRED]** = direction accepted during the discussion, but subject to validation. > **[PROPOSED]** = a candidate design or requirement, not yet agreed or tested. > **[OPEN]** = unresolved question, material trade-off, or necessary external validation. > **[LIMITATION]** = an important boundary on what the system can truthfully claim. This is a **reviewable working specification**, not an established technical design, a legal opinion, or an evidence-based claim that it will win elections. It deliberately preserves the original objectives, their rationale, the evolution of the proposal, and the tensions that a rigorous reviewer should confront. The technical architecture is an instrument, not the project objective. --- ## 1. Executive proposition **OATH** is a proposed voluntary, candidate-led system intended to distinguish demonstrably accountable political candidates from candidates who do not accept comparable scrutiny. It is conceived as an **external route into government**, not as a reform requiring initial approval from the political institutions it seeks to change. The OATH proposition is to make the conduct, financial interests, commitments, interactions, and public decisions of a participating candidate continuously observable, independently recorded where possible, permanently comparable, and susceptible to meaningful public interrogation. Its purpose is to make undisclosed conflicts, corruption and deliberate dishonesty so **difficult to conceal, and so costly to attempt**, that unscrupulous candidates have a strong incentive not to join, while genuinely public-spirited candidates gain a comparatively inexpensive means of establishing credibility, attracting an audience, and competing electorally. **The decisive outcome sought is not maximum surveillance for its own sake.** It is **maximum electoral viability for candidates whose integrity can be established to an unusually high degree of confidence**. Surveillance, cryptography, transparency and electoral communication are means to that end. The eventual prospect of an honest legislative majority implementing structural improvements is a desirable consequence, not a prerequisite for OATH's launch. At its simplest, the public proposition is: > **A candidate accepts continuous, independently verifiable scrutiny before asking voters to entrust them with public power. The public can examine the evidence without having to take the candidate's word for it.** The **OATH Initiative** would define the voluntary commitment and participation standard. The **OATH Registry** would preserve and expose the associated evidence, histories, discrepancies and verification status. The **OATH Compact** would express the commitments taken by individual candidates and, if elected, public officials. ### 1.1 Non-negotiable versus contingent | Classification | Item | |---|---| | **[CORE]** | Voluntary participation by individual candidates, independent of parliamentary or governmental permission to begin | | **[CORE]** | Recruitment and electoral advancement of people genuinely motivated to serve the public interest, irrespective of their preferred policies | | **[CORE]** | Practical resistance to concealment, revision of history, financial capture, and targeted reputation manipulation | | **[CORE]** | Continuous rather than merely periodic accountability; interrogators should ordinarily query the system, not rely on the candidate's fresh assurances | | **[CORE]** | A low financial barrier for credible, non-wealthy candidates | | **[PREFERRED]** | Public, continuing, historically retained financial transactions and holdings; near-24/7 candidate-worn video capture | | **[PREFERRED]** | Independent, tamper-evident evidence and publicly checkable continuity, with protection for third parties where necessary | | **[PREFERRED]** | One participation standard: no special exclusion of wealthy candidates and no obligation to accommodate the complexity of their finances | | **[OPEN]** | Exact surveillance scope; full public exposure versus sealed evidence; feasibility of proof of coverage; legal jurisdictions; immediate and deferred consequences; precise electoral effect | --- ## 2. The underlying problem: why OATH exists ### 2.1 Political-market failure [CORE] The motivating assessment is that existing representative politics routinely fails to allow voters to distinguish genuinely public-minded candidates from candidates influenced by self-interest, private money, patronage, concealed affiliations, or calculated deceit. The problem has several reinforcing dimensions: 1. **Information asymmetry.** Voters see campaign declarations, reputational narratives and selectively disclosed facts, not a trustworthy, continuously inspectable account of the candidate's conduct. 2. **Financial asymmetry.** Campaign exposure and competitiveness often depend upon funds, donors, party machinery, wealthy networks or access to established media channels. 3. **Credibility asymmetry.** A relatively ethical candidate may be badly damaged by a small real or manufactured scandal, while an actor who makes no serious claim to integrity may simply reject criticism, denounce the press, or appeal to a closed partisan audience. 4. **Entrenchment.** Existing institutions benefit from the incentives and inertia of the current system and cannot be assumed to initiate a reform that undermines those advantages. 5. **Recruitment failure.** Some capable, genuinely public-spirited people avoid candidacy because they lack money, attention, access, confidence in the process, or willingness to participate in its perceived compromises. 6. **Epistemic failure.** The public is routinely asked to trust claims of good intentions and ethical conduct without independent access to evidence that would confirm or contradict them. These are the proposer's **problem hypotheses**. They are to be examined empirically; the specification does not presume that every politician is corrupt, every wealthy person is dishonest, or every non-participant has something to conceal. ### 2.2 Target intervention [CORE] OATH seeks to change the *candidate-selection environment* rather than prescribe what elected candidates must believe. The intended causal chain is: ```text Independent, credible accountability standard ↓ Honest candidates find participation tolerable and advantageous Dishonest or opportunistic candidates face high exposure risk ↓ Improved candidate differentiation and voter confidence ↓ Wider reach, greater electoral competitiveness, lower dependence on patronage ↓ More accountable individuals elected over successive cycles ↓ Potential critical mass for deeper structural reform ``` **[LIMITATION]** Every arrow in that chain is a hypothesis to test. A credible transparency programme cannot truthfully guarantee electoral victory, infer dishonesty from refusal alone, or guarantee the internal motives of a participant. ### 2.3 Outcomes to optimise **Primary outcome:** maximise the number and electability of genuinely public-minded candidates who can demonstrate credible integrity without a significant personal financial burden. **Supporting outcomes:** - Make strategic dishonesty less attractive and easier to expose. - Enable voters and independent critics to test allegations against primary evidence. - Reduce candidates' dependence on expensive publicity, fundraising and institutional gatekeepers. - Build a trustworthy public evidence base resistant to revisions, selective presentation and operator capture. - Allow honest disagreement and ordinary errors without collapsing integrity into ideological conformity or infallibility. - Create a system deployable before complete independent auditing, with an honest and clearly indicated assurance level. **Explicit non-goals:** selecting a policy ideology; eliminating all error or incompetence; guaranteeing agreement with every officeholder's decisions; making wealth formally disqualifying; using escrow or financial bonds as the foundational proof of integrity; requiring initial enactment by government. --- ## 3. Core conceptual distinctions ### 3.1 Integrity is not policy agreement [CORE] A candidate may make controversial, unpopular or mistaken decisions while behaving honestly and in good faith. OATH is not a policy approval organisation and should not score support for one legislative programme as evidence of integrity. Poor outcomes and incompetence remain matters for ordinary electoral accountability. The system should test whether a candidate's actions are consistent with openly stated interests and commitments, whether facts and conflicts were disclosed, and whether material contradictions or undisclosed benefits exist. It should help participants explain unpopular decisions, without dictating what those decisions must be. ### 3.2 Evidence versus proof of character [LIMITATION] OATH can provide stronger evidence of conduct than ordinary disclosure regimes. It cannot read intent or establish that a person will remain honest in every possible future circumstance. Its credible product is **verifiable conduct, visible constraints, attributable omissions or gaps, and accountable responses to challenges** — not metaphysical proof of moral purity. A registry that claims more than the evidence supports would recreate the trust deficit it is intended to solve. ### 3.3 Continuous observability versus periodic disclosure [CORE] Periodic financial returns, annual declarations and retrospective meeting logs leave considerable room for suspicions of selective omissions. The desired target is **ongoing capture and prompt publication or commitment of relevant events**, with historical continuity available for direct public comparison. A concern such as "Did this official interact with organisation X between dates A and B?" should, where data coverage permits, be addressed by querying recorded interactions and their provenance, not by requiring a fresh personal denial from the official. ### 3.4 Public scrutiny versus private interrogation [CORE] A central aspiration is that questioning the candidate personally about *whether an event happened* becomes usefully redundant because the evidence is already independently interrogable. Asking *why* a decision was made, challenging the meaning of evidence, or discussing political judgement will remain legitimate and often necessary. ### 3.5 Detection is different from prevention [CORE] OATH does not need to make every corrupt act physically impossible. It seeks to make wrongdoing **difficult to carry out without creating discoverable evidence**. This is why the proposer prioritises continuous visibility over complex prohibitions backed by bonds, escrow or contractual penalties. **[LIMITATION]** Continuous recording cannot by itself prove the absence of unrecorded accounts, private communications, covert proxies, concealed camera outages, prearranged coded signals or delayed rewards. The architecture must report actual capture assurance, not treat a cryptographic proof of an uploaded record as proof that no external event was omitted. --- ## 4. Agreed and evolving design principles | ID | Principle | Status | Design implication | |---|---|---|---| | P-01 | **Candidate-led and voluntary** | CORE | No dependence on prior constitutional, parliamentary or party reform | | P-02 | **Integrity selection before policy selection** | CORE | No ideological entry condition; no policy-performance score masquerading as moral proof | | P-03 | **Continuous visibility** | CORE | Continuous event handling and capture-gap monitoring; periodic forms alone are inadequate | | P-04 | **Public finance by default** | PREFERRED | Accounts, transactions and holdings intended to remain publicly queryable and historically retained | | P-05 | **Near-continuous self-camera capture** | PREFERRED | Candidate-worn recording with evidence provenance, independent commitments, and verifiable interruptions | | P-06 | **Outside candidate control** | CORE | A participant may submit evidence but cannot quietly erase, rewrite or fork independently witnessed records | | P-07 | **Query rather than reassurance** | CORE | Public access to supporting records, claims, provenance, coverage limits and challenge status | | P-08 | **Exposure before detailed prohibitions** | CORE | Minimise bespoke financial constraints; disclosure may naturally encourage divestment and simpler relationships | | P-09 | **Wealth-neutral eligibility, not wealth accommodation** | CORE | Same formal participation requirements for all; complex wealth may impose disproportionate practical burden | | P-10 | **Minimal candidate expense** | CORE | No material personal bond requirement or reliance on large campaign funding | | P-11 | **Third-party rights** | PREFERRED | Sensitive incidental evidence may need controlled disclosure without compromising public proof of existence/integrity | | P-12 | **Honest phased implementation** | CORE | A usable self-operated mode precedes mature independent infrastructure; assurance labels must not overclaim | | P-13 | **Post-office capture addressed explicitly** | OPEN | Deferred reward is a fundamental incentive loophole; covenant, disclosure tail and other mechanisms to be assessed | | P-14 | **Automatic resignation is not MVP** | PREFERRED | A possible later mechanism only, protected against gaming and subject to constitutional validity | | P-15 | **The Initiative and Registry are distinct** | CORE | OATH Initiative = voluntary pledge and rules; OATH Registry = evidence and verification infrastructure | --- ## 5. Draft A — The OATH Compact (public-facing candidate pledge) **Status:** PROPOSED WORKING DRAFT. Legal effect and detailed scope would depend on jurisdiction. This is not yet a contractual instrument. ### 5.1 Preamble > **The OATH Compact** > > Public office is an exercise of delegated trust. I seek that trust not on the assertion that I am virtuous or infallible, but on a voluntary willingness to make my conduct and interests open to sustained, independent examination. > > I undertake to make available a continuous, verifiable account of the financial interests, relevant relationships, activities, commitments and public decisions that could affect my responsibilities to the people I ask to represent. I accept that legitimate questions about my integrity should, wherever possible, be answered from preserved evidence rather than from my personal assurances alone. > > I will not claim that participation makes me perfect or that honest political disagreement is misconduct. I accept correction, scrutiny and public accountability, and I acknowledge that material concealment or falsification may properly cause the public to withdraw its confidence in me. ### 5.2 Working commitments **C-01 — Voluntary entry and continuity.** I choose to join OATH before seeking or exercising office and accept its published participation requirements. Leaving OATH or ceasing capture cannot be concealed retrospectively; the dates and assurance consequences of withdrawal are public. **C-02 — Financial openness.** I commit to continuously disclosing my financial accounts, holdings, liabilities, beneficial interests, income, material transfers and transactions at the level specified by the OATH protocol, with permanent public access to the historical financial record to the extent legally permissible. I will identify the sources and limitations of any feeds. **C-03 — No hidden revision of history.** I accept that submissions, corrections, withdrawal events, material recording gaps and conflicts of evidence will remain part of an append-only public audit history. A correction adds context or supersedes an assertion; it does not secretly replace the original. **C-04 — Ongoing personal capture.** I commit to the defined near-continuous body-camera and associated evidence-capture regime, subject to transparent exceptions and lawful protection of third parties. Interruptions, exclusions and unauthenticated periods will not be silently represented as complete coverage. **C-05 — Independence.** I will not control the independent OATH evidence registry, its verification witnesses, adjudication of contested events, or the rules by which my own compliance is determined. **C-06 — Public challenge and correction.** I accept evidence-backed questions, independent scrutiny, publication of competing interpretations, and the right of affected parties to seek correction. No machine-generated suspicion will, without fair assessment, be presented as a finding of intentional wrongdoing. **C-07 — Financial and personal relationships.** I accept that my business arrangements, collaborations, gifts, offers, advisers and interested-party contacts may be exposed by the agreed recording regime. The protocol does not in itself require divestment, although I may need to simplify or relinquish relationships that cannot meet the standard. **C-08 — Decisions and explanations.** I will preserve a traceable record of my public commitments, material official decisions and reasons where practicable, while distinguishing facts, legal constraints, judgement, changes of mind and policy disagreements. **C-09 — Post-office accountability.** I acknowledge that rewards arranged during service but delivered after office undermine the system. I support development of an effective, jurisdiction-appropriate post-tenure disclosure or no-reward mechanism. Precise obligations are not yet settled and must not be represented as already enforceable. **C-10 — Honest representation of assurance.** I will not describe candidate-operated records, witness-observed logs, independently reconciled accounts and independently adjudicated findings as though they provide the same level of proof. ### 5.3 Matters intentionally *not* imposed by this draft - No ceiling on initial personal wealth and no categorical ban on wealthy candidates. - No compulsory asset escrow, integrity bond, confiscation or divestment as the universal entry mechanism. - No commitment to a particular economic, social, party or ideological agenda. - No claim that every statement, vote or outcome must be correct. - No automatic resignation based on an allegation, an unexplained technical outage, or a machine-produced suspicion score. ### 5.4 Candidate-facing explanation > **I am not asking you to trust that I am honest. I am voluntarily accepting an ongoing system in which you can independently check what I do, what I own, what I say, and when my account of events changes.** **[OPEN]** Whether the public finds this proposition convincing, excessive, performative or coercive must be evaluated, not assumed. Candidate refusal may have reasons unrelated to dishonesty, particularly third-party privacy, safety, family responsibilities and legal restrictions. --- ## 6. Target operating concept: what the full OATH system does ### 6.1 Operational domains **A. Financial capture and public history** - Continuous or highest-available-frequency data from declared accounts, payment providers, banks, brokers and other financial institutions. - Public histories of positions/holdings, flows, liabilities, income sources and changes in beneficial ownership, as legally and technically obtainable. - Signed or institution-attested source data whenever possible, distinguishing direct institutional feeds from candidate-supplied exports. - Cross-references among financial events, organisations, known interests, meetings, policy positions and public actions. - Public identification of stale feeds, unsupported providers, unexplained discontinuities or unverified completeness. **B. Candidate-worn evidence capture** - Near-24/7 first-person video, with audio only where lawful and within the approved protocol. - Continuous segmentation, device signing, sequence counters, timestamps, independent anchoring and gap detection. - Clear classifications of recorded, buffered, offline, excluded, malfunctioning, unverified or disputed periods. - Retention and access policies that do not treat an innocent bystander's presence as consent to unrestricted publication. **C. Official activity and public decision history** - Campaign representations and official commitments, preserved in the order made. - Meetings, relevant engagements, gifts, approaches from interested parties, votes, instructions and material decisions. - Official public records and supporting source documents, with clear provenance. - Explanations of rationale and changes of position; where feasible, a pre-decision rationale trail that reduces retrospective reconstruction. **D. Independent scrutiny and public interrogation** - A platform capable of answering queries across the evidence record. - Candidate-independent history of what was available and when. - Evidence-linked contradiction, conflict, omission and gap alerts. - Challenges, responses, corroboration, corrections and review outcomes. - Ability to reproduce significant answers and assess how much of the relevant evidence universe the query covers. ### 6.2 Intended sample public questions - "What accounts and beneficial interests were recorded for this candidate as of this date?" - "What money flowed to or from organisation X, its known affiliates or associated individuals during period Y?" - "Did the candidate's declared holdings change before or after this decision?" - "Which meetings or recorded interactions relate to this lobbying proposal?" - "Did the candidate previously make a statement inconsistent with this vote, explanation or later financial transaction?" - "Was the camera operating continuously during the relevant period, and what verifiable evidence exists for any gaps?" - "Which parts of this answer come from bank-confirmed data, candidate submissions, inferred relationships or sealed evidence?" - "What is not covered by the records, and what does the system actually know about the absence of a matching event?" **Critical distinction:** The Registry should answer queries about its **verified corpus** and coverage. A complete answer over committed records is not automatically proof that no unobserved event occurred in the real world. ### 6.3 Public finance versus incidental privacy **[PREFERRED]** Financial transactions and holdings of the participating candidate are intended to remain continuously public and permanently queryable; cryptographic commitments alone are *not* a substitute for the core desired disclosure. **[OPEN]** A transaction record may also reveal private information about a payer, payee, household member, whistleblower or unrelated service provider. Reviewers must design a principled means to reconcile candidate financial openness with third-party data protection, financial security and legal duties. Redacting account credentials and unrelated identifiers is compatible with open financial scrutiny; concealing substantive conflicts under a broad privacy exception is not compatible with OATH's purpose. ### 6.4 Full raw video is not assumed to be public The discussion converged on **continuous capture and publicly verifiable evidence commitments**, but not necessarily public live broadcast or unrestricted release of every raw video segment. The proposed approach is: 1. Capture the candidate's agreed evidence stream continuously. 2. Cryptographically commit to every received segment as soon as practicable. 3. Publish capture continuity, incident metadata and hashes promptly. 4. Store sensitive footage encrypted under independently governed custody when required. 5. Provide clear, narrow, reviewable mechanisms to release relevant evidence in response to substantial public-interest concerns. 6. Prove that released footage matches the previously committed original, including the relevant sequence and timestamps. **[LIMITATION]** A hash proves that subsequently produced bytes match committed bytes. It does not independently prove that the camera was worn, aimed appropriately, or operating at every relevant moment. Exclusion and release procedures are substantive trust dependencies, not technical afterthoughts. --- ## 7. Trust and adversarial model ### 7.1 Parties and trust boundaries | Party | Role | What OATH must *not* assume | |---|---|---| | Candidate / official | Consents, carries capture device, authorises feeds, makes declarations | Complete honesty or complete control over external institutions | | Banks / brokers / payment institutions | Provide financial facts and account metadata | Universal data access, instant delivery, global account coverage | | Capture device / software | Collect and sign observations | That any device can prove the wearer never evaded recording | | Registry operator | Ingests, stores, indexes and exposes events | That a central operator remains incorruptible | | Independent witnesses | Checkpoint and compare committed histories | That any one witness or fixed coalition cannot be compromised | | Auditors / reviewers | Inspect completeness, provenance, conflicts | That professional status implies impartiality | | Evidence custodians | Retain sealed footage and administer lawful access | That secrecy alone establishes independence | | Journalists / watchdogs / public users | Challenge, investigate, query, reproduce findings | That all challenges are made in good faith | | Adjudicators, if introduced | Resolve disputed breaches or exposure requests | That a mere accusation establishes guilt | ### 7.2 Threats explicitly within scope - Undisclosed accounts, assets, trusts, beneficial interests and compensation rights. - Transactions routed through nominees, relatives, associates or informal arrangements. - Manipulated, forged, delayed, omitted or selectively disclosed candidate-supplied data. - Registry forks, concealed corrections, selective search results and operator compromise. - Camera tampering, device substitution, unobserved periods and fabricated provenance. - Coded signals, undisclosed communication channels, off-camera coordination. - Fabricated allegations, adversarial microtransactions, misleading edits and selective quotation. - Collusion by a witness, auditor, custodian or the Registry's funders. - Delayed compensation, paid appointments, beneficial arrangements or benefits to associates after leaving office. - Harassment, political pressure, threats or retaliation facilitated by unrestricted sensitive data. ### 7.3 What cryptographic integrity guarantees — and what it does not | Property | Mechanism | Scope / limitation | |---|---|---| | Historical tamper evidence | Content hashes, signatures, append-only Merkle log | Detects alteration of **accepted records**, not omission before ingestion | | Chronological consistency | Signed checkpoints and consistency proofs | Proves one committed history extends another, subject to verification assumptions | | Resistance to different histories | Independent witnesses, gossip, checkpoint co-signing | Depends on independent comparison, availability and adversary assumptions | | Event authenticity | Source signatures, hardware attestations where possible, independent source reconciliation | Signature authenticates a source/key; not necessarily the real-world truth of a claim | | Query integrity | Authenticated committed indexes and verifiable query execution | Completeness only for the **indexed, committed corpus** and supported query semantics | | Capture coverage | Device health, counters, external heartbeat, gap alarms, overlapping sources | Raises confidence; cannot guarantee no unrecorded conduct | | Financial account completeness | Bank/registry attestation, legal records, external reconciliation, discrepancies | Not universally provable across all jurisdictions and informal arrangements | | Proof of honest intent | None | Cannot be cryptographically established | ### 7.4 Distinguish competing hypotheses from established findings The public user interface must differentiate: **unverified suspicion**, **source disagreement**, **objective contradiction in records**, **material discrepancy**, **reviewed finding**, **appealed finding**, and **resolved explanation**. Correlation of two events is not automatically evidence of bribery or intent. Adversarial inputs must never automatically produce final misconduct labels. --- ## 8. Technical architecture: intended mature design ```text Candidate devices Financial institutions Official public records │ │ │ └──────────────────────────────┼──────────────────────────────────┘ ▼ Source adapters / authentication ▼ Normalisation + provenance + validation ▼ Append-only event ingestion │ │ │ └── Encrypted evidence/object store ▼ Merkle transparency log / checkpoints │ Independent witness network │ Optional external public anchoring ▼ Verified public event corpus │ Authenticated indexes + claim graph │ Public explorer / query / API │ Contradiction analysis / challenges / reviews ``` ### 8.1 Principle of implementation **[PREFERRED]** Use an independently operated **append-only transparency log**, with external witnesses and public checkpoints. A public blockchain may optionally anchor checkpoint roots; it is not necessary to place all video, financial transactions or sensitive documents directly on-chain. The original suggestion of a distributed write-once ledger is aligned with the trust objective, but the core requirement is **publicly detectable tampering and independent historical verifiability**, not a particular blockchain technology. ### 8.2 Core record format — conceptual Every accepted submission, source event, correction, acknowledgement, capture gap, challenge, ruling or policy revision should be represented as an immutable registry event. Suggested fields: ```json { "event_id": "sha256:...", "subject_id": "oath:person:...", "event_type": "FINANCIAL_TRANSACTION", "schema_version": "0.1", "source_type": "INSTITUTION_ATTESTED", "source_id": "institution:...", "observed_at": "2026-10-13T13:15:00Z", "received_at": "2026-10-13T13:15:08Z", "committed_at": "2026-10-13T13:15:10Z", "coverage_id": "account-stream:...", "payload_hash": "sha256:...", "payload_ref": "object://...", "references": [], "classification": "PUBLIC", "author_signature": "...", "registry_receipt": "..." } ``` Illustrative only: canonical serialisation, signature scope, identity format and storage semantics need normative specification. In particular, **client-reported time**, independent receipt time and log commitment time must not be conflated. **Event families** might include: - `PARTICIPATION_STARTED`, `WITHDRAWAL`, `STATUS_CHANGED` - `ACCOUNT_DECLARED`, `ACCOUNT_VERIFIED`, `ACCOUNT_FEED_DELAYED`, `HOLDING_CHANGED`, `FINANCIAL_TRANSACTION`, `BENEFICIAL_INTEREST` - `CAMERA_SEGMENT_COMMITTED`, `CAPTURE_GAP`, `CAPTURE_EXCEPTION`, `DEVICE_HEALTH` - `MEETING`, `GIFT`, `INTERESTED_PARTY_CONTACT`, `VOTE`, `OFFICIAL_DECISION` - `PUBLIC_COMMITMENT`, `RATIONALE`, `AMENDMENT`, `CORRECTION` - `CHALLENGE`, `EVIDENCE_REQUEST`, `RESPONSE`, `ATTESTATION`, `REVIEW_FINDING`, `APPEAL`, `REDACTION_NOTICE` - `POLICY_VERSION_PUBLISHED`, `KEY_ROTATION`, `SECURITY_INCIDENT` ### 8.3 Transparency log and witnesses - Canonically serialised record bytes are hashed and appended into a Merkle tree. - The Registry issues signed checkpoints containing the log identity, tree size, root hash, issue time and operator signature. - Inclusion proofs demonstrate that an event is committed to a particular checkpoint. - Consistency proofs demonstrate that a later checkpoint extends an earlier one, under the relevant hash/security assumptions. - Independent witnesses publish or co-sign checkpoints, preserve previous observations, and compare histories. - Public monitors regularly validate checkpoints and raise alerts on inconsistent histories, unauthorised rewrites or witness unavailability. - External public anchoring can increase resistance to coordinated log rewriting without making a chain the primary storage medium. Witness quorum size, geographic independence, conflict rules, key custody, checkpoint latency and anti-collusion mechanisms remain to be determined by threat modelling. ### 8.4 Video provenance and custody **Initial suggested design (not final):** - Consecutive capture segments, e.g. 1–5 minutes, each bound to device identity, local counter, previous-segment digest, observed timestamps and a signed manifest. - Publish segment commitments, independently received timestamps, stream heartbeats and expected-sequence continuity as promptly as available. - Maintain explicit gap events: no footage; network offline but device buffer intact; camera deliberately disabled; permitted privacy exclusion; camera failure; unverifiable interval. - Store sensitive segments encrypted in redundant custody with versioned access rules and an auditable release workflow. - Publicly publish the commitments and disclosure decisions even when raw files cannot be released. **Important:** A video segment's hash says nothing about what happened outside the field of view. Multi-modal attestation and external source reconciliation may improve practical assurance but cannot establish omniscient coverage. ### 8.5 Finance ingestion and provenance An adapter for each source should expose: - account ownership/beneficial-interest assertion and verification state; - latest source-confirmed balance and holdings date; - events or statements supplied directly by the institution versus through the candidate; - provider reporting lag, API freshness, missing data and outage history; - signed checksums or independently preserved original statements where possible; - historical corrections and reconciliations, including financial events recorded late. The public record should remain permanent in principle while allowing legally mandated corrections or restricted access to particular fields, with verifiable notice of those changes. **The feasibility of permanent unrestricted public disclosure must be established jurisdiction by jurisdiction.** ### 8.6 Query and inference engine The service requires at least three logically separate layers: 1. **Evidence corpus:** immutable facts *about the records*: who submitted, what was submitted, when, source verifiability and gaps. 2. **Assertion/relationship graph:** claims about assets, parties, meetings, commitments, decisions and temporal relations, with explicit provenance and uncertainty. 3. **Interpretive analysis:** rules or models that identify apparent contradictions, conflicts and suspicious coincidences — with links back to primary records and an opportunity for alternative explanations. Queries should return an **assurance envelope**: source coverage, dataset/checkpoint identifier, time window, data lag, missing streams, independently verified sources and the strength of any completeness proof. ### 8.7 Authenticated query completeness [PROPOSED] For queries whose semantics can be formally expressed, the Registry should eventually issue proofs that an answer includes **all matching entries in a committed index**. This may involve committed indexes or authenticated data structures linked to the transparency log. The proof must be carefully labelled: *"No event matching predicate P exists in the committed and indexed records at checkpoint H"* is materially different from *"No such real-world event ever occurred"*. More complex relational, language-model or inference queries may not admit straightforward cryptographic completeness proofs. Those outputs require reproducible source lists, documented transformations and, where possible, independently recomputable results. --- ## 9. Draft B — Phased v1 technical and delivery specification **Design rule:** every phase must be usable on its own, and no phase should suggest a higher degree of independence or completeness than it actually supplies. Earlier phases should use future-compatible data structures, signatures, event IDs and verification APIs. ### 9.1 Delivery phases and assurance tiers | Phase | Public designation (working) | Operating mode | Defensible assurance claim | Important missing property | |---|---|---|---|---| | **0** | **OATH-Self** | Candidate-run capture, submission, hash chain and public evidence feed | Records publicly published by the candidate can be checked against later changes where independently retained | Cannot independently prove complete capture or candidate-independent control | | **1** | **OATH-Registry** | Independent registry ingestion, append-only log, status/gap service and query explorer | Candidate cannot unilaterally rewrite evidence already accepted by the Registry | Operator may still omit/fork unless independently monitored | | **2** | **OATH-Witnessed** | Independent checkpoint witnesses and consistency monitoring | Historical log revisions/forks are externally detectable under defined assumptions | Does not prove unreported real-world events or missing financial accounts | | **3** | **OATH-Proven** *(name provisional)* | Committed query indexes; selected independently verifiable result-completeness proofs | Supported queries are complete relative to specified committed indexes | Full real-world completeness and complex interpretation remain unproven | | **4** | **OATH-Full** *(name provisional)* | Mature sensitive-evidence custody, disclosure controls, audits and dispute procedures | Published capture/record evidence and governed releases are independently reviewable | Still cannot guarantee character, complete surveillance or election outcome | **[OPEN]** Public-facing tier names need review. In particular, “Proven” and “Full” may imply more than can be guaranteed; alternative names should explicitly describe the evidenced property. A separate *operational status* (current / delayed / interrupted / suspended) should not be conflated with *assurance tier*. ### 9.2 Phase 0 — Candidate-operated launch mode **Goal:** enable a credible pilot with modest cost and no dependence on mature independent auditors or custodians. **Minimum deliverables:** 1. Candidate enrolment, consent and identity/public-key binding. 2. Mobile or wearable capture agent that segments, signs and uploads recording manifests, with retained encrypted footage where lawful. 3. Hash-linked event publication with frequent external timestamp receipts or automatic mirror publication when obtainable. 4. Candidate financial account declarations and regular automated provider exports/API feeds **where available**, visibly labelled by provenance. 5. Public append-only candidate timeline covering participation, financial data freshness, statements, material meetings, camera heartbeats and gaps. 6. Queryable public explorer for recorded finance, claims, event timestamps and known coverage gaps. 7. Transparent machine-readable status endpoint and export API. 8. Secure operational handling of device keys, exposed financial metadata and personal data. **Claim that may be made:** this candidate has voluntarily begun publishing a time-linked, reviewable evidence trail, whose continuity and internal consistency outsiders can inspect. **Claim that may not be made:** the candidate's entire life has been independently verified, or all finances and events have been captured. **Architecture requirements carried forward:** stable event schema, hash/signature format, source tags, timestamp separation, checkpoint interface, challenge/event references, and explicit gap reporting. Design now for eventual migration into an independent log without rewriting earlier evidence. Migration must mark the exact point independence begins; it cannot retroactively make self-operated data independent. ### 9.3 Phase 1 — Independent registry operation **Goal:** the candidate ceases to be the sole custodian of their public history. **Add:** - Registry-hosted ingestion endpoints and a public event store. - Canonical validation and source authentication. - Merkle append-only log, signed checkpoints, downloadable proofs and independent public mirrors. - Public financial source-verification state and reconciliations. - Automatic capture/ingestion gap detection and public operational notices. - Structured challenges and responses preserved in the log. - Candidate-independent hosting, operator governance and incident reporting. **Acceptance tests:** - A candidate cannot silently delete or modify an accepted entry. - A correction remains visible alongside the original. - Public clients can verify inclusion against a checkpoint. - Captured video continuity or financial feed downtime is not silently interpreted as complete activity. - Registry operator outages are distinguishable from candidate-side outages. ### 9.4 Phase 2 — Independent witnesses **Goal:** eliminate the requirement to trust the Registry operator's word that its own archive has not forked or been rewritten. **Add:** - Multiple organisationally independent witness services. - Published checkpoint histories, consistency verification and fork alarms. - Witness co-signatures or observe-and-gossip with explicit security assumptions. - Open-source verifier/CLI so any third party can reproduce log-integrity checks. - Documented governance for witness addition, withdrawal, compromise and key rotation. **Acceptance tests:** - A simulated operator presents incompatible checkpoints to two audiences; the monitor detects or exposes the conflict under the specified witness connectivity assumptions. - A compromised log signing key cannot silently invalidate already independently witnessed history. - Public proof verification works without trusting the OATH web front end. ### 9.5 Phase 3 — Authenticated query verification **Goal:** allow independent verification that a supported response includes all matching entries within a declared evidence corpus. **Add:** - Committed financial and temporal indexes. - Versioned, auditable index builders with checkable source-to-index mapping. - Result proofs for precisely defined predicates. - Coverage/freshness metadata and explicit unsupported-query notices. - Open verifier libraries and reproducibility datasets. **Acceptance tests:** returned results and non-results verify against a specific checkpoint for supported predicates; deliberate omission from a committed index is detectable. Failure to ingest a real-world event remains an independently reported coverage problem, not a cryptographic success. ### 9.6 Phase 4 — Independent sensitive-evidence custody and review **Goal:** make sensitive recording evidence available for legitimate scrutiny without imposing unlawful or disproportionate disclosure on third parties. **Add:** - Independent, redundant encrypted evidence custody. - Versioned rules for sealing, access, redaction, limited release and appeals. - Transparent independent review of evidence requests and capture exceptions. - Verification that released material matches previously committed segments. - Safeguards against public harassment, selective leaks, privilege breaches and retaliatory disclosure. **Acceptance tests:** no candidate or single operator can silently alter the record or privately rewrite a release decision; equally, a mere hostile allegation cannot trigger automatic exposure of unrelated private individuals. ### 9.7 Suggested v1 API surface [PROPOSED] Indicative routes; not an implementation contract: ```text POST /v1/enrolments POST /v1/events POST /v1/capture/segments/commit GET /v1/subjects/{id}/timeline GET /v1/subjects/{id}/financial-records GET /v1/subjects/{id}/coverage GET /v1/subjects/{id}/status GET /v1/log/checkpoints/latest GET /v1/log/entries/{event_id}/inclusion-proof GET /v1/log/consistency-proof?from={size}&to={size} POST /v1/challenges GET /v1/challenges/{id} GET /v1/export/{subject_id} ``` Every public query should ideally include `as_of_checkpoint`, actual observation range, provider data freshness, source-verification class, omitted fields and current known capture gaps. Sensitive endpoints require a separate authorisation and evidence-release design. ### 9.8 Proposed release gates - **Gate A — Basic reliability:** app/device runs, uploads and safely recovers from offline periods without erasing gap history. - **Gate B — External verifiability:** public can independently verify hashes/signatures and reproduce timeline chronology. - **Gate C — Registry independence:** candidate cannot rewrite accepted history; public can export original records. - **Gate D — Non-equivocation:** independent witness behaviour is tested under deliberate adversarial forks. - **Gate E — Query correctness:** data-index builders and supported result proofs survive red-team omission tests. - **Gate F — Legitimate scrutiny:** evidence-release governance survives attempts to force disclosure of innocent bystanders or block legitimate public-interest review. These gates are **engineering acceptance targets**, not automatic permission to deploy in a jurisdiction without legal and human-rights analysis. --- ## 10. Financial structure: exposure first, divestment as consequence ### 10.1 Rejected default: financial bonds or compulsory escrow The discussion considered an **integrity bond**, escrowed assets, strict financial instrument prohibitions, obligatory trusts and predetermined forfeiture as ways to make dishonesty expensive. The proposer objected that these mechanisms can be complicated, impose unnecessary candidate burden, fail to reveal omissions and delayed rewards, and reintroduce trust in rule-makers and enforcement bodies. They were **not accepted as the primary OATH mechanism**. The preferred causal mechanism is different: ```text One demanding, continuous financial exposure standard ↓ Complex structures and interested counterparties must tolerate exposure ↓ Some arrangements become impractical or unattractive ↓ Candidates voluntarily simplify, divest, or decline entry ``` No separate blanket prohibition is needed to produce those incentives, although specific legally necessary participation conditions may eventually be unavoidable. ### 10.2 Wealthy candidates Wealth is **not** a disqualifier. A wealthy candidate remains eligible in principle if able and willing to meet the standard. OATH is **not required to optimise for their convenience**. Financial complexity may naturally raise the cost of complying and deter some wealthy aspirants; the proposer considers that an acceptable, potentially mildly beneficial side effect, rather than a system objective. **[OPEN]** The assumption that wealth is a reliable proxy for a greater risk of corruption, and the practical recruitment cost of excluding wealthy but ethical candidates indirectly, should be independently assessed. Apply the same published standard; do not label wealth itself proof of dishonesty. ### 10.3 Missing accounts and omissions Continuous public records expose many undeclared relationships once they interact with recorded accounts or events. They do not automatically catch **interactions deliberately kept outside monitored channels**. A rigorous design needs multiple evidence paths: source attestation, institutional reconciliation where permitted, known beneficial ownership records, device event provenance, external official records and public challenges. Public-facing coverage must always distinguish: - **Declared** accounts from **institution-attested** accounts; - **Recorded** transactions from **all transactions a person may have made**; - **Reported absence of evidence** from **proof of non-existence**; - **Delayed data** from **genuine inactivity**. The aim is to make omission progressively more difficult and risky, not claim that logging one account logically proves that no other account exists. --- ## 11. Post-office capture and long-term rewards **Status: important, unresolved structural loophole.** A person may accept transparency during office while making favourable decisions in anticipation of later employment, consulting fees, board appointments, donations, family benefits, contracts or benefits supplied through nominees. Continuous in-office financial and camera data may leave future reward channels untouched. ### 11.1 Option A — Self-imposed no-reward covenant [PREFERRED AS INTERIM] A participant pledges not to accept specified post-office payments, appointments or benefits connected to decisions made in office. It is simple and consistent with the original voluntary structure, but proof, enforceability, jurisdictional reach and the definition of prohibited benefit are difficult. ### 11.2 Option B — Post-office transparency tail [PROPOSED] Continue financial disclosures, beneficial-interest records and paid-role reporting for a meaningful fixed period after office (for example five years, but **no duration is agreed**). Ordinary full-time body-camera obligations need not continue. This creates a retrospective evidence trail of potential delayed rewards and raises the expected reputational cost of corrupt bargains. **Limitation:** postponed payments can outlast the tail or be routed via proxies, trusts or relatives. Public observation is a deterrent, not guaranteed attribution of quid pro quo. ### 11.3 Option C — Legally enforceable disgorgement or restrictions [PROPOSED / JURISDICTION-SPECIFIC] Where law permits, explore limited covenants, civil recovery of demonstrably improper gains, cooling-off restrictions or restrictions on paid advocacy related to prior official influence. Any ability for a private initiative to sue, enforce covenants or impose penalties must be established by qualified local counsel; it cannot simply be asserted by the Compact. ### 11.4 Option D — Incentive redesign [OPEN RESEARCH] Invite alternative mechanisms that are less complex than bonds/escrow and more robust than merely voluntary post-office promises. Desired properties: - effective against rewards deferred beyond a term or routed through proxies; - no large candidate capital requirement; - independently verifiable, with limited discretionary enforcement; - compatible with legitimate subsequent employment and freedom of association; - operable without initial legislation if possible; - does not create new powers for the OATH operator to coerce participants. ### 11.5 Related future policy (outside OATH eligibility) The proposer anticipates that independently elected honest candidates **might** support bans or strong limits on lobbying, replaced by an open, democratised public consultation mechanism. These are potential downstream policy reforms, **not conditions of OATH membership**. They must not become hidden ideological selection tests. --- ## 12. Resignation 'kill-switch' concept **Status:** speculative future proposal, **excluded from the initial system**. Idea: a participant might pre-commit to leaving office if an exceptionally clear and severe OATH breach is independently established, potentially via a pre-signed resignation instrument where legally valid. **Why deferred:** an automatic or adversary-triggerable resignation process could allow hostile parties to manufacture capture gaps, fabricate evidence, compromise devices, weaponise reporting processes or exploit technical failures to remove an honest official. A voluntary private instrument may also have no effect under the applicable constitutional or parliamentary rules. **Minimum preconditions for future consideration:** 1. Local constitutional and employment/office-holding law validates the proposed mechanism. 2. Only narrow, independently ascertainable breach predicates apply. 3. Technical gaps and disputed facts cannot by themselves trigger immediate resignation. 4. Independent review, notice, appeal and protection against capture are available. 5. No single Registry operator, political party, complainant or automated classifier can activate it. 6. A candidate's policy statement favouring future exploration must not imply that the mechanism already exists. An interim option is public suspension of an assurance claim pending review, with proportionate restoration and correction procedures rather than automatic loss of office. --- ## 13. Electoral value and recruitment strategy ### 13.1 Intended electoral differentiation [CORE] The central value proposition is voluntary, costly-to-fake accountability **before** obtaining public power. A participant seeks to replace the ordinary "trust my assurances" relationship with one where substantial relevant evidence is independently inspectable. The proposer wants the difference in commitment to be so striking that OATH candidates have an enormous competitive advantage, particularly against entrenched politicians who decline comparable visibility. However, **refusal is not proof of guilt**, and the electoral advantage is a proposition for testing, not a guarantee. ### 13.2 Why committed honest candidates might join - A route to perceived credibility without years of party patronage or extensive fundraising. - Shared infrastructure and communications that would otherwise be inaccessible to individual candidates. - A way to withstand disinformation and manufactured scandals through independently timestamped evidence. - Ability to show continuity of interests and explain changes without demanding unconditional faith. - A clear, public commitment to accountability that is independent of party or ideology. ### 13.3 Risks to adoption - The personal burden of intensive recording and exposure, especially for family, colleagues and constituents. - Inability to access reliable live financial data without government or institutional cooperation. - Abuse of the Registry by partisan challengers or hostile funders. - The possibility that visible imperfections actually increase electoral vulnerability. - Media focus on intimate trivia, rather than material integrity. - Lack of effective privacy protections or safeguards for legitimate confidential activity. - Public scepticism that any self-selected assurance scheme can genuinely distinguish character. ### 13.4 Low-cost candidate support requirements **[PROPOSED]** A candidate should receive open-source capture software, a standard disclosure workflow, a public profile, queryable records, understandable assurance status, legal/privacy guidance and ready-to-use non-partisan explanations of the evidence standard. The Foundation's own funding and donors should be transparent to prevent the anti-capture organisation becoming captured itself. No promise is made that this alone replaces conventional outreach, satisfies all local campaign-finance laws or produces a winning campaign. --- ## 14. Governance and enforcement ### 14.1 Who sets the rules? An independent, publicly governed OATH Initiative or Foundation could publish versioned standards, onboarding requirements, assurance categories and appeal processes. This is a **proposed governance mechanism**, not an existing body. It must not hold discretionary power to rewrite rules retroactively for a favoured or disfavoured candidate. Material rule changes should be versioned, publicly debated, dated and linked to the exact periods they govern. ### 14.2 Who enforces them? The intended primary enforcement is **evidence and public scrutiny**, rather than comprehensive prohibitions or financial forfeiture: - A gap, late report, inconsistent statement or independently established breach becomes part of the public evidence record. - Objective assurance statuses update according to disclosed, reproducible rules. - Voters and third parties can independently examine why an assurance property holds or does not hold. - Independent review is required before attributing intent, deciding contested disputes or taking any major punitive action. This leaves an important distinction: **the protocol can automatically detect certain evidence failures**, but legal enforcement, reputational consequence and the candidate's continued political viability are separate matters outside its direct control. ### 14.3 Anti-capture controls [PROPOSED] - Full disclosure of the Foundation's funding, major donors, governance interests and software suppliers. - Independent, diverse witnesses and separation of ingestion, custody, adjudication and standards governance. - Open data exports and independent verifiers to prevent lock-in to one website. - Public incident disclosures, protocol versioning, conflicts-of-interest procedures and appeal histories. - Ability to challenge an incorrect status or fabricated allegation without erasing underlying evidence. - Documented handling of critical security, legal or privacy incidents. --- ## 15. Risk register and unsolved contradictions | Risk / tension | Why it matters | Candidate mitigation / review question | |---|---|---| | **Complete openness vs third-party rights** | The candidate's voluntary consent does not waive the privacy or safety of bystanders, family, patients, journalists or whistleblowers | Can independent custody, narrowly defined exceptions and provable commitments preserve decisive scrutiny? | | **Permanent finance vs data protection** | Permanent unrestricted publication may conflict with law, correction rights or the interests of counterparties | What precise financial fields can be lawfully public in each jurisdiction? | | **Capture vs real-world completeness** | A correct log can faithfully preserve an incomplete stream | What credible independent coverage measures, institution attestations and external reconciliations are attainable? | | **Technology claims exceeding evidence** | Overclaiming destroys trust in the Registry | Publish assurance envelopes, explicit data provenance, and unobserved periods | | **False accusations and hostile querying** | Continuous data can fuel conspiracy, harassment and misleading correlations | Evidence thresholds, qualified flags, reproducible sources, review and appeal | | **Candidate selection adverse effects** | Intrusive surveillance may repel principled candidates more than strategic opportunists | Measure uptake, attrition and reasons for non-participation in real pilots | | **Provider and state dependence** | Banks, employers, officials and public bodies may withhold direct feeds | Begin with transparently weaker assurance; avoid representing candidate-exported records as bank-certified | | **Deferred rewards** | Gains can be arranged for years after tenure | Compare disclosure tail, enforceable covenants and new anti-proxy approaches | | **Governance capture** | The Registry could become the new unaccountable arbiter of integrity | Independent witnesses, public rules, neutral governance, appeals, fork detection | | **Privacy-safe evidence obstruction** | Sealed evidence might be impossible to inspect even when public-interest claims are strong | Narrow release triggers, independent custody, public request/review decisions | | **Electoral effectiveness** | More information need not produce trust or votes | Independent voter and candidate studies; no predetermined victory claim | | **Auto-resignation weaponisation** | Bad-faith challengers could use induced technical failures or forged reports | Defer; require legal validation, narrowly objective triggers and due process | | **Security exposure** | Continuous locations, finances and communications can enable threats, extortion or exploitation | Minimise credentials/identifiers; assess delay, restricted details and custody without hollowing out integrity | | **Cross-party neutrality** | An integrity organisation could quietly become an ideological filter | Audit admission, scrutiny and challenge treatment across candidates and political positions | --- ## 16. Success measures and falsification criteria OATH needs testable hypotheses rather than only persuasive framing. ### 16.1 Evidence-system metrics [PROPOSED] - Share of declared accounts with institution-authenticated feeds. - Finance ingest delay and maximum observable reporting gaps. - Camera coverage time in clearly defined states: authenticated, buffered, missing, excluded, contested. - Detection time for altered entries or inconsistent checkpoints. - Accuracy and reproducibility of supported query answers. - Precision/recall and fairness assessments of contradiction alerts using labelled cases. - Percentage of serious challenges resolved with verifiable evidence rather than unsupported candidate assurances. - Frequency and outcomes of witness, custody and operator failures. - Candidate participation cost and operational burden. ### 16.2 Candidate and electoral metrics [PROPOSED] - Uptake and retention among qualified prospective candidates without major wealth or existing party patronage. - Recruitment changes among people who previously considered politics financially inaccessible or futile. - Voter comprehension of what each assurance tier actually proves. - Effects on trust, perceived credibility, willingness to support and resistance to fabricated scandal, measured in unbiased studies. - Fundraising dependence and campaign expenditure relative to comparable candidates. - Unintended deterrence among ethical candidates with private/family responsibilities. - Incidence of demonstrably resolved disputes or independently detected discrepancies. ### 16.3 Findings that should force design revision - A majority of ethical prospective candidates find participation unacceptable even after realistic third-party protections. - Corrupt actors can consistently conceal material conflicts at tolerable cost while appearing fully compliant. - The public systematically mistakes cryptographic record integrity for proof of complete honesty. - Public availability of data increases harmful false allegations faster than it improves robust verification. - Governance or evidence-release discretion becomes an opaque source of political leverage. - Assurance claims fail independent red-team evaluation. These are not reasons to abandon the project in advance; they are necessary conditions for rigorous learning. --- ## 17. Priority research agenda for independent reviewers Reviewers should first challenge the causal assumptions and intended outcomes, **not** simply refine the proposed technology. ### R-01 — Is the selection mechanism real? Can radical observable accountability actually establish a separating incentive between public-spirited and opportunistic candidates? Which dishonest actors would still opt in, and which honest people would refuse? Is there a less invasive, equally persuasive mechanism? ### R-02 — Can completeness be established to a politically meaningful threshold? Distinguish source completeness, account completeness, human-activity completeness, index completeness and knowledge of intent. Determine what can be proven, independently corroborated, inferred probabilistically or only represented as unknown. ### R-03 — Does permanent candidate-financial publicity work lawfully? Develop jurisdiction-specific analyses of banking access, personal-data legislation, public-office ethics law, electoral rules, freedom of expression, bystander rights and beneficial ownership. Identify a credible minimum jurisdiction and pilot scope. ### R-04 — Can continuous camera evidence be both useful and non-abusive? Analyse consent, confidentiality, legal professional privilege, whistleblower safety, filming restrictions, security hazards, domestic privacy, false-gap allegations and publicly inspectable exceptions. Propose an evidence-release regime with independent review and measurable anti-concealment properties. ### R-05 — How can OATH fund itself and protect independence? Assess foundation governance, open-source stewardship, procurement, major-donor restrictions, cross-party oversight, appeals, verifiers, witnesses and possible financial capture of the Registry itself. ### R-06 — What replaces the bond for deferred compensation? Seek new solutions for post-office payoffs, benefits to associates, future consultancy, disguised options and long-delay quid pro quo that avoid candidate wealth barriers and complex discretionary enforcement. ### R-07 — What is the minimum honest launch product? Determine the smallest Phase 0 that a candidate can operate affordably without implying complete or independent assurance. Verify whether the proposed Phase 0 data model genuinely supports migration to external witnesses and committed queries. ### R-08 — Does visible accountability deliver the claimed electoral advantage? Design neutral, preregistered studies, pilots and field observations. Test multiple candidate profiles and voting environments without assuming that non-participation signifies guilt or that public exposure is inherently persuasive. ### R-09 — Could more effective alternatives fulfil the business case? Reviewers are explicitly invited to replace continuous camera capture, selected financial architecture, the exact phased design or even the OATH Compact if another candidate-level, low-cost, independently credible mechanism better achieves the principal objective. The specification is **not** an instruction to defend the present architecture at any cost. ### R-10 — How should the initiative represent uncertainty? Design language, user interfaces and status taxonomies that make the difference between *documented*, *corroborated*, *cryptographically verified*, *disputed*, *unobserved* and *demonstrated misconduct* intelligible to ordinary voters. --- ## 18. Recommended independent review protocol A reviewing operator (human or AI) should return: 1. **Objective restatement:** the underlying selection/electoral problem without assuming the proposed solution is optimal. 2. **Contradiction audit:** internal inconsistencies, unacknowledged impossibilities and false proofs; distinguish fundamental blockers from addressable risks. 3. **Mechanism analysis:** incentives for honest, dishonest, wealthy, poor, politically established and independent prospective candidates. 4. **Threat model:** strongest plausible cheating, manipulation, capture and omission strategies, with mitigation feasibility. 5. **Architecture alternatives:** at least one materially different implementation, preferably including a reduced-surveillance solution as a comparator. 6. **Legal/ethical matrix:** what needs jurisdiction-specific validation and what can be launched without state participation. 7. **Pilot design:** lowest-cost meaningful experiment, objectives, acceptance tests, rollback triggers and candidate/bystander protections. 8. **Open decisions ranked:** by consequence, uncertainty and urgency; do not convert a discussion suggestion into an agreed requirement. 9. **Updated proposal:** proposed text edits, added/deleted requirements and the rationale for each. 10. **Evidence discipline:** distinguish established facts, assumptions, conjectures and preferences; cite external claims if additional research is performed. Reviewers should be candid about technical limits, but should not quietly change the principal goal from **selection/electability of trustworthy candidates** to mere database design, policy ranking, or abstract anti-corruption compliance. --- ## 19. Decisions made, ideas rejected, and unresolved design choices ### 19.1 Firmly established in discussion - OATH's priority is replacing untrustworthy officeholders with credible, public-minded alternatives, **not** directing their eventual policy choices. - System participation starts with candidates and should work before political institutions authorise reform. - The system should operate continuously, rather than depend on periodic self-attestations. - Candidate finances and holdings are intended to be publicly visible on an ongoing basis and available historically. - Near-24/7 candidate body-camera surveillance is part of the contemplated high-assurance design. - The public should be able to investigate concerns from the platform itself, substantially reducing reliance on direct personal interrogation for factual questions. - The record must not depend exclusively upon trusting the candidate or the operator's assertion of immutability. - Early deployment is essential; fully independent auditing cannot be a prerequisite for launching a clearly labelled lower-assurance mode. - No categorical ban on wealthy candidates; no need to redesign the standard to make wealthy candidates comfortable. - Incompetence, error and policy disagreement are not equivalent to corruption and remain subject to ordinary electoral judgement. - Long-term deferred compensation is an unresolved vulnerability. ### 19.2 Investigated but not adopted as foundations - Mandatory integrity bonds, asset escrow and forfeiture. - Compulsory universal divestment, no-equities requirements, or legal wealth caps. - Government-first reform or mandatory statutory participation. - Full public live broadcasting of every body-camera segment, regardless of third-party harm. - Fully automated resignation or removal at launch. - A single binary badge claiming that an individual is guaranteed honest. - A blockchain storing all raw content as the essential primary database. ### 19.3 Explicitly open - Exact legal form of the Initiative and Registry and their accountability mechanisms. - Acceptable gaps and exceptions in personal capture; whether body camera, audio and communications metadata are independently mandatory. - Exact financial publication granularity, latency, counterparty redaction and retention rules. - How to reconcile immediate public querying with sealed evidence and controlled release. - How institutional account feeds, beneficial interests and undeclared proxies can be reconciled at scale. - The independent custody, witness quorum and proof system. - Any formal breach/removal, appeal, forfeiture or post-office regime. - How to measure, and potentially achieve, the intended electoral advantages. --- ## 20. Proposed next engineering and governance deliverables **D-01 — One-page public concept note:** reason OATH exists, voluntary promise, evidence standard and careful statement of assurance. **D-02 — OATH Compact v1.0:** concise public pledge plus jurisdiction-dependent detailed protocol schedules, legal review and third-party safeguards. **D-03 — Assurance taxonomy:** objectively testable definitions for candidate-operated, registry-operated, witnessed, independently sourced and query-verified claims. **D-04 — Threat and trust-boundary specification:** normal operation and adversarial failures, with assurance claims limited to what survives testing. **D-05 — Phase 0 reference implementation:** signed event ingestion, financial source labels, capture manifests, gap events, public read-only API and independently exported evidence. **D-06 — Phase 1/2 verification protocol:** canonical serialisation, log proofs, key management, witnesses, gossip and cross-check tools. **D-07 — Financial openness/legal pilot matrix:** available institutional APIs, data completeness, public-data rules, safe publication granularity and candidate burden. **D-08 — Video custody and privacy design:** consent, cryptographic evidence commitments, sensitive release and public challenge rules. **D-09 — Public interrogation and contradiction research prototype:** temporal relationship graph, provable data provenance, query-coverage metadata and non-accusatory alerts. **D-10 — Electoral/adoption evaluation plan:** independent empirical test of the separating-equilibrium and voter-credibility hypotheses. --- ## Appendix A — Conceptual evolution in the discussion 1. **Naming and separation:** OATH emerged as the candidate's voluntary commitment. The OATH Initiative was distinguished from the OATH Registry that technically preserves evidence. Earlier general acronym brainstorming is excluded from this dossier. 2. **Immutable disclosure registry:** initial concept relied on an append-only financial/interest/commitment record, tamper evidence and independent witness mechanisms; blockchain considered, but not presumed essential. 3. **Continuous accountability:** intermittent declarations were rejected as inadequate. The scope expanded to continuous financial flows/holdings, public self-service interrogation and near-24/7 body-camera capture. 4. **Business-case reset:** the central objective was clarified as selecting genuinely public-spirited candidates and maximising their electoral prospects, not achieving privacy, blockchain, or philosophical purity as ends in themselves. 5. **Constraints versus observation:** proposals for compulsory divestment, asset restrictions, financial bonds and escrow were challenged. One demanding exposure standard, potentially forcing voluntary simplification, was preferred. 6. **Wealth clarification:** the design may unintentionally deter high-net-worth candidates; they should not be formally excluded or receive special accommodations. 7. **Third-party protections:** raw video need not be universally public; continuous capture with tamper-evident commitments and controlled release was accepted as a workable direction, subject to scrutiny. 8. **Deferred benefit problem:** a covenant was provisionally acceptable; a post-office financial transparency tail and other solutions remain candidates for further analysis. 9. **Resignation idea:** a pre-signed resignation mechanism was raised but deferred because it could enable hostile displacement and may be legally unavailable. 10. **Phasing requirement:** a candidate-operated initial version must exist before independent auditing/witness infrastructure is complete, with no false representation of its assurance level. ## Appendix B — Vocabulary - **OATH Initiative:** the proposed independent steward of participation standards, public commitments and governance. - **OATH Compact:** a participant's voluntary promise and associated conditions. - **OATH Registry:** independently verifiable technical record and public scrutiny interface. - **Committed event:** event data whose cryptographic digest is bound to a published checkpoint. - **Coverage:** defined sources, times, categories and observation limits represented by evidence; not a synonym for omniscience. - **Witness:** separate party that observes, verifies, archives or co-signs Registry checkpoints. - **Non-equivocation:** resistance to presenting incompatible histories to different observers undetected. - **Assurance tier:** declared and tested strength of a specific technical or organisational verification property. - **Integrity finding:** independently supported conclusion about documented conduct, not a psychological verdict about motives. - **Transparency tail:** continuation of defined post-office financial and professional disclosures to detect delayed payoffs. - **Candidate-operated mode:** entry-level deployment where the candidate publishes evidence but independent completeness and custody guarantees have not yet been established. --- **End of v0.1 working proposal.** **Editorial rule for subsequent revisions:** retain a dated decision log, record which statements are settled requirements versus optional design suggestions, and do not claim a stronger guarantee of honesty, completeness, independence, legal enforceability or electability than the evidence supports.