# SPP Review and Improvements
## 11 October 2026

## 1. Rewrite — more professional and realistic

The Sovereign Provenance Protocol is a design for an economic system that ties governance weight and yield claims to verified unique human identities rather than transferable tokens, and that attempts to mint new claims only against cryptographically attested records of real utility.

Governance uses a one-person-one-vote constraint enforced by zero-knowledge proofs of personhood. Influence on proposals is further modulated by a square-root function of directed contribution, gated by the personhood proof. Value claims are generated only when an action is recorded as an immutable attestation containing an author signature, metadata, and peer scores. Yield from a multi-asset treasury (commodities, infrastructure, tokenized real-world assets, and intellectual-property rights) is distributed in proportion to relative provenance scores accumulated over an epoch.

The specification is strongest as a coherent architectural preference. It is weakest as an implementable system. The personhood enrollment mechanism, the objectivity of utility measurement, the permanence of scores, and several concrete accounting and centralization issues in the provided contracts remain open. Until those are closed with audited mechanisms and realistic cost models, the protocol is a detailed design sketch rather than a deployable system.

## 2. Explain the ZK personhood enrollment problem

Zero-knowledge proofs of personhood can hide the biometric or hardware signal once a unique human has been enrolled, but they do not solve the enrollment problem itself.

A sparse Merkle tree of commitments plus a nullifier prevents double-voting after enrollment. The hard part is the first insertion: how a new leaf is proven to correspond to exactly one previously unenrolled human without a trusted intermediary, without creating a market for fake enrollments, and without leaking identifying data.

Concrete difficulties:
- Biometric templates (iris, face, fingerprint) can be spoofed, stolen, or generated by generative models. A zero-knowledge proof that “this template matches a live scan” still requires a trusted or hardware-rooted capture step whose compromise creates unlimited fake identities.
- Hardware attestations (secure elements, TEEs) shift the trust to the manufacturer and the supply chain. An attacker who controls enrollment devices can mint many identities.
- Social or peer attestation schemes are collusion-prone and do not scale to Sybil resistance under economic pressure.
- Once an identity is enrolled, key rotation (as in the MACI-style design) protects against key sale but does not recover from an already-enrolled fake identity. The GenesisInjector-style bypass in the specification makes the problem worse by allowing privileged insertion.

No existing public ZK-PoP system has demonstrated enrollment that is simultaneously permissionless, Sybil-resistant under realistic attack, and free of a trusted setup or physical check that can itself be gamed. This is the load-bearing unsolved assumption.

## 3. How to improve this proposal — prioritized

1. **Replace the enrollment assumption with a concrete, limited scheme.** Publish a specific enrollment protocol (hardware-rooted capture + nullifier, or a time-limited physical check with public audit) and remove any privileged bypass such as the GenesisInjector. State the residual trust assumption explicitly.
2. **Turn the voting formula into actual quadratic voting.** Add an explicit budget or quadratic cost so that many small contributions cannot be farmed more cheaply than fewer large ones. Keep the personhood gate.
3. **Make provenance scores epoch-bounded and challengeable.** Add decay or reset at epoch boundaries and a path for successful challenges to reduce or reverse previously minted score. Do not allow caller-supplied utility and consensus values; require attested inputs.
4. **Fix the contract accounting.** Add zero-division guards, consistent units (do not mint ERC-20 against an ETH balance without conversion), and epoch-aware last-claimed tracking. Remove or time-lock Ownable / admin paths that contradict the stated sovereignty goals.
5. **Specify oracles and hardware attestation for utility.** Define the threat model for the telemetry schema and the enclave or oracle that converts physical measurements into the objective-utility input. Without this, the 60/40 score split is arbitrary.
6. **Separate the manifesto from the specification.** Keep the philosophical framing, but mark every mechanism that is still a sketch versus one that has a concrete, auditable implementation path.

These six changes convert the current blueprint into a narrower, more credible design that can be incrementally implemented and audited.