Constitution
What this can never become
Most of what follows is already true. Each article names the thing that keeps it true — a gate that fails the build, a test that would go red, a shape in the content model with nowhere to put the thing it forbids.
13 of these are enforced: a named check fails if the article is broken. 2 are undertaken, meaning no code can prove them — they bind the people who keep this, not the program. The difference is marked on every one, because a promise that claimed to be enforced and was not would be worse than no promise.
- Ienforced
Nothing about a reader leaves their device.
No analytics, no telemetry, no error reporting, no third-party request of any kind. The page paths here are things like /passages/psalm-34-17-19 and /traditions/buddhist: a log of them is a record of what somebody believes, or is looking for, at the moment they were least able to defend themselves. Fonts are self-hosted for this reason and no other.
Held bye2e/values.spec.ts — "no request ever leaves the origin"; and no analytics, tracking or error-reporting package may appear in package.json
- IIenforced
No accounts, no identity, no profile.
Nothing about a reader exists to be lost, sold, subpoenaed or leaked. What you keep is kept on your device. This is why /saved offers a file and a link instead of a login: that is the whole of what an account would have bought.
Held bye2e/values.spec.ts — no email or password field, no cookie, and nothing in storage but the theme; and no authentication package may appear in package.json
- IIIenforced
Nothing a reader writes is stored or transmitted.
Anywhere this collection offers a place to write, what is written stays in the browser and then goes. It is never sent, never saved, and never recoverable — including by us.
Held byscripts/constitution.ts — any reader-facing text input outside the admin must be covered by a spec asserting zero network requests and empty storage
- IVenforced
The library presents; the reader concludes.
Nothing here compares, ranks, harmonises or adjudicates traditions. A curator cannot write “notice how this echoes the Stoic view” because the content model has nowhere to put it. The rule is a type error rather than a discipline.
Held bylib/schema.ts has no field for it; lib/tone.ts and pnpm lint:copy catch the wording; the colophon review catches the shape of the argument
- Venforced
Nothing is optimised for engagement.
No streaks, no counts, no goals, no notifications, no endless scroll, no nudge to come back. Every sequence here ends, and reaching the end is the expected outcome rather than a failure to engage. An app about peace whose loss function is attention becomes an anxiety machine; that is not a hypothesis, it is what every feed does.
Held bypnpm lint:copy urgency and streak patterns; LENGTH in lib/feed.ts; e2e/feed.spec.ts — "nothing loads when you reach the bottom"
- VIenforced
Nothing interrupts.
No modal, no popup, no interstitial, no autoplaying sound or video, no request for notifications, location or any other permission. A reader is never asked for anything they did not come here to give.
Held bye2e/values.spec.ts — "no page interrupts the reader" and "nothing asks for permissions or attention"
- VIIenforced
Nothing publishes without its source and settled rights.
Every text carries its translator, edition, licence and the address it was checked against. A source whose rights are unresolved fails the build rather than appearing.
Held bypnpm validate:content gates, proven to fire by pnpm test:gates
- VIIIenforced
A label says what a thing is, never whether it works.
“A divination practice” is the whole of what this collection asserts about a horoscope: no hedge, no “some people believe”, no wink. Scripture is not hedged either. The same restraint applies to both, or it is not restraint.
Held bycomponents/EpistemicLabel.tsx renders it above every passage; pnpm lint:copy; e2e/values.spec.ts — every tradition on a shelf is presented identically
- IXenforced
A reader's refusal of a kind of content is absolute.
Somebody who says they do not want scripture, or divination, or research, is not shown it — with no exploration override, no “you might like”, and no exception. Nothing is removed from the library for anyone else.
Held bylib/preferences.ts applied before paint; e2e/preferences.spec.ts
- Xenforced
Help is always one click away.
A visible route to the crisis note exists on every page, including the ones that hide the site's chrome. Somebody who arrives here in the worst hour should never have to navigate to find a phone number.
Held bye2e/values.spec.ts — "no page is a dead end, and the crisis note is always reachable"
- XIenforced
Everything here can be read on paper, and kept without an account.
Print styles apply everywhere, cards can be cut out, and what you keep can be written to a file. Nothing in this collection may require the app in order to be read.
Held bye2e/print-share.spec.ts and e2e/transfer.spec.ts
- XIIundertaken
Nothing here is advertised, sponsored, or sold — including attention.
No advertising, no sponsored placement, no affiliate link, no sale or sharing of anything about anybody. Article I already makes an ad network technically impossible, which is the kind of accident worth keeping.
Held byNothing in code can prove a future intention. Article I is the practical guard.
- XIIIenforced
Nothing a machine wrote reaches a reader unless a person has passed it.
What a reader reads here is reproduced from a source with its provenance, or written by a person, or — in exactly one field — drafted by a model and then read, corrected and signed off by a person before any reader can see it. That field is `taughtMe`, and it was opened deliberately: the curator wanted a note on each passage saying what it taught somebody, and asked that drafts be marked as machine-written and human-verified rather than passed off as a person's own. Marking them is not a disclaimer, it is the condition. An unverified draft is not published, not previewed and not reachable — it does not exist as far as the site is concerned — and a verified one says on the page that a model wrote it and a person passed it. Nothing else in the collection may be machine-drafted: not a passage, not a context note, not a framing question, not a colophon note. The earlier form of this article forbade machine text outright and was held by editorial discipline alone; this one permits less than it appears to and is the first version a build can actually enforce.
Held bylib/content.ts refuses to publish a taughtMe that is drafted and unverified, or verified without a named person, or drafted without saying by what; proven by gate fixtures in scripts/test-gates.ts. components/Taught.tsx renders nothing that is not passed, and states the provenance of everything it does render.
- XIVundertaken
This is a library, not care.
It will never present itself as therapy, treatment, diagnosis or a service, and will never attempt to detect anyone's state and respond to it. Where somebody engages heavily with grief, the correct response is not more grief.
Held byThe About page says so in as many words. The density cap on heavy content is the one part a machine can hold.
- XVenforced
A text is never abridged where it is given to be read.
No reading surface shows part of a passage as though it were the passage. An index may excerpt, marked as an excerpt — the catalogue and the concept pages do — because a list of what exists is not a place anybody reads. Everywhere else the text arrives whole. This article exists because the front door broke it for months: the feed rendered the first three paragraphs of every passage with no ellipsis and nothing to say a text had been cut, and it was not a random third that went missing. It was the last one, and these texts turn at the end. A reader was shown the second arrow striking and not the disciple struck by one only; Ānanda's grief and not "live as your own island"; "a time to kill" and never "a time for peace". Somebody arriving in difficulty was handed the setup and refused the turn, and had no way to know anything was missing. That is a worse failure than showing them nothing, because it looks like an answer.
Held bye2e/feed.spec.ts — "a passage on the front door is the whole passage", which checks the day's real cards paragraph by paragraph; and an invariant in scripts/test-invariants.ts that scans every reading surface for a paragraph cap, because the browser test can only see the passages that day happens to draw
The exceptions
Named here rather than left to be discovered. A constitution with unstated exceptions is worth nothing.
- The admin holds a password and a session cookie.
- It is for whoever maintains this collection, it is not part of the library, and it holds nothing about any reader. Articles I and II are about readers.
- The colophon review sends the curator's own writing to a model.
- From the server, never a reader's text, and never on a reader's request. It is how the house's writing is checked against Article IV.
Amendment
An article may only be removed by a change that also removes the check holding it, and that records the removal in the colophon. Weakening this is never a silent diff: deleting a promise costs you deleting the test that proved it, in the same commit, in public. An article may be narrowed rather than removed, on the same terms and with one more: a narrowing must leave the article at least as enforceable as it was, so that what a promise gives up in scope it repays in proof.
What has been amended
Article XIII
Was: No machine-written text enters the collection.
Now: Nothing a machine wrote reaches a reader unless a person has passed it.
The curator wanted a note on each passage saying what it taught somebody, wanted those drafts written by the assistant, and asked that they be marked as machine-written and human-verified rather than presented as a person's own writing. The old article forbade that outright. Rather than ignore it, it was narrowed — and the narrowing bought enforcement: the article was `undertaken` and held by editorial discipline, and is now `enforced`, because an unverified draft reaching a reader is a thing a build can detect. The permission is one field wide and everything else is still forbidden.
About says what this collection is. The colophon is where changes to any of this would be written down.