CITIZEN OS ← Tools

A specification · no party · no accounts · runs in your browser

A system of rulership where the people hold the power — not the people who hold office.

Governments drift: power concentrates, decisions get made in rooms you can't see, and voting feels like a box you tick once every few years. This page is a working blueprint for the opposite — an internet-native civic machine built from initiatives, randomly-drawn citizen assemblies, ranked-choice ballots, open budgets and verifiable audits. Every part of it is explained, and every mechanism is simulated honestly, right here, offline, in your browser. Nothing is claimed that isn't shown.

12 principles5 layers of machinery6 guardrails1 working engine5 languages0 data leaves your browser

01 · The diagnosis

Power doesn't leave the people by accident. It drifts through four holes.

Each hole is a design flaw, not a law of nature. Each one has a mechanical fix — and the fixes are already proven in bits and pieces around the world.

Hole 1

Capture

Whoever can fund the loudest campaign wins the office. Then the office pays back the funders.

The fixSortition — lawmakers are drawn by lot from the population, like jury duty, not bought by anyone. Zero campaigns, zero donations, zero loyalty.

Hole 2

Apathy

Voting costs time and delivers little. Most people abstain, and the abstained are ruled by the committed.

The fixNear-zero-friction participation: one-tap ranked ballots, reminders by default, delegation of your vote to a trusted friend or group.

Hole 3

Secrecy

Decisions are made in lobbies, committees and closed emails. You find out after they're law.

The fixTransparency by construction: every debate transcript, every vote, every budget line and every audit is published as open data.

Hole 4

Scale

One person cannot read every law, so "representatives" read them — and that reading becomes a profession.

The fixDistributed deliberation: small random assemblies (150 citizens) study each decision in depth; everyone votes on the big calls with weighted thresholds.

02 · The constitution you can read

Twelve principles, each enforceable by code or by ballot.

A system is only as good as its refusal to be captured. These twelve are the hard rules everything else is built from — and making them enforceable is the whole point.

  1. 01
    All power derives from citizens.There is no office that isn't a delegation, revocable at any time. Officials are agents, not owners.
  2. 02
    One person, one equal vote.No weighting by wealth, land, or social media following. No exceptions, no gatekeepers.
  3. 03
    Every decision is traceable.Who proposed it, who deliberated it, who voted, what data it rested on — public, machine-readable, permanent.
  4. 04
    Lawmakers are drawn, not elected.Citizens' assemblies by lot kill the campaign industry — the thing that makes politics a currency for the rich.
  5. 05
    Any citizen can propose.A low signature threshold (0.5% of citizens) sends any proposal to a full public ballot. No party gate, no editor.
  6. 06
    Anything can be recalled or repealed.Laws are provisional decisions, not permanent conquests. If a policy fails, citizens can reverse it the same way they passed it.
  7. 07
    Rights are locked.Fundamental rights change only through a supermajority ballot plus the consent of a drawn assembly — never by a routine vote.
  8. 08
    Everything sunsets.No law survives more than five years without explicit renewal. Dead rules can't accumulate into an unreadable code.
  9. 09
    Budgets are data, and partly yours.Every public pound is published as open data, and a fixed share of every budget is allocated directly by citizens.
  10. 10
    Every official is audited, publicly.Independent auditors drawn by lot, random public audits, and automatic consequences — because oversight nobody can see is theatre.
  11. 11
    The machine must prove itself in public.Open-source code, reproducible tallies, verifiable receipts for every vote. If you can't audit the count, you don't have elections — you have a ceremony.
  12. 12
    The system works with no internet at all.Paper ballots, phone lines and assisted voting give equal access. The internet adds speed and reach; it is never the only door.

03 · The machinery

Five layers. Each one does one job, and each is replaceable.

The trick of any resilient system is separation of powers. Here the separation is explicit: proposing, deliberating, deciding, executing and overseeing are five different machines with five different sets of people.

Layer 1
Propose
Anyone · zero signature cost

Any citizen drafts a proposal — a law, a budget carve-out, a repeal, a question. With 0.5% of citizens signed, it goes to the assembly. The gate is a number, not a committee.

KillsAgenda control: the monopoly of "what gets discussed" is the most quietly powerful tool in politics. Here, citizens set the agenda directly.
Layer 2
Deliberate
Citizens' Assembly · 150 drawn by lot · stratified

A random, demographically representative assembly gets the proposal, hears balanced evidence from both sides, and deliberates in public — full transcripts published. It returns a draft plus a minority report.

KillsRubber-stamping and capture: no one campaigns for a seat that is drawn from a hat, so there is nothing to fund and nothing to buy.
Layer 3
Decide
Everyone · ranked ballots · tiered thresholds

Single transferable vote. The threshold of consent rises with consequence: 50%+1 for routine matters, 60% for budgets and treaties, 66% for constitutional change, 75% plus assembly consent to touch fundamental rights.

KillsBoth mob rule and gridlock: everyday decisions stay easy, while the most dangerous ones need the broadest consensus.
Layer 4
Execute
Public agencies · bound to published plans

Agencies implement exactly what was decided, against published delivery plans with live dashboards. Every plan sunsets in five years unless renewed. Failure to deliver is a factual, public event — not a press release.

KillsBureaucratic drift: the gap between what was promised and what was done becomes measurable, so it stops being invisible.
Layer 5
Oversee
Audit pool drawn by lot · plus citizens' recall

An independent auditor pool — audited themselves by rotation — publishes reports on every layer. Citizens can force a recall of any official with 20% signatures and a ballot. There is no office above this layer.

KillsUntouchability: the final check on power is not another official. It's the people, with a mechanism that costs them two minutes.

04 · The guardrails

Every failure mode of direct democracy, and the exact mechanism that answers it.

"Let the people decide" fails in predictable ways. A system brave enough to hand power out must also be paranoid enough to read every objection first. These are the six objections, answered.

Risk → mechanism
RiskMechanism that answers it
Tyranny of the majorityRights lock: fundamental rights need 75% + assembly consent. Majority rule governs decisions, never persons.
Elite captureSortition removes the campaign. No funding races, no lifetime politicians — every seat is a term of service, drawn, not sold.
Voter fatigueOne-tap ranked ballots, recurring reminders, and delegation — you can lend your vote to a trusted person or organisation and revoke it any time.
MisinformationEvery proposal carries linked provenance and a public "model card" of its data. An independent, citizen-funded fact-check endowment is audited like everything else.
Digital divideOnline is a fast lane, never the only road: paper ballots, assisted phone voting, community booths. Parity of access is a principle (§12), not a footnote.
Security & trustOpen-source tallying, printable receipts, public audits and reproducible counts — no single vendor owns the election, and every voter can verify their vote landed.

05 · The power flow

Power circulates. It is never parked.

Follow the arrows: every decision originates with citizens, passes through considered deliberation, is made by everyone, executed publicly, audited independently — and every arrow can be reversed.

THE PEOPLE every citizen · one vote PROPOSE 0.5% signatures DELIBERATE 150 drawn by lot open transcripts DECIDE ranked · tiered thresholds EXECUTE published plans 20 24 20 15 AUDIT drawn pool · public SUNSET · renew or expire RECALL · signatures + ballot POWER FLOWS THROUGH THE MACHINE — AND EVERY ARROW CAN BE REVERSED

07 · Rules lab

Four honest simulations. Same inputs, different rules — you'll see why the rules matter.

Everything below computes in your browser from the numbers on screen. No backend, no tracking, no pretend data claimed as real. Each demo is labelled with exactly what it does and does not prove.

SIM 01

Election Lab — same 1,000 votes, three different rules

A thousand citizens rank five proposals. Plurality counts only first choices. Instant-runoff transfers votes from eliminated options. Approval counts everyone's top three. They often pick different winners. That difference is the whole argument for ranked choice.

SIM 02

Sortition Draw — a 150-person assembly, drawn by lot, matched to the population

This is how the deliberative layer gets its membership: nobody campaigns for it. Slide the population and the assembly size, draw, and check whether the sample mirrors the people. A real charter uses census data and a witnessed draw.

SIM 03

Budget Floor — give people 100% of the money

In a participatory budget a fixed share of public spending is allocated directly by citizens: every pound is published as data and the community decides the split. Move the sliders until the split is yours — then compare it with a typical top-down allocation.

SIM 04

Threshold Engine — how much consent does a decision need?

The same proposal dies or becomes law depending on the tier of decision. Set the support and the turnout; the rules decide what passes. This is why §7 (rights are locked) exists — a few passionate votes should never rewrite a right.

Public support54%
Turnout (quorum)62%
54%

Illustrative thresholds from the spec: 50%+1 routine · 60% budgets & treaties · 66% constitutional · 75% + assembly consent for rights. Quorum 40% in this demo.

06 · The Public Floor

Decisions are argued, counted and published in the open — and anyone can re-check them.

This is the working engine, not a mock-up. Set a charter, raise proposals, argue them on a public map, draw the assembly, ballot by ranked choice, and publish a result with a cryptographic receipt. The whole state exports as one file — a public ledger — that anyone on earth can import and verify against the published numbers. No server. No trusted third party. The count is checkable by everyone.

UI translated · the community's content stays in their language
LIVE COMMUNITY CHARTER
■ FOR ■ AGAINST ■ EVIDENCE ■ QUESTION THE FLOOR — EVERY ARGUMENT VISIBLE

PUBLIC LEDGER — EVERY ACTION, HASH-CHAINED

1 · SET YOUR CHARTEROne community, one charter: quorum, tiered thresholds, signature quota, assembly size.
2 · CIRCULATE THE LEDGERExport the public ledger and share it anywhere public — a folder, a group chat, a notary.
3 · THE WORLD CAN CHECKAnyone imports the file and re-verifies every tally and every hash. No server, no trust required.

08 · Reality check

What's real, what's built, and what would still be hard.

A spec that ignores its own problems is a pamphlet. Here is the honest ledger.

  • This isn't fiction — it's assembled from pieces that already run. Citizens' assemblies have been used on hard national questions and have the track record to show for it. Participatory budgeting began in one city and spread across the world — Paris has put hundreds of millions of euros under direct citizen allocation. A whole country votes online in national elections. The parts work. What doesn't exist yet is the whole machine, wired together and enforced. That's the project.
  • This page proves nothing about politics — it demonstrates mechanisms. The simulations show that rules change outcomes, that random samples can represent populations, and that budget choices are value choices. Real adoption needs organised citizens, lawyers and years of patient work.
  • The hardest problem is enforcement. A system that hands power back must first be accepted by the people who currently hold it. That's why the road starts small: budgets and assemblies are reversible, low-threat experiments. No government defends the 10% of its budget it gave to citizens; it defends the 100% it kept.
  • Scale means layers. Eight billion people can't vote on everything. The answer is nesting: neighbourhood assemblies, city assemblies, regional, national, and a union layer — each deciding what belongs at its level, each able to overrule nothing above it without a bigger threshold.
  • The internet is the amplifier, not the oracle. Everything critical is duplicated offline: paper ballots, booths, assisted voting. The network gives speed, reach and open records; it is never the only door in.
  • What it can't do: make decisions popular, or make outcomes comfortable. Democracy doesn't guarantee good answers — it guarantees the answer is yours to change. That reversibility — every law sunsets, every official recallable — is the real innovation. Mistakes become expensive to keep, cheap to fix.

09 · The road

You don't start a country. You start a town.

  1. 1
    One town writes a charter.A council adopts a citizens' charter: 150-person assembly on the year's hard decisions, 10% participatory budget, all meetings and data published. Both are reversible — which is exactly why they're adoptable.
  2. 2
    The city scales it.City-wide initiatives with a 0.5% signature bar, ranked-choice ballots, a public recall mechanism, an auditor pool drawn by lot. The tools are open-source, so the cost is zero.
  3. 3
    Cities federate.A network of cities shares the open stack — the code, the charters, the audit methodology — and mutualises oversight. Learning spreads horizontally, without asking permission.
  4. 4
    A convention, then a referendum.At enough scale, a citizens' convention drafts a national constitution in plain language, and the people ratify or reject it in a single ranked ballot. That is the only moment power is handed over: by vote, not by coup.

What you can do this week — join or start a citizens' assembly in your town; ask your council for one participatory budget line; request your local spending data in machine-readable form; send this page to one elected official and one sceptical friend. The mechanism starts with 1% of the people asking for it nice and clearly.

10 · Questions

Asked before you ask.

Who runs Citizen OS?
Nobody — and that is the design. The software is open source; the administrators of any instance are drawn by lot and audited by a pool that is itself audited. No party, no company, no founder, no lifetime role. If you can find a person without whom the system stops, it's a flaw, not a feature.
What stops it being hacked or rigged?
The same things that must protect any election, plus one extra: nobody owns the count. Tallying code is public, every vote carries a receipt voters can check, and paper ballots remain the fallback for every critical decision. The internet is a fast lane into a system that still works if the internet vanishes.
Doesn't direct democracy just mean mob rule?
Mob rule is what happens when a simple majority can do anything. That is precisely what the tiers prevent: 50%+1 for routine matters, 60% for budgets, 66% for the constitution, 75% plus a drawn assembly to touch fundamental rights — and a deliberation stage in between, with a published minority report. Laws are also reversible, so a bad decision is correctable instead of permanent. The riskiest decisions are deliberately the hardest to make — and the easiest to undo.
Will people actually bother to vote?
People vote when voting is cheap and consequential. One-tap ranked ballots, automatic reminders, delegation of your vote to anyone you trust (revocable any time), and decisions that visibly change your town — all of that is measurable, and all of it is cheaper than the current default: one day every four to five years. And the assembly layer means nobody has to read a 200-page bill to participate in the decision that matters to them.
What's the catch?
The catch is enforcement: a state has to choose to hand power over, and states rarely volunteer. The answer is to make the first steps small, reversible and embarrassing to refuse — a participatory budget line, a citizens' assembly, open data. Each one that works makes the next one harder to deny. That is why this page ends with the town, not the revolution.