Social Media 2
Invariants
Social Media 2 is operated by the Polis cooperative. The cooperative binds the product to no ads, no data sale, no public status games, no pay-to-play matching, and deletion rights.
Plain language: Social Media 2 never offers an endless scroll stream.
Why: Civic time should move offline, not into habit loops.
Enforced by: Architectural UI inventory and forbidden-symbol CI.
Prevents: Attention capture becoming the product.
Plain language: A citizen never sees a public popularity tally attached to another citizen.
Why: Public tallies turn neighbors into performers.
Enforced by: Architectural schema and UI scans.
Prevents: Status-seeking replacing real-world participation.
Plain language: Public reaction totals are not a product surface.
Why: Numeric applause would reward performance over presence.
Enforced by: Architectural UI and storage checks.
Prevents: Comparative social scoring.
Plain language: People cannot browse strangers as public profiles.
Why: Social Media 2 is for meetings that happen after mutual consent and real rooms.
Enforced by: Architectural route inventory.
Prevents: Swipe culture and performative identity.
Plain language: The business model cannot depend on selling attention.
Why: Ad funding pressures the product toward more app time.
Enforced by: Procedural financial audit and outbound API inventory.
Prevents: The attention market capturing governance.
Plain language: Algorithms cannot optimize for return clicks or session length.
Why: The goal is serendipity, not compulsion.
Enforced by: Procedural SARB review of objective functions.
Prevents: Rage-loop optimization.
Plain language: Citizens do not receive public comparative standing values.
Why: Public standing creates gaming and hierarchy.
Enforced by: Architectural code and UI scans.
Prevents: Merit-game capture.
Plain language: The design system has no component for unbounded scrolling streams.
Why: Interfaces should end cleanly and send people back outside.
Enforced by: Architectural component inventory.
Prevents: Dark-pattern browsing loops.
Plain language: Time inside the app is never the success metric.
Why: Social Media 2 should cause real-world time, then get out of the way.
Enforced by: Procedural objective-function review.
Prevents: Product decisions that reward more screen time.
Plain language: Citizen signal slots keep their identities and are never collapsed into one vector.
Why: Cross-slot comparison creates false similarity.
Enforced by: Architectural type checks and lint scans.
Prevents: Spurious matching math.
Plain language: The primary output is always a real-world gathering.
Why: Online-only activity cannot satisfy the civic purpose.
Enforced by: Architectural product-surface inventory.
Prevents: The platform drifting into another screen-only network.
Plain language: No owner or founder can rewrite the rules alone.
Why: Civic infrastructure must survive private pressure.
Enforced by: Constitutional articles, SARB, Assembly, and Trustee Council process.
Prevents: Governance capture.
Plain language: Citizen data is not sold, including aggregate packages.
Why: Trust depends on refusing the broker model.
Enforced by: Procedural outbound API and financial audit.
Prevents: Data-broker extraction.
Plain language: Behavioral data cannot target advertising elsewhere.
Why: The no-ad promise cannot have an off-platform loophole.
Enforced by: Architectural SDK and pixel inventory.
Prevents: Hidden advertising surveillance.
Plain language: The system cannot write messages on behalf of citizens.
Why: Trust requires that a human message came from a human.
Enforced by: Architectural compile guard and DM route review.
Prevents: Synthetic intimacy.
Plain language: Paying more never changes matching priority.
Why: Access tiers cannot become civic privilege.
Enforced by: Architectural matcher contract.
Prevents: Pay-to-play citizenship.
Plain language: Match reasoning is never published as a public comparison between citizens.
Why: Private matching evidence must not become social standing.
Enforced by: Procedural output inventory and audit review.
Prevents: Leaderboard dynamics.
Plain language: Algorithm-weight changes require a SARB log row.
Why: Civic algorithms need visible public control.
Enforced by: Constitutional SARB workflow and procedural audit log checks.
Prevents: Quiet manipulation of matching policy.