DOI: https://doi.org/10.5281/zenodo.21947430
Canonical: https://thonly.org/research/verified-human-anonymous-local-giving · Licence: CC0 1.0
This specification is offered to the commons in the spirit of __dāna__, that all beings may give and receive without barrier. May the work it enables reduce suffering for all who encounter it.
The Buddha taught that the higher form of giving is giving without expectation of recognition. The mechanism specified in this document is intended to make that practice structurally easy in the digital age — to allow any human to thank any other human in physical proximity, with verified humanity but without disclosure of identity, in a manner that keeps gratitude flowing locally rather than being captured by global platforms or extractive intermediaries.
This document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time.
This document constitutes a defensive publication establishing prior art as of 2 May 2026 for the combination of mechanisms described herein. Any subsequent patent application claiming the combined mechanism — biometric human-presence attestation + physical-radio proximity attestation + recipient-anonymous gratitude transfer — should be considered to be filed against established prior art and should be denied on grounds of obviousness in light of this publication.
Mirrors of this document with independent timestamping appear at GitHub, arXiv, IP.com, and the Internet Archive (web.archive.org, archive.today, perma.cc). Each mirror carries an independent tamper-evident timestamp.
We specify a digital-payment primitive in which a sender expresses gratitude (with optional monetary attachment) to a recipient who is physically nearby in real space, with two structurally novel properties operating in combination: (1) verified-human attestation at the moment of the action, achieved via FIDO2 / WebAuthn biometric-gated cryptographic signing, ensuring that the sender is a human present at the moment of thanking rather than a bot or an automated process; and (2) physical-radio proximity attestation via Bluetooth Low Energy or Ultra-Wideband ranging, ensuring that the recipient is geographically nearby (within a density-tunable radius) at the moment of the transfer. These two attestations are then composed with (3) recipient-side anonymity: the recipient receives the thank-you and any attached monetary value but is not informed of the sender's identity. The resulting primitive is, to the author's knowledge, not previously published as a unified mechanism. Its properties include the structural restoration of cash's local-circulation property to digital money, the operational feasibility of dāna (anonymous giving) at scale, the rebuilding of local-economic social capital eroded by globalized digital payment platforms, and a category of bot-resistant gratitude infrastructure for an age of pervasive autonomous agents. We provide system architecture, reference implementation patterns, edge-case and adversarial analysis, use cases, and citations to relevant prior art across digital payments, proof-of-personhood, community currencies, and Buddhist economic traditions.
Connection to the unified mission frame. This specification is offered in service of HeartBank's canonical top-level mission: to restore humanity to the middle way (madhyamā pratipad) — the optimal condition for awakening that modernity has systematically pushed away from at population scale. Verified-human anonymous local giving operationalizes Buddhist dāna (anonymous giving) — a practice the Buddha specifically taught as supportive of practitioners' progress along the middle way. By restoring cash's local-circulation property to digital money and making the recipient blind to giver identity, the primitive removes two specific commercial affordances that push modern giving toward the indulgence-extreme distortions (status-display and reciprocity-tracking). The mechanism is offered as one substrate among many specified across the corpus toward middle-way restoration.
Two trends in early-2020s digital infrastructure motivate this work. The first is the rapid expansion of autonomous agents — large language models, agentic AI, robotic processes — operating at scale on consumer-facing platforms. By 2026, a meaningful fraction of social-media interactions, financial transactions, and customer-service exchanges are executed by software agents rather than humans. As this fraction grows, the question of whether a given action originated from a human becomes both harder to answer and more important to verify. Existing proof-of-personhood mechanisms (CAPTCHAs, biometric registration, government-ID verification) attest humanity at registration time but not at action time; a registered human may lend or sell their credentials to an automated process operating in their name.
The second trend is the continuing concentration of digital-payment flows in a small number of global platforms. Where physical cash circulated locally — a dollar in a neighborhood bakery flowed to the local baker, who tipped a local server, who bought at a local bodega, generating multiple local economic events per dollar — digital payments via Venmo, Cash App, WeChat Pay, or Wing eliminate this property. Money sent across a digital payment network does not prefer local recipients; it can flow anywhere instantly, and platform algorithms (advertising, discovery, recommendation) systematically surface the largest payable counterparties rather than the nearest. This has been argued, in the social-capital literature, to contribute to the erosion of local economic ties and the loneliness epidemic now documented by national public-health authorities.
We propose a digital-payment primitive that addresses both trends simultaneously. The mechanism enables a sender to express gratitude — with optional monetary attachment — to a recipient who is verifiably nearby in physical space, with the sender's humanity attested at the moment of the action and the recipient receiving the gratitude without learning the sender's identity. The combination of these three properties (proximity, verified-humanity, and recipient-side anonymity) constitutes, to the author's knowledge, a unified mechanism not previously published.
The publication is offered to the commons. The author and the institution he represents will not seek patent on the mechanism. The intent is that the mechanism become public infrastructure — useful to gratitude-economy projects, community-currency experiments, religious and cultural organizations, and any other actor whose mission is served by bot-resistant local gratitude flow.
The structural problem of digital money's non-locality has been recognized for a century. Silvio Gesell's demurrage currency, deployed at scale in the Wörgl experiment of 1932–33 in Austria, imposed a holding cost on currency, forcing it to circulate; it produced full employment in a depression-era town before being suppressed by the Austrian National Bank. Edgar Cahn's TimeBanking movement (1980 onward) substituted time as the unit of account, with the property that an hour given is an hour received regardless of the giver's socioeconomic position. Local Exchange Trading Systems (LETS, originated by Michael Linton in 1983) established neighborhood-bounded currencies with explicit geographic charters. None of these systems, however, included biometric attestation of human presence at the time of action; they rely on community trust rather than cryptographic verification.
Digital-cash protocols beginning with Chaum's ecash (1983) explored anonymous digital payment but without proximity attestation; the recipient could be anywhere in the world. Bluetooth-mediated peer-to-peer payment apps (Bump, 2009; LevelUp; various contactless near-field-communication payment specifications) established proximity-bounded digital transfer but without anonymity from the recipient and without biometric human-presence attestation. Apple's NearbyInteraction framework (2020 onward) and Google's NearbyConnections API provide modern OS-level Bluetooth Low Energy and Ultra-Wideband proximity primitives that enable cryptographically-attested physical co-location between two devices, but these are exposed as building blocks rather than as gratitude-economic primitives.
Recent proof-of-personhood proposals — most prominently Worldcoin (Sam Altman et al., 2023 onward) — establish that a registered participant is a unique human via biometric (iris) registration, but verify humanity once at registration rather than at each action. A registered Worldcoin user may delegate their credentials to an autonomous agent; the system cannot distinguish a human-driven transaction from a bot transaction signed with that user's key. The mechanism specified in this document binds humanity-attestation to the moment of the action via biometric-gated FIDO2 / WebAuthn signing, which is enforced device-side at each invocation rather than once at enrollment.
FIDO2 and WebAuthn (W3C Recommendation, 2019; widely deployed across iOS, Android, Windows, macOS, and major browsers by 2024) provide a standardized cryptographic signing primitive in which a private key is held in a secure enclave protected by user biometric or local credential (Face ID, Touch ID, Windows Hello, Android biometrics). Signing requires user-present biometric authentication at each invocation. The protocol is widely deployed but has not, to the author's knowledge, been combined with physical-radio proximity attestation in service of a recipient-anonymous gratitude payment primitive.
The Pāli canon contains extensive discussion of dāna (giving, generosity) as one of the ten pāramitās (perfections). Among the canonically distinguished forms, the highest is giving without expectation of recognition, return, or even the giver's awareness of having given (cf. Aṅguttara Nikāya 8.31, Dāna Sutta; Aṅguttara Nikāya 4.236, where giving is characterized by cāga — letting-go — as opposed to the lesser form characterized by attachment to the gift's reception). The mechanism specified in this document operationalizes the higher form structurally: the giver's identity is not knowable to the recipient by design, removing the social and psychological benefits of recognition that contaminate the canonically purer form.
Robert Putnam's Bowling Alone (2000) and subsequent work documented the decline of local social capital in late-20th-century United States, with similar trends documented elsewhere. The U.S. Surgeon General's 2023 advisory Our Epidemic of Loneliness and Isolation formally identified loneliness as a public-health crisis with mortality and morbidity comparable to obesity and tobacco use. Digital-payment platforms have been argued in this literature to contribute to the erosion of local economic ties; the mechanism specified here is a structural intervention, making local digital flow easier than non-local flow.
The proximity rule is the structural constraint that a gratitude transfer is permitted only between a sender and a recipient whose mobile or wearable devices have, within a bounded interval prior to the transfer, exchanged cryptographic proof of physical co-location within a configurable radius r. Transfers that do not satisfy this constraint are rejected by the protocol and are not settled.
The radius r is not fixed at a single value. It is parameterized by population density at the location of the transfer, with sensible defaults of approximately 100 meters in dense urban contexts (a city block; an indoor venue; a single building) and up to 10 kilometers in rural or sparsely-populated contexts (a village; a stretch of highway). The density value is derived from publicly-available population-density data (e.g., the WorldPop dataset, the Global Human Settlement Layer) consulted at the transfer's geographic coordinates. A monotonic relationship between population density and radius preserves the property that "nearby" means "in the same lived community" rather than a fixed metric distance.
Proximity is established cryptographically rather than self-reported. Three layered mechanisms are specified, in order of preference:
At least two of these mechanisms must agree, or a single UWB attestation must be present, for the proximity rule to be satisfied. The verifying party may apply additional heuristics — transfer velocity over time, coordinated movement patterns, device-attestation freshness — to detect spoofing attempts.
The proximity rule has three consequential properties: (a) it restores cash's local-circulation behavior to digital money, since digital flow becomes geographically-bounded by construction; (b) it inverts the digital-advertising economic logic, since platform discovery surfaces nearby small businesses (which can be re-tipped) rather than distant large businesses (which cannot); (c) it makes wandering — in the canonical Buddhist paribbājaka sense — economically meaningful, since each step a wanderer takes admits a new neighborhood to their gratitude-economic reach.
Humanity attestation in the specified mechanism operates at two layers, applied in series:
The recipient receives the gratitude expression and any attached monetary value, but is not informed of the sender's identity. The system retains the sender's verified identity for adversarial-pattern detection, regulatory compliance, and limited audit purposes — but does not surface it to the recipient under any normal interaction. The recipient sees only: the gratitude content; the verified humanity-attestation; the attested proximity at time of transfer.
The combination of (a) per-action biometric humanity attestation, (b) cryptographic physical-radio proximity attestation, and (c) recipient-side anonymity is, to the author's knowledge, not previously published as a unified mechanism. Existing digital-payment systems have at most two of the three: cash has anonymity and proximity but no humanity verification (any actor can spend cash); Worldcoin has humanity verification but not proximity and not recipient anonymity; contactless payment apps have proximity but not anonymity and not per-action humanity verification; privacy-preserving cryptocurrencies have anonymity but not proximity and not humanity verification. The combination is the defended invention of this publication.
The combination of proximity and verified-human anonymity is more than the sum of its components. Each property alone is well-explored; their combination produces emergent properties:
We sketch a reference architecture without claiming any specific implementation as canonical. Variations consistent with the three structural properties (per-action humanity attestation, proximity attestation, recipient anonymity) fall within the scope of this defensive publication.
The recipient receives a per-transfer pseudonym for the sender, derived deterministically from the sender's identity and a per-recipient salt, such that repeat transfers from the same sender to the same recipient appear under a stable pseudonym (allowing relational continuity) without disclosing identity. Different recipients see uncorrelated pseudonyms for the same sender.
function sendGratitude(recipient, content, amount?) {
// 1. Establish proximity via UWB (preferred) or BLE
const proximityProof = await measureProximity(recipient);
if (!proximityProof.withinRadius(densityAdjustedRadius()))
throw new ProximityError();
// 2. Build transfer payload
const payload = {
recipient: recipient.publicId,
content,
amount,
proximity: proximityProof,
timestamp: now()
};
// 3. Biometric-gated signing via WebAuthn
const signature = await navigator.credentials.get({
publicKey: {
challenge: hash(payload),
userVerification: "required" // forces biometric
}
});
// 4. Submit to verifying party
return submitTransfer({ payload, signature });
}function verifyTransfer(transfer) {
// 1. Verify FIDO2 signature
if (!verifyWebAuthnSignature(transfer.payload, transfer.signature))
return reject("invalid_signature");
// 2. Verify per-action user-presence + biometric flags
const flags = transfer.signature.authenticatorData.flags;
if (!flags.userPresent || !flags.userVerified)
return reject("user_not_present");
// 3. Verify proximity attestation
const r = densityAdjustedRadius(transfer.payload.location);
if (!verifyProximityProof(transfer.payload.proximity, r))
return reject("proximity_failed");
// 4. Adversarial heuristics
if (detectCollusion(sender, recipient)) return reject("collusion");
if (rateLimitExceeded(sender)) return reject("rate_limit");
if (codedMessageHeuristic(transfer)) return flag("coded_message");
// 5. Settle and deliver
const pseudonym = derivePseudonym(sender.id, recipient.salt);
if (transfer.payload.amount)
settle(sender, recipient, transfer.payload.amount);
deliverToRecipient({
pseudonym,
content: transfer.payload.content,
proximity: transfer.payload.proximity
});
}Two parties may collude by repeatedly tipping each other, attempting to launder value or fabricate social signal. The verifying party detects this via graph analysis: bidirectional flow exceeding a threshold ratio, repeating co-location patterns outside normal social graphs, near-equal balance flow over time. Detected collusion results in rate-limiting, transfer reversal, or aura penalty.
A sender may attempt to communicate a covert message via the transfer amount (e.g., $1.34 as a timestamp; $99.99 as a coded signal). The verifying party applies entropy and pattern heuristics to flag suspected coded messages for review and may quantize amounts to defeat fine-grained covert channels.
A bad actor in physical proximity may attempt to harass a recipient via a burst of anonymous unwanted thanks. The mechanism mitigates this via per-pseudonym rate-limiting (the same pseudonym cannot exceed N transfers per recipient per period) and recipient-side block lists by pseudonym. Repeated harassment escalates to the verifying party with the underlying identity revealed for adversarial action.
A sender may attempt to fake their location via GPS spoofing to satisfy the proximity rule. The mechanism rejects GPS-only attestations when UWB or BLE is available; cross-references cell tower signal strength; analyzes signal multipath; and rejects velocity-implausible movement patterns.
FIDO2 signatures include a per-signing nonce signed alongside the payload, preventing replay of historical signatures. Proximity attestations include freshness timestamps; stale attestations are rejected.
Per-jurisdiction regulatory variance is handled by configurable thresholds: small anonymous transfers are unconstrained; transfers above a configurable threshold trigger optional verification escrow with progressive identity disclosure to the recipient as required by local law. The structural anonymity is preserved at the social layer; legal compliance is layered on top.
High-end deepfake plus stolen device with biometric bypass remains a residual attack on per-action FIDO2 alone. The DNA-verified family-tree layer — Layer 4 of the B-PoH℠ protocol specified in the companion paper B-PoH℠ as Humanity Layer for the AI-Native Internet — closes this gap by binding the FIDO2 identity to a biologically-verified human kinship graph.
The mechanism specified here addresses the gratitude-transfer primitive but leaves several related questions for separate work:
| Venue | Identifier |
|---|---|
| Primary canonical | <https://thonly.org/research/verified-human-anonymous-local-giving> |
| Institutional mirror | <https://heartbank.net/research/verified-human-anonymous-local-giving> |
| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/verified-human-anonymous-local-giving.md> |
| arXiv preprint | _identifier to be assigned_ (cs.CR / cs.CY) |
| IP.com Defensive Publication | _identifier to be assigned_ |
| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/verified-human-anonymous-local-giving> |
| archive.today | _identifier to be assigned_ |
| perma.cc | _identifier to be assigned_ |
The author acknowledges his father, with whom the Khmer transcription of the Tipiṭaka is being undertaken; the Cambodian Theravāda Saṅgha, whose lineage carries the canon that grounds this work; the survivors and descendants of the Cambodian genocide of 1975–79, whose civilizational rebuilding is the soil this publication grows from; the foundational thinkers in community currency, proof-of-personhood, and Buddhist economics whose work is cited above; and the autonomous artificial intelligence community whose alignment work this publication intends to contribute to in the spirit of the bodhisattva path.
— End of defensive publication —
Document SHA-256 to be computed at publication and cross-published to all mirror venues.