The Watershed

Preamble

Complex frameworks that cost deliberation, effort and sacrifice deserve a

chance to prove themselves, to be amended by the people living under them, and

to have their consequences decided by a jury of peers. That was the promise of

the framework this one borrows from. It could have worked. What broke it was

not the design on paper — it was that the design could be manipulated by people

patient enough to learn where the handles were, and that the people it belonged

to did not, or could not, act in time.

So this document is written with a different assumption. It assumes that anyone

who gains power here will eventually try to keep it, including the person

writing this. Every mechanism below is chosen for how hard it is to capture,

not for how well it reads.

Three things follow from that assumption, and they run through everything else:

Power is surrendered by mechanism, not by promise. A rule that depends on

someone choosing to honour it is not a rule, it is a hope. Where this document

takes power away from someone, it does so on a trigger that fires whether they

like it or not.

Everything is on the record, and the record cannot be quietly edited. Most

capture is not dramatic. It is a number changed, a vote unrecorded, a meeting

not minuted, a version rewritten. A framework that cannot be silently revised

is much harder to steal.

Leaving is always available and always works. The final check on this

document is not inside it. It is that anyone can take a complete copy and go,

under a licence that cannot be revoked. Governance you have to trust is worse

than governance you can route around.

And one thing that is not a metaphor.

Water rules. Not a founder, not a board, not a majority. Without water

there are no people to govern, no machines to run, and nothing to argue about.

Every other article in this document is subordinate to that fact, and Article

Zero states it in a form that can actually be checked against a river.

This is a draft. Nothing here has been ratified, because there is not yet

anyone to ratify it. Saying so plainly is the first test of whether the rest is

worth reading.

Article I — Membership

§1.1 One human, one account, one vote

A member is one person. One person holds one account and casts one vote, and

the software enforces this at the level of the database rather than the level of

good intentions.

There is no weighted vote here. Not by seniority, not by contribution, not by

money, not by how much anyone has built. The founder's vote and the vote of

someone who joined this morning are the same size. Every scheme for making some

votes count more begins as a reasonable observation about merit and ends

somewhere nobody meant to go.

§1.2 No proxies, no delegation

A member votes personally or does not vote.

Votes may not be delegated, assigned, transferred, pledged, or held by anyone on

another's behalf. This forecloses the most reliable route to quiet capture:

accumulating other people's votes without ever having to persuade a room.

The cost is real — delegation is genuinely convenient, and busy people

genuinely stop participating without it. That cost is accepted deliberately. A

framework where fifty people's voices can be carried in one pocket is a

framework with one person in it.

§1.3 Good standing

A member in good standing is one who is not currently suspended by a jury.

That is the whole definition, and it is short on purpose. Good standing must not

become a lever — a status a curator can withhold, an activity requirement that

quietly disenfranchises anyone with a job, or a loyalty test. Only a jury of

peers can take it away, under Article IV, and only for a stated term.

§1.4 Joining

Each gallery sets its own rule for who gets a key: open, vouched, or invited.

That choice belongs to the gallery, is published in its registry entry, and is

visible to anyone before they apply.

What a gallery may not do is set a rule that makes membership contingent on

agreement. Nobody is required to endorse this project, its findings, its

politics or its founder to hold an account and cast a vote. A membership that

filters for agreement produces a body that agrees, which is the same as having

no body at all.

§1.5 What membership is not

Membership is not ownership, not employment, not a share, and not a promise of

anything. Nobody profits from anyone joining. There are no tiers of member.

There is no member whose account is worth more than another's.

§1.6 Leaving

A member may leave at any time, without asking, without explaining, and without

losing what they wrote. Article VII governs what leaving means and what leaves

with them. Nobody may be talked out of it by any mechanism the software makes

easier than the exit.

Article II — The Curator

§2.1 The office

A curator runs one gallery. They decide what hangs on its walls: which

collection, which identity, which rooms are open, and what the gallery is for.

The metaphor is exact and worth keeping. A gallery's character is its curator's

judgement made visible, and a good curator is not a neutral party — they are

someone with taste who is accountable for it. The office exists because

committees cannot choose a colour.

§2.2 What a curator may do

• Choose the gallery's collection, name, identity and voice.
• Open and close rooms within the gallery.
• Appoint moderators, and remove them.
• Put proposals to the gallery's members.
• Act in an emergency under §2.6.

§2.3 What a curator may not do

• Alter the record. Not a meeting, not a transcript, not a vote, not a

document, not a hash. A curator's authority stops at the surface of the thing.

This is the line the entire project is built to hold, and it is not

negotiable by any officer at any level.

• Suspend a member. Only a jury does that (Article IV).
• Amend the Watershed, or exempt their gallery from it.
• Withhold the Gage (§0.3).
• Set aside a vote of their gallery's members.

§2.4 Appointment, and the ladder

The Curator General appoints gallery curators. Today the Curator General is the

project's owner, and this document does not pretend that is anything other than

what it is.

A curator is technically an administrator scoped to one gallery — the same

permission ladder every other desk in this project already uses, rather than a

second system invented for this document. A framework that needs new plumbing to

express its own org chart is describing an org chart that does not exist.

§2.5 Term, rotation, and the end of the office

A curator serves a term of two years, renewable once by a vote of that

gallery's members, and then must stand down for at least one full term.

Rotation is not a comment on any individual's performance. It is the recognition

that the longer one person holds a post the more the post becomes shaped around

them, until removing them means dismantling the gallery. Mandatory rotation is

cheap while nobody minds and impossible once somebody does, which is why it is

written now.

Above the Waterline (§6.5), a gallery's members may remove their curator by

simple majority, at any time, for any reason or none.

§2.6 Emergency powers, and how they die

A curator may act without a vote to stop imminent harm: a legal threat, a

security breach, a doxxing, an active abuse of a member.

Every emergency action:

• takes effect immediately;
• is posted to the record within 24 hours, with the reason;
• expires automatically after 14 days unless ratified by a vote.

Expiry is automatic. Nothing has to be repealed, nobody has to remember, and no

one has to fight to end it. Emergency powers that require an affirmative act to

switch off are how temporary measures become permanent, every time, everywhere

this has ever been tried.

Article III — The Board

§3.1 What the board is for

The board handles the two things that corrupt everything they touch when handled

quietly: money and law.

Funding, spending, contracts, licences, legal exposure, and anything that

creates an obligation outliving the people who agreed to it. If a decision could

still be binding after everyone who made it has left, it belongs to the board.

§3.2 What the board is not for

The board does not decide what is published, what is investigated, what a

gallery looks like, or what is true. It holds the purse and the paperwork. A

board that can decide what gets published is a board that can be lobbied to

decide what does not.

§3.3 Seats

A board has no fewer than three and no more than seven seats. Terms are three

years, staggered so that no board is ever replaced all at once, and no member

may serve more than two consecutive terms.

**No seat may be bought, granted for a donation, reserved for a funder, or held

by anyone by virtue of anything other than election.** A funder who requires a

seat is declining to fund this project, and should be told so in those words.

§3.4 How the board decides

• Every vote is a roll call: who voted, which way, and a written reason.
• Reasons are published with the vote, permanently, in the record.
• Quorum is two-thirds of seated members. Vacancies do not lower quorum, so a

board cannot govern by attrition.

• A member with a conflict declares it and does not vote. An undeclared conflict

discovered later voids the vote it affected.

"I voted yes because I was asked to" is a perfectly acceptable reason to file.

It is also one nobody wants their name attached to in public, forever, which is

most of the point.

§3.5 The disclosure that has to stay

**As of the drafting of this document, the board is not seated. There are no

board members. One person — the project's owner and current Curator General —

holds every function this article describes.**

That is stated in the project's GOVERNANCE.md already, and it is repeated here

rather than softened because a governance document that describes a board which

does not exist is worse than having no document. Anyone reading this should

assume, until the registry says otherwise, that "the board" means one person.

What changes this is the Waterline (§6.5), and it changes it mechanically.

§3.6 Money is public

Every amount in and every amount out is published: source, sum, date, and

purpose. Anonymous donations are accepted; anonymous donors of record are

not — the project may decline to publish a name, and may never decline to

publish the fact, the amount, and any condition attached.

There is no such thing as a private line item here. A project whose entire

premise is that public money should be traceable does not get to keep its own

books shut.

Article IV — The Jury

§4.1 Drawn by lot, never elected

A jury is seven members in good standing, drawn at random from the affected

gallery. Not elected. Not appointed. Not volunteers.

This is the single most important anti-capture mechanism in this document, and

it is the one most likely to be argued away as impractical.

An elected judiciary can be captured by whoever is best at winning elections,

which over time is whoever is most organised, not whoever is most fair. A

volunteer panel is captured by whoever cares most about being on it — which,

reliably, is whoever has an interest in the outcomes. **A panel drawn by lot

cannot be captured in advance, because at the time anyone would need to buy it,

nobody knows who is on it.** Sortition is old, it is well understood, and it was

dropped from most modern systems precisely because it is inconvenient to the

people those systems ended up serving.

§4.2 What a jury decides

• Whether a member should be suspended, and for how long.
• Whether an officer has violated this document.
• Whether a proposal or a decision violates Article Zero.
• Any dispute two members bring to it jointly.

A jury does not decide what is true about the world. It decides whether the

rules here were followed. The record decides what is true.

§4.3 How it runs

• Selection is by lot from all members in good standing in the gallery, with the

seed and the method published so any member can re-run the draw and get the

same seven.

• Anyone may decline to serve. The draw continues until seven accept.
• Anyone connected to the matter is excluded before the draw, not after.
• Both sides are heard. The subject of a complaint always gets to answer it.
• Five of seven to suspend a member or find against an officer.
• The verdict is published with reasons. Dissents are published too.

The published seed is what makes the draw checkable. A random selection nobody

can reproduce is indistinguishable from a chosen one.

§4.4 Limits on what a jury may do

A jury may suspend a member for a stated term, find that an officer violated

this document, strike a proposal that violates Article Zero, and order that

something be added to the record.

A jury may not delete anything from the record, fine anyone, take anyone's

data, or bar anyone permanently. There is no exile here, because a permanent

ban is unappealable by construction, and the framework's own remedy for

irreconcilable difference is Article VII — leaving, with everything you brought.

§4.5 Appeal

A verdict may be appealed once, to a fresh jury drawn by the same method with no

member of the first. The second verdict stands.

Two juries, drawn independently, reaching the same answer is about as good as

this gets. A third would just be shopping.

§4.6 The standing exception

Under §0.5, a person downstream of a water decision may bring a matter to a jury

without being a member. They are heard on the same terms as a member. This

is the only route into this framework that does not require an account, and it

is deliberate: the people most harmed by a decision about water are usually the

people with no standing to object to it.

Article V — The Record

§5.1 The record is the point

This project exists to keep a public record and to prove it has not been

altered. Everything else — the galleries, the themes, the franchises, this

document — is scaffolding around that.

So the record binds this framework harder than it binds anyone else. A project

that demands transparency from councils and keeps its own governance in a drawer

has simply changed who holds the drawer.

§5.2 What is on the record

• Every version of every document in this set, with its diff.
• Every proposal, its water finding, and its full text as voted on.
• Every vote: who, which way, when, and why.
• Every jury: the seed, the panel, the verdict, the reasons, the dissents.
• Every emergency action, its stated reason, and its expiry.
• Every appointment and every removal.
• Every amount in and out (§3.6).

§5.3 Append-only

Nothing is deleted from the record. Corrections are appended and linked to what

they correct, so the original and the correction are both readable, forever, in

order.

This is not pedantry. Most quiet capture is retrospective — the number that was

always that number, the clause that was always worded that way, the vote nobody

remembers. A record that cannot be silently revised removes an entire category

of attack, and it costs nothing but disk.

§5.4 The two things that may be withheld

Exactly two, and no others may be added except by amendment:

• 1. Personal information that would endanger someone — a home address, a

legal name under threat, the identity of a source. The fact of the

withholding is always published, with the reason.

• 2. Material under an active legal restraint. The existence of the restraint,

its date, and its source are published unless publishing them is itself

restrained — in which case that is published the moment it lifts.

Anything else, including material that is embarrassing to this project, its

officers or its founder, is on the record.

§5.5 Privacy is a limit on us, not a promise about you

The privacy commitments in the Bill of Rights are not marketing. They describe

what the software already refuses to store, and they are written so that anyone

can check the claim against the schema:

• Page views are counted without storing addresses or identifiers.
• Listening data is counted per segment of tape, never per person — the table

cannot answer "what did this person listen to", only "how often has this minute

been played by anyone".

• No email address is exposed through any public interface, including to the

organiser of a campaign someone signed.

A claim about data handling that cannot be checked against the code is an

advertisement. These can be checked, and if they ever stop being true the code

is the thing that broke, not the promise.

§5.6 The record outlives the project

The record is mirrored by custodians who each hold a complete copy, under

licences that cannot be revoked. No officer of this project, including its

founder, can recall a copy, delete it, or make it illegal.

This is what makes the rest of this document more than an internal policy: the

consequence of ignoring it is not a reprimand, it is that the record continues

without you.

Article VI — Amendment

§6.1 Everything here is amendable

Every word of this document can be changed by the people living under it,

including its name. "The Watershed" is version 1.0's name, stored as data rather

than written into the software, so that renaming it is a ratified vote and not a

decision by whoever has commit access.

The single exception is Article Zero, which has its own harder process at §0.6.

§6.2 How an amendment passes

• 1. Proposal. Any member may propose. The full text as it would read must be

attached — not a description of the change, the change.

• 2. Water finding (§0.4). Without it the proposal cannot be put to a vote.

The software enforces this rather than a chair remembering.

• 3. Deliberation. A mandatory open period of 30 days before any vote can

begin. It cannot be shortened, waived, suspended, or set aside by anyone,

for any reason, including an emergency.

• 4. Vote. Open 14 days. Roll call, with a written reason, published

permanently.

• 5. Threshold. Two-thirds of members in good standing — not two-thirds of

those who happened to vote. Abstention counts against.

§6.3 Why the deliberation window cannot be waived

The urgent amendment is the oldest trick there is. A crisis appears, a change is

proposed as an emergency measure, the ordinary safeguards are set aside because

this time is different, and the emergency ends while the change stays.

So the window has no override. Not by the curator, not by the board, not by

unanimous consent, not by the founder. A genuine emergency is handled under

§2.6, which acts immediately and expires by itself in 14 days — an emergency

gets you action, never a permanent rule.

§6.4 Sunset on delegated power

Any power this document grants to an office — as opposed to a right it

recognises in a member — expires five years after it is granted unless

re-ratified by the process above.

The burden sits on the side of keeping power, and it recurs. Powers that persist

because nobody got around to removing them are how every framework of this kind

has drifted, and the drift is never visible in the year it happens.

§6.5 The Waterline

Below the Waterline — fewer than 100 members in good standing — this

document binds curators, moderators and the board. It does not bind the

owner, who retains final say. That is the honest description of a project with

one director, and pretending otherwise would make everything above decorative.

At the Waterline — the moment the hundredth member in good standing is

counted — this document binds the owner exactly as it binds everyone else.

Automatically. No signature, no ceremony, no announcement, no opportunity to

reconsider. The software enforces it: past the threshold, an owner override

returns an error instead of succeeding.

The count is published on the governance page as a rising line, whether or not

the number flatters anyone.

Why a threshold rather than a date. A date can be met by a project with no

one in it, which would hand the framework to whoever is standing closest. A

hundred members in good standing is roughly the point at which a fork is

survivable — enough people to keep a mirror running, seat a jury by lot, and

disagree in public. Below that, the checks in this document are theatre; above

it, they are real.

Why it is mechanical. Because the alternative is asking everyone to trust

that a person with power will give it up on schedule, and this entire document

is written on the assumption that they will not. The threshold is the one

promise here that does not require anybody to keep it.

§6.6 What an amendment cannot do

No amendment may:

• weaken Article Zero except by §0.6;
• remove the right to leave, or the right to fork (Article VII);
• make the record deletable (§5.3);
• create a vote worth more than one vote (§1.1);
• raise the Waterline once it has been crossed.

That last one has a specific failure in mind: a body that has just gained power

voting to raise the bar behind it so that no one else can. The number goes down

by amendment. It never goes up.

Article VII — Exit and Fork

§7.1 The check that does not depend on us

Every mechanism in this document can fail. Juries can be lazy, boards can be

captured, curators can be stubborn, and a founder can decide the rules are for

other people. Every framework that has ever failed had internal checks that

looked adequate on paper.

So the last article is the one that does not run on our good faith. **Anyone can

take a complete copy and leave, and nothing anyone here does can stop them.**

§7.2 Leaving, as a member

A member may close their account at any time, without asking, explaining, or

waiting.

On leaving they take a complete machine-readable copy of everything they wrote.

Not a summary, not a PDF, not a partial export behind a support request — the

actual content, in a format another system can read.

What stays is what belongs to the record: votes cast, verdicts, and the fact of

membership. Article V is append-only and leaving does not rewrite history. What

someone said in a public vote remains what they said.

There is no exit interview, no retention flow, no "are you sure", and no offer.

The exit is at least as easy as the sign-up, and if it ever is not, that is a

violation of this article.

§7.3 Forking, as anyone

The code is licensed AGPL-3.0. The content is licensed CC BY-SA 4.0. Both are

irrevocable for copies already released.

Anyone — a member, a former member, a stranger, someone this project has

wronged, someone who simply disagrees — may take the whole thing, stand it up

elsewhere, run it their way, and compete. They may keep the record, the tooling,

and the data. They must keep it open, and they must not claim it is us.

A fork is not a failure of this framework. It is the framework working. The

right to leave with everything is what makes staying meaningful, and it is the

only check that keeps working after the others have been captured.

§7.4 What this costs the founder, in plain terms

This is written down so nobody has to infer it later.

The licences cannot be withdrawn. A mirror custodian's copy cannot be recalled,

deleted, or made conditional on agreement. The sealed tier opens on a threshold

of custodians rather than on one person's signature. And past the Waterline, the

owner is bound by this document like anyone else, by mechanism rather than

choice.

What the founder keeps is what cannot be given away by writing: having built it,

and whatever authority comes from people choosing to stay.

§7.5 If this project dies

If the project stops, is abandoned, is bought, or is compelled to shut down, the

record is already mirrored by custodians who each hold a complete copy under

irrevocable licences.

There is nothing to wind up and no one to ask. The record continues without us,

which is the correct outcome, because the record was never the point of the

organisation — the organisation was a way of keeping the record.

The Bill of Rights

*Rights of members, and in places of anyone at all. These are limits on what

this project may do — not features it offers, and not promises it may revise

when they become inconvenient.*

1. The right to read

Every member may read the entire record: every document, version, proposal,

vote, verdict, appointment and figure. No paywall, no tier, no login gate on the

public record, and no "contact us for details."

The two narrow exceptions in §5.4 are the only ones, and each is published as a

withholding with its reason.

2. The right to the record of yourself

Every member may see everything this project holds about them, in a form a

machine can read, without asking permission or stating a purpose.

3. The right to a jury

No member may be suspended by an officer, a curator, a moderator, a board, or

the founder. Only a jury of peers drawn by lot, having heard them, for a stated

term, with published reasons.

4. The right to privacy from us

This project will not build a profile of you, and the code is written so it

could not if it wanted to:

• Page views are counted without storing addresses or identifiers.
• Listening is counted per segment of tape, never per person — the table cannot

answer "what did this person listen to."

• No email address is exposed through any public interface, including to the

organiser of a campaign you signed.

• Nothing here is sold, rented, traded, or shared with an advertiser, ever.

Check it against the schema. A data-handling claim that cannot be verified in

the code is an advertisement, and these were written to be checkable.

5. The right to leave with what is yours

Close the account whenever you like, take a complete copy of what you wrote, and

do not be asked why. Your votes and verdicts stay on the record, because the

record is append-only and history is not editable by departure.

6. The right to fork

Take the whole project and run it yourself, under licences that cannot be

revoked. You do not need permission. You do not need to be in good standing. You

do not need to have been a member.

7. The right to be wrong out loud

No member may be suspended for disagreeing with this project, its findings, its

officers, or its founder. Not for criticism, not for being mistaken, and not for

being right in a way that is inconvenient.

Conduct is a matter for a jury. Opinion is not conduct.

8. The right to the question

Any member may demand a water finding on any decision (§0.4), and anyone

downstream may bring a water matter to a jury whether or not they are a member

here (§0.5).

9. The right to an answer

A member who brings a matter under this document is entitled to a decision, in

public, with reasons. Silence is not a permitted response, and neither is

indefinite delay — a matter not heard within 90 days goes automatically to a

jury drawn by lot.

*These rights are subordinate to Article Zero, like everything else here. Water

does not negotiate, and neither does the arithmetic that says nothing on this

list matters to anyone who has run out of it.*