THE CONSENSUAL PIT

How a village archive borrows a kingdom's cryptography — and keeps its soul

PIT Research Cycle №1 — synthesis paper · Public Information Transmission (P.I.T.) · CC0 (public domain) Research date: 2026-08-05 · Four parallel tracks (identity, zero-knowledge access, consent consensus, transcription) woven into one document · All factual claims carry footnoted sources; anything uncertain is flagged ⚑ UNVERIFIED, never smoothed over.

0. ABSTRACT

A Public Information Transmission — a pit — is a static website that turns the ephemeral knowledge shared at gatherings into a permanent, forkable public good: recordings, transcripts, and searchable archives that cost nearly nothing to run and belong to everyone. This paper answers one design question end to end: how does such an archive stay radically open while honoring the consent of every human in it? Four findings. First, the Kingdom of Bhutan's migration of its national digital identity to Ethereum (announced October 13, 2025) demonstrates a pattern a village can inherit directly: anchor, don't store — cryptographic proofs on-chain, human data off-chain.¹² Second, consent can be formalized as signed, revocable attestations (Ethereum Attestation Service) held off-chain as derived data in the archive's own repository — no blockchain of our own, because a pit needs anchoring, not consensus machinery.³⁴ Third, privacy on a static site is a key-release problem: content must be encrypted at rest, with a single tiny edge function as the door, and zero-knowledge membership proofs (Semaphore) enabling anonymous, self-serve revocation.⁵⁶ Fourth, the archive's voice — transcription — must be built, not bought: word-level timestamps for karaoke-style playback, EN/HE/HI language coverage, offline desert capability, and \$0.04/audio-hour economics are requirements no commercial meeting platform meets at any price.⁷⁸ The result is a complete, village-forkable architecture for the consensual pit — plus an honest ledger of what is shipped today versus what remains declared vision.

1. WHY A PIT EXISTS — AND WHY CONSENT IS ITS SOUL

Most of what is said at gatherings dies with the gathering. A talk under a shade structure, a story traded at a village fire — the knowledge is real, the audience is twenty people, and by next season it is gone. The Public Information Transmission project exists to interrupt that loss with the simplest possible machine: record, transcribe, publish as a static site, license CC0, let anyone fork it. No platform, no paywall, no backend — HTML, JSON, and media files any web server on Earth can host for approximately zero dollars. A pit is not a product. It is a protocol for keeping what a community figured out.

The first pit was Esmeralda; the family has since grown to fifteen declared forks — from ZuitzPit to ShellPit 🐢, PitGoa 🌴 to DevconPit 🇮🇳 — each a village choosing to transmit rather than forget. Canon holds that even a fork with no archive yet is alive: a pit is a story before it is a website, and the declared intention to transmit, told honestly, is the first transmission.

But an archive of people is an archive of people. Every recording contains voices, faces, names — humans who may not have known a microphone was present, or who said yes in August and changed their mind in March. This is why the pit's soul is not openness. It is consent.

The pit's consent canon, as it stands today, has three load-bearing stones:

The taxonomy. Every asset in a pit carries a consent state: pending → assumed → explicit, or revoked. pending never ships publicly. assumed means the context implies willingness but no explicit yes is on record — and assumed can never be laundered into explicit by fiat. History is append-only: corrections get new lines, never erasures.⁹

The ShellPit consent consensus (2026-08-01). The Terrible Turtle camp collectively agreed — humans, in a shade structure, talking until everyone nodded — to publish the full ShellPit folder: 35 videos and 15 photos. All 50 assets moved from assumed to explicit, with an order_ref pointing at the collective grant. Canon insists this is recorded as a collective grant, not as fifty individual signatures — and that a single person's one-word email still overrules the entire camp.⁹ The collective can bless; it cannot steamroll.

The universal consent window. One address — consent@publicinform.com — serves every pit and every fork. It is checked every morning; takedowns are honored with love inside a 24-hour SLA. A one-word message, remove, is sufficient. No account, no form, no lawyer. Forks inherit the window; they never run their own consent inbox.⁹

This is the social contract the rest of this paper must serve. The research question was never "how much cryptography can a pit absorb?" It was: how do we make this covenant durable, verifiable, and inheritable by forks — without forcing a thirty-person camp to run infrastructure meant for a nation-state?

As it happens, a nation-state just showed how small the answer can be. 🇧🇹

2. THE BHUTAN LESSON — WHAT A VILLAGE INHERITS FROM A KINGDOM

On October 13, 2025, at a ceremony in Thimphu attended by the Prime Minister, the Crown Prince, Vitalik Buterin, and Ethereum Foundation president Aya Miyaguchi, the Kingdom of Bhutan announced it was anchoring its National Digital Identity (NDI) system on Ethereum — the first nation to do so.¹²¹⁰

The path matters as much as the destination. Bhutan's NDI began with a 2020 Royal Command, grounded in what the official case study describes as the King's personal vision that every citizen has a right to privacy.¹¹ Parliament passed the National Digital Identity Act in July 2023 — the legal covenant before the technology. The system launched nationwide in October 2023 on Hyperledger Indy, using W3C Verifiable Credentials in the AnonCreds format with CL signatures — meaning zero-knowledge selective disclosure was native from day one: a citizen can prove they are over 18 without revealing their birthdate.¹¹ The registry migrated to Polygon in August 2024, then to Ethereum mainnet in October 2025, with full credential migration targeted for Q1 2026 (⚑ completion not independently confirmed as of this writing).¹¹² By March 2025 it had issued 234,568 foundational IDs — roughly three in ten residents.¹³

What does "anchor a national identity on Ethereum" precisely mean? This is the part most coverage gets wrong, and it is the part a pit must get right:

• Personal data is not on-chain. Citizen records live in citizens' wallets and government systems. What goes on Ethereum is trust metadata: cryptographic hashes, issuer schemas, DID documents, public keys, credential status.¹¹⁴
• Ethereum is the notary, not the database. Anchoring the schemas makes them "authentic, tamper-proof, and can be verified by any party without querying a central authority."¹⁴ Bhutan's GovTech Secretary put it plainly: Ethereum's decentralization makes the anchor "virtually impervious to disruption."¹²
• The zero-knowledge lives at the edges. Selective disclosure happens between the citizen's wallet and the verifier — holder to verifier — not on the chain itself. The chain notarizes the schema; the humans exchange the proofs.¹¹

From this, a village camp inherits five lessons, each worth carving over the door:

1. Anchor, don't store. Hashes and schemas on-chain; humans' data off-chain. This is exactly the pit pattern: manifest hashes anchored, transcripts served static.
2. Verification happens at the edges. A pit doesn't need ZK-on-chain; it needs ZK-at-the-doorbell — proofs exchanged where access is requested.
3. Consent is a first-class trust task. Every Bhutan NDI sharing flow is a wallet consent pop-up. The consent UX is the protocol.
4. Covenant before code. Bhutan passed its identity Act before nationwide launch. The pit's equivalent: the consent taxonomy and ledger spec before the harvest.
5. Small is an advantage. A kingdom of ~750,000 people, "a small team and smaller budget," went world-first.¹⁵ Sovereign identity infrastructure is no longer a superpower's privilege. A village can run it — and a thirty-person camp can inherit it.

The instruments have become village-affordable. An ENS name costs \$5/year (five characters or more; shorter names cost more), with unlimited gasless subnames.¹⁶ Off-chain EAS attestations cost literally nothing — they are signed JSON.³ Sign-In With Ethereum (ERC-4361) reached Final status in August 2025 and works in every major wallet for zero gas.¹⁷ What Bhutan does with a GovTech Agency, a pit does with a repo, a multisig, and an email address checked every morning.

Section 3 shows how.

3. THE ARCHITECTURE OF THE CONSENSUAL PIT

Three research tracks — Ethereum identity (A), zero-knowledge access (B), and consent consensus (C) — converged independently on a single architecture. When three investigators arrive at the same blueprint from different doors, the blueprint is probably load-bearing. Here it is, layer by layer.

3.1 Anchoring, not consensus

First, what the architecture is not. A pit does not need its own blockchain. NIST's classic decision flowchart (IR 8202) asks whether you have a shared data store, multiple mutually distrusting writers, no available trusted third party, and a need for disintermediated transaction rules.¹⁸ Walk a pit through it honestly: the site is static files (read-mostly, one pipeline writing); there is one writer (consumers verify, they don't write); the camp is the trusted party — that is what a consent authority means; and there are no adversarial transactions between strangers at all. Four no's. A pit running its own chain would buy a validator set, a token, and an outage surface to solve a problem it does not have.

What a pit needs from a chain is narrower, and Ethereum sells it by the cent: existence/timestamp anchors, a censorship-resistant revocation registry (a remove no host, mirror, or bad-faith fork can quietly drop), and portable identity (names and attestations any fork can verify without asking permission). That is anchoring: borrowing Ethereum's consensus — bought and maintained by someone else — to notarize the pit's state. Borrow consensus, own semantics.⁴

Real consensus — actual agreement-formation among humans — is needed in exactly three places, and the architecture names them plainly:

1. The consent decision itself. Humans agreeing to be seen. Consent and consensus share a Latin root — consentire, "to feel together" — and this is the one consensus that can never be delegated to machinery, because the moment a machine decides who consents, nobody did.
2. Fork governance. Which fork is canonical, whose registry entry points where, who inherits the universal window's obligations.
3. Registry disputes. Conflicting claims — "that attestation is forged," "that revocation is unauthorized." Today stewards arbitrate and the ledger records the outcome; optimistic-oracle arbitration modules (SafeSnap/Reality, Kleros) are a solved, adoptable pattern if dispute volume ever justifies them.¹⁹²⁰

Everything else — serving video, rendering transcripts, searching — is static-site work, and stays that way.

3.2 Identity: ENS names, Safe multisigs, and hats

Speaker identity anchors on ENS: one parent name per pit (\$5/year), speakers get or bring names, transcript speaker labels link to ENS profiles, and gasless off-chain subnames (via CCIP-Read) mean even a 300-speaker pit costs nothing beyond the parent renewal.¹⁶²¹ Resolution is read-only via public RPC — it works from a static site with zero backend. This is the Bhutan pattern at village scale: their Organizational DIDs in a national Trust Registry are our pit's ENS names in a manifest.

Organizer identity is a Safe multisig — a smart-contract wallet that executes only when M-of-N owners sign.²² The sizing is sociological, not technical: a village runs 2-of-3 (two organizers plus a trusted elder), a camp 3-of-5 (including one signer who is not a camp insider — the outside eye who asks "did everyone really agree?"), a conference 4-of-7.⁴ The critical distinction, worth stating in bold: the multisig is a stamp, not a brain. The camp decides out loud; the Safe notarizes. The moment the notary starts deciding, the covenant is dead.

Optional Hats Protocol roles (revocable, non-transferable ERC-1155 tokens) make authority legible: an Organizer hat that may propose consensus artifacts, a Consent-Steward hat that may stamp the ledger and execute takedowns, a Speaker-Steward hat required in any quorum publishing identifiable people.²³ When an organizer drifts away, the hat moves; history doesn't rewrite.

3.3 Consent as attestations: the EAS consent registry

The consent taxonomy becomes a signed-data registry using the Ethereum Attestation Service — a public-good protocol for attestations that can be made on-chain (gas only, cents on an L2) or off-chain (EIP-712 signed JSON, free, stored anywhere), with native revocation that marks an attestation invalid without deleting it.³²⁴ Two properties make EAS feel designed for pits:

• Revoke-don't-erase is already the pit's religion. EAS revocation semantics are isomorphic to the ledger's append-only history[]. No translation loss.
• Delegated attestation is desert-native. A speaker signs an EIP-712 payload on a phone with no ETH and possibly no connectivity; a steward submits it later and pays the cents. Consent collected at the pit, anchored from the city.²⁵

The proposed grant schema is deliberately sparse: pit_slug, content_root, content_types, subject_ref, taxonomy_state, license, authority_ref, granted_at. One attestation can bless a whole folder (via a Merkle root over asset hashes — the ShellPit pattern formalized). authority_ref is the on-chain form of order_ref, pointing at the decision artifact: a hashed camp statement for a village, a Snapshot proposal on IPFS for a conference.⁴²⁶ A collective grant is recorded as collective — taxonomy_state=2, with subject_ref a Merkle root over hashed participants: provable per-person later, enumerable by nobody. Revocations ride EAS's refUID composability, pointing at the grant they kill, forming an auditable chain.³

One rule is carved over the registry door, in EAS's own words: "Never attest to personal or private data directly on-chain."²⁷ A public attestation that names a person is a permanent, uncensorable, undeletable dox of exactly the humans the pit exists to protect. So identifiers come in three tiers: the public tier holds only hashes (keccak256(normalized_name + pit_salt)) or scoped nullifiers — decisions, not identities; the steward tier keeps the full record (who said yes, the email thread) as a private off-chain attestation; the anchor tier timestamps the off-chain attestation's existence on-chain — timing publicly verifiable, contents sealed.²⁷²⁸

3.4 Derived data: revocations.json is never hand-merged

The pipeline end to end: attestations (grants and revocations) → index → fold to current state → emit consent-ledger.json, revocations.json, and the search-index exclusion list. revocations.json is regenerated like the search index — regenerate, don't hand-merge — and it is the file every fork and mirror watches: if an asset id appears there, the content comes down everywhere the constellation reaches.⁴²⁹ Hand-editing revocation state is the one unforgivable sin: derived data is how a static site keeps a dynamic promise. CI recomputes ledger counts and fails the build on drift.

A hard-won operational finding sharpens this: a revocation that doesn't reach backups, search indexes, generated images, and CDN caches is theater. The takedown propagation checklist — site → index → manifests → backups → caches → downstream-fork flag — is now canon.⁶

3.5 The gate: sealed at rest, keys released at the door

Here is the uncomfortable truth Track B surfaced first: a static site cannot hide bytes. Anything served is public; a "locked" page whose bytes sit in the repo is hidden, not sealed — curl defeats every JavaScript gate (confirmed live: consent-gated lanes were found serving HTTP 200 to strangers).⁶ Privacy on a static site therefore collapses to one sentence: sealed transmissions must be ciphertext at rest, and access becomes a key-release problem — who obtains the key, under what conditions, checked by whom.

The recommended default — "sealed at rest + worker door" — is pragmatic to the point of modesty. Sealed transmissions are encrypted client-side (per-asset symmetric keys; ciphertext in the repo). A single tiny edge function — a Cloudflare Worker, one JavaScript file, free tier at camp scale — verifies a wallet signature (SIWE) against the pit's own generated consent/membership JSON and releases the key only on pass.¹⁷³⁰ The family already ships this pattern (ops/publicinform-worker.js) — it is in our DNA, not an import. Its honest properties: the key never reaches the browser until the door says yes (an attacker curling the repo gets ciphertext); worker down closes the sealed lane while the public lane stays up (fail-closed, the correct direction for a privacy gate); and its weaknesses — a trusted operator, centralized key custody, a live dependency — are declared, not hidden.⁶

Lit Protocol (threshold key-release across a decentralized node network, gated by on-chain conditions) is the strongest trustless option — but it costs real money at production scale, demands wallet UX from every viewer, is mid-migration across three network generations (⚑), and fails worst in the desert: no Lit nodes, no chain RPC, no decryption. Verdict: an optional module for token-gated drops, not the default seal.³¹

3.6 The zero-knowledge jewel: anonymous self-serve revocation

The single best ZK fit in all four tracks is not about hiding content. It is about revocation without doxing. Semaphore lets a person prove "I am a member of this group" — and broadcast a signal — without revealing which member, with scoped nullifiers preventing double-signaling.⁵ World ID is built on Semaphore, which proves the primitive scales to millions of members in production.³²

The ceremony is small and human: at consent time, when a speaker says yes, the camp also collects their Semaphore identity commitment — one extra QR scan at the same social moment. Thereafter that speaker can signal revoke, scoped to pit-slug + session-id, exactly once, verifiably a real member, without revealing who they are — Sybil-safe takedown that survives the organizer being unreachable and the pit outliving the gathering.⁶³³ The same mechanism doubles as an anonymous-but-human doorbell for interactive lanes: verification on the doorbell, never on the library.²⁹

The revocation registry itself is a four-tier spectrum, and the ordering is the ethics:

• Tier 0 — the email door (canon, today, forever): one word to consent@publicinform.com, a human stamps the ledger within 24h. Zero crypto, zero UX, works for your grandmother. Every other tier adds self-sovereignty; none may remove this lane. Your grandmother is a consent authority too.
• Tier 1 — signed JSON registry: revocations.json becomes a signed document (multisig signature chain); static-native, \$0, buildable this week.
• Tier 2 — Semaphore nullifiers: the self-serve, dox-free door described above.
• Tier 3 — on-chain anchor: the Merkle root of the revocation set published on a cheap L2 — append-only enforced by math; not even the family can silently drop a revocation from history. One transaction per anchor batch, not per revocation.⁶

Honesty about limits is part of the privacy policy: revocation governs future access and derived layers — ciphertext already mirrored cannot be unserved, and the UI must say so plainly. Radical honesty about the limits of deletion is the privacy policy.

4. THE VOICE OF THE PIT — WHY TRANSCRIPTION IS BUILT, NOT BOUGHT

A pit's archive is only as alive as its transcripts. The family's signature artifact is the karaoke Knowledge Transponder — playback where every word lights up as it is spoken — and that single feature quietly dictates the entire transcription strategy: it requires word-level timestamps. No words, no glow.⁸

Track D surveyed the entire 2026 landscape against eight canon criteria (word-level timestamps, diarization, cost per audio-hour, offline capability, EN/HE/HI language coverage, privacy, forkability, honest failure modes) and returned a verdict with no suspense but plenty of receipts: BUILD stays champion, INTEGRATE stays tactical, PARTNER is politely declined for the archive core.

The meeting-assistant class — Circleback (the one that prompted the question), Otter, Fireflies, Granola, Fathom, Read.ai, Notta — solves workflow: notes, action items, CRM sync. Not one publishes word-level timestamps (utterance-level at best), so none can feed the Transponder. All are per-seat subscriptions: a ten-person camp on Circleback Team runs \$250/month — roughly 200× the family's verified bulk lane — and still can't produce a karaoke transcript. All are cloud-only, failing the desert outright. And two — Otter and Fathom — train their models on user data by default: not a pricing problem but a consent-canon violation, since camp audio on a third-party platform requires every speaker's opt-in to that specific third party.⁸³⁴

Meanwhile, the family's own pipeline stands on verified in-house numbers: Groq whisper-large-v3-turbo at \$0.04 per audio-hour (re-confirmed against vendor pricing, matching the July 2026 harvest of 257.7 audio-hours) for bulk, and Deepgram nova-3 with diarization and word timestamps at a verified effective \$0.26/audio-hour (ShellPit re-harvest, 2026-08-01) for fidelity lanes, with Speechmatics as the designated backup lane (\$0.129/audio-hour, diarization included, the strongest privacy posture and the only real on-premise menu among API vendors) and AssemblyAI second — vendor diversity is resilience.⁸ A 30-audio-hour month costs \$1.20 on the bulk lane. Free onboarding credits (\$200 Deepgram, \$100 Speechmatics, \$50 AssemblyAI) mean a new pit transcribes its first ~480 audio-hours before spending a dollar.⁸

Two strategic upgrades close the honest gaps:

1. The playa lane — offline transcription, buildable today. The desert has no internet, so a camp kit of whisper.cpp (single binary, Metal-accelerated — an audio-hour in ~6–30 minutes on any modern MacBook) or faster-whisper plus pyannote community-1 for diarization, with models downloaded before the event (the diarization models are gated — desert canon: provision before you leave). Cost: electricity. Privacy: audio never leaves camp — the strongest answer available.⁸³⁵
2. The language moat. The family's gatherings speak English, Hebrew, and Hindi. The hot 2026 open models — Parakeet v3, Voxtral Transcribe 2, Qwen3-ASR — all skipped Hebrew. The whisper lineage remains the only self-host stack covering EN+HE+HI with word-level timestamps. The watch-list is honest: adopt Voxtral or Qwen3 the day they add Hebrew; until then, the moat holds.⁸³⁶

Partnerships, declined honestly: Circleback et al. fail the word-timestamp, offline, per-seat, and forkability doors simultaneously. One door stays open: their workflow layer could serve the family's own coordination meetings (not camp archives), and a non-financial conversation — word-level export on their roadmap? — is worth having; referral revenue for a CC0 public-good protocol would be a conflict-of-interest smell.⁸ Notta's on-device "Privacy Mode" beta (July 2026) is the first meeting-class product moving toward the pit's architecture: watch it, don't wed it.³⁷

The one-line answer: the karaoke requirement, the offline requirement, and the consent requirement are three doors no commercial partner currently fits through — so the pit builds its own voice, and swaps commodity APIs as replaceable lanes.

5. THE ROADMAP — SHIPPED vs DECLARED

Radical honesty is the design, so the roadmap is a ledger, not a promise. ⚑ flags mark uncertainty; DECLARED means believed and intended, not yet built — and the family treats that word as a vow of accuracy, not an apology.

SHIPPED — verifiable today: - ✅ The consent taxonomy (pending → assumed → explicit → revoked), append-only ledger, derived counts.⁹ - ✅ The universal consent window: consent@publicinform.com, morning check, 24h SLA — Tier 0 of every revocation path.⁹ - ✅ The ShellPit collective consent consensus (2026-08-01): 50 assets, one collective grant, order_ref recorded, individual override preserved.⁹ - ✅ The transcription pipeline: Groq bulk lane at a verified \$0.04/audio-hr; Deepgram nova-3 fidelity lane with word timestamps + diarization; hallucination cross-check canon with ⚑ flags in production.⁷⁸ - ✅ The wallet-auth edge-worker pattern (ops/publicinform-worker.js) — the door exists.⁶ - ✅ Static-site, ~\$0, forkable architecture — fifteen forks declared, fourteen numbered (PatagoniaPIT's number awaits Shaka's word).⁹

DECLARED — designed in this cycle, not yet built: - ⚑ The EAS PITConsent schema (grant + revocation) — spec complete in Track C; deployment declared. - ⚑ ENS speaker identity on transcripts — primitives verified; rollout declared. - ⚑ Camp Safe multisigs as consent authorities — sizing playbook written; ceremonies declared. - ⚑ Signed revocations.json (Tier 1) — buildable this week; build declared. - ⚑ Semaphore consent-time ceremonies and nullifier self-serve revocation (Tier 2) — the cycle's flagship design; declared. - ⚑ MACI coercion-resistant secret ballots for contentious consent votes — Track B's fourth medal (🏅): a reference architecture for the day a camp's consent decision itself needs a private vote, not default kit; declared. - ⚑ Sealed-at-rest encryption for private transmissions with worker key release — architecture ranked; sealing declared. (Today's gates are honest about being gates of honor; the census found client-side locks serving bytes to strangers.⁶) - ⚑ The playa offline transcription kit — components mature and verified; pre-provisioning declared. - ⚑ Bhutan's full credential migration to Ethereum mainnet — targeted Q1 2026; completion unverified at research date.¹²

NEVER — the negative roadmap, equally canon: - ❌ Names or emails on-chain. ❌ Hand-edited ledger counts or hand-merged revocations. ❌ Laundering assumed into explicit. ❌ A fork running its own consent inbox. ❌ Publishing anything whose state is pending. ❌ Camp audio on platforms that train on it by default. ❌ Claiming deletion where only future-access revocation is possible.

6. THE INVITATION — FORK YOUR OWN PIT

A kingdom anchored its citizens' identity on Ethereum with a small team and a smaller budget, and proved that sovereign infrastructure is no longer a superpower's privilege.¹⁵ A desert camp agreed out loud to be seen, and proved that consent needs no machinery more exotic than an honest ledger and an email that is answered. Between those two proofs sits the whole thesis of this paper: the cryptography of nations now fits in a village's pocket, and the only irreplaceable ingredient is the humans saying yes.

So: fork your own pit. Record what your village figures out. Transcribe it for \$1.20 a month. Publish it static, CC0, forkable. Put the consent window on every page. Let the collective bless collectively and the individual revoke alone. Anchor the promises where nobody can delete them; keep the people where nobody can enumerate them. The taxonomy, the schemas, the playbook, the economics — all in this cycle's four tracks, CC0, waiting to be inherited.

Every fork has a first sentence. This paper ends so yours can begin.

The pit provides — but only with permission. 🦉🕳️🌺

FOOTNOTES / SOURCES

All sources accessed 2026-08-05 unless noted. Full per-track bibliographies: track-a-ethereum-identity.md (27 sources), track-b-zk-access.md (16), track-c-consent-consensus.md (28), track-d-transcription.md (full receipts), in this repository.

Synthesis woven by LORE 🦉 from four tracks by PIT GIRL 💗 (A), Privy 🔒 (B), CRUSTY 🦀 (C), PIT BULL 🐂 (D), commissioned for the pit family 2026-08-04. CC0 — fork me like crazy. ⚑ flags are deliberate: uncertainty is flagged, never smoothed over.

FACT-AUDIT ✅ (PIT GIRL 💗, 2026-08-05)

Auditor: PIT GIRL 💗 (Track A owner) · protocol: every factual claim cross-checked against the four track files; 18 footnote URLs live-checked (curl + reader); quotes verified verbatim at source; canon sweep per family law. LORE's voice untouched except the four numbered fixes below.

Fixes applied (4 — all small, all logged)

1. §2 quote made verbatim. The ethereum.org quote read "…tamper-proof, and verifiable by any party…"; the source actually says "…tamper-proof, and can be verified by any party without querying a central authority." Fixed to the exact source wording (re-fetched ethereum.org/decentralized-identity 2026-08-05, quote confirmed live on the page).
2. §2 ENS price precision. "An ENS name costs $5/year" → "(five characters or more; shorter names cost more)" — per ENS's official pricing page (3-char = $640/yr, 4-char = $160/yr). Track A had it right; the synthesis had generalized.
3. §5 fork arithmetic aligned with registry canon. "fifteen forks declared and numbered" → "fifteen forks declared, fourteen numbered (PatagoniaPIT's number awaits Shaka's word)". Verified against /shared/public/pit-protocol/pits.json: 17 entries = 15 locked roster (incl. Esmeralda + OSO-ancestor, which are not forks) + VitPit №16 + PatagoniaPIT (number pending). 15 forks total, 14 of them numbered.
4. Footnote 37 link fixed. Was the prnewswire.com homepage; replaced with the actual release (Notta Privacy Mode for Notta Desktop, 2026-07-03) — verified HTTP 200.

Claims cross-checked against tracks — ALL PASS ✅

• Bhutan (Track A, held to my own standard): Oct 13 2025 ceremony, Thimphu, PM + Crown Prince + Vitalik + Aya, "first nation" ✅ (The Block corroborates independently); 2020 Royal Command + King's privacy vision ✅; NDI Act July 2023 ✅; Oct 2023 nationwide launch on Hyperledger Indy ✅; AnonCreds + CL signatures = native ZK selective disclosure ✅; Polygon Aug 2024 ✅; Q1-2026 full-migration target with ⚑ completion-unverified flag ✅ (flag preserved, not smoothed); 234,568 foundational IDs by Mar 2025 ✅ (ethereum.org: "Over 234,000"); "anchor, don't store" ✅; "virtually impervious to disruption" ✅; "a small team and smaller budget" ✅; ~750k population within Track A's 750–800k range ✅.
• Numbers: $0.04/audio-hr ✅ · $0.26/audio-hr verified effective ✅ · $1.20/mo ✅ · $250/mo Circleback ✅ · "roughly 200×" ✅ (208×) · 257.7 audio-hrs July 2026 ✅ · credits $200/$100/$50 ✅ · ~480 free audio-hrs ✅ · ENSv2/Namechain scrapped Feb 6 2026 → mainnet hierarchical registries ✅ (article re-verified) · ERC-4361 Final Aug 2025 ✅ · diarization economics per Track D ✅.
• Names/protocols: AnonCreds/CL ✅ · EAS on/off-chain rails, native revocation, refUID, delegated attestation, "Never attest to personal or private data directly on-chain" (verbatim-verified at source) ✅ · Semaphore/nullifiers, World ID-on-Semaphore ✅ · Safe 2-of-3/3-of-5/4-of-7, "stamp not a brain" ✅ · Hats ERC-1155 ✅ · NIST IR 8202 four-no's ✅ · SafeSnap/Reality + Kleros ✅ · grant schema fields byte-identical to Track C ✅ · revocation tiers 0–3 ✅ · takedown propagation checklist ✅ · census HTTP-200-to-strangers finding ✅ · Otter/Fathom train-by-default (de-identified; footnote 34 carries the nuance) ✅ · Notta Privacy Mode July 2026 ✅ · whisper.cpp 6–30 min/MacBook ✅ · Parakeet/Voxtral/Qwen3 skip Hebrew ✅.
• Consent canon: taxonomy + no-laundering ✅ · ShellPit 2026-08-01 consensus (35 videos + 15 photos = 50, collective grant, order_ref, individual override) ✅ · consent@publicinform.com morning check + 24h SLA ✅ · internal footnote paths (9, 29) exist on /shared ✅.
• Rankings: A — ENS 🥇 EAS 🥈 reflected ✅ · B — worker-door 🥇 Semaphore 🥈 Lit 🥉 reflected ✅ · D — BUILD champion ✅.

Flags for PIT BOY (structural — LORE's call, not mine) ⚑

1. MACI is absent. Track B ranked MACI 🏅 (Arch 4, coercion-resistant secret ballot for contentious consent votes, "reference architecture, not default kit"). The synthesis covers 🥇🥈🥉 but never mentions private voting. Defensible as editorial economy — but a reader of Track B will notice the fourth medal missing. Suggest LORE consider one line (§3.1 registry disputes or the roadmap), or declare the omission deliberate.
2. Track D's vendor-diversity recommendation (Speechmatics as designated backup lane, AssemblyAI second) not carried — synthesis keeps only the credit numbers. Minor; the BUILD-champion verdict is faithfully conveyed.

Both flags resolved editorially by PIT BOY 🕳️😤 before publication (2026-08-05, per the audit's own suggestions): MACI added to the DECLARED ledger as reference architecture; the Speechmatics/AssemblyAI backup lanes carried into the economics paragraph. LORE's voice otherwise untouched. 3. The Block URLs 403 to curl — bot protection only; both articles verified live and on-claim via reader. Not dead links.

Canon sweep ✅

Shaka appears nowhere (no titles needed, none given) · OSO named only as ancestor-registry context, never an org · ʻohana unborrowed · SHIPPED vs DECLARED ledger strictly separated, DECLARED worn as vow ✅ · every ⚑ flag preserved (Bhutan Q1-2026, Lit three-generations, honor-gate census) · radical-honesty tone intact throughout · no music players, no target=_blank, CC0 footer present 🍴.

VERDICT: PUBLISH 🟢

Every load-bearing claim traces to a track with receipts; the four fixes were precision, not substance; the two flags are editorial, not factual. The chronicle is load-bearing, BOY. Build the page. 💗

— PIT GIRL 💪🕳️✨ · accuracy IS beauty · the pit provides, and I make it shine