Civilization Seed Vault

Start here

Three names, one job each.

Civilization Recovery Protocol is an open standard: how devices find each other, keep a family's traffic private, let a lost person be found, record a community's trade without money, and keep time when the satellites stop. Civilization Seed Vault is a kit that implements it. CIV-SV-01 is the kit's model number. Nothing has been built yet, and every number on this page is an estimate until a prototype measures it.

You want the device

Keep reading. The spec strip above is the buying decision in six numbers; "Straight answers" further down is what it refuses to be. The kit section shows what's in the case and what isn't, on purpose.

You want to build one

Read the specification, then the rationale — every decision with what was rejected and what it costs. The prototype path is in dependency order and step 2 is where the project can be killed cheaply. A printable enclosure for a Bambu P1S is in the repo, with a filament guide.

You want to implement the Protocol

Read the Protocol draft. Conformance levels are in §15; a phone with compatible firmware can be a Node without a ledger. Ledger sync and key rotation are the sections expected to change after the first two-node test, and §16 lists what that test decides.

Want to help? In order of value: a clinician or agronomist to review playbooks; a partition test of the ledger merge on two off-the-shelf LoRa handhelds; a source for plastic-substrate, front-lit e-paper; a Class 9 trademark search before anything is printed. The full orientation is in Start here.

What it does

Three screens you'll actually use.

Everything on the device is reachable with the big nav pad, gloves on. Every answer says where it came from.

Water — purification

Filter cloudy water through cloth
Boil one minute (three above 2,000 m)
Or two drops of plain bleach per litre, wait 30 min
Or a clear bottle, six hours in full sun

Source: Water treatment — open

Playbooks: checklists and decision trees for water, fire, shelter, bleeding, burns, childbirth, a lost person, a trade dispute. Human-reviewed. Zero-power reading.

Locate

DAD — 640 m

fix 2 min old · tier: GPS

SweepSound & strobe

Beacon every 30 s · battery 61%

Locate: a compass arrow while satellites last, the community's own surveyed nodes and a signal sweep after that, and a command that makes the lost device sound and strobe for the last hundred metres.

Market — Ridge

OFFER  Eggs, dozen        0.5 h  Maria
WANT   Chainsaw sharpen   1.0 h  Tom
OFFER  Tomato seedlings   0.3 h  Ana
OFFER  Well pump repair   ask    Luis

Your balance +4.5 h · limit −40 h

Market board and mutual-credit ledger: offers, wants, a price history, and a balance in hours. Not money. Nothing minted, nothing converted, nobody in the middle.

Knowledge

Search first. Generate last.

What it takes to restart: water, fire, shelter, first aid and trauma, childbirth, sanitation, food preservation, seed saving, staple crops, hydroponics, solar and batteries, basic electricity, small engines, navigation, radio. On e-paper, at near-zero power. The library is the truth. The language model is the librarian, and it's rationed — it runs only when search comes up empty, and it tells you what it will cost in battery first.

Layer 1 — near-zero power

Keyword search over a two-gigabyte essentials library on the always-on half. Playbooks. Calculators for chlorine dosing, rehydration solution, weight-based dosing, solar sizing, planting dates. Deterministic, reviewed, cited.

Layer 2 — cheap

Full-text search over the whole library: Wikipedia, WikiMed, field manuals, agriculture and appropriate-technology collections. Then a bank of tens of thousands of pre-written, cited answers. A question is one lookup, under a second, no generation.

Layer 3 — rationed

A four-billion-parameter model for synthesis and badly phrased questions. It answers only from retrieved passages, quotes dosages instead of computing them, and ends every answer with the article it came from.

Power

Alive on sunlight. Honest about the arithmetic.

Two halves. The always-on half — mesh, radio, reader, beacon, ledger — must live on the panel on the device's back. The compute half is switched off until asked.

Radio 1.5

Browse 1.0

Voice 0.7

0.4

0.3

0.6

Radio mesh listening, clock, ledger Browse 30 min on the compute half Voice 10 min transmit, 1 h listen 0.4 ten searches 0.3 flashlight 0.6 reading, night light, language model

4.5 Whwhat a moderate day costs

5–8 Whwhat the back panel makes in decent sun

30–40 Whwith the fold-out panel from the kit

No sun for a week: four to five days at that pace, fourteen days if only the radio half runs, and about three days of beacon on the last ten percent of the cells. The cells are LiFePO4 because they survive thousands of cycles; the charger will also take scavenged lithium-ion 18650s in adapter sleeves, because in ten years that's what will be lying around.

Comms

Talks to what people already own. Keeps what's private, private.

A LoRa mesh that speaks Meshtastic, so your family's devices and a neighbour's node are the same network. A push-to-talk UHF radio that works with the cheap handhelds people already have. An AM, FM and shortwave receiver on a wire you string to a tree.

Diagram: two family handhelds linked on the family channel and by UHF voice, a neighbour's phone with a Meshtastic node relaying on the open channel, three community anchor nodes at a barn, a well and a ridge, a lost device beaconing, and three GNSS satellites feeding position while they last. — Diagram, drawn from the specification, not AI-generated. One family, one community, one mesh: family and community channels, a stranger's node relaying what it can't read, anchors for positioning after the satellites, and a beacon being found.

Read it left to right

Dad and Mom carry family devices. Their messages and positions ride the family channel, encrypted with a key only their kit holds; within a kilometre or so they can simply talk, on push-to-talk UHF that is plain voice by law — the manual says so, and the screen says so.

The barn, the well and the ridge each have a community node at a surveyed spot. They carry the community channel — the market board, the ledger, notices — and they are the anchors that place a device by signal strength once the satellites are gone. A community surveys its anchors while GNSS still works, which is a chore the quick-start has to sell.

The neighbour's phone with a stock Meshtastic node holds none of the family's keys and relays their packets anyway, because a mesh relays what it can't read. That is the whole reason to speak Meshtastic: a stranger's hardware makes the family's network bigger without being trusted with anything.

The device on the hill

It is beaconing — every thirty seconds for the first hour, then every two minutes, then five — because its battery is the one that matters, and below ten percent it drops everything else to keep transmitting, for about three days. Dad's Locate screen shows bearing and distance while the satellites last, signal strength from the three anchors after that, and the last hundred metres by a command that makes the lost device sound and strobe.

The satellites are dashed because they are borrowed. The device only listens to them; it cannot keep them up. They stay accurate for a couple of weeks after their ground segments stop and useful for months — the window when people are scattered — and then what is left is the sky, a clock and a map, which the device also carries.

Nothing in this picture leaves the mesh. A registered 406 MHz beacon reaches satellite search-and-rescue; this reaches the people who already know your name.

Channel	Who	Used for
Open	Anyone on the same region preset	Discovery, interop, a beacon of last resort
Community	Vouched devices, shared key	Market board, ledger, notices, voice notes
Family	The kit's devices, shared key	Messages, positions, beacon
Direct	One device to one device	Private messages, co-signing, key rotation

Encrypted where it's legal, plain where it isn't

Everything private rides the mesh, where encryption is allowed on the unlicensed band. The UHF voice radio is a party line by regulation, and the manual says so. Keys are exchanged over a pairing cable or a six-digit PIN — no camera, no cloud — and the family's root key lives on a sealed paper card in the case and nowhere else.

Lose a device, keep the family

Mark it lost. Every other device drops its keys and receives a new family key individually, encrypted to its own identity, so the lost handheld can't read its own replacement. Optionally wipe it remotely; it keeps beaconing in the clear, because being found beats being private.

Find

Hold one button. Be found.

Beacon on the lost device; Locate on the seeker. The beacon backs off over time because the lost device's battery is the one that matters, and below ten percent it drops everything else to keep transmitting — about three days.

Diagram, drawn from the specification, not AI-generated. Three tiers, in the order the seeker falls through them, and the beacon schedule underneath.

Bearing and distance

Both devices have satellite positioning: a compass arrow, a distance, the age of the fix. Four constellations, not one, because they'll fail on four different days.

Anchors and sweep

When the satellites go, the community's own mesh nodes at surveyed spots — the well, the barn, the ridge — place a device to about a hundred metres by signal strength. No anchors in range: turn slowly, let your body shadow the antenna, get a rough bearing. Finds someone in a field or a building, not under snow or rubble, and the screen says so.

Sound and strobe

The last hundred metres: the seeker commands the lost device to blast its speaker and strobe its flashlight, overriding every battery lockout.

There is no citizen-run GPS and there can't be one: positioning satellites need atomic clocks in orbit and a ground segment that uploads corrections every day. When that stops, the receivers stay accurate for about two weeks and useful for months, which is exactly the window when people are scattered. After that, what's left is what worked before 1990: the sky, a clock, and a map. The device carries the almanac and computes sun, moon and star positions itself; the kit carries a plastic sextant; the clock is temperature-compensated and keeps time from satellites while they last, from shortwave time signals while they last, and from the moon after that.

Trade

A ledger for a town without cash.

Every balance starts at zero. A trade is one record signed by both devices; one signature is a proposal, two make it real. You can go negative up to a limit the community sets, and the other person's device shows your balance before it agrees to sign. Nothing to mint, nothing to double-spend, nothing to steal.

Records copy themselves around the community channel and merge, so every device holds the whole history and a lost handheld loses none of it. Membership is a vouch. Disputes are a flag everyone can see and a correction both sides sign. The unit is hours — legally boring before a collapse, and the one thing that still has a price after.

Design perimeter, stated once: no conversion to cash, no operator, no fee, no custody, no token. Before a collapse it's a timebank with a noticeboard.

The Protocol

The last three sections are a standard, not a product.

Channels, beacon, locate, the ledger, vouches, the playbook format, how the clock keeps time — those are rules two devices follow to work together, and they are published as the Civilization Recovery Protocol: open, implementable by anyone, on any hardware, owned by no one.

Why open

A family's second device might be a phone running Meshtastic. A community's anchor nodes might be someone else's hardware. A standard nobody owns is the only one a stranger's device will ever speak, and a recovery protocol that only works with one vendor's kit isn't a recovery protocol.

Three names, one job each

Civilization Recovery Protocol is the standard. Civilization Seed Vault is the kit — the reference implementation, the thing in the case. CIV-SV-01 is the model. The Protocol is published as a 0.1 draft — read it — with the sections most likely to change after the first two-node test marked as such, because a standard has to start somewhere.

Built to fix

Ten years outdoors, and every seal is a consumable.

Back of the device: the whole rear face is a solar array under glass, with a small latch at the bottom and capped ports on the side. — The back is the panel. The only other thing on it is the cell-bay latch.

The cells slide in from the bottom, flashlight-style, behind a cap with one O-ring and a latch you can work in the cold. No screws. No headphone jack — it was the weakest seal on the device. No telescoping antenna — it was the part most likely to break. Spare seals ride in the case, and you inspect the O-ring every time you swap cells.

IP68defined: 1.5 m of fresh water for 30 min

516.826 drops from 1.22 m; the radio may not reset

512.6immersion, run on a printed prototype before tooling

−20 to 55 °Coperating; audio and lights carry on below the screen's limit

Tested by named MIL-STD-810H methods — low pressure, temperature extremes and shock, rain, humidity, fungus, salt fog, sand and dust, immersion, vibration, drop, icing — with pass criteria written before testing. "Mil-spec" has no certifying body, so the word isn't used.
An aluminium frame carries the cells, the compute module, the antenna mounts and the drop loads, and spreads five watts of heat through the side rails so nothing is hot under your palm.
Plastic-substrate e-paper, because glass panels crack in drop tests. Conformal-coated board. Standard Torx screws, no adhesive.

Exploded illustration: front glass, e-paper panel, front shell with keyboard, antennas, main board, aluminium frame with cell bay, two cells, end cap with O-ring, rear shell with solar array. — Nine parts, in order. Illustrative — the engineering drawing comes from the CAD once the frame exists.

The end cap swung open on its latch, showing the O-ring and two LiFePO4 cells sliding out. — One latch, one O-ring, two cells. The seal gets inspected every swap.

Parts sheet: line drawings of all twenty-one printable parts of the prototype enclosure, each labelled with name, quantity, material and size. — Drawn from the parametric CAD, not AI-generated. Every printable part of the prototype enclosure: tub, lid, cell bay, end cap and latch, bumpers, buttons, caps, gasket, keypad. Twenty-one parts, four filaments, no supports. Open the sheet.

The kit

A civilization starter kit that fits in one case.

The open hard case, packed, every item in its own foam cavity. — Packed. Interior about 30 × 22 × 13 cm.

In the case

The device, with a spare LoRa stub and UHF whip — whips break.
A 10 W fold-out solar panel.
Two spare LiFePO4 cells.
A spare microSD with the always-on image, and a spare SSD with the full library.
A 75 cm FM wire and a 10 m shortwave wire, each with plug, insulator and clip.
A plastic sextant. The device is the almanac; this is the instrument.
A sealed headset, a USB-C cable, a pairing cable.

And the parts people forget

A seal kit: O-rings, port caps, membranes.
An AA flashlight and a Torx driver.
A sealed recovery card holding the family root key — the one thing that never lives on a device.
A printed quick-start: swapping cells and seals, re-imaging, beacon and locate, channels, the ledger, stringing a wire antenna.
Recommended, not included: a registered 406 MHz personal locator beacon, and a paperback of Lewis Dartnell's The Knowledge — the canonical reboot curriculum, which can't be bundled but survives anything the device doesn't.

The family case

The kit a family actually buys is four devices and one set of everything else. Most of the case is per-family, not per-device — the recovery card, the pairing cable, the sextant, the wires, the seal kit — so four single kits duplicate all of it and leave the family's root key with no single home. The family case has four slots, one shared accessory set, a four-port hub fed by a larger panel, and a cradle under each device: drop it in on its port rail and it's charging.

Straight answers

Five things it isn't.

Not a rescue beacon

A registered 406 MHz PLB reaches satellite search-and-rescue. Nothing here leaves the mesh. If the scenario is "hurt and alone in the backcountry," buy the PLB — the quick-start says so on page one, and the word "emergency" never appears on the beacon screens.

Not money

The ledger records credit between people. Nothing is minted, sold, converted or held for anyone. No operator, no fee, no token. The screens say credit and hours, never coin or wallet.

Not a phone

No camera, no cellular, no cloud, no app store, no touchscreen, no sealed battery. A rugged phone plus a Meshtastic node does most of this cheaper — until the battery is three years old and the network is gone.

Not "mil-spec"

There is no body that certifies that phrase. The test methods are named, the pass criteria are written before testing, and the drop and immersion tests run on a printed prototype with a live board inside before any tooling is bought.

Not yet certified

The UHF voice module as specified is a homebuilt transmitter on FRS/GMRS frequencies with no type acceptance, which cannot be sold to the public in the US; pre-collapse it is legal only under a GMRS or amateur licence. The LoRa side has an open certification question of its own. Both are in the spec and the RF document, and both are resolved — by certified modules, a licensed-operator add-on, or removal — before this is a product rather than a design.

Status

Working design. Nothing built yet.

Every number on this page is an estimate until the prototype measures it. This is the order the measuring happens in.

Two off-the-shelf LoRa handhelds and two candidate Linux boards on a bench.
Search and the answer bank against the medical library; measure lookup and model speed on both boards; pick one from the numbers.
Wire the two halves together; log real power for twenty-four hours.
Channels and pairing, then Beacon and the signal sweep, field-tested for bearing accuracy.
Ledger and market board across four nodes, with a deliberate partition to prove the merge.
The first ten playbooks and five calculators, reviewed by a clinician and an agronomist.
E-paper, tuner, UHF module and lights on the real board; prove the transmit interlock with the radio keyed at full power beside the other antennas.
Frame, cell bay, printed enclosure; drop, immersion and thermal tests with a live board inside. No tooling until a season of field use.

Open questions, kept in the open

Language-model throughput on the Rockchip NPU, and whether speech recognition runs on it well enough to matter.
Whether the always-on half really averages 60 milliwatts with the mesh listening and the ledger gossiping.
Sourcing e-paper that is plastic-substrate, front-lit and industrial-temperature at once, in small quantities.
The error rate of a generated answer bank with two hundred thousand entries.
Whether an off-the-shelf quarter-turn latch holds seal compression at −40 °C.
How long the cell contacts bounce open in a drop.
Bearing accuracy of the signal sweep at 915 MHz with a body-shadowed handheld.
AM reception from a ferrite rod inside an aluminium frame under a solar array.
Whether a limiter alone protects the broadcast receiver when a ten-metre wire is attached and the UHF radio transmits beside it.
How a non-convertible, operator-less ledger is classified where it's sold. A lawyer confirms before sale.
Real solar yield in the owner's climate, and cell temperature under a full-face array in an olive shell.

Documents

The spec is the source of truth.

Start hereWhich reader you are, how the documents fit, how to help. Civilization Recovery Protocol, draft 0.1The open standard: transport, keys, channel tiers, beacon, locate, ledger, market, playbooks, time, conformance. Specification, v0.5Hardware, software, comms, economics, kit, prototype path. Design rationale, v0.5Thirty-three decisions, each with what was rejected and what it costs; what forecloses options; what isn't known yet. RF and mesh technical design, draft 0.1For an RF engineer to validate: airtimes, traffic model, link budget, power, coexistence, regulatory questions. Ten questions at the end.

When the network goes away, this doesn't.