Disaster recovery, for civilization.
The knowledge to restart food, water, medicine, power and a working community — in one hand, off the grid, for a decade. A private mesh for your family. Push-to-talk voice and broadcast radio. A beacon that finds you. It charges from its own back, its cells swap in gloves, and every part of it is built to be repaired.
What it does
Everything on the device is reachable with the big nav pad, gloves on. Every answer says where it came from.
Playbooks: checklists and decision trees for bleeding, burns, childbirth, water, fire, a lost person, a trade dispute. Human-reviewed. Zero-power reading.
Locate: a compass arrow while satellites last, the community's own surveyed nodes and a signal sweep after that, and a command that makes the lost device sound and strobe for the last hundred metres.
OFFER Eggs, dozen 0.5 h Maria WANT Chainsaw sharpen 1.0 h Tom OFFER Tomato seedlings 0.3 h Ana OFFER Well pump repair ask Luis
Market board and mutual-credit ledger: offers, wants, a price history, and a balance in hours. Not money. Nothing minted, nothing converted, nobody in the middle.
Knowledge
What it takes to restart: water, fire, shelter, first aid and trauma, childbirth, sanitation, food preservation, seed saving, staple crops, hydroponics, solar and batteries, basic electricity, small engines, navigation, radio. On e-paper, at near-zero power. The library is the truth. The language model is the librarian, and it's rationed — it runs only when search comes up empty, and it tells you what it will cost in battery first.
Keyword search over a two-gigabyte essentials library on the always-on half. Playbooks. Calculators for chlorine dosing, rehydration solution, weight-based dosing, solar sizing, planting dates. Deterministic, reviewed, cited.
Full-text search over the whole library: Wikipedia, WikiMed, field manuals, agriculture and appropriate-technology collections. Then a bank of tens of thousands of pre-written, cited answers. A question is one lookup, under a second, no generation.
A four-billion-parameter model for synthesis and badly phrased questions. It answers only from retrieved passages, quotes dosages instead of computing them, and ends every answer with the article it came from.
Power
Two halves. The always-on half — mesh, radio, reader, beacon, ledger — must live on the panel on the device's back. The compute half is switched off until asked.
No sun for a week: four to five days at that pace, fourteen days if only the radio half runs, and about three days of beacon on the last ten percent of the cells. The cells are LiFePO4 because they survive thousands of cycles; the charger will also take scavenged lithium-ion 18650s in adapter sleeves, because in ten years that's what will be lying around.
Comms
A LoRa mesh that speaks Meshtastic, so your family's devices and a neighbour's node are the same network. A push-to-talk UHF radio that works with the cheap handhelds people already have. An AM, FM and shortwave receiver on a wire you string to a tree.
| Channel | Who | Used for |
|---|---|---|
| Open | Anyone on the same region preset | Discovery, interop, a beacon of last resort |
| Community | Vouched devices, shared key | Market board, ledger, notices, voice notes |
| Family | The kit's devices, shared key | Messages, positions, beacon |
| Direct | One device to one device | Private messages, co-signing, key rotation |
Everything private rides the mesh, where encryption is allowed on the unlicensed band. The UHF voice radio is a party line by regulation, and the manual says so. Keys are exchanged over a pairing cable or a six-digit PIN — no camera, no cloud — and the family's root key lives on a sealed paper card in the case and nowhere else.
Mark it lost. Every other device drops its keys and receives a new family key individually, encrypted to its own identity, so the lost handheld can't read its own replacement. Optionally wipe it remotely; it keeps beaconing in the clear, because being found beats being private.
Find
Beacon on the lost device; Locate on the seeker. The beacon backs off over time because the lost device's battery is the one that matters, and below ten percent it drops everything else to keep transmitting — about three days.
Both devices have satellite positioning: a compass arrow, a distance, the age of the fix. Four constellations, not one, because they'll fail on four different days.
When the satellites go, the community's own mesh nodes at surveyed spots — the well, the barn, the ridge — place a device to about a hundred metres by signal strength. No anchors in range: turn slowly, let your body shadow the antenna, get a rough bearing. Finds someone in a field or a building, not under snow or rubble, and the screen says so.
The last hundred metres: the seeker commands the lost device to blast its speaker and strobe its flashlight, overriding every battery lockout.
There is no citizen-run GPS and there can't be one: positioning satellites need atomic clocks in orbit and a ground segment that uploads corrections every day. When that stops, the receivers stay accurate for about two weeks and useful for months, which is exactly the window when people are scattered. After that, what's left is what worked before 1990: the sky, a clock, and a map. The device carries the almanac and computes sun, moon and star positions itself; the kit carries a plastic sextant; the clock is temperature-compensated and keeps time from satellites while they last, from shortwave time signals while they last, and from the moon after that.
Trade
Every balance starts at zero. A trade is one record signed by both devices; one signature is a proposal, two make it real. You can go negative up to a limit the community sets, and the other person's device shows your balance before it agrees to sign. Nothing to mint, nothing to double-spend, nothing to steal.
Records copy themselves around the community channel and merge, so every device holds the whole history and a lost handheld loses none of it. Membership is a vouch. Disputes are a flag everyone can see and a correction both sides sign. The unit is hours — legally boring before a collapse, and the one thing that still has a price after.
Design perimeter, stated once: no conversion to cash, no operator, no fee, no custody, no token. Before a collapse it's a timebank with a noticeboard.
The Protocol
Channels, beacon, locate, the ledger, vouches, the playbook format, how the clock keeps time — those are rules two devices follow to work together, and they are published as the Civilization Recovery Protocol: open, implementable by anyone, on any hardware, owned by no one.
A family's second device might be a phone running Meshtastic. A community's anchor nodes might be someone else's hardware. A standard nobody owns is the only one a stranger's device will ever speak, and a recovery protocol that only works with one vendor's kit isn't a recovery protocol.
Civilization Recovery Protocol is the standard. Civilization Seed Vault is the kit — the reference implementation, the thing in the case. CIV-SV-01 is the model. The Protocol document is extracted from the spec once the ledger and channel model have survived the prototype's partition test, so the first published version isn't one that has to be retracted.
Built to fix
The cells slide in from the bottom, flashlight-style, behind a cap with one O-ring and a latch you can work in the cold. No screws. No headphone jack — it was the weakest seal on the device. No telescoping antenna — it was the part most likely to break. Spare seals ride in the case, and you inspect the O-ring every time you swap cells.
The kit
Straight answers
A registered 406 MHz PLB reaches satellite search-and-rescue. Nothing here leaves the mesh. If the scenario is "hurt and alone in the backcountry," buy the PLB — the quick-start says so on page one, and the word "emergency" never appears on the beacon screens.
The ledger records credit between people. Nothing is minted, sold, converted or held for anyone. No operator, no fee, no token. The screens say credit and hours, never coin or wallet.
No camera, no cellular, no cloud, no app store, no touchscreen, no sealed battery. A rugged phone plus a Meshtastic node does most of this cheaper — until the battery is three years old and the network is gone.
There is no body that certifies that phrase. The test methods are named, the pass criteria are written before testing, and the drop and immersion tests run on a printed prototype with a live board inside before any tooling is bought.
Status
Every number on this page is an estimate until the prototype measures it. This is the order the measuring happens in.
Documents
The Civilization Recovery Protocol document — channels, beacon, locate, ledger, playbook schema — is published after the prototype's partition test.