UNRATIFIED

This piece started somewhere small. I built a rule-conflict engine for one village, the Rules Stack for Pingree Grove, Illinois: it reads the local ordinances against the state and federal law that overrides them and flags where they collide. Building it, I kept hitting the same thing. The documents did not just regulate the village. They said who counted as a resident, what that status granted, and which authority won when two rules disagreed. The rules were a constitution. This essay is what happens when you point that realization at the identity layer of digital public infrastructure.

A constitution does four things ordinary infrastructure does not. It defines membership, allocates rights, structures power, and is entrenched against easy change. The identity layer of digital public infrastructure does all four. It reaches entrenchment not through a supermajority amendment clause but through path dependence and service dependency. And it does all of this with no ratifying moment. That last gap, constitutional force without constitutional legitimacy, is the subject of this piece.

The title gives away the thesis, so there is no twist to protect. You see the stakes from the first screen. The officials inside the nation you are about to build never will. The whole piece runs on that distance.

You are the architect now, working from above. To enroll a population you have to decide what a person is made of: which fields are required, which biometrics are captured, how a name is shaped, how a household is shaped. Each decision looks like a form. Each one is a definition of membership, which is the first thing a constitution does.

Here is the part the form does not advertise. Every required field manufactures people who cannot satisfy it. A classification does not just sort the world; it produces a residual category, the box marked other, and that box has a population. You are not being asked to confess anything about yourself. You are being shown the people your schema has just defined as outside.

To enroll is to constitute the citizen. That is constituent power in the precise sense Sieyes gave it: the power that founds an order, exercised here through a settings panel. The people in the residual category were authored at the same moment as everyone else. They just landed on the side of the line that the schema treats as a defect in the data.

Same gesture, two faces. As the architect you mandate links: the ID is required to open a bank account, to keep a phone number, to draw welfare, to enroll a child in school. Each link turns a right into something preconditioned on the credential. As the gatekeeper you also field a stream of requests from other agencies who would like to read the same identity: a tax cross-check, a health ministry mid-emergency, a police request just this once.

Every one of those requests is defensible in isolation. None of them is the villain. The reach densifies in aggregate, and entrenchment arrives through a ratchet of locally sensible yeses. By the time anyone asks whether the ID has become a master key, the honest answer is that no one ever decided it should be. It just kept being reasonable to say yes.

A different instinct is available, and I have reached for it before. On the house page of this site, every reading carries two timestamps, when it was observed and when it arrived, so the screen shows you how stale it is instead of faking a live badge. I called it Honest Stamps. The rhyme for an identity layer is selective disclosure: a credential that proves only what a service needs, and says plainly what it is not proving. Take that as a rhyme and not an equivalence. A human-readable honest label is a different layer from a cryptographic proof, and the master key above is the opposite of both.

Path dependence is what makes the second face permanent. Once banks, telcos, and the ration shop all read the same ID, the cost of being without it stops being an inconvenience and starts being exclusion from the economy. The system did not have to be made compulsory by decree. It was made compulsory by everything else agreeing to depend on it.

Note: the piece does not ask about your real name, household, gender, or housing. That would be invasive, and it would lecture the people it means to illuminate. The exclusion was authored from above in Act I and is now visited on you as the issued citizen. The irony does the work that borrowed feeling cannot.

Foreclosure works at two scales at once. At the scale of the system, the nation cannot be revised except by a quiet config change. There is no amendment process, no public reading, no vote. There is a settings panel, and whoever holds it can redraw membership on a Tuesday. At the scale of the person, the citizen cannot refuse, because participation has been set, or has already effectively been set, as mandatory.

Hirschman gave us the three responses to a failing institution: exit, voice, or loyalty. This design removes exit by construction. You cannot leave a system that the bank, the phone, the school, and the ration shop all require, and you were never given voice, because there was no ratifying moment at which a no could have been registered. What remains is loyalty by default, which is to say consent that was never asked for and cannot be withdrawn.

Glissant called it the right to opacity: the right not to be made fully legible to a system that will sort you on what it sees. Foreclosure is the closing of that right. The foreclosure of alternatives is also the line that separates constitutional-grade rails from ordinary law. An ordinary law you can fall foul of and still live around. This you cannot.

The console asks you to deploy. Then it asks a second question it never asked before: by what authority. This is where the case study earns its place. Aadhaar, India's national identity system, was an executive scheme first and a law second.

The Unique Identification Authority of India was created by executive notification on 28 January 2009, not by an Act of Parliament. The first Aadhaar number was issued on 29 September 2010, and hundreds of millions of residents were enrolled under the executive scheme before any enabling statute existed. The Aadhaar Act was passed by the Lok Sabha on 11 March 2016, and it was passed as a Money Bill, a classification that let it bypass the Rajya Sabha, the upper house, which can only recommend changes to a Money Bill and cannot block it.

Constitutional review arrived only once the system was already near universal. In August 2017 a nine-judge bench of the Supreme Court held, unanimously, that privacy is a fundamental right. In September 2018 a five-judge bench upheld the Aadhaar Act by four to one, striking down the provision that had let private companies demand the ID, while the majority upheld the Money Bill route. Justice Chandrachud dissented on that route, calling it a fraud on the Constitution. In 2019, in a separate case, a Constitution bench doubted that Money Bill reasoning and referred the question to a larger bench, which has still not been constituted. The route was questioned. It was never overruled. The order of operations is the whole point: build first, legislate after, and let the courts arrive once the thing is too entrenched to unwind.

Nothing in that box changed when you pressed the button. The fields you required are still the fields you required. The links are the same links. Only the vocabulary resolved, from the machine voice into the civic one, and the gap between the two readings is the essay. Your field schema was a definition of citizenship the whole time. Your dependency toggles were a schedule of rights. Your access approvals were an amendment log written by nobody in particular. The ratifying authority is the one field the console never made you fill in, because the system works perfectly well without it. The label the form asked for was the title of a constitution all along. That is exactly the scandal: constitutional force, with no constitutional legitimacy, made literal.

This is not an argument against digital public infrastructure, and it is not thin-good, thick-bad. It is narrower than that. If these systems carry constitutional force, then they deserve constitutional process. That means ratification-grade legitimacy rather than a deploy button, amendment that is deliberately hard rather than a settings panel, independent review over schema changes, entrenched rights of exit, and a design built to be wrong gracefully and revised in the open.

The honest concession, the one that keeps the piece from being a polemic: run the three-part test on pure payment rails and they score low on every axis. A transfer protocol like UPI in India or Pix in Brazil does not define who you are, cash and other rails remain a fallback, and non-participation stays legally possible. Exit survives. So the constitutional charge is highest at the identity layer and close to zero at payments, and the right prescription is therefore layered, not uniform. Treating a payment rail like a founding document would be its own mistake.

The standing objection is not a threat to the argument. It is the argument. Someone will say that this is not a constitution, that nobody ratified it. That is exactly right, and it is the scandal restated: constitutional force, no constitutional legitimacy. The more a layer defines who you are, gates your rights, and forecloses your exit, the more ratification-grade process it owes you. Most of them do not give you any. You have now watched yourself write one of these without meaning to. That is the only credential the form ever needed from you.

THE RESEARCH SHADOW

Scoring a country on virtue is the exact move the theory in this piece teaches you to distrust, so this is not that. It is a process-legitimacy comparison. Each system is scored only on checkable process facts across the three axes that mirror the acts. The scale runs one way: higher is more ratification-grade process, lower is less. The thesis predicts that constitutional-grade systems would carry ratification-like process. The honest finding is that they mostly do not, and that one of the rows complicates the thesis in a way worth keeping.

Held out for now: the EU digital identity wallet, which is in flux and has a thin documented process trail. It is a live experiment to watch, not a scored row.