A protocol for cultural archives that keep working when the server is gone, the funding stops, or the network goes down. Written to be forked and run by people who will never meet each other.
STATUS — Draft. No reference implementation. Nothing is running yet. This page is the specification, published so it can be built, forked, and argued with.
There is nothing here to sign up for. There is no instance to join, no organisation behind it, and no server that holds the canonical copy.
What follows is a description of a file format and five rules about how to pass it around. If you implement it, you have a node. If someone else implements it differently and you can still trade material with them, the protocol did its job.
It is deliberately small. The entire mandatory core is one manifest file, one hash function, and one guarantee about physical media. Everything a real archive needs beyond that — cataloguing, search, moderation, curation, design, community rules — is intentionally left undefined, because those are the parts every community must be free to answer differently.
Not through censorship, usually. Through a lapsed domain, an unpaid invoice, a hard drive in a closet, an institution reorganising, a platform deciding the category is unprofitable. One copy in one place under one budget is not preservation. It is a countdown.
The three properties below are not features. They are the minimum required for material to outlive the people and money currently maintaining it.
Every participant can hold the whole archive. If one node disappears, the culture does not disappear with it. There is no copy whose loss is fatal, and therefore no copy worth attacking, seizing, or buying.
Material is split into verifiable pieces and retrieved from many peers at once. Demand creates capacity instead of consuming it: the more people want something, the more places it exists and the faster it travels.
No continuous connection is assumed anywhere in this protocol. A phone, a community node, a USB drive, or a local Wi-Fi link holds a bundle now and passes it onward whenever contact next becomes possible — in an hour or in a year.
The unit of exchange is a bundle: a plain directory containing a manifest and a flat store of content-addressed files. It is not a database, not an archive format, and not a container. This is the single most important decision in the protocol, and every other property falls out of it.
Because a bundle is an ordinary directory of ordinary files, it can be copied by any tool that has ever copied files — cp, rsync, a sync client, a torrent, a file manager, a phone plugged into a laptop. No implementation has to agree with any other about anything but the layout.
bundle/
├── commons.json the manifest
└── blobs/
├── 4c1a9e2f… one file per work, named by hash
├── b70f2213…
└── e0d84a97…
The manifest is UTF-8 JSON. Core keys are fixed; anything else is namespaced and ignorable.
{
"rcp": 1,
"id": "sha256:9f2b6c04…",
"title": "Harbour Road Oral History",
"parent": null,
"works": [
{
"blob": "sha256:4c1a9e2f…",
"media_type": "audio/flac",
"title": "Interview 04 — the strike winter",
"contributors": ["A. Mensah", "recorded by J. Okonkwo"],
"recorded": "2026-02-19",
"rights": "CC BY-SA 4.0",
"duration_s": 3241
}
]
}
Every blob value is the hash of the bytes it names, so a file can be verified by anyone, offline, without asking a server whether it is authentic. A bundle that fails verification is not a trust question. It is a corrupt file.
A bundle's id is the hash of its own manifest, with the id field itself omitted and the remaining keys serialised canonically — sorted, UTF-8, no insignificant whitespace. The name of a thing is therefore computed from the thing. Nobody assigns it and nobody can revoke it.
This means any edit — adding a work, fixing an attribution, removing material a community has asked to withdraw — produces a different bundle with a different identity. The original is not overwritten, because nothing in this protocol can overwrite anything.
Set parent to the id you derived from and the two remain legible as a lineage rather than a conflict. Divergence is the expected condition of a network with no central copy, so the format records it instead of trying to resolve it. Two archivists who disagree do not need to win. They need to stay reachable.
An implementation may support any transport it likes. It must be able to read and write the third one, because that is the floor beneath which the network cannot fall.
A route may cross a fast internet link, pause for a week in someone's pocket, then continue over a community mesh. The protocol does not distinguish between these. Material moves whenever two parts of the network meet.
This is the whole contract. It is short on purpose: every additional requirement is a reason for two implementations to become unable to talk to each other.
This document is public domain. Copy it, rename it, cut what you do not need, and publish the result as your own without crediting anyone.
That is not generosity. A protocol you must ask permission to fork has a single point of failure in exactly the place this design is trying to eliminate — and a commons that one party can close is not a commons, whatever its licence says.
If your fork keeps the five rules, say so, and material will continue to flow between your network and everyone else's. If it breaks them, please call it something else. Not because a name is owned, but because the name is only useful while it still predicts whether two strangers can exchange a bundle.
Works carry their own rights. Placing this specification in the public domain says nothing about the licensing of anything anyone stores in a bundle, and implementations must not treat it as though it does.
A node is not software. A node is a complete copy, plus somebody willing to hand it on.
Two copies in two places is already a network. Everything after that is scale, and scale is the easy part.
a streaming platform
a permissioned library
a server with a kill switch
a living archive
a replicated memory
infrastructure for an oral commons
No registry, no steering committee, no canonical fork, no reference implementation, and no address to write to. Compatibility is determined by this text and by whether bundles actually move between two systems — never by a body that certifies anyone.
A version is identified by the hash of the specification document that describes it. Publishing a changed document creates a new version, and the old one keeps working for as long as somebody keeps a copy of it. The protocol is governed exactly the way it expects archives to be governed: by whoever bothered to keep a copy.
STATUS — RCP/1, draft. Written to be implemented; not yet implemented. If you build it, you are not joining a project. You are making a second copy of an idea, which is the only thing this document has ever asked anyone to do.