Reference implementation of the Civilization Recovery Protocol (§4–§6, open). Category: civilization starter kit.
Designation: CIV-SV-01. Handheld, solar-sustained, offline. Holds the knowledge to restart food, water, medicine, energy and shelter; lets a family and a community talk across kilometres without infrastructure, privately; finds a family member who is lost; keeps a community's trade honest without money; keeps working for a decade with no supply chain.
Naming. Three names, one job each. Civilization Recovery Protocol is the open standard: the channel tiers, beacon schedule, Locate tiers, ledger records, vouches, playbook schema and time-source ladder in §4–§6 — published, implementable by anyone on any hardware, owned by no one. Civilization Seed Vault is the kit: the reference implementation and the product; the address is civilizationseedvault.com. CIV-SV-01 is the model designation — the label, the BOM line, the firmware string. Civilization starter kit remains the category name in these documents. The product name is descriptive by deliberate trade — it says what the thing is and is weak to register — so the protectable assets are the logo, the model designation and, over time, the reputation, and the community lives in the Protocol rather than the mark. Rules that follow: "Seed Vault" is never compressed to "Seedvault" (an established Android backup application) and never set alone as a wordmark; "Civ" appears only inside the designation, never as a name prefix (occupied by the Civilization games and civic-tech organisations); the Protocol is written out, never abbreviated (CRP is C-reactive protein, which is in the library); a short spoken handle for radio use is still open and gets a Class 9 search before it gets a domain; and the Class 9 search on the full name happens before anything is printed on hardware. Previous working name Ember was dropped for a trademark conflict.
Changes from v0.4: telescoping whip removed; internal ferrite-rod antenna for AM/LW added; third receive-only SMA (BCST) with wire antennas in the kit for FM/SW; rails reassigned — controls on the left rail, ports on the right rail; image prompts B2, B4 and B9 updated to match.
v0.5.1: spare LoRa stub and UHF whip added to the kit; hard-case interior sized (~30 × 22 × 13 cm); B4 reframed so the case enters the frame at true scale; B10 (packed case) added as the foam-layout check.
v0.5.3: positioning after GNSS — temperature-compensated RTC with a time-source ladder (GNSS → shortwave time signals → lunar distance); celestial-navigation module in the Layer 1 calculators; plastic sextant in the kit; anchor-node tier in Locate; GNSS degradation timeline in the manual.
v0.5.4: printable prototype enclosure added under cad/ — parametric CadQuery, STEP/STL per part, filament guide in cad/README.md. Printed prototype is 33 mm thick (2.4 mm walls) and carries the cam lever on the end cap rather than the rear face; both revert with the aluminium frame.
v0.5.5: naming hierarchy — Civilization Recovery Protocol (open standard) / Civilization Seed Vault (kit) / CIV-SV-01 (model); §5 and §6 marked as Protocol; principle 10; prior art extended (Dartnell, EA "Civilization Recovery Kits"); paperback add-on in the kit. The Protocol document is extracted from §4–§6 after the prototype's partition test.
Purpose
Non-goals: camera, video, cellular, cloud, touchscreen, sealed battery, app store, satellite rescue (§5.5), any form of money, token, or convertible unit (§6).
White flashlight (20 lm low / 300 lm high, 60 s auto-step-down from high, high locked out below 20% SoC, all but SOS and remote strobe locked out below 10%), deep-red night LED (~40 mW), Morse/SOS strobe, remote strobe on a Locate command. Cost shown as "hours of radio." Separate AA flashlight in the kit.
I2S MEMS mic and 1 W speaker behind vent membranes; speaker in the front bezel above the display. Headset: sealed screw-lock 4-pin connector under a tethered cap, on the right (port) rail. Codec2 for voice notes.
| Load | Wh/day |
|---|---|
| Domain A baseline (mesh listening, clock, ledger gossip) | ~1.5 |
| Reading on Domain A, 1 h with front light | ~0.1 |
| Red night light, 3 h | ~0.1 |
| Flashlight: 30 min low, 5 min high | ~0.3 |
| Broadcast radio, 1 h | ~0.2 |
| UHF voice: 10 min TX, 1 h RX | ~0.7 |
| Domain B searches, 10 sessions | ~0.4 |
| Layer-3 LLM, 2 sessions × 60 s | ~0.2 |
| Domain B browsing, 30 min | ~1.0 |
| Total | ~4.5 |
Full-back array covers a moderate day in decent sun. No sun: ~4–5 days moderate, ~14 days Domain A only. Beacon-only reserve at ≤ 10% SoC: ~3 days.
Device; 10 W fold-out panel; 2 spare LFP cells; spare microSD (Domain A image + Tier-0); spare NVMe (full library); LoRa stub and UHF whip antennas mounted, plus a spare of each (whips break); 75 cm FM wire antenna and 10 m SW wire antenna, each with an SMA plug, an insulator and a clip; sealed wired headset; USB-C cable; pairing cable; seal kit; AA LED flashlight; Torx driver; plastic sextant (the device is the almanac; the sextant is the instrument); sealed recovery card; printed quick-start covering cell and seal replacement, re-imaging, Beacon and Locate, channels, the ledger, and stringing a wire antenna; hard case with a closed-cell foam insert, interior about 30 × 22 × 13 cm — roughly three times the device's footprint; the folded panel and the device set the length, the PLB sets the depth; foam layout per image B10. Recommended add-ons, not built in: a registered 406 MHz PLB, and a paperback of Lewis Dartnell's The Knowledge — the canonical reboot curriculum, which cannot be bundled in the library but survives anything the device doesn't.
SoM → thermal pad → aluminium frame → side rails and top bezel; the rear face is excluded from the path. ~5 W spread over ~0.045 m² is roughly a 10 °C rise. Frame thermistor throttles Domain B at 60 °C, shuts it at 70 °C. The thermal test (Domain B full load, 30 min, sealed, 40 °C ambient, rear face in sun; no throttling, no hand surface above 48 °C) is run in the production colour.
Keyword search (BM25, typo-tolerant) over Tier-0; playbooks (decision trees and checklists, per-node citations, nav-pad navigable — bleeding, burns, fractures, childbirth, dehydration, poisoning, fire, water, shelter, radio procedure, lost person, trade dispute, finding your position without GNSS); deterministic calculators with cited formulas (chlorine dosing, SODIS, ORS, weight-based dosing tables, solar sizing, battery runtime, planting dates, unit conversion, celestial navigation: onboard sun, moon, planet and navigation-star ephemeris computed from astronomical models rather than tables; noon sight for latitude; sight reduction for a fix from two or more bodies; lunar distance for recovering UTC; sunrise/sunset and local-noon times for any date and place); flat LZ4-block reader.
Full-text search over every ZIM via its Xapian index; answer bank (50–200k cited Q&A generated at build time, eval-graded, medical subset human-reviewed, per language; one embedding lookup at runtime); kiosk mode (Wi-Fi hotspot serving kiwix-serve to family phones).
Invoked only on a low-similarity layer-2 miss, an explicit request, or a translation with no MT model; shows battery cost first; hybrid retrieval → LLM with locked prompt; no retrieval hit → says so and opens the nearest Tier-0 article; dosages quoted verbatim; every answer ends with Source: <article> — open.
whisper.cpp small → M2M-100 418M / OPUS-MT → Piper. LLM only for ASR cleanup, per-language answer-bank responses, simplification, fallback translation. Not NLLB-200 (CC-BY-NC). Re-evaluate Gemma 3n if speech-in becomes primary.
Qwen3-4B Instruct (Apache 2.0), non-thinking; quick mode Qwen3-1.7B; embeddings EmbeddingGemma-300M or bge-small (multilingual variant for non-English banks). Release gate: ≥ 200-question grounded-accuracy set, ≥ 95% for layers 2 and 3; playbooks and calculators reviewed by a clinician and an agronomist; glove-usability audit of every safety-relevant task.
Record note or type text → pick channel, contact or group → outbox until ACK → recipient inbox → play/read. Delivery receipts. Optional scheduled check-in with a nag if missed.
Triggers: hold Beacon 3 s; trusted remote request; opt-in IMU auto-beacon (impact → 5 min stillness → unanswered prompt). Frame: identity, position or last-known-plus-age, battery, status, fixed TX power. Schedule: 30 s for hour one, 2 min to hour six, 5 min after; 2 s listen window after each frame. Beacon-only mode at ≤ 10% SoC. Beacon frames go on the family channel; if the device's keys have been wiped (§5.8), beacon frames fall back to the open channel in cleartext — being found beats being private.
Tiered, with the tier and data age always shown: GNSS bearing and distance → anchor-node position (the device places itself by signal strength from three or more community nodes at surveyed positions — the well, the barn, the ridge — to roughly a hundred metres in open ground; the seeker and the beacon both use it, so Locate keeps a bearing after GNSS is gone) → signal-strength sweep with body-shielding bearing (±30°; 915 MHz does not penetrate snow or rubble) → remote sound-and-strobe for the last ~100 m. Last-known position stored per contact. Anchor positions are surveyed once while GNSS still works, or from the map, and gossip on the community channel as signed records.
Absolute position after GNSS is a Layer 1 job, not a Locate job: latitude from a noon sight needs no clock; longitude needs the disciplined clock in §3.7 and a sight; and terrain association against the offline map covers the rest. This is how navigation worked before 1990 and the device carries everything but the horizon.
Beacon, Locate, remote wipe, key rotation and ledger co-signing are accepted only from identities on the device's trusted list. Family devices are trusted at provisioning; community members are added by an in-person vouch (§6.5).
Not a PLB or EPIRB. A registered 406 MHz PLB reaches satellite search-and-rescue; nothing here leaves the mesh. The word "emergency" does not appear in the Beacon UI.
Four tiers, mapped onto Meshtastic channel slots (up to 8 per device):
| Tier | Members | Crypto | Purpose |
|---|---|---|---|
| Open | anyone on the same region preset | Meshtastic default (public) | discovery, interop with strangers' nodes, cleartext beacon fallback |
| Community | vouched community devices | AES-256 shared key, rotated | market board, ledger gossip, community notices, community voice notes |
| Family | the kit's devices | AES-256 shared key, rotated | family messages, positions, beacon |
| Direct | one node to one node | per-node X25519 key agreement + AES-CCM | private messages, ledger co-signing, key rotation delivery |
Nodes relay packets they cannot decrypt, so the community's open nodes carry family traffic. Every device also holds an Ed25519 signing key, separate from its mesh key, for ledger records, vouches and revocations. All algorithms are standard and the implementation is published.
Known limits, stated in the manual: packet headers (sender and recipient node IDs) are cleartext — who talks to whom and when is visible to any receiver even though content is not; there is no forward secrecy, so a captured device exposes past traffic on the channels it holds; positions shared on a channel are visible to everyone on that channel.
A mutual-credit ledger and a market board, running on Domain A over the community channel. It records who owes whom, in a unit the community chooses, and it lets people post offers and wants. It is not a currency: nothing is minted, nothing is scarce, nothing is sold, nothing is convertible, no one holds value for anyone else, no fee is taken. The UI uses the words credit, hours and balance; it never uses money, coin, token or wallet.
Default: hours. A community may define one other unit (kWh, kg of a staple) with a stated ratio; more than two units is refused by the UI because it recreates money-changing. Hours are the default because they are the most legally boring pre-collapse (timebank) and the most robust when nothing else has a price.
Each device's Ed25519 signing key is its ledger identity. A person, not a device, is the party: a lost device's identity is superseded by a successor record signed by the family root key (§5.7), and its balance carries over because the records are replicated.
{payer, payee, amount, unit, memo, timestamp, nonce} signed by both parties, created in person over the pairing cable or BLE PIN, or remotely over Direct. A record with one signature is a proposal, not a transaction. There is no unilateral entry, so there is nothing to double-spend; a balance simply goes negative up to a credit limit set by the community (default −40 hours). The payee's device shows the payer's balance and limit before co-signing and refuses to co-sign past the limit — an override requires a second trusted signature, which makes exceptions visible.
Joining a community is a vouch record signed by an existing member and the newcomer. Each identity's page shows: vouched by, vouches given, trade count, net balance, and any open dispute flags (a signed statement by one party that a record is contested; resolution is social, using the trade-dispute playbook, and closes with a co-signed correction record). No scores, no algorithms — people read the page.
Records are an append-only set gossiped over the community channel and merged by union; balance is the sum. Because every record is co-signed there are no conflicts to resolve, partitions heal by exchange, and any device holds the whole community's history (~200 bytes per record; 100k records ≈ 20 MB). A new member's device receives the set from any vouching device.
Posts on the community channel: offer or want, category, quantity, price in the unit (or "ask"), location hint, expiry (default 7 days), poster identity. The device keeps a simple price history per category so a community can see what a dozen eggs has cost over the last season. Posts are signed; anyone can see them; only the poster can withdraw them. The board is the feature people will actually use; the ledger exists to keep it honest.
Mutual credit below a few dozen active participants stalls — a family does not need a ledger. The ledger and board ship present but not prominent on a family-only deployment and become a home-screen item once a community key is installed.
The design stays inside a non-convertible, operator-less, fee-less, custody-less perimeter: no exchange for fiat, no one holding balances on others' behalf, no transfer fees, no token sale, no maker-run network. That is what keeps a bilateral ledger outside money-transmitter and securities definitions as commonly understood; a lawyer confirms it before sale. Pre-collapse it is a timebank. Informal timebanks have decades of history; formal barter exchanges carry IRS reporting duties, so the ledger exports CSV for anyone who needs to report. The maker never runs a community, holds a key, or issues a unit.
Tier-1 (Domain B, ~600–900 GB): Wikipedia EN, WikiMed, Wikibooks, WikiHow, Wikiversity, iFixit, Gutenberg EN, Stack Exchange bundles, OSM region extracts, Khan Academy text, Appropriate Technology Library, FAO manuals, USDA canning guide, NCHFP, FM 21-76 and first-aid manuals, CDC/WHO field guides, Open Source Ecology GVCS, Hesperian titles (licence), answer bank and indexes.
Tier-0 (Domain A, ≤ 2 GB plus playbooks): water · fire · shelter · first aid and trauma · medicines and dosing tables · wound care · childbirth · sanitation · food preservation · seed saving · staple crops by climate · hydroponics · solar/battery/small-engine basics · basic electricity · knots · navigation · radio procedure, frequencies and wire antennas · lost-person procedure · trade-dispute procedure · weather signs · regional plants pack.
Licensing: Wikipedia family CC BY-SA; Gutenberg and US government manuals public domain; Hesperian CC BY-NC-SA (permission for a product); Appropriate Technology Library audited per document; models — Qwen Apache 2.0; whisper, Piper, M2M-100 MIT; Gemma terms restrict; NLLB-200 non-commercial.
Cells (3–5 years), O-rings and gaskets (inspect yearly, replace at 5), end-cap springs (with cells), microSD and NVMe (5–7 years or first error), front-light LEDs, keyboard dome sheet, wire antennas (they get lost, not worn), the printed recovery card (re-issue on any rotation).
cad/ — print the tub, lid, cap and latch first, fit-check with real cells and the panel, then the TPU parts); 516.8, 512.6 on the end cap and port caps, §3.12 thermal in the production colour. Tool only after a season of field use.Appendices (build prompt, image prompts) are not included in the published copy.