Part II, The Citizen Layer

Derived from Axioms 1 (sovereignty), 7 (verifiability), 12 (subsidiarity), 14 (minimal complexity), and the consent precondition of §0.2. This is how a real person becomes a verified, sovereign participant, without the system becoming a surveillance state.

The Citizen Layer is the base of the whole model: the mandate (Part III) and verifiability (Part VIII) are only as trustworthy as the answer to "is each participant a real, unique, eligible person, freely expressing their will?" Getting this right, securely and privately and inclusively, is the hardest single engineering problem in the design, so it is specified first.

II.0 What the system asks of a citizen

A complete governing system is large, but the demand it places on an ordinary citizen is deliberately small, and smaller than today's. In daily life a citizen:

• votes by ranking candidates on one ballot (Part III), with no tactical calculation to perform;
• occasionally votes in a referendum on a genuine question of values, after an independent, plain-English brief (§II.4-II.5);
• may, perhaps once in a lifetime, be selected by lot to sit on an assembly or jury (§II.3), paid, briefed, and supported;
• can verify the things that matter, that their vote counted, that public money went where it was said, with tools any citizen can run (Axiom 7), but is never obliged to.

That is the whole of the routine obligation. The machinery behind it is intricate because governing a country is intricate; the citizen-facing surface is not. This distinction, system complexity is not user complexity, is how the design meets Criterion 11, alongside the one-page Citizen's Charter (§I.1), the whole-model map (§0.8, the entire architecture as 1·5·4·4·3 — one promise, five powers, four acts, four levers, three locks), and the plain-English duty (§0.7). The claim is counted, not asserted: a citizen holds sixteen concepts to grasp the whole (docs/COMPLEXITY.md); everything deeper is drill-down for those who run or audit the system.

II.1 Secure digital identity, the foundation

Every citizen has a state-guaranteed digital identity that proves three things and no more: that they are real, unique (one person, one identity, sybil-resistant), and eligible for a given action. The design is governed by four hard requirements that are normally in tension, and a workable solution has to satisfy all four at once:

1. Sybil-resistant, impossible to manufacture fake or duplicate citizens.
2. Privacy-preserving, the state can verify eligibility without learning what you did. Identity must not become a single key that links all your activity. This is forbidden by the privacy/data rights in §I.3.
3. Inclusive, works for citizens without smartphones, without internet, with disabilities, and offline (Criterion 12). No one is excluded by the technology.
4. Verifiable, any citizen can confirm the system is behaving correctly (Axiom 7).

The architecture that achieves this (detailed in Part VIII):

• Separation of powers, applied to data. The body that issues identity is institutionally and technically separate from the body that records votes or delivers services. No single database links a person to all their actions.
• Zero-knowledge eligibility proofs. A citizen proves "I am an eligible voter who has not yet voted" without revealing who they are. Cryptography lets the system check the claim without storing the link.
• Unlinkable credentials. Separate, non-correlatable credentials per domain (voting, services, participation) so activity cannot be aggregated into a profile.
• Citizen-held keys, state-backed recovery. The citizen controls their identity; a robust, abuse-resistant recovery process (multi-party, audited) prevents permanent lock-out without creating a master backdoor.
• Mandatory offline equivalent. A physical credential and in-person process that delivers the same rights as the digital path. Digital is a convenience, never a gate.

Forbidden by design: a single, linkable national ID that tracks citizens across all activity. That is the surveillance-state failure mode, and §I.3 makes it unlawful. The identity layer proves eligibility, not behaviour.

The one genuine tension, named not hidden. Requirements 1 (uniqueness) and 2 (no linkage) pull against each other: proving "one person, one identity" needs some canonical enrolment root, which is in principle a master record. The model does not assert both away; it resolves the tension concretely (§VIII.2) — the uniqueness check runs on one-way commitments never queried after issuance (split custody, sunsetted templates), so uniqueness is established without leaving a surveillance graph. And because strong uniqueness needs a strong enrolment, that enrolment is itself governed by separation of powers and public roll-reconciliation (§VIII.2), so the issuer cannot quietly become the demos chokepoint (it sets both the numerator and the denominator of every threshold, §XIX.5).

II.2 The franchise, who participates

1. Voting age: 16, paired with mandatory civic education (§II.6). Why: 16-year-olds are bound by the state's decisions for the longest, are old enough for considered civic judgement (Scotland and several democracies already enfranchise them), and earlier enfranchisement raises lifelong participation. It is a deliberate choice favouring intergenerational fairness (Axiom 13).
2. Eligibility: citizenship + a residency/registration test, verified once via the identity layer; automatic registration (the state knows who is eligible and registers them, non-registration is a state failure, not a citizen's).
3. Minimal disenfranchisement. Because power flows from the people (Axiom 1), removal of the vote is exceptional, never automatic, and never a tool of punishment beyond narrowly defined, Court-reviewable circumstances. (The right to vote is itself Class A, §I.3, so any removal is only by individual court order tied to a directly-relevant matter, never automatic on conviction.)
4. Due process at the gate, and no exclusion by refusal. Because eligibility runs through issuance of a state identity, the issuer must not become a chokepoint on the franchise: disputed citizenship, statelessness-in-fact, the undocumented, and those with no fixed address receive an independent, fast, appealable adjudication of eligibility and of any issuance refusal, separate from the government of the day (§VIII.2). The residency test accommodates the no-fixed-address citizen, and enrolment cannot be silently repurposed into surveillance by a future government (structural guarantees, §VIII.2) — so a citizen is never forced to choose between participation and a privacy objection.

II.3 Three modes of participation

The people exercise sovereignty through three complementary channels, each chosen to cover the others' failure modes:

The key innovation: combining election (B legitimacy + accountability) with sortition (immune to campaign money, lobbying, and re-election incentives). Election and lot are the only two legitimate ways to select people for power; using both, each checking the other, is stronger than either alone. The standing Citizens' Sortition Chamber is constituted in Part IX as the second chamber.

*Representative and private. Stratified sortition appears to need the demographic-to-person linkage the identity layer forbids. It is reconciled by privacy-preserving stratified sampling: the identity layer issues zero-knowledge demographic attributes (age band, region, and the like) without revealing identity, selection runs against aggregate quotas, and verified respondents self-present — so the sample stays demographically representative, and verifiably so, without any central demographic-to-person database (§VIII.2, §VI.3a). Sortition is also immune to money; it is defended against information capture* by the adversarial-briefing rules of §VI.3 and §XIX.6.

II.4 Bounding direct democracy (so it is consent, not mob rule)

Direct democracy is powerful and dangerous. It is bounded so it expresses informed, considered consent (§0.2) rather than transient passion:

1. Rights-checked, narrowly. No referendum or initiative may breach Class A rights, and the Court screens proposals against the Charter before they go to vote — but this pre-vote screen is confined to *Class A / core breaches and proposals that facially strip a qualified right with no proportionality justification. Ordinary Class B limitations are not blocked pre-vote; they proceed and are tested post hoc* under the §I.3.1 gate (where the burden is already on the state). Refusals are reasoned, published, fast, and appealable to the Court (a legality question the Court is competent on — the constitutional-convention procedure of §I.9.4a is reserved for core-boundary and extraordinary-amendment questions, not routine initiative screening), so an anticipatory screen cannot become an unelected agenda-veto over what the people may even ask themselves.
2. Deliberation required. A mandatory cooling-off + Citizens' Assembly review precedes any binding referendum, so the public decides after deliberation, not in a flash of feeling.
3. Thresholds for initiative. Citizen-initiated proposals require a meaningful, geographically distributed signature threshold (verified via the identity layer) to prevent narrow or astroturfed capture. The tally is de-duplicated (one signature per verified citizen) and geographically apportioned without a linkable per-citizen activity record — a privacy-preserving petition protocol (§VIII.2, §XIX.5) — so "un-astroturfable" does not come at the cost of a surveillance trail.
4. Truthful-information duty. An independent public-information function (§II.5) must publish a balanced, fact-checked brief to every voter before the vote.
5. Validity conditions (turnout / approval quorums). A binding direct vote is valid only if it meets a published participation condition set by decision type: constitutional or core-adjacent changes require a supermajority of eligible (not merely cast) votes plus a participation floor (§I.9.3, §XV.2a); ordinary binding referenda a defined quorum. To avoid the perverse incentive by which a pure turnout quorum rewards a boycott, the condition is expressed as an approval quorum — a minimum yes-share of the whole electorate — rather than raw turnout, which is exactly the whole-electorate-share floor operationalised in §XIX.5.

II.5 Civic information rights, the precondition of informed consent

Consent obtained through ignorance or deception is not consent (§0.2). Therefore:

1. Citizens have a right to truthful information from the state (§I.3) and to the reasoning behind decisions.
2. An independent Public Information function (constituted under the Integrity Assembly, Part VI) provides balanced, evidence-based briefings before every vote and publishes a continuous, neutral account of what the government is doing and why.
3. Counter-disinformation is handled by transparency and verifiability, not censorship (which would breach §I.3 expression). The state floods the zone with verifiable truth and provenance; it does not decide what citizens may say. (Mechanism in Part VIII.)

II.6 Civic education

A standing, non-partisan civic-education entitlement: how the system works, how to verify it, how to reason about evidence and trade-offs, and media/disinformation literacy. This is the enabler of the age-16 franchise and of Criterion 1 (informed legitimacy). It is curriculum-independent of the government of the day (overseen by the Integrity Assembly) so it can never become state propaganda.

II.7 Inclusiveness, no citizen excluded by the technology

Criterion 12 is a hard requirement, not an afterthought:

• Every digital civic action has a non-digital path (in person, by post, assisted) that is first-class in rights and weight. Honesty requires naming the one limit: for a blind, low-literacy, or assisted voter, individual verifiability and receipt-freeness cannot both be fully preserved (confirming "cast as intended" means trusting the assistant, who then learns the vote), so the offline path trades some individual cryptographic verification for access — compensated by tactile/audio independent verification devices, two-official witnessed assistance, in-person supervised booths as the coercion-safe default, and universal (aggregate) verifiability via risk-limiting audits. "Equivalent in rights", yes; "identical in every cryptographic property", honestly not (§VIII.3).
• Accessibility (disability, language, literacy) is built in, not bolted on; participation is measured by channel and demographic (§VI.7) so any drift toward a two-speed citizenry is visible and correctable, not assumed away.
• Digital exclusion never reduces a citizen's rights or weight; the offline citizen is a first-class citizen.

II.8 Failure modes and safeguards

Part II ends. Next: Part III, The Electoral System.