DOI: https://doi.org/10.5281/zenodo.21947430
Canonical: https://thonly.org/research/verified-human-anonymous-local-giving · Licence: CC0 1.0
This specification is offered to the commons in the spirit of __dāna__, that all beings may give and receive without barrier. May the work it enables reduce suffering for all who encounter it.
The Buddha taught that giving that seeks neither return nor recognition is the higher giving (AN 7.52). The mechanism specified in this document is intended to make that practice structurally easy in the digital age — to allow any human to thank any other human in physical proximity, with verified humanity but without disclosure of identity, in a manner that keeps gratitude flowing locally rather than being captured by global platforms or extractive intermediaries.
This document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time.
This document constitutes a defensive publication establishing prior art as of 2 May 2026 for the matter of the first revision of the combination of mechanisms described herein; additions are dated in-text and each revision is independently timestamped. Any subsequent patent application claiming the combined mechanism — biometric human-presence attestation + physical-radio proximity attestation + recipient-anonymous gratitude transfer — should be considered to be filed against established prior art; whether the composition is non-obvious is an examiner's determination this publication exists to inform.
This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.
We specify a digital-payment primitive in which a sender expresses gratitude (with optional monetary attachment) to a recipient who is physically nearby in real space, with two attestation properties operating in combination: (1) verified-human attestation at the moment of the action, achieved via user-verified, per-action FIDO2 / WebAuthn signing on a platform authenticator, ensuring that the sender is a human present at the moment of thanking rather than a bot or an automated process; and (2) physical-radio proximity attestation via Bluetooth Low Energy or Ultra-Wideband ranging, ensuring that the recipient is geographically nearby (within a density-tunable radius) at the moment of the transfer. These two attestations are then composed with (3) recipient-side anonymity: the recipient receives the thank-you and any attached monetary value but is not informed of the sender's identity. Each member is known; what this publication discloses is the three-way composition in one signed action — no reference found composes all three in one signed action, and whether the composition is non-obvious is an examiner's determination this publication exists to inform. Its properties include the structural restoration of cash's local-circulation property to digital money, the operational feasibility of dāna (anonymous giving) at scale, the rebuilding of local-economic social capital eroded by globalized digital payment platforms, and a category of bot-resistant gratitude infrastructure for an age of pervasive autonomous agents. We provide system architecture, reference implementation patterns, edge-case and adversarial analysis, use cases, and citations to relevant prior art across digital payments, proof-of-personhood, community currencies, and Buddhist economic traditions.
Connection to the unified mission frame. This specification is offered in service of HeartBank's canonical top-level mission: to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible (madhyamā pratipad). Verified-human anonymous local giving operationalizes Buddhist dāna (anonymous giving) — a practice the Buddha specifically taught as supportive of practitioners' progress along the middle way. By restoring cash's local-circulation property to digital money and making the recipient blind to giver identity, the primitive removes two specific commercial affordances that push modern giving toward the indulgence-extreme distortions (status-display and reciprocity-tracking). The mechanism is offered as one substrate among many specified across the corpus toward middle-way restoration.
Two trends in early-2020s digital infrastructure motivate this work. The first is the rapid expansion of autonomous agents — large language models, agentic AI, robotic processes — operating at scale on consumer-facing platforms. By 2026 a growing and unmeasured share of social-media interactions, financial transactions, and customer-service exchanges are executed by software agents rather than humans. As this fraction grows, the question of whether a given action originated from a human becomes both harder to answer and more important to verify. Existing proof-of-personhood mechanisms (CAPTCHAs, biometric registration, government-ID verification) attest humanity at registration time but not at action time; a registered human may lend or sell their credentials to an automated process operating in their name.
The second trend is the continuing concentration of digital-payment flows in a small number of global platforms. Where physical cash circulated locally — a dollar in a neighborhood bakery flowed to the local baker, who tipped a local server, who bought at a local bodega, generating multiple local economic events per dollar — digital payments via Venmo, Cash App, WeChat Pay, or Wing eliminate this property. Money sent across a digital payment network does not prefer local recipients; it can flow anywhere instantly, and platform algorithms (advertising, discovery, recommendation) systematically surface the largest payable counterparties rather than the nearest. We conjecture — the social-capital literature documents the decline of face-to-face exchange (Putnam 2000) without isolating payment rails — that non-local digital payment removes one of the daily occasions for local contact; this paper builds the intervention, and the cohort study tests the conjecture.
We propose a digital-payment primitive that addresses both trends simultaneously. The mechanism enables a sender to express gratitude — with optional monetary attachment — to a recipient who is verifiably nearby in physical space, with the sender's humanity attested at the moment of the action and the recipient receiving the gratitude without learning the sender's identity. This publication discloses the combination of these three properties (proximity, verified-humanity, and recipient-side anonymity) as a single mechanism.
The publication is offered to the commons. The author and the institution he represents will not seek patent on the mechanism. The intent is that the mechanism become public infrastructure — useful to gratitude-economy projects, community-currency experiments, religious and cultural organizations, and any other actor whose mission is served by bot-resistant local gratitude flow.
The structural problem of digital money's non-locality has been recognized for a century. Silvio Gesell's demurrage currency, deployed at scale in the Wörgl experiment of 1932–33 in Austria, imposed a holding cost on currency, forcing it to circulate; unemployment fell markedly in the town while it rose nationally, and public works were completed, before the Austrian National Bank suppressed it in 1933 to protect its monopoly. Edgar Cahn's TimeBanking movement (1980 onward) substituted time as the unit of account, with the property that an hour given is an hour received regardless of the giver's socioeconomic position. Local Exchange Trading Systems (LETS, originated by Michael Linton in 1983) established neighborhood-bounded currencies with explicit geographic charters. None of these systems, however, included biometric attestation of human presence at the time of action; they rely on community trust rather than cryptographic verification.
Digital-cash protocols beginning with Chaum's ecash (1983) explored anonymous digital payment but without proximity attestation; the recipient could be anywhere in the world. Proximity-bounded transfer arrived with Bump (2009; payments via Bump Pay, 2012), which matched sensor data server-side, and became radio-mediated with Square Cash's Nearby Payments (2014) over Bluetooth LE; contactless NFC specifications did the same at the terminal — all without anonymity from the recipient and without per-action human-presence attestation. Apple's Nearby Interaction framework (2020 onward) and Android's core-uwb library (Android 12 onward) expose UWB ranging, with BLE as the pairing channel; they return a distance, not an attestation — the attestation in §3.3 is this paper's construction, a device-attested signature over the ranging result. Two-leg compositions are published: Citibank's gratuity patent (US 12,165,124 B2, priority 2017, granted 2024) identifies nearby devices of potential gratuity payees, credits the payee, and offers an anonymity control — proximity plus anonymity; RAADAAR (US 9,854,616 B2, priority 2015) pairs BLE proximity with anonymous "gifts" and payment integration; Mastercard's biometrically enabled proximity-payment device (EP 1671282 A2, priority 2003) and Samsung's UWB payment method (WO 2022/225298 A1, priority 2021) pair proximity with biometrics or secure ranging; and the privacy coins pair anonymity with settlement. None found composes all three in one signed action.
Recent proof-of-personhood proposals — most prominently Worldcoin (Sam Altman et al., 2023 onward) — establish uniqueness once, at registration, via biometric (iris) enrolment, and have since added on-device re-authentication and an explicit delegation model under which agents act for a verified human. The distinction this paper draws is between uniqueness and presence: a delegated agent is a labelled agent, and what the primitive here requires is that the giving human be present at the act. The mechanism specified in this document binds humanity-attestation to the moment of the action via biometric-gated FIDO2 / WebAuthn signing, which is enforced device-side at each invocation rather than once at enrollment.
FIDO2 and WebAuthn (W3C Recommendation, 2019; widely deployed across iOS, Android, Windows, macOS, and major browsers by 2024) provide a standardized cryptographic signing primitive in which a private key is held in a secure enclave protected by user verification — biometric or device credential (Face ID, Touch ID, Windows Hello, Android biometrics, or a PIN) — with the relying party learning that verification occurred, not which modality. This publication discloses the protocol's combination with physical-radio proximity attestation in service of a recipient-anonymous gratitude payment primitive.
The Pāli canon contains extensive discussion of dāna (giving, generosity) as one of the ten pāramī (perfections; Buddhavaṃsa, Cariyāpiṭaka). The canon grades giving by motive: Aṅguttara Nikāya 8.31 lists eight motives for a gift, and Aṅguttara Nikāya 7.52 (the Dānamahapphala Sutta) grades seven, from giving with expectation of return at the bottom to giving as "an ornament of the mind" at the top. The mechanism specified in this document operationalizes the higher form structurally: the giver's identity is not knowable to the recipient by design, removing the social and psychological benefits of recognition that contaminate the canonically purer form.
Robert Putnam's Bowling Alone (2000) and subsequent work documented the decline of local social capital in late-20th-century United States, with similar trends documented elsewhere. The U.S. Surgeon General's 2023 advisory Our Epidemic of Loneliness and Isolation formally identified loneliness as a public-health crisis, with a mortality effect the advisory puts at the level of smoking up to fifteen cigarettes a day and above that of obesity. That non-local digital payment removes a daily occasion for local contact is this paper's conjecture, not the advisory's finding (§1); the mechanism specified here is a structural intervention, making local digital flow easier than non-local flow.
The proximity rule is the structural constraint that a gratitude transfer is permitted only between a sender and a recipient whose mobile or wearable devices have, within a bounded interval prior to the transfer, exchanged cryptographic proof of physical co-location within a configurable radius r. Transfers that do not satisfy this constraint are rejected by the protocol and are not settled.
The radius r is not fixed at a single value. It is parameterized by population density at the location of the transfer, with sensible defaults of approximately 100 meters in dense urban contexts (a city block; an indoor venue; a single building) and up to 10 kilometers in rural or sparsely-populated contexts (a village; a stretch of highway). Default: r(ρ) = clamp(10 km · (ρ / 1 km⁻²)^(−1/2), 100 m, 10 km), with ρ read from a cached WorldPop 1 km density tile (or a GHS-POP 100 m tile) on the device, so the lookup discloses nothing; BLE-only attestations use 2r. The anchors are design estimates — no field test has tuned them — and the claim that a monotonic mapping tracks "the same lived community" rather than a fixed metric distance is a conjecture the cohort study is meant to test.
Proximity is established cryptographically rather than self-reported. Three layered mechanisms are specified, in order of preference:
At least two of these mechanisms must agree, or a single UWB attestation must be present, for the proximity rule to be satisfied. The verifying party may apply additional heuristics — transfer velocity over time, coordinated movement patterns, device-attestation freshness — to detect spoofing attempts.
The proximity rule has three consequential properties: (a) it restores cash's per-transfer locality — every hop is local, as it is for a banknote, however far the chain of hops travels; (b) it inverts the reach logic of digital platforms: the recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not; (c) it makes movement generative, since each step admits a new neighborhood to the sender's reach. (The resonance with the canonical wanderer, the paribbājaka, is a lens the Preamble's tradition supplies, not a property of the mechanism.)
Humanity attestation in the specified mechanism operates at two layers, applied in series:
The recipient receives the gratitude expression and any attached monetary value, but is not informed of the sender's identity. The system retains the sender's verified identity for adversarial-pattern detection, regulatory compliance, and limited audit purposes — but does not surface it to the recipient under any normal interaction. The recipient sees only: the gratitude content; the verified humanity-attestation; the attested proximity at time of transfer; and a stable per-recipient pseudonym for the sender (§6.3), which carries no identity. "Recipient-side anonymity" means exactly this — anonymity toward the recipient; the verifying party is a trusted party that sees everything, and no unlinkability toward it is claimed (§10).
The combination of (a) per-action biometric humanity attestation, (b) cryptographic physical-radio proximity attestation, and (c) recipient-side anonymity is disclosed here as a single mechanism. Existing digital-payment systems have at most two of the three: cash has anonymity and proximity but no humanity verification (any actor can spend cash); Worldcoin has humanity verification but not proximity and not recipient anonymity; contactless payment apps have proximity but not anonymity and not per-action humanity verification; privacy-preserving cryptocurrencies have anonymity but not proximity and not humanity verification; Citibank's gratuity patent and RAADAAR have proximity and anonymity but no per-action humanity verification; the biometric proximity-payment family and Apple Pay over Nearby Interaction have proximity and biometrics but no anonymity. No reference found composes all three in one signed action; the composition is the disclosed matter of this publication, and whether it is non-obvious is an examiner's determination this publication exists to inform.
The combination of proximity and verified-human anonymity is more than the sum of its components. Each property alone is well-explored; their combination is designed to produce properties none has alone:
We sketch a reference architecture without claiming any specific implementation as canonical. Variations consistent with the three structural properties (per-action humanity attestation, proximity attestation, recipient anonymity) fall within the scope of this defensive publication.
The recipient receives a per-transfer pseudonym for the sender, derived as HMAC(salt_R, sender_id) with salt_R held by the verifying party, such that repeat transfers from the same sender to the same recipient appear under a stable pseudonym (allowing relational continuity) without disclosing identity. Different recipients see uncorrelated pseudonyms for the same sender, because their salts are independent; the verifying party, which holds every salt, can correlate them all.
function sendGratitude(recipient, content, amount?) {
// 1. Establish proximity via UWB (preferred) or BLE
const proximityProof = await measureProximity(recipient);
if (!proximityProof.withinRadius(densityAdjustedRadius()))
throw new ProximityError();
// 2. Build transfer payload
const payload = {
recipient: recipient.publicId,
content,
amount,
proximity: proximityProof,
timestamp: now()
};
// 3. Biometric-gated signing via WebAuthn
const signature = await navigator.credentials.get({
publicKey: {
challenge: concat(verifierNonce, hash(payload)), // single-use nonce from the verifier
userVerification: "required" // user verification; modality is device policy
}
});
// 4. Submit to verifying party
return submitTransfer({ payload, signature });
}function verifyTransfer(transfer) {
// 1. Verify FIDO2 signature
if (!verifyWebAuthnSignature(transfer.payload, transfer.signature))
return reject("invalid_signature");
// 2. Verify per-action user-presence + biometric flags
const flags = transfer.signature.authenticatorData.flags;
if (!flags.userPresent || !flags.userVerified)
return reject("user_not_present");
if (!admittedAuthenticators.has(transfer.signature.aaguid))
return reject("authenticator_not_admitted"); // attested platform authenticators only
// 3. Verify proximity attestation
const r = densityAdjustedRadius(transfer.payload.location);
if (!verifyProximityProof(transfer.payload.proximity, r))
return reject("proximity_failed");
// 4. Adversarial heuristics
if (detectCollusion(sender, recipient)) return reject("collusion");
if (rateLimitExceeded(sender)) return reject("rate_limit");
if (codedMessageHeuristic(transfer)) return flag("coded_message");
// 5. Settle and deliver
const pseudonym = derivePseudonym(sender.id, recipient.salt);
if (transfer.payload.amount)
settle(sender, recipient, transfer.payload.amount);
deliverToRecipient({
pseudonym,
content: transfer.payload.content,
proximity: transfer.payload.proximity
});
}Two parties may collude by repeatedly tipping each other, attempting to launder value or fabricate social signal. The verifying party detects this via graph analysis: bidirectional flow exceeding a threshold ratio, repeating co-location patterns outside normal social graphs, near-equal balance flow over time. Detected collusion results in rate-limiting, transfer reversal, or aura penalty.
A sender may attempt to communicate a covert message via the transfer amount (e.g., $1.34 as a timestamp; $99.99 as a coded signal). The verifying party applies entropy and pattern heuristics to flag suspected coded messages for review and may quantize amounts to defeat fine-grained covert channels.
A bad actor in physical proximity may attempt to harass a recipient via a burst of anonymous unwanted thanks. The mechanism mitigates this via per-pseudonym rate-limiting (the same pseudonym cannot exceed N transfers per recipient per period) and recipient-side block lists by pseudonym. Repeated harassment escalates to the verifying party with the underlying identity revealed for adversarial action.
A sender may attempt to fake their location via GPS spoofing to satisfy the proximity rule. The mechanism rejects GPS-only attestations when UWB or BLE is available; cross-references cell tower signal strength; analyzes signal multipath; and rejects velocity-implausible movement patterns.
The verifying party issues a single-use nonce that the WebAuthn challenge commits to, alongside the payload hash, preventing replay of historical signatures. Proximity attestations include freshness timestamps; stale attestations are rejected.
Per-jurisdiction regulatory variance is handled by configurable thresholds: small anonymous transfers are unconstrained; transfers above a configurable threshold trigger optional verification escrow with progressive identity disclosure to the recipient as required by local law. The structural anonymity is preserved at the social layer; legal compliance is layered on top.
High-end deepfake plus stolen device with biometric bypass remains a residual attack on per-action FIDO2 alone. The DNA-verified family-tree layer — Layer 4 of the B-PoH℠ protocol specified in the companion paper B-PoH℠ as Humanity Layer for the AI-Native Internet — closes this gap for senders who have opted in, by binding the FIDO2 identity to a biologically-verified human kinship graph; for all others the attack remains the residual named in §10.
The mechanism specified here addresses the gratitude-transfer primitive but leaves several related questions for separate work:
miss-aquarius-and-aquarian-pool-architecture). Its alignment substrate (the Theravāda Tipiṭaka) is specified in the companion paper Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment (target publication January 7, 2027).| Venue | Identifier |
|---|---|
| Primary canonical | <https://thonly.org/research/verified-human-anonymous-local-giving> |
| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/verified-human-anonymous-local-giving.md> |
| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/verified-human-anonymous-local-giving> |
| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |
| Zenodo | a version DOI per revision |
The author acknowledges his father, with whom the Khmer transcription of the Tipiṭaka is being undertaken; the Cambodian Theravāda Saṅgha, whose lineage carries the canon that grounds this work; the survivors and descendants of the Cambodian genocide of 1975–79, whose civilizational rebuilding is the soil this publication grows from; the foundational thinkers in community currency, proof-of-personhood, and Buddhist economics whose work is cited above; and the autonomous artificial intelligence community whose alignment work this publication intends to contribute to in the spirit of the bodhisattva path.
Coined names used in this paper and the standard terms an examiner would search for them.
| Term used here | Standard technical term |
|---|---|
| verified-human attestation | per-action user verification; FIDO2 / WebAuthn user-verified assertion from an attested platform authenticator |
| proximity rule | proximity-bounded payment authorization; UWB / BLE secure ranging, distance bounding |
| recipient-side anonymity | payer anonymity toward the payee; pseudonymous payment with per-recipient pseudonym (HMAC) |
| verifying party (Miss Aquarius) | trusted attestation verifier (checks humanity and proximity attestations; holds no funds) |
| B-PoH℠ | proof of personhood; human-presence and identity verification layers |
| dāna | anonymous charitable giving; donation, gratuity |
| Re-Tip Fund℠ | forward-only earmarked allocation, recorded on a ledger (usable only for further gifts; never withdrawn) |
| aura penalty | reputation score penalty; trust-score reduction |
— End of defensive publication —
Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.