Safe Perimeter, in full

1. Scope and claim

Argued at /coverage/

Ref	Level	Requirement
SP-1	MUST	The system is described as closing a specific gap - sustained, unexplained physical proximity between a child and an adult under active monitoring, in places a fixed geofence cannot see - and never as a solution to child sexual abuse generally.
SP-2	MUST	Published material states that the large majority of child sexual abuse is committed by family members and acquaintances, and that most people who commit these offenses have no prior conviction and are therefore invisible to the system.
SP-3	MUST	Published material states that the system has no effect on online grooming.
SP-4	MUST NOT	Any coverage figure be published without the assumptions that produced it.
SP-5	SHOULD	Coverage be re-estimated annually against the jurisdiction's own case data rather than national averages.

2. Enrollment of monitored subjects

Argued at /due-process/

Ref	Level	Requirement
SP-6	MUST	Monitoring be imposed prospectively, at sentencing, as an express component of the sentence, with the defendant on notice before plea.
SP-7	MUST	Any application to a person already convicted proceed by individualized determination: a validated risk assessment, notice, a hearing, the right to counsel, and a written finding.
SP-8	MUST NOT	Monitoring be applied to any class of existing registrants by blanket administrative reclassification.
SP-9	MUST	Tiering derive from a validated actuarial risk assessment together with offense characteriztics, and never from an offense label alone.
SP-10	MUST	The subject be entitled to challenge the assessment and to an independent evaluation.
SP-11	MUST	Every imposition carry a defined term, with the burden on the state to justify continuation at each review.
SP-12	SHOULD	The highest tier be sized to the supervision capacity that actually exists, not to the population that qualifies on paper.

3. Enrollment of children

Argued at /legal/

Ref	Level	Requirement
SP-13	MUST	A child be enrolled only by a guardian with verified parental authority, verified against the estranged-parent threat specifically.
SP-14	MUST	Enrollment end automatically at a defined age and never convert into an adult account.
SP-15	MUST NOT	A child's band be required as a condition of attending school, receiving services, or entering a public place.
SP-16	SHOULD	The views of a child old enough to hold one be recorded at enrollment, because a device a child did not agree to is a device they will disable.

4. Sensing and the physical constraint

Argued at /anchored-zones/

Ref	Level	Requirement
SP-17	MUST	Every radio in the sensing path be active and powered. The supervised person's court-ordered ankle unit already is; the child-side ranging module is, and its power budget lives in the shoe sole where a cell physically fits.
SP-18	MUST NOT	A passive tag be used anywhere in the sensing path. Passive tags have no transmitter and are certified to 20 mm against a 15.24 m requirement, which is why the child side is a powered module rather than a printed tag in a strap.
SP-19	MUST	The child-side device be receive-only. It may hear a monitored identifier and warn the child directly; it must never emit an identifier of its own, because a transmitting child-side device announces a child's position to any receiver.
SP-20	MUST NOT	BLE received-signal-strength appear anywhere in the proximity decision path. It is admissible only as a wake-up trigger to initiate a real ranging exchange.
SP-21	MUST NOT	GNSS position differencing be used to decide proximity. Urban error exceeds the threshold it would be asked to decide.
SP-22	MUST	The proximity decision rest on a ranging modality whose documented accuracy is smaller than the threshold it decides - in practice ultra-wideband.
SP-23	MUST	Escalation above the lowest tier require agreement between at least two independent sensing modalities.
SP-24	MUST	Anchors perform the ranging, classification and decision; wearables broadcast only.
SP-25	MUST	Every anchor be site-surveyed and calibrated at installation, and its zone class recorded then rather than inferred later.
SP-26	MUST	Distance-bounding be cryptographic, so that a relayed exchange cannot manufacture proximity.
SP-27	SHOULD	Anchor siting be documented well enough that a contested reading can be reconstructed after the fact.

5. Zone classification

Argued at /anchored-zones/

Ref	Level	Requirement
SP-28	MUST	Zones be classified as Class A - a place whose primary purpose is children's presence - or Class B, a place children frequent incidentally.
SP-29	MUST NOT	A Class B zone reach the dispatch tier automatically.
SP-30	MUST	Published material state that anchored zones protect places, not people in arbitrary locations, and that this is a narrowing of the original concept.
SP-31	SHOULD	Class A hours track the actual hours children are present, so a school at midnight is not treated as a school at noon.

6. Alert logic

Argued at /alert-tiers/

Ref	Level	Requirement
SP-32	MUST	The response ladder have at least the five tiers defined in this specification, with distinct recipients at each.
SP-33	MUST NOT	Any tier above Log be reached on separation distance alone, at any distance, for any duration.
SP-34	MUST	Sustained dwell be required for every tier above Notify.
SP-35	MUST	Dispatch require sustained dwell together with either a legally designated exclusion zone or a third repeat encounter within thirty days.
SP-36	MUST	A lost position fix produce no event, and the gap itself be recorded so the outage is auditable.
SP-37	MUST	A degraded position fix cap the encounter at Notify.
SP-38	MUST	Dwell thresholds be raised in dense venues, where incidental proximity is the norm.
SP-39	MUST NOT	The assessed risk tier move an outcome by more than one step in either direction.
SP-40	MUST NOT	The child's own band be the thing that makes the noise. The alarm is emitted by the anchor at the site, to the adults present; the band tells the child by vibration alone, so a child is never the source of a sound aimed at an adult.
SP-41	MUST	Audible alerting be confined to the guardian's own device, at tier 3 and above.
SP-42	MUST NOT	Any alert be placed automatically to emergency services on a proximity threshold.
SP-43	SHOULD	Ladder thresholds be tunable per jurisdiction and every change be versioned against the encounters it affects.

7. The warning to the monitored person

Argued at /warning/

Ref	Level	Requirement
SP-44	MUST	A warning be delivered to the monitored person before any escalation that a warning could have averted, so that leaving is always an available outcome.
SP-45	MUST NOT	The warning disclose, confirm, imply or vary with the presence of any child. It is triggered by zone, never by a person.
SP-46	MUST NOT	The warning convey direction, distance, bearing, count or dwell.
SP-47	MUST	The warning be byte-identical in every instance, so that presence cannot be inferred from its content or its behavior.
SP-48	MUST	The warning be delivered privately to the subject - haptic and to their own device - and never through a speaker audible to bystanders.
SP-49	MUST	A defined grace period exist, and departure within it be recorded as cleared.
SP-50	MUST	A cleared warning be available to the subject as evidence of compliance.
SP-51	MUST	Published material state that the system deliberately issues warnings indistinguishable from false ones, because varying them would turn the warning into a detector.
SP-52	MUST	The warning be part of the core specification rather than an option a deployment may omit.
SP-53	MUST	The ratio of warned-and-turned-back to warned-and-continued be measured and published - it is the most useful operational metric the system can produce.
SP-54	SHOULD	A warning be issued on approach, before the boundary is crossed, so that the available outcome is prevention rather than a record of a violation.

8. Named-victim zones

Argued at /additions/

Ref	Level	Requirement
SP-55	MUST	A protected zone attached to a named prior victim exist only where a court has imposed a no-contact order naming that person.
SP-56	MUST	Participation be initiated by the victim, revocable by them at any moment, and never a default or a condition of anything.
SP-57	MUST NOT	A victim be told that declining weakens their protection, or be enrolled by anyone other than themselves or their guardian.
SP-58	MUST	Published material state that for some survivors carrying a device tied to their offender is itself harmful.

9. Data protection and matching

Argued at /data-flow/

Ref	Level	Requirement
SP-59	MUST	Proximity matching be performed on the child's device against a published list of pseudonymous keys.
SP-60	MUST NOT	Any position of any party be transmitted to a server at any time.
SP-61	MUST	The child's band be receive-only: no advertised service, no response to probes, and no identifier transmitted.
SP-62	MUST	Broadcast identifiers rotate at least every fifteen minutes and be unlinkable across days without the key that generated them.
SP-63	MUST	The band hold no identity for the child, so that a found device tells the finder nothing.
SP-64	MUST	Position history on the band be limited to a rolling window of no more than 72 hours and never be exportable or synchronized.
SP-65	MUST	The pairing secret be wiped on tamper and on guardian revocation.
SP-66	MUST	The published key list be partitioned by region wherever the full list exceeds what a band can hold.
SP-67	MUST	Published material state plainly that publishing the key list creates a proximity oracle any third party can build a receiver for, and that this capability did not previously exist.
SP-68	MUST NOT	A guardian be able to learn the identity of the other party to an encounter.
SP-69	SHOULD	Key distribution be rate-limited and client-attested, accepting that neither eliminates the oracle.

10. Identity resolution and split custody

Argued at /identity/

Ref	Level	Requirement
SP-70	MUST	Set membership be decidable locally, in real time, offline, without learning which device an identifier belongs to.
SP-71	MUST	Identity resolution require both a judicial order and an independent key custodian, such that neither can resolve an identity alone.
SP-72	MUST	The key custodian be organizationally separate from both the operator and the supervising agency - not merely a separate system operated by the same party.
SP-73	MUST	Every resolution and every refused attempt write an immutable audit record.
SP-74	MUST	Any exigency exception name the class of circumstances, name the official who may invoke it, notify the reviewing court within 24 hours, and write the same audit record.
SP-75	MUST NOT	An exigency path exist without a time limit and a review. That is the architecture defeated by its own exception.
SP-76	MUST	Published material describe the system as pseudonymous with a trusted matching party, and never as anonymous.
SP-77	MUST	Published material state that an operator who observes a person while capturing their identifier has bound the two by direct observation, and that no cryptography prevents this.

11. Isolation and the console

Argued at /isolation/

Ref	Level	Requirement
SP-78	MUST	Observations and keys be held in separate trust domains under separate organizational control.
SP-79	MUST NOT	Any single domain compromise yield an identity bound to a location.
SP-80	MUST	The audit store be append-only and separate from every domain it records.
SP-81	MUST	The console refuse, in code rather than by policy, any query that would resolve an identity without the two-party authorization.
SP-82	MUST	Every refusal be logged as visibly as every grant.
SP-83	MUST NOT	Separation be claimed on the basis of containerization alone. Containers on one host share a kernel, and a custodian that is a different container in the same organization is not a custodian.
SP-84	MUST	Egress be default-deny between domains, with the permitted flows enumerated.
SP-85	SHOULD	The console be operable with the identity path entirely unavailable, so that losing it degrades the system rather than stopping it.

12. The voluntary attestation bracelet

Argued at /bracelet/

Ref	Level	Requirement
SP-86	MUST	Enrollment be voluntary, wearer-initiated and wearer-revocable at any time without giving a reason.
SP-87	MUST NOT	Wearing be compelled, or made a condition of employment, tenancy, education, benefits or access to any public place.
SP-88	MUST	The wearer hold their own keys, and be the only party who can disclose an attestation.
SP-89	MUST	Disclosure be selective, so that proving one thing does not reveal the rest of the day.
SP-90	MUST NOT	The device broadcast identity or location, carry a microphone or camera, or accept a remote command to open an audio or video channel. These are absent from the bill of materials, not disabled in software.
SP-91	MUST	A duress mechanism exist that does not signal its use to a person standing next to the wearer.
SP-92	MUST NOT	Any attestation claim the absence of an event the device has no sensor for.
SP-93	MUST	Changes to any linked party be visible to all existing linked parties and take effect only after a delay.
SP-94	SHOULD	The wearer be able to export and destroy their own record independently of the operator.

13. Devices

Argued at /devices/

Ref	Level	Requirement
SP-95	MUST	The subject's device detect strap breach by continuity, wear by skin contact and temperature, and being worn by motion coherence.
SP-96	MUST	The subject's device carry its own network radio and not depend on any device the subject controls.
SP-97	MUST	Both devices buffer events they cannot transmit and upload them on reconnection.
SP-98	MUST	Every buffered event be labeled with its true age when delivered.
SP-99	MUST NOT	A buffered event be presented as current.
SP-100	MUST	Loss of all received signals in a location with prior coverage be recorded as an event in its own right.
SP-101	MUST NOT	Any implanted device be used. A passive implant has no power, no positioning and no radio range, and cannot perform this function.
SP-102	SHOULD	The child's band achieve a five to seven day charge interval; a band charged daily will not be worn.
SP-103	SHOULD	The child's band carry no screen, name or branding that marks the wearer out.

14. Power and availability

Argued at /operations/

Ref	Level	Requirement
SP-104	MUST	The charging obligation be stated in the subject's conditions with a specific window and duration.
SP-105	MUST	A dead battery on the subject's device be defined in the order as a compliance event with a written response.
SP-106	MUST NOT	A dead battery on a child's band ever be treated as a violation by anyone.
SP-107	MUST	Both devices warn before power loss, and the guardian be told when a band goes offline.
SP-108	SHOULD	Repeated discharge patterns be addressed through supervision rather than through the device.

15. Anchor security

Argued at /anchor-security/

Ref	Level	Requirement
SP-109	MUST	An anchor and the network mutually attest, so that a stolen or cloned anchor is detectable and revocable within minutes.
SP-110	MUST	The current-interval enrollment set be held in a secure element and never in extractable storage.
SP-111	MUST	Opening the enclosure zeroize all key material and report the event.
SP-112	MUST	Neighboring anchors cross-check each other's presence and attestation, so a hostile device introduced into a zone is noticed by the ones around it.
SP-113	MUST	An anchor reporting implausible detection volume be quarantined automatically - which is also the defense against replay injection.
SP-114	MUST	Penetration test results for the anchor be published. It is the most accessible attack surface in the system and should be the most publicly scrutinized.
SP-115	MUST NOT	An anchor hold any identity, any history beyond the current interval, or any key that resolves anything.
SP-116	MUST	Published material state that a rogue anchor which merely listens is a passive harvester of rotating identifiers, and that no attestation scheme prevents someone building a receiver from published parts.
SP-117	SHOULD	The backend operator be contractually named and independently penetration-tested, given that tens of millions of comparable devices funnel through a handful of shared backends.

16. Accessibility

Argued at /accessibility/

Ref	Level	Requirement
SP-118	MUST	Haptic and visual alerting be equivalent to any audible channel, not secondary to it.
SP-119	MUST	Alerting for children with cognitive or developmental disabilities be designed with that population rather than adapted for them afterwards. They are at markedly elevated risk of abuse.
SP-120	MUST NOT	Any alert reaching a child rely on a sudden loud sound. A loud noise is not a neutral intervention.
SP-121	MUST	Guardian alerting offer channels other than a smartphone application, and be available in the languages the jurisdiction serves.
SP-122	MUST	Accessibility requirements appear in the procurement specification. Requirements that are not specified do not survive contact with a vendor.
SP-123	MUST	Published material state the principle plainly: a protective system that works less well for the children at highest risk has inverted its own purpose.

17. Evaluation and measurability

Argued at /evaluation/

Ref	Level	Requirement
SP-124	MUST	The evaluation be pre-registered before deployment, with named primary outcomes, a comparison group and a public analysis plan filed before the first device ships.
SP-125	MUST	Primary outcomes be limited to what the system can move: false-alert rate by tier, officer response rate, absconding, registration compliance, and the warned-and-turned-back ratio.
SP-126	MUST NOT	Reoffending be presented as a primary outcome. Base rates are low enough that no realistic pilot can detect a change in it.
SP-127	MUST	The minimum aggregate telemetry that makes the system evaluable be specified up front, and be shown not to reintroduce a location database.
SP-128	MUST	An independent adversarial review covering the exigency path, anchor spoofing, replay injection and stalking inversion be completed before any pilot, with results published.
SP-129	MUST	The program state in advance what evidence would count as it having failed.
SP-130	SHOULD	An oversight board publish quarterly metrics and hold the authority to suspend the program.

18. Operations

Argued at /operations/

Ref	Level	Requirement
SP-131	MUST	Firmware be rolled out in stages and the version recorded against every encounter.
SP-132	MUST	Staleness of a band's copy of the key list be a monitored condition rather than a silent degradation.
SP-133	MUST	Enrollment, tier, term and audit history transfer with a subject who moves between jurisdictions.
SP-134	MUST	The program end for a subject who moves somewhere the order is unenforceable, and say so rather than claim a coverage it no longer has.
SP-135	SHOULD	Fleet health - reporting, silent over 24 hours, strap events - be reviewed daily.

19. Due process, audit and exit

Argued at /due-process/

Ref	Level	Requirement
SP-136	MUST	Every tier 3 and tier 4 event produce a record the subject is entitled to obtain, including the classifier inputs that produced it.
SP-137	MUST NOT	That record disclose the child's identity or location history.
SP-138	MUST	A written challenge route exist with a deadline binding on the authority as well as on the subject.
SP-139	MUST	Fix quality, device health and firmware version at the time of an encounter be disclosed to a subject contesting it.
SP-140	MUST	An overturned alert be removed from the repeat count that feeds the ladder.
SP-141	MUST	Every read of the encounter store be written to an append-only audit log.
SP-142	MUST	A subject be able to obtain their own portion of that audit log.
SP-143	MUST	A petition for removal exist, with published criteria and published grant rates.
SP-144	MUST	Records be destroyed on exit, with a certificate issued to the subject.
SP-145	MUST	Alert accuracy be published in aggregate at least quarterly, classified by cause.
SP-146	SHOULD	Median time from alert to human action be tracked weekly as the program's leading failure indicator.

---

Open questions this document does not answer

A specification that claims to have settled everything is not finished, it is unexamined. These are open:

• Radio choice. Bluetooth LE gives range and battery life but is trivially detectable; ultra-wideband gives far better distance accuracy at a power cost a small band may not survive. The dwell thresholds in this document assume distance accuracy the radio may not deliver, and that assumption has not been tested.
• The proximity oracle. Local matching requires publishing keys, and publishing keys lets anyone build a detector. Regional partitioning and attestation narrow it. Nothing eliminates it without moving matching to a server, which reintroduces the central location database. Whoever adopts this has to choose knowingly.
• Whether the child-side device is adopted at all. Every figure in the coverage model is multiplied by the share of children carrying a working, charged band. That share is not a technical parameter, and no amount of engineering sets it.
• Cost. Nothing in this document is costed. Hardware, network, monitoring center staffing, hearings and appeals are all real and none is estimated here, because an invented number would be worse than an absent one.
• Whether the assessment instrument is good enough. The tier feeds the ladder. Validated actuarial instruments have known and published error rates, and this design has not been tested against what those errors do to alert quality.