Normative

"Play up, play up, and play the game." — Vitai Lampada

HASHCLUE: PROTOCOL CONSTITUTION v1

Normative Reference: This Constitution is the supreme governing document of HashClue. The HashClue Protocol Specification v1 ("the Spec") implements the rules declared here. Where this Constitution cites a Spec section, the citation identifies where the technical detail resides; in any conflict, this Constitution prevails.

HashClue is a perpetual cryptographic treasure hunt that exists to maintain a single, continuous global challenge in which participants attempt to discover a hidden real-world location by submitting exact guesses of a canonical secret string whose cryptographic hash is publicly known. HashClue is not a game service, not an entertainment product, and not an interactive narrative; it is a mechanism whose sole purpose is to provide a fair, open, and mathematically verifiable way for human insight and deduction to be converted into a provable winning claim on a pooled prize.

Each active round of HashClue is defined by three and only three objects: a real-world physical cache location, a canonical secret string that encodes that location, and a public cryptographic hash of that string. The canonical secret string format is HC1, defined and locked in the Spec. The hash function is SHA-256. No other hidden objects exist within a round, no secondary secrets exist, and no parallel puzzles exist. A round is solved if and only if a participant submits a guess whose canonical string produces the published hash under SHA-256. There are no partial wins and there are no approximate matches; victory is binary. Victory determination is purely mechanical: a submitted guess is normalized according to the HC1 rules, hashed using SHA-256, and compared to the public hash. If the result is equal, the submission is a winning solution; if the result is not equal, the submission is not a winning solution. No human judgment, interpretation, or discretionary validation exists at any stage of this process.

At any moment in time there exists exactly one active round, and that round remains active until it is solved. A new round may begin only after a valid solution to the previous round has been verified, and HashClue never operates multiple concurrent rounds.

All information required to independently verify a winning submission must be publicly available, and any third party must be able to verify a claimed solution without contacting any operator, steward, or organization. All participants interact with the same system under identical conditions: there are no private clues, no privileged channels, and no special access classes. Any information released by the protocol is released publicly and becomes available to all participants simultaneously.

HashClue makes no promise of profit, yield, or return. Participation is voluntary, and HashClue does not characterize participation as an investment.

EOA-Only Participation

Participation in HashClue is restricted to externally owned accounts (EOAs). Contract addresses, including smart wallets, multisig wallets, account-abstraction wallets, bots, and automated contracts, are not permitted to interact with the protocol, submit guesses, unlock clues, receive payouts, or hold protocol roles, and any interaction originating from a contract address will revert on-chain. This restriction exists to preserve deterministic settlement and prevent payout-blocking or griefing behaviors.

Charitable Allocation

HashClue includes a fixed charitable allocation by design. A defined percentage of each winning pot is routed to a designated charity wallet at resolution. This allocation is structural, non-discretionary, and independent of authority control. It does not alter the for-profit, creator-operated nature of the system.

Design Ethos & Non-Goals

This section declares what HashClue does not attempt to provide and the boundaries of its design intent.

HashClue is adversarial by design. The protocol assumes that participants may act in competition with one another and does not seek to prevent, constrain, or penalize adversarial behavior among participants.
HashClue prioritizes deterministic resolution under identical rules. All participants operate under the same published mechanism; the protocol does not guarantee fairness, equality of opportunity, or protection from the strategies of other participants.
All material risks of participation are intended to be disclosed within this Constitution and the Spec rather than concealed. The protocol's obligation is transparency of rules, not mitigation of outcomes.
The protocol recognizes outcomes mechanically, without regard to the intent, morality, or method of information acquisition employed by any participant.
Participation is voluntary and informed. No aspect of the protocol compels entry, and continued participation constitutes acceptance of the rules as published.

HashClue is stewarded, not governed. There exists a steward persona known as The Cartographer, who serves as the custodian of continuity for the mechanism. The Cartographer's legitimate functions are limited strictly to publishing hashes, publishing rules, maintaining infrastructure, and releasing public clues according to declared mechanisms. The Cartographer possesses no authority over outcomes, does not control truth inside the system, cannot determine winners, cannot prevent valid wins, cannot approve or reject solutions, cannot modify verification, and cannot alter active rounds. The Cartographer is bound by the same rules as all participants and is subject to the same verification process. The Cartographer is not an owner of HashClue, not an administrator of outcomes, and not a final authority; The Cartographer is the first caretaker of a machine that does not obey him.

Stewardship & Continuity

The Cartographer

HashClue has exactly one Cartographer at any time. The Cartographer is a custodian, not a ruler. The Cartographer's authority is strictly limited to the functions enumerated in this Constitution: publishing cryptographic hash commitments, releasing public clues according to the Clue Ladder, maintaining protocol infrastructure, and publishing rules. The Cartographer possesses no authority beyond these functions and cannot control outcomes, prevent valid wins, approve or reject solutions, modify verification rules, or alter any active round. The Cartographer is bound by every rule in this Constitution and the Spec.

Scope of Continuity (Critical Limitation)

This continuity mechanism ensures that future rounds can be initiated after Cartographer disappearance. It does not guarantee recovery of funds locked in an in-progress round.

The on-chain contract requires msg.sender == cartographer for releasePayout(), enterDormancy(), and markVoid(). If the Cartographer's key is lost or the Cartographer becomes unavailable while a round is active:

The pot in that round may be locked permanently
No payout can be released without the original Cartographer key
The successor Cartographer cannot execute functions on the prior round's contract

This is a known, accepted risk of the v1 contract architecture. Succession transfers authority over new round deployment, not control over existing deployed round contracts. Participants are advised that mid-round Cartographer loss may result in permanent fund lock.

Liveness Requirement

The Cartographer demonstrates continued availability through on-chain activity. A heartbeat is any transaction originating from the Cartographer's wallet address on the same blockchain as the HashClue contract. The transaction value MAY be zero. No specific calldata or destination is required.

Liveness is evaluated on a rolling 90-day window. The Cartographer is considered live if at least one heartbeat has occurred within the preceding 90 days.

Automatic Succession

If the Cartographer fails to produce a heartbeat for two consecutive 90-day intervals (approximately 180 days of silence), automatic succession is triggered. Automatic succession is:

Deterministic: The successor is computed algorithmically from on-chain data
Permissionless: Any observer may verify the trigger conditions and the correct successor
Silent: No announcement, ceremony, or acknowledgment is required
Unarguable: There is no appeal, no voting, no community intervention, no discretion

Upon trigger, the first eligible successor in the deterministic ordering becomes the new Cartographer. The liveness requirement applies to all future Cartographers without modification.

Eligibility

Only previous round winners are eligible to become Cartographer through automatic succession. Eligibility is determined by the PayoutReleased event having been emitted for the address as the winner of a completed HashClue round.

The following are explicitly not eligible:

Addresses that have only purchased clues
Addresses that have only submitted guesses (without winning)
Addresses that have spent funds in the protocol but never won
Addresses that have renounced eligibility

Eligibility is objective, finite, and verifiable from on-chain event history.

Deterministic Successor Ordering

Eligible winners are ordered by the following criteria, applied in sequence:

Ascending total lifetime winner payout. The address with the smallest cumulative winner payout across all rounds is ranked first. This favors new winners over repeat winners.
Earliest first win block number. Among addresses with equal lifetime payout, the address whose first win occurred at an earlier block number is ranked first.
Lexicographic wallet address. Among addresses with equal lifetime payout and equal first-win block, the address that sorts first lexicographically (lowercase, 0x prefix) is ranked first.

The first eligible address in this ordering that has not renounced becomes the successor.

Renunciation

Any eligible winner may permanently renounce eligibility for succession. Renunciation:

MUST be an on-chain transaction from the renouncing address
MUST be on the same chain as the HashClue contract
MUST include calldata beginning with HASHCLUE_RENOUNCE_V1
Transaction value MAY be zero
Is permanent and irreversible

A renounced address is permanently skipped in the successor ordering. Renunciation cannot be undone. Validity is determined solely by (a) tx sender address and (b) calldata prefix match. Off-chain statements, social media posts, or other publication methods do not constitute valid renunciation.

Voluntary Abdication

The Cartographer may voluntarily abdicate at any time. Abdication:

MUST be an on-chain transaction from the current Cartographer address
MUST be on the same chain as the HashClue contract
MUST include calldata with the format HASHCLUE_ABDICATE_V1|successor=<address>
The named successor MUST already be eligible under the winner-only rule
Transaction value MAY be zero
Is effective immediately upon inclusion in a canonical block on the same chain. For avoidance of doubt, no finality depth, confirmation count, or off-chain interpretation is required.
Is irreversible

Upon abdication:

The named successor becomes Cartographer immediately
The abdicator's liveness obligation terminates immediately
The liveness requirement applies to the new Cartographer without modification

Validity is determined solely by (a) tx sender address and (b) calldata prefix match. Off-chain statements, social media posts, or other publication methods do not constitute valid abdication.

There are exactly two mechanisms for succession:

Voluntary abdication. Immediate transfer to a named eligible successor
Automatic succession. Triggered by liveness failure (~180 days)

No other succession path exists. The prior succession declaration mechanism (transfer by signed declaration with future effective date) is superseded by this amendment.

Limits of Succession

Succession, whether automatic or voluntary, transfers only the custodianship of publication and infrastructure. No additional powers, privileges, or authorities are conferred. The successor Cartographer is bound by every rule in this Constitution. Succession does not and cannot:

alter any active round,
modify any past round or its verification outcome,
change the canonical secret string format (HC1),
change the hash function (SHA-256),
modify any immutable parameter enumerated in the Spec (§7), or
confer any discretionary authority over outcomes, verification, or funds.

Dormant-State Rule

If no valid Cartographer exists and no eligible successor exists (because all eligible winners have renounced or no rounds have been won), HashClue may remain dormant indefinitely. Dormancy does not violate this Constitution. During dormancy, all existing rounds, all verification rules, all committed hashes, and all immutable parameters remain in force. Any active round at the time of dormancy remains active and solvable; a valid preimage submission still wins. Dormancy affects only the publication of new rounds and new clues.

HashClue does not require maintainers or custodians to exist in order to remain valid, operative, or legitimate, and the absence of maintainers does not constitute a failure or breach of this Constitution. If maintainers exist, their authority is strictly limited to preserving implementation correctness, infrastructure continuity, and verifiability of the protocol as written; they possess no authority to alter, reinterpret, extend, optimize, rebalance, or otherwise modify protocol rules, economics, trust assumptions, lifecycle semantics, or the behavior of any active or historical round. Maintenance does not confer authorship, stewardship, governance, discretion, or interpretive mandate, and no maintainer may claim authority to "improve," "fix," or "evolve" HashClue; any change to meaning or guarantees requires an explicit new protocol version and cannot occur retroactively or implicitly. If no maintainer exists, HashClue may continue unchanged, execute mechanically, or enter dormancy without violation of this Constitution.

Once a round begins, its defining elements become immutable. The public hash is immutable, the secret string is immutable, the hidden location is immutable, and the verification rules for that round are immutable. If an error is discovered, it may only be addressed in future rounds, and no retroactive modification is permitted.

The following properties are foundational to the identity of HashClue: one hidden location, one secret string, one public hash, exact-match victory, deterministic verification, public rules, and one active round at a time. If any of these properties cease to hold, the system no longer constitutes HashClue.

HashClue is designed to persist independently of any single operator or organization. HashClue seeks permanence, and its success is defined as the continued existence of the mechanism over time.

This document defines HashClue. Nothing outside this document overrides it.

The Office of the Cartographer

The Office of the Cartographer is the delegated administrative structure through which the Cartographer may administer the protocol. It is not a governing body and holds no independent authority. All authority exercised through the Office originates with, and remains vested in, the Cartographer alone.

Officers act solely on delegated authority. No officer holds independent, collective, or originating authority, and no combination of officers may exercise authority beyond what the Cartographer has individually delegated.

All offices are created, filled, and vacated at the discretion of the Cartographer. Appointments are revocable and confer no tenure, entitlement, or continuity beyond the Cartographer's ongoing delegation. An office may remain vacant indefinitely without impairing the structure or authority of the Office.

The existence of the Office does not limit, divide, or condition the Cartographer's authority.