Facilitator
Runs the meeting and the process. Never controls the agenda alone — that's how a facilitator quietly becomes a chairman.
Everyone else gets the light switch. This is for stewards, delegates, and safety reviewers — the people who keep an Orbit from quietly mutating into the thing it formed to fight. It's long on purpose, because the boring parts are load-bearing. Nobody is ever forced to read it to participate. But if you're going to hold power in here, you should know exactly how little of it we're going to let you keep.
Capped at 25 so it can run on actual consensus instead of Robert's Rules and resentment. Above roughly that number, humans stop trusting and start delegating trust to procedure — and procedure is exactly what gets captured. Five standing roles do the work, and every one of them rotates every 90 days.
Runs the meeting and the process. Never controls the agenda alone — that's how a facilitator quietly becomes a chairman.
Maintains the Transparency Log and publishes within 24 hours. Cannot keep things off-log without supermajority approval. The institutional memory, deliberately not vested in one skull.
Holds the keys, executes the two-signature rule. Never unilaterally decides spending. Money is the most common vector for capture, so it gets the most friction.
The outward face. Vouches for newcomers, maps relationships. Does not speak to media without an explicit mandate — a spokesperson nobody appointed is just a leak with a haircut.
Approves invitations, watches for infiltration, audits opsec, runs the confirmation vote for probationary members. Reports concerns — never acts as police.
Represents the Orbit at an Assembly or Delegation with a written mandate. Instantly recallable. Must have an Alternate.
Attends Assembly meetings and steps in the second a Delegate is compromised, burned out, or bought.
Coordinates a temporary task force. Holds zero authority over the parent Orbit.
Calls a specific meeting and drafts its preliminary agenda. That's the whole job — it ends when the meeting does.
Exclusive right to invite for the first 30 days, or until the Orbit hits 5 members — then drops to a regular member. Founding is a phase, not a title you keep.
30-day read-only period. Can discuss; cannot vote, see pre-join history, serve as delegate, or vouch for anyone.
Voting rights, can hold roles, serve as delegate, vouch, and read full history. A verified node in the trust graph.
Stripped of all powers pending a recall vote or investigation. Limbo, not exile.
There is no discover tab, no follower count, no "people you may know." Orbits are invisible by default, and enlistment mirrors how trust actually forms in the physical world: somebody who already has it stakes some of theirs on you.
The default. The Orbit is unknown outside itself. As far as the rest of the network is concerned, it doesn't exist.
Other Orbits can see that it exists — e.g. "Warehouse Orbit 3" — but get no details, no roster, no content.
Rare, and only for genuinely public-facing work. Even then, member identities stay hidden.
None of it at this stage. The less we hold, the less there is to subpoena, leak, or weaponize. Data you never collected is the only data that's truly safe.
Applicant submits an encrypted form, receives a hashed handle, and sees a welcome page and FAQ. No Orbits, no content, nothing to scrape.
Named an inviter? They're pinged to vouch, decline, or ignore — auto-expires in 7 days. No inviter? You land in a pool visible only to founders in your location/vocation affinity, who can claim and vouch for you.
Once vouched, a blind suggestion is made from hashed location, schedule, theme, and capacity. You see only: "There's an Orbit of 8 in your department working on scheduling. Join?" No handles until you accept. No match? You're offered the chance to found one.
30-day read-only membership. You can discuss, but you can't vote, serve as delegate, or read history from before you joined.
An Orbit confirmation vote (simple majority) grants full history, voting, vouching, and turns your handle into a verified node in the trust graph.
A graph metric, not a vibe: how many of your vouches turned into confirmed members? Vouch for someone who's later ejected as a spy and your vouching privilege in that Orbit is revoked, with the oversight flagged. Over time the signal compounds — who's been in the most Orbits, invited the most people who stuck, delivered on the most mandates. Trust you can audit instead of trust you have to take on faith.
Location and vocation data is hashed and salted. Server admins see tags, never the raw truth of where you sleep or clock in.
No real names in the UI, ever. The client warns you the moment it thinks you typed one.
Accounts inactive for 90 days are archived and their vouching powers suspended. Stale trust is a liability.
Hard limit of 25. At capacity, the platform stops nagging and starts nudging you to split.
Burnout isn't a personal failing; it's a design failure that the platform is responsible for preventing. So commitment is metered. You can subscribe to a hundred Orbits and still owe real work to almost none of them.
Receives updates. No voting, no obligations. Does not count toward the Orbit cap.
Signs petitions, attends public events, donates, amplifies. No internal governance role. Doesn't count toward core capacity.
Takes one-off tasks, joins work sessions, comments on proposals. May have limited voting; holds no standing roles.
Counts toward the cap of 25. Full voting, expected at meetings, can hold roles, subject to rotation and recall.
Holds a defined role. Higher accountability — and explicitly told not to overcommit across Orbits.
Default: 1 primary Orbit, up to 2 contributor Orbits, unlimited observer/supporter subscriptions. Max 2 active role assignments — you cannot be Scribe in two places at once. Two primaries is allowed only if neither holds a critical standing role, and it gets reviewed every cycle.
Everyone self-declares a weekly capacity — Low (1–2h), Medium (3–5h), High (6–10h), Surge, or Unavailable. Try to join something that blows your budget and the system warns you. A commitment ledger shows every active tie in one place, so "I didn't realize I'd said yes to that much" stops being a thing that happens.
1 primary Orbit · 2 contributor · 2 active roles · 3 active tasks
1 primary grievance · 2 supporting objectives · unlimited parked ideas
A few major active campaigns · everything else parked or watched
Short, intense, time-boxed. 1–6 weeks, frequent meetings, a clear end condition.
Medium-term. 2–6 months, regular cadence, milestone-driven.
Long-term maintenance. Ongoing, low cadence, durable documentation.
Each Orbit also carries a cadence class — Dormant, Watch, Monthly, Biweekly, Weekly, Sprint, Emergency — and a definition of "done." Every grievance Orbit names its end condition up front: heat restored, written repair timeline obtained, the mayor recalled. Long campaigns break into milestone gates where members recommit, drop to contributor, or rotate out. This is the machinery that kills "forever Orbits" before they fossilize into little institutions.
Primary membership is a term, not a life sentence — 2 weeks for sprints, 6 for campaigns, 3 months for stewardship. At term end you renew, rotate out, drop to observer, transfer your commitment, or rest. Every Orbit keeps a small trusted core and a broad low-friction periphery, plus a bench of people who'll sign a letter or attend an inspection without going primary. Specialist pools — legal, translation, press — let skilled people help many Orbits without joining them all. Stepping back is normal. Guilt is not a recruiting tool.
Issues move through states — Idea → Intake → Watch → Parked → Active → Blocked → Resolved → Archived — scored on urgency, harm, number affected, winnability, capacity burden, and strategic value. A structured score so groups argue about the right things instead of whoever's loudest in the chat.
The moment two Orbits need each other, the temptation is to merge upward into something with a leadership. RORBT routes around that with layered, recallable, sunset-dated structures that coordinate but never command.
Instead of blocking duplicate Orbits, the platform detects possible overlap and offers a privacy-preserving delegate channel — opened only by mutual consent. Through a minimal disclosure protocol, delegates work out whether they're doing the same thing, complementary things, or unrelated things, then choose to stay separate, coordinate loosely, or form a Delegation.
A lightweight, issue-specific coordination structure. Each Orbit sends a recallable delegate with a written mandate. It can align timelines, share non-sensitive updates, draft shared proposals, and prep public statements. It cannot command Orbits, expose members, merge without consent, or spend without approval. Mandatory sunset date, regular review.
Broader, longer-term coalition structures spanning multiple campaigns. Same delegate principle: Orbits send mandated delegates; the Assembly coordinates but never governs the Orbits. It can charter Delegations as sub-structures for specific fights. No Orbit may hold more than 25% of an Assembly's steward roles, and the Safety Steward and Convener must come from different Orbits — diversity enforced in math, not goodwill.
Everything is infrastructure-as-code (Terraform) for portability. If a provider folds, gets leaned on, or decides we're a liability, the entire stack redeploys to a new one in under an hour. The protocol survives the app; the app survives its landlord.
Encrypted comms, DMs and group chat with members, on-the-ground coordination, voting, Orbit updates, reading logs. The thing in your pocket at 6am outside the gate.
The deep-work surface: facilitation, record-keeping, treasury review, council coordination. The justification for a keyboard in 2026.
An orchestration console for delegates and security roles. Monitors network health without ever violating member anonymity.
User: handle, public_key, hashed_location_tags, hashed_vocation_tags,
join_date, trust_score, capacity_budget
Orbit: orbit_id, theme_tags, max_size(25), founder_id, creation_date,
visibility, campaign_mode, cadence, status
Membership: user_id, orbit_id, tier(observer/supporter/contributor/
primary/roleholder), joined_date, term_end
Commitment: user_id, orbit_id, role, weekly_hours_pledged, status
Vouch: vouch_id, voucher_id, applicant_id, status, expiry
AffinityBridge: bridge_id, scope_id, requesting_orbit, matched_orbit,
status, visibility, outcome
OrbitDelegation: delegation_id, scope_id, name, purpose, status,
visibility, review_at, sunset_at
Assembly: assembly_id, scope_id, charter, status, review_at, sunset_atStructural prevention beats reactive moderation every time. The goal is to make the platform unattractive and frankly unusable for extremists, accelerationists, violent sectarians, and coercive creeps — while keeping ordinary democratic organizing dead simple. The bouncer is the architecture, not a content team drowning in a queue.
Prohibited: advocacy or planning of violence, threats, weapons coordination, sabotage, terrorism support, targeted harassment, doxxing, hate organizing, dehumanizing rhetoric, recruitment for extremist orgs, instructions for violent or illegal harm, coercion, intimidation.
Permitted: civil disobedience and protest discussion — provided it stays nonviolent and contains no plan to injure, threaten, stalk, or terrorize anyone.
These live in the governance kernel, not buried in a Terms of Service nobody reads. Every Assembly and Orbit must affirm them. You cannot opt out of the part that keeps this from becoming a militia with a nice UI.
Can onboard, read limited materials, sit in probationary spaces. Cannot create Assemblies, mass-invite, touch money, become a delegate, or moderate.
Can vote, join proposals, participate in approved working groups.
Can sponsor newcomers, draft proposals, hold Orbit roles, serve as delegate.
Can moderate, run treasury workflows, launch Assembly proposals, publish public statements, administer event pages.
No Assembly or Delegation goes live instantly. First it provides a lawful purpose, nonviolence and prohibited-conduct clauses, named safety stewards, delegate and treasury rules, moderation coverage, a public charter, and a sunset clause. Then a safety review. High-risk triggers get deeper human eyes.
No algorithmic amplification. No trending Assemblies, recommended groups, follower counts, engagement leaderboards, quote-dunk mechanics, anonymous mass broadcast, or public member directories. Discovery is always invite, vouch, affiliate request, or manual approval. Outrage doesn't compound here because there's nothing for it to compound in.
You flag behavior, not ideology. Signals include calls for or praise of violence, dehumanizing language, doxxing attempts, weapons references, attempts to move sensitive planning off-platform, rapid cross-Orbit recruitment, coded threats, attempts to bypass consensus or centralize authority, and re-creating a dissolved group under a new name. We're watching what people do, which is the only thing worth watching.
No active concerns. The default.
Signals exist. Increased logging, reduced mass-invite, mandatory steward review for public actions.
Can't create public events, fundraise, mass-invite, or publish without review.
No new members, no public posts, no treasury movement, no events. Internal review only.
Temporarily disabled pending investigation.
Permanently shut down. Rooms archived, public page replaced with a dissolution notice, members notified, evidence preserved.
Severe violations earn permanent bans, enforced through device/session revocation, invite-graph monitoring, hashed identifiers, re-vouch restrictions, and ban-evasion detection. Calibrated to keep the genuinely dangerous out without building a surveillance machine to do it — the cure can't be the disease.
No emergency dictatorship: rotation, recall, transparency, treasury separation, delegate mandates, the anti-violence policy, and the appeal path are all non-waivable. Cooling-off periods gate high-impact public actions. Dissenting Orbits can attach a minority report to major decisions — venting pressure instead of splintering. And everything sunsets unless deliberately renewed.
Treat nonviolence, anti-harassment, anti-terrorism, role rotation, recall, and transparency as constitutional design constraints — not moderation preferences. No group can opt out. An Assembly can't form, a delegate can't be seated, an event can't be published, and a treasury action can't execute unless they accept and satisfy these constraints. Combine that with a capacity model that prevents burnout and an affinity model that prevents duplication, and the platform structurally favors healthy, resilient, lawful organizing. The good outcome isn't policed into existence. It's the path of least resistance.
The back office exists, and pretending otherwise would be its own kind of lie. The honest move is to make it transparent, laddered, and accountable — so the people holding the emergency brake can themselves be checked.
An incident queue with type, severity, evidence snapshots, and assigned reviewers. An entity graph mapping users, vouches, Orbits, Delegations, Assemblies, treasury actions, and reports to surface coordinated abuse. Live interventions: freeze threads, lock event pages, suspend invite chains, revoke delegate powers, pause treasury, quarantine, force re-auth, preserve evidence, broadcast safety notices.
The words on the buttons shape the actions people reach for. So we choose them on purpose.
Every Assembly and Delegation wears its own expiry on its face: "This coordination structure expires in 90 days unless renewed by participating Orbits." Institutions are very good at finding reasons to keep existing. This one has to re-earn its existence on a clock.