Humaney
Every human is a prime — one, unrepeatable, indivisible.
What it is
Before the token, before the score-card, before anything technical, Humaney is an invitation to grow: to steady your heart and mind, to sharpen memory and focus, to follow your curiosity. The token is a deliberate by-product.
It begins with a ceremony on your own phone. You sing, you breathe, your face proves you are live — and your device turns that into a zero-knowledge proof that those values were computed together, by the holder of one secret. No raw biometric data leaves the phone.
On the question every such protocol is judged on — one person wearing many masks — we bound the flow, not the stock. Making identities scarce would take a database of bodies, an appointed verifier, or a price of entry, and this architecture refuses all three on purpose. So we bound what any identity can earn per unit of human-attended time instead: one hunt claim a day — a limit the founder tightened from three specifically so this could not be built into an addictive game — a long cooldown before a place pays again, nearly every reward pulled rather than pushed, and a map of real places you have to stand in. That daily cap is the hunt’s, not a ceiling over everything you can do in a day: the practice sessions carry their own separate limits, and a leaderboard prize is reserved when the round resolves and pulled by the winner, with its own per-person daily spacing on the way out — except the memory and attendance rounds, which pay their winners directly at resolve. That exception describes the contract deployed today, read 2026-09-15, and will need re-reading at the next deploy. A thousand identities are not a thousand incomes — they are a thousand daily chores, for one human with one day.
No recording, image or raw measurement of your body is transmitted by the protocol, or written on-chain. One thing derived from your voice is: a pattern the chain compares against the people already registered, and that reproduces nothing about you. There is no biometric database — nothing to leak, nothing to seize.
A brief liveness check. A minute of free breathing. About five minutes of paced coherent breathing. A couple of minutes reading your heart rhythm at your fingertip. Then singing a sequence of phonemes, six rounds, bracketed by a closing liveness check. Fifteen minutes is a fair ask for a human — and the minutes are cultivation, not security: the timer binds only someone using our app, and modified software skips every minute of it. What bounds mass enrolment today is not the invite list: the contract that mints an identity holds no allowlist, so an invitation decides who we guide through the ceremony, not who may enrol. One identity per wallet address is enforced on-chain — and addresses are free, so that part is bookkeeping rather than a barrier. What is not bookkeeping is an admission cap tied to the existing population: it is live on the contract today, and each day it admits a few hundred more identities than already exist — so the population can at most double in a day. That throttles mass enrolment; it does not stop it, and doubling is not slow. A determined effort still arrives, in daylight. Enrolment is open on this testnet deliberately, while HMN is worth nothing: we would rather be attacked here and learn how than trust a gate we never tested. The duplicate-voice comparison that flags the same person enrolling twice has been armed since the 2026-09-01 deployment: it compares and records. A match does not end your enrolment, but it does hold it up: the early attempts are recorded without issuing an identity number — which is a refusal, and will feel like one — and you may attempt again. At the final attempt you are admitted even if you still match, and the match is recorded permanently rather than used to turn you away. Arming it added friction for someone using our app honestly, and it did not bound how many identities can exist, because modified software can simply submit nothing to compare. And physicality bounds what an identity can earn by standing in a place — not how many identities exist; it is the bound we lean on hardest and the one least built. The minutes are what makes joining worth doing; they are not what makes joining hard.
Three values: a commitment (an anonymous stand-in for you), a random registration code, and a public record of the device you enrolled with. Separately, the voice pattern that gets compared. No recording or raw measurement of your body, at any point. The nullifier is not derived from your voice: it comes from a random secret made on your phone. So a second enrolment produces a different one, and it bars an enrolment from registering twice rather than barring a person from enrolling twice. What makes it only a replay gate on-chain is that the app hands it to the contract, and the contract cannot tell a real one from a made-up one: it bars an enrolment from registering twice, not a person from enrolling twice. The device record is forensic, not enforcement — captured in public at the one moment it exists, so anyone can check it against Apple's or Google's roots off-chain, later; its contents are never parsed on-chain. One thing about it is enforced: the same device cannot file a second identity's record. Catching the same person enrolling fresh is a separate voice comparison, and it now runs in the shipping ceremony — armed at the 2026-09-01 deployment. It compares and records. On a match it records you without issuing an identity number and invites another attempt; at the final attempt it admits you even if you still match, and records that you did. And the number we have for how well it works is one person’s: across 54 real ceremonies the founder was matched to himself about two times in three. That is a measurement of one man recognising himself, not of how often it recognises you — we have no second person’s figure to give you yet. The white paper's Appendix A publishes the measurements.
Season One
A steady heart enables sustained attention; attention deepens memory; curiosity propels all of it.
Steady the heart. Rest a fingertip over the camera and your phone reads the rhythm of your heartbeat; a few minutes of paced breathing measurably moves the score.
You cannot focus, remember or wonder well from a dysregulated body. And in many traditions the heart is the seat of the soul: a coherent human is more able to follow their heart, and to be honest — integrity flows from an unconflicted inner state.
Hold and connect. A short practice: hold and reproduce a growing sequence. Ancient technique, honest measurement — you either recall it or you don't.
Direct the mind. Steady attention on abstract symbols — and on your own face transformed: your half-face mirrored into a whole, your halves merged into a person you have never seen.
The two halves of a face can be read as the two halves of a psyche — the conscious and the unconscious, the manifest and the unmanifest. To sit with each, and then with their merge, is to hold both: a glimpse of the integrated self you are growing toward.
Reach outward. Inward, curiosity explores the self. Outward, it walks — a world map of some 1,200 real places, where what counts is that you actually went and stood there.
The mark, out in the world.
Sacred sites, world-heritage places, cities. Each season a hidden subset lights up with rewards; which ones is sealed in advance and revealed only after the season ends — mystery while you play, full audit forever after. A spot that pays cannot pay again for 377 days, and one identity may claim at most one hunt reward in a day — that is the flow bound written on a calendar. The founder tightened that from three so this could not be built into an addictive game; the contract now live still allows three. Finish the program and you earn seven nominations — seven places you personally put on that map. Finishing is the whole condition. (This page said the Council was far smaller than the cohort, so most who finish would not earn them, until 2026-09-03. The seat count is under active change — a ruling that day sets the testnet council to the same size as the cohort — so the sentence understated it. We give no seat figure here rather than replace one moving number with another.) (This page said “complete the program and you earn seven nominations” until 2026-09-02, then said a Council seat was required too, until 2026-09-15. The first version was right: a later ruling removed the seating half, and the contract these testers will meet asks only that you finish.) You choose where; you do not get to name them. Once a place is on the map it stays: a later conviction can stop you nominating more, and cannot remove the ones already there. And the honest asymmetry: physicality is the bound we lean on hardest and the one least built. A phone reports where it says it is; the outside witnesses that would fix that are designed, not shipped. Faking presence is the single most valuable bug you could file.
The fixed frame
Four rules the rest is built around — and below, plainly, which parts of them the bytecode itself enforces. Everything else belongs to the community.
A per-wallet cap, welded at deploy so no vote can rewrite the table — though the owner could clear the weld by deploying a contract that rewrites the flag and then making one upgrade call that runs it — two transactions if that contract has to be written first — and one if suitable code already exists on chain. The count is not the point and it has moved three times: what holds at any count is that no ordinary upgrade operation can unweld anything, that clearing the flag needs code written for the purpose, and that every step leaves a public on-chain artefact. (This page said “a single public transaction” until 2026-09-02; that understated the cost. No upgrade operation on its own can unweld anything.) Separately, most welded functions can be paused without being unwelded — blocked is not unwelded. Reward paths refuse to pay you past the founder's own amount — an ordinary token transfer is not one of them, and a few Council-purse paths do not ask yet. The check reads your balance at the moment you are paid, not a running total — so a wallet paid up to the cap that sends those tokens elsewhere can be paid again. A cap binds wallets, not people: one person can hold several addresses, and the protocol offers one such route by design. So we bound what we pay into an address, we make every balance public, and a balance buys no votes.
At a fixed population milestone the protocol hands over — triggered permissionlessly: anyone, not the founder, may fire it, which is what makes it un-dodgeable — and irreversible once fired. It hands to one successor address named in advance. Making that address genuinely the Council's is an operational duty we carry out in the open, and the slot is public: check it yourself.
Our token is issued only as a receipt, to honour honest human effort — and what it is worth depends on the perceptions and perspectives of the beholder. That is why $0 today is the honest starting point: nothing is owed to anyone, and nothing has to grow to pay for what came before.
Nothing here is required. The landmark rewards you for coming; it never charges a toll for arriving.
During Phase 1 the founder holds the upgrade key, and most of the protocol stays changeable on purpose. Eighteen functions are welded at deploy — retirement, the grievance channel, free speech, the permanent action log, and the anti-whale and supply floor. Welding means those eighteen refuse replacement and refuse removal: the chain itself turns the transaction down. And here is the part that sentence leaves out, which matters more than the eighteen. The weld is a flag in ordinary contract storage, and an upgrade can carry initialisation code that runs against that storage — so the weld can be cleared, but not in one step: it takes code written for that purpose plus one upgrade call that runs it, every step a public on-chain artefact. (How many transactions that is depends on whether the code already exists: two if it has to be written first, one if it is already on chain — as stated above.) (This page said “one owner transaction” until 2026-09-02. That was false and it understated our own protection: no upgrade operation on its own unwelds anything — replacement and removal are refused by the contract, and there is no unlock.) The honest promise is not that they cannot be changed. It is that nobody can change them without a visible owner transaction on a public chain — the protection is that you would see it, not that it is impossible. It does not freeze the protocol, because new functions can still be added beside them. The identity module and the joiner arithmetic are deliberately not welded, so the joining rules can still be repaired. Everything unwelded is a promise the protocol intends to keep, not one it is structurally bound to — and that is the honest difference. The upgrade key ends at retirement: it transfers, in one transaction, to the successor address named in advance. Be exact about what that is and is not — there is no timelock on it, or on any other founder power: a diamond cut, an ownership transfer and a solvency mint are each one immediate transaction, with no vote, no delay and no second signature. What bounds the key is the welded eighteen, a public chain, and our diligence — and the third of those is a person, not a mechanism. The veto becomes the Council's, exercised at a golden-ratio supermajority of 0.618 — 233 of 377 seats at full size — and the power of the purse transfers the same way; no chamber may spend alone.
The count is eighteen, and that part is settled. A re-derivation on
2026-09-01 produced twenty and was withdrawn on 2026-09-02: the deploy composes eighteen, and two
test suites assert exactly that number, so a passing build is the measurement. This page
said the figure should be read as “disputed, not measured” between those two dates.
That was wrong, and it was wrong in the direction that costs a reader least — it hedged a
number that was already checkable. Two things remain true and are worth more than the
count. You cannot query the eighteen — no function returns the welded set, so you
cannot look it up the way you can look up a balance. But the deploy logged it.
The transaction that welded these eighteen emitted the whole list, and any later change would
emit one too. We read that log on 2026-09-15: one such event, at block 46229938, carrying
eighteen entries — and no other since. All eighteen were matched by name to the functions the source welds — none left over, none guessed at. Sign-up is deliberately not among them — the founder ruled that the function creating identities must stay changeable. Its selector is 0x0e9bea83; look for it in that log and you will not find it, and if you ever do, you have caught us. So this is a claim you can check, with a public
node and no permission from us. And which functions make up the eighteen is only partly checked. A test asserts
the size of each of the five groups, and another names most of the individual functions —
but not all of them, so a swap involving one of the unnamed functions could pass if the group
kept its size.
The claim this figure sits beside never depended on the number: no upgrade operation on its own can
unweld anything, at eighteen or at twenty.
The same honesty applies to your tokens, and this is the largest example of it.
Every transfer of HMN between two registered people calls into the upgradeable part of the protocol
before it completes, and if that call fails the transfer fails. On the diamond live since 2026-09-01
(0xf6b7eec7…4efe; the 2026-08-06 one this paragraph originally described is
tombstoned, and the hook was re-checked on the new chain — recordTrade routes to a
facet there), two things
would do that: removing the called function in an owner transaction, or a wiring mistake that makes
it refuse. So whoever holds the upgrade key can halt HMN transfers, or block particular
ones, for as long as they hold it. Be precise about what that is and is not: it can
stop tokens moving, and it cannot itself move them. This particular lever is censorship, not
confiscation: it cannot spend your balance or reassign it to anyone.
There is one separate path that can take tokens, and it is not this one. A fraud conviction, carried through every appeal, can burn part of a convicted person’s balance. It is bounded in three ways worth knowing: it can never take you below the joining grant your cohort minted, the amount is re-clamped to that limit at the moment it executes, and what is taken is re-minted into the Coherence Commons rather than destroyed or paid to an accuser — the community later decides its use. We mention it here because a page that told you your balance could never be touched would be wrong.
We did not add this in order to have it. It is the price of those protections being enforceable at all: the alternative — letting that call fail silently — would have permanently given up any future ability to enforce the wallet cap or to freeze a single account after a fraud finding. Both choices are permanent, because the token contract cannot be upgraded after launch, and there is no third option. The founder ruled on it in August knowing precisely this. It is held by the founder now and by the High Council after the handover, and like every other power here, using it takes a visible transaction on a public chain — the protection is that you would see it.
Invitation
A closed testnet, stood up by a few founding stewards — humans stress-testing the ceremony, the four qualities, and the governance that will one day be entirely theirs. We read for good faith and genuine resonance with the mission, not for crypto experience.
If you were invited, you know the way in. There will be a way to apply.
