Say the same thing everywhere.
Shared messaging any supporter can pick up and post in their own voice — with a record of what was approved, by whom, and against which version of which policy.
A supporter in Whangārei and one in Invercargill should be recognisably saying the same thing, without either of them having to guess what is safe to say. The app advises as they write; it never stops them posting. The one thing it does stop is copy that cites policy the party has withdrawn — because that is a harm they cannot judge for themselves.
The risk is not that someone posts the wrong thing. It is that nobody uses it.
A library slower than writing your own post gets ignored, and an ignored library is worse than none — it creates confidence at the centre that the message is controlled when it is not. So the test this is built against is deliberate: if the checking were removed entirely, would people still use it? Everything below is arranged around that answer being yes.
Not every party can use this
A party may use it only if its own constitution, charter or equivalent founding document says two things — that evidence comes ahead of ideology, and that truthfulness binds the party and its members.
- Evidence ahead of ideology, as a principle the party holds itself to. Not that it values evidence — every party says that, and saying it costs nothing. That evidence comes first when the two pull apart, which is the only time the commitment is worth anything.
- Truthfulness binding on the party and its members, rather than on the organisation's public statements alone. The people doing the arguing are the ones this app puts words in front of.
- A route by which argument can change a position. Evidence ahead of ideology means little without a door for the evidence to come through: a named process a member can use to put a case, with the evidence for it, to whoever sets policy. The ordinary machinery is enough — remits, conference, a policy committee that accepts member proposals.
- In the founding documents, and they have to stay there. A statement of intent on a web page is not the test — it is written by whoever holds the pen this month. If a party removes the commitment, its access to this App goes with it.
- Competing and opposing parties can run side by side. The requirement is about how a party binds itself, not about where it sits.
- A short application, and expressly not an expression of interest. It asks for proof that can be validated: bona-fide status as a political party, and the constitutional commitment. Meeting the test makes a party eligible; each one is then enabled individually.
The test is published here in full and it is the same for every party, so a party that does not meet it can read exactly what would have to be true. Which parties have met it is not published — eligibility would read as endorsement, and this has to read the same to parties that oppose each other.
A party could write those words purely to get in. That is a smaller loophole than it looks: the words are what the app then holds it to, in front of its own members, every time anyone uses it. The admission test is a document; what follows it is a habit.
One — find something to post
What should I be saying today?
That is the question a supporter actually has — not "show me everything about tax". So the default view is what is live now, set by comms with a date window, and the rest is one tap away. Level and role are inferred from who you are; nothing is asked that can be known.
Two — write your own, and see what it flags
It names the clause, quotes it, and lets you post anyway
This is live — the same check the app runs. Type something, or use one of the examples. It is pattern matching, not judgement: it will miss things and it will flag innocent copy, which is exactly why it advises rather than blocks.
0 / 2000 characters
Three — the moderator's view
Submitted copy arrives with its flags already attached
Including the ones the author dismissed — dismissing costs one tap and no justification, but the moderator sees it happened. Escalation follows the party's existing chain, never a hierarchy invented by the app.
Four — why the register of approvals is the point
Approved against which version of which policy
Published policy moves. An approval that cannot say what it was approved against proves nothing later. Each approval records the copy, the approver, the moment, and the content hash of every policy it cites — so the party can show a line was approved properly against the policy in force at the time. That is the difference between a mistake and a scandal.
And when policy changes underneath it
The app checks on a schedule — hourly where it is configured to — and again at the two moments that matter: when someone opens a template to write with, and when they submit. Changed policy flags the template for a human. Nothing is auto-withdrawn. Withdrawn policy is the one case where the app stops someone.
How does the moderator find out? Today they pull rather than get pushed: the flags travel with the copy and are waiting in the queue when they open it. There is no email or notification yet — and how a party wants to be told, and how often, is a decision for the party rather than something to assume on its behalf.
The published pages carry no dates, no version numbers and no feed, so
content hashing is the only mechanism available — a workaround for missing metadata, not the
right answer. A Last-Modified header or a small feed would turn inference into
fact, and would serve journalists and members as much as it serves this.
The register of approvals is the party's own
Each approval records the copy, who approved it, when, and the content hash of every policy it cites. The history is append-only: a correction is a new entry, never an edit, and the model refuses updates and deletions rather than trusting anyone to remember the rule. So the party can show later what a line was approved against, and check for itself that the policy behind it is the one that was in force.
The data sits under New Zealand or EU jurisdiction, and the account of a decision is in one place rather than scattered across several vendors. What that is worth against the tools a party already uses is a judgement for the party and its own advisers.
Where this stands: each approval is cryptographically signed before it is saved, under a key belonging to this platform and specific to the party’s own Village — an unsigned approval cannot exist. Its fingerprint is also sent to an outside time-stamp authority, which receives the fingerprint and nothing else. That timestamp is obtained when the outside authority can be reached. Where the authority could not be reached, the approval still carries the date and time it was recorded, signed by this platform; the downloaded record states that no outside timestamp was obtained, and the platform keeps retrying the request in its six-hourly sweep. A party can download an approval as a folder holding the exact bytes the fingerprint covers, the signature, a page of commands, and — where each was available at the time — the signing key and the timestamp token, and check the lot on its own machine with openssl and a couple of ordinary shell tools, nothing of ours. The key belongs to this platform and is held for that Village, so what a third party checks without us is a supplier’s signature. Where a timestamp was obtained, it stands alongside that signature, and the two together are what a claim of back-dating has to contend with. The step beyond is the party holding its own key — a governance decision for the party before it is an engineering one, and today the engineering is a seam rather than a second provider. The timestamp is evidence a tribunal weighs, not a presumption it must accept.
Where the versions stand: the app opens and compares the versions of a message that carries more than one, and shows a moderator any claim that some versions make and others do not. Versions arrive from a party's library, once that library is built from its published policy. A member's own draft is submitted as a single version and stays that way — the app writes nothing in the member's name — so until a party's library is built, its own messages carry one version each.