Operating it
A console that watches everything, and cannot tell you who anyone is
Not because it has been configured not to. Because there is no column to select, and the query engine refuses the attempt in writing.
The ask was for a console with everything tokenized so that nobody is exposed, tracking continuously, and able to run queries actively. All three of those are compatible, and the console below is all three at once - but only if the fourth thing is true as well: that when an operator asks the console who, the console says no, and says so on the record.
That is not a compromise bolted onto the design. It is the design. The Anchored Zone Protocol states it as a single sentence, and everything on this page is that sentence turned into running code: set membership is local and real-time; identity is remote, authorized and logged. An anchor holds the identifiers that are valid for the present ten-minute window across every enrolled device. It can therefore establish, immediately and offline, that something it can hear is enrolled - without learning which device, and without contacting a server.[19] Crossing from that fact to a person is a separate act, with a court in it.
What this page is
This is a design document, and the console is a working demonstration of a specified mechanism, not a deployed system. The board is a seeded simulation: the anchors, the encounters and the identifiers are generated in your browser by a pseudo-random generator, they correspond to no person and no place, and the whole session replays identically from the same seed. Nothing here reaches a network, and nothing is stored between page loads.
The console
Zone board
Every anchor, every tick, live - seeded replayAZP-CONSOLE-1
| Identifier observed | Anchor | Class | Modalities | Range | Dwell | State | Tier | Human |
|---|
Every row here is an anchor's own observation of a rotating identifier it matched against the current-interval enrollment set, locally, without contacting anything. The identifier column is the only handle the board has, it changes every ten minutes, and nothing in this table survives to the next day. GNSS is shown in gray because it is context only - it answers "is this plausible?", never "how far apart are they?", and it is not counted towards agreement.
Query layer
A real parser over the real store - press Run, or Cmd/Ctrl + EnterTry one of these - the last five are refused, and the refusal is the interesting part
A standing query is not free. Tick the box and the console re-runs your query as the board moves - and writes an audit line every time it does, because a read that leaves no trace is not a read anybody can be held to. Watch the log at the bottom of this console grow while it runs.
Identity resolution
Two independent approvals and a judicial order, or nothing at allTry it in the wrong order. Approve as the operator and press Resolve: it fails, and it fails because the derivation has one of its two inputs and cannot be computed, not because a rule said no. Approve twice as the operator: the second one is rejected as not a second party. Clear the order reference and the custodian releases nothing. Every one of those attempts lands in the log.
Exigency
Narrow, time-limited, auto-notifying, and audited identicallyThe exigency replaces the order. It does not replace the custodian - both approvals are still required, and a custodian approval offered after the authority has expired is refused. The reviewing court is notified at the instant of invocation rather than at the convenience of the invoker, and the same audit record is written, field for field, as the judicial path writes. The board runs at five seconds a tick, so the slider above projects the same record forward to show what it looks like when the authority lapses and when the review falls due - it moves the viewpoint, never the record.
Tamper and liveness
Loss of signal is a tier 1 event and is never a dispatch| Last identifier | Anchor | Class | Silent for | Tier the engine assigns |
|---|
Loss of signal is ambiguous between a failed device, a basement and a person who has fled, and there is no safe default: failing loud reproduces the false-alert rate that made officers stop reading alerts, and failing quiet reproduces the fatality in the GAO record. So it is neither. It goes to an officer's queue. It rises to a silent guardian notice only if the last known position was in a class A zone or the outage runs long, and it can never reach the audible tier at any duration, because a device that has stopped reporting is evidence of proximity to nobody.
Audit log
Append-only, hash-chained, and -| # | Clock | Kind | Actor | Token | Code | Detail | Hash |
|---|
Reads, refusals, approvals, adjudications and resolutions all land here. There is no method on this log that removes or edits an entry - the array is closed over, every entry is frozen the moment it is written, and the reader is handed a copy. Each entry carries the hash of the one before it, so a rewrite that somehow reached the array would still show up as a broken chain at a named index.
The boundary
A refusal that leaves a record is a control. A refusal that leaves nothing is a preference
Every attempt to cross the line is written down, including the ones that failed - especially the ones that failed.
What the query language accepts
The console does not fake this. There is a tokenizer, a recursive-descent parser and an evaluator that runs over the in-memory observation store, and a query that does not parse returns a parse error rather than a quiet empty table - the failure mode that lets a console look like it answered.
SELECT * | col, col, ... | COUNT(*)
FROM observations
WHERE expr
ORDER BY col [ASC | DESC]
LIMIT n
expr := expr AND expr | expr OR expr | NOT expr | ( expr )
| col <op> literal
| col IN (literal, literal, ...)
| col LIKE 'pattern' -- % and _ wildcards
| col BETWEEN literal AND literal
<op> := = != <> > >= < <=
literal := a number, or a single-quoted stringEvery column that exists
This list is the privacy guarantee, and it is worth reading as one. An operator may select every column in it, on every row, all day, and still not know who anybody is.
| Column | What it holds |
|---|---|
obs_id | Row number in the anchor's own local ring |
t, time | When the contact began, in world seconds and as a clock time |
anchor | Which fixed anchor observed it |
zone_class | A or B - the classification set by a person at installation, never inferred |
zone_kind | What kind of place the anchor sits in |
rpi | The rotating proximity identifier observed. Valid for ten minutes, then gone |
uwb, cs | Whether each deciding modality agreed that an enrolled device is present |
gnss | Coarse containment. Context only. Never counted, never decides |
agree | Deciding modalities in agreement - uwb + cs, and never gnss |
range_m, dwell | Ranged separation, and seconds of continuous contact |
tier | What the tier engine assigns this row, from the table in the protocol |
state | observing, ended, or signal-lost |
adjudicated | Whether a human has reviewed it - the gate in front of the audible tier |
There is no name column, no person column, no device serial, no case number and no key material, and none of them can be added by a query. The absence is the point: a store that never held an identity cannot leak one, and an operator who never had the ability cannot be pressured into using it.
What the engine refuses, and why it says so out loud
A query that would cross the authorization boundary is refused by the planner, before a single row is read, and
the refusal is written to the audit log with the query text attached. The check runs on the parsed tree rather than
on the query text, which matters in both directions: an identifier called name is refused, and a
string literal that happens to contain the word is not, because data is not a request.
| Code | Raised when | What it means |
|---|---|---|
E-ID-01 | A query names an identity column - name, person_id, address, dob | The column does not exist and cannot be created. This is the boundary itself. |
E-ID-01 | A query asks for a stable identifier - device_id, imei, serial | Linkage is identity resolution in slow motion. Following one device across a day is the thing rotation exists to prevent. |
E-ID-02 | A query reads identities, registry, keys, custody, or joins to one | Those relations are on the other side of the line. The console holds observations and no key material. |
E-ID-03 | A query calls RESOLVE(), UNMASK(), WHOIS() | Resolution is not a query function. It is a two-party procedure with a court in it. |
E-COL-01 · E-TBL-01 · E-FN-01 | An unknown column, table or function | An honest error, not a boundary event - but still logged, because an audit trail with gaps in it is not an audit trail. |
E-SYN-01 | The query did not parse | Reported as a parse error rather than an empty result. |
The reason the refusal is loud rather than silent is the same reason the successful reads are logged too. A console that quietly returns nothing teaches an operator to keep trying. A console that refuses in writing, into a log an inspector will read, tells the operator exactly what happened and tells everyone else that it happened.
Why one person cannot do it
Splitting custody is what turns the guarantee from a promise into a property. The operator holds observations and no keys. The independent custodian holds keys and no observations. A court authorizes joining them, and an insider at either organization, acting alone, cannot produce an identity.
In this console that separation is arithmetic rather than an if-statement, which is the difference between a rule and a mechanism. Each party releases a share. The handle is derived from the combination of the two shares, and the function that derives it returns nothing at all when handed one - not a partial answer, not a narrowed field, nothing. There is no code path from one share to a handle, because there is no such function to call. You can test this in the panel above by approving as the operator and pressing Resolve, and you can test it in the check page, which runs a thousand candidate custodian shares against the same operator share and counts the collisions.
What comes out at the end is a pseudonymous handle, and the specification stops there deliberately. It is the thing the two authorized parties carry to a case file that this site does not hold. It is not a name. No name exists anywhere in this document, and inventing one - even an obviously fictional one - would be fabricating a record about a person, in a system whose entire subject is what happens when records about people are wrong.
The residual risk, stated rather than papered over
This is a pseudonymous system with a trusted matching party, not an anonymous one. An anchor operator who watches a person walk past and captures the identifier at that moment has bound that identifier to that human by direct observation, and no cryptography prevents it - the objection the DP-3T analysis raised against every scheme of this shape.[28] The enrollment set also reveals how many devices are enrolled. Publishing any long-window key retroactively links every identifier derived from it. The right response is to say so in plain language rather than borrow privacy vocabulary the architecture does not support.
Why the board holds so much at tier 2
Because the alternative has been measured, and it ended the programs that tried it.
95.50% of monthly GPS monitoring alerts in Cook County were false, up from 57.79% under radio frequency.Hwang, Maniar, Smith & Nivens (2026), "False Alerts Related to GPS Electronic Monitoring in Illinois Cook County Sheriff's Office," Criminal Justice Review; urban GNSS error, Satellite Navigation (2025)
Driven by GPS drift; the worst zip codes were distinguished by tall buildings.
Hwang, Maniar, Smith & Nivens (2026), "False Alerts Related to GPS Electronic Monitoring in Illinois Cook County Sheriff's Office," Criminal Justice Review; urban GNSS error, Satellite Navigation (2025)
Driven by GPS drift; the worst zip codes were distinguished by tall buildings.
That is the number the gates on this board exist to survive. Cross-modality agreement filters the drift that produced it; the dwell threshold filters people walking past; the zone classification separates a school playground from a pharmacy that happens to sit near one; and a human adjudicates before anything becomes audible or reaches a dispatcher.[17] No single sensor reading reaches the top of the ladder in this console, at any distance, in any zone, on any subject - and you can watch that hold by leaving the board running.
You will notice that nothing on the board sits at tier 3 until you press Adjudicate on a row. That is not a rendering artefact. The engine will not assign the tier without the human step, and the human step is itself an audit entry, because a decision nobody is recorded as having made is a decision nobody can be asked about.
What this console is not
- It is not a deployed system. This is a design document. Nothing described here has been built or operated, and the board is a simulation whose seed is printed on it.
- It is not a surveillance product with a privacy setting. The refusals are not a configuration. Turning them off would not reveal anything, because the store has no identity in it to reveal.
- It is not a claim that tokenization solves the problem. It solves exactly one problem - a standing database of who was where - and leaves the observation attack, the enrollment-set count and the key-publication linkage in place, all of which are written down above rather than left out.
- It is not the cryptography. The identifier derivation and the audit chain in this file use a fast non-cryptographic function so the whole board runs synchronously in one frame. The real primitive is HMAC-SHA256, it is implemented for real elsewhere on this site, and the check page runs it against a published known-answer vector. What this console demonstrates is the shape of the boundary, and the shape does not depend on which hash sits underneath it.
The engine is /assets/console.js and the binding is /assets/console-ui.js;
both are plain, readable JavaScript with no build step and no dependency. The console's own test vectors are exported
from the engine as CONSOLE_VECTORS and run by runConsoleChecks(), and they are executed in
your browser on the check page along with everything else this site claims about itself.
How this works
0:48 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.
Transcript
| At | Section | What it says |
|---|---|---|
| 0:02 | What it is | This is an operations console that watches every anchor continuously, and is unable to tell you who anyone is. |
| 0:09 | The board | Each row is one anchor's own observation of a rotating identifier. The identifier changes every ten minutes and nothing survives to the next day. |
| 0:19 | The query layer | You can query the store for real. There are sixteen columns and not one of them is an identity, because no such column exists to select. |
| 0:28 | The refusal | Ask the console who, and it refuses in writing. The check runs on the parsed query, not the text, and every refusal is logged. |
| 0:37 | Resolving a name | Crossing that line needs two separate parties and a court order. Neither half can do it alone, because one share cannot produce a handle. |