# ToG Registry Standard

Version 1.0, November 2026

https://pregen.org/tog/registry-standard

Copyright 2026 Valerii Egorov (Pastheroza). This text may be copied and changed only as Section 15(d) allows.

TERMS FOR REGISTRIES

*Purpose.* This Standard sets out what every Registry must do to be listed by the Steward, so that Holders, Providers and Platforms can rely on any listed Registry in the same way. It gives no one a Permission and takes none away: the Licence alone does that.

## 1. Definitions.

"**Standard**" shall mean the requirements set out in this document, from its title to "END OF STANDARD".

"**Licence**" shall mean the Terms of Generation Licence, Version 1.0, November 2026, in short ToG-L 1.0, identifier `ToG-L-1.0`, published by the Steward at https://pregen.org/tog, and any later version that a Statement held by the Registry cites. Terms defined in Licence Section 1, such as "Holder", "Person", "Entity", "Matter", "Statement", "Stop", "Deal", "Record", "Request", "Approval", "Authenticated", "Authorisation", "Provider", "Platform", "home Registry", "Remove", "Appendix" and "Steward", have the same meaning here.

"**Operator**" shall mean the person or Entity that runs a Registry, and "**Personnel**" anyone who acts for it.

"**Directory**" shall mean the signed list of Registries the Steward publishes under the directory rules. A Registry is "**listed**" while its entry there (its "**Listing**") is not revoked; its "**Prefix**" and its signing keys are those its Listing names.

"**ToG Code**" shall mean a code a Registry issues to a Holder in the form the ToG code specification prescribes, including a code migrated as that specification allows.

"**Proof Line**" shall mean the line `ToG: ` followed by the whole ToG Code, as the identity specification prescribes, and a "**Channel**" a public account, profile or website the Holder controls.

"**Identity Provider**" shall mean a service independent of the Operator that verifies a natural person's identity and age against an official identity document; a person it has so verified is "**Identity Verified**".

"**Registration Process**" shall mean the required reference registration process, and "**Answers**" the closed answers and Conditions a Holder gives in it.

"**Move**" shall mean a Holder's change of home Registry. "**Hand-over**" shall mean the transfer, for one Holder, of every version of its Statements, its Deals, the Records and Approvals that name them and every Stop and withdrawal, unchanged with their signatures and times, in the form the profile prescribes.

## 2. The Licence and the Referenced Specifications.

(a) *Duties.* A rule that says a Registry does or never does something is a duty; "may" gives a choice.

(b) *The Licence controls.* This Standard never changes the Licence; where they differ, the Licence controls. A Listing and a Registry's signature are not a Permission and do not state that a use is lawful (Licence Section 13(a) and 13(d)).

(c) *Referenced Specifications.* The Steward publishes each of the following at https://pregen.org with its version and hash. They fix the form of every code, message, file and signature; where one conflicts with the Licence or this Standard, the Licence and this Standard control.

1. the ToG code specification, `spec/TOG-CODE.md`, [version and hash];
2. the directory rules, Section 9.1 of `spec/PG-CODE.md` and Section 9.2 of `spec/TOG-CODE.md`, [version and hash];
3. the Registration Process, Part A of `spec/drafts/tog-funnel.md`, with its test vectors, [version and hash];
4. the lookup specification, `spec/extensions/lookup.md`, [version and hash];
5. the identity specification, `spec/extensions/identity.md`, [version and hash];
6. the core, `spec/PRE-GEN-SPEC.md` and `spec/PRE-GEN-CORE.md`, [version and hash]; and
7. the profiles named in Licence Section 1.

(d) *Conformance.* A Registry conforms only if it meets every duty that applies to it; a duty about an optional service applies once it offers that service.

## 3. Listing, Keys and Signatures.

(a) *Conditions.* The Steward lists a Registry only when it has:

1. a named Operator, with a public address and a contact for complaints;
2. a Published Policy that meets paragraph (b);
3. accepted the Licence, this Standard and the core by a signed statement;
4. published its key set on its own domain, with its next key announced;
5. open access: it answers any Provider known by its domain, with no account and on the same terms for every Provider;
6. a start address on its own website at which it receives the Answers, as the Registration Process prescribes; and
7. published its answers to the checklist the Steward publishes with this Standard.

(b) *Published Policy.* A Registry publishes at a stable address, in plain words, and keeps each dated version (its "**Published Policy**"):

1. the evidence it accepts for a person's identity, an Entity's existence, the authority of anyone who acts for another and ownership or control of each kind of Matter, and the Identity Providers it uses;
2. its prices, and what it never charges for (Section 12);
3. its Move Policy (Section 11);
4. how to send it a notice to Remove content (Section 10) and a complaint (Section 14);
5. its privacy notice and its availability target (Section 13);
6. whether it holds Authorisations and whether it accepts Deals in the category `sexual` or `adult`; and
7. the version of this Standard it conforms to.

A change never reaches back to an act already done.

(c) *The Steward's check.* The Steward verifies the Operator's identity and its control of its domain, takes each key from the Registry's live key set, and gives one legal entity one Prefix. A Listing, a Prefix and a listed key are never removed or reassigned, even after the Registry closes, because codes are cited forever.

(d) *Suspension and revocation.* The Steward suspends or revokes a Registry as Licence Section 16(f) provides. It may revoke for opening anything without the verification Section 6 requires, breaking a floor of the Licence, repeated false claims or a compromise of the Registry's operation; for any other failure of a duty it first gives public notice with a period to cure, and suspends if the failure is not cured. From a revocation nothing the Registry signs authorises anything; what it signed before stays valid; and its Holders' records pass as Section 11(c) provides.

(e) *Keys.* A Registry signs with keys of the kind the core prescribes and has its next key listed before using it. A retired key stays listed, and what it signed stays valid unless it was compromised earlier (Licence Section 7(f)). A Registry that suspects a key is compromised stops using it at once, reports it privately to the Steward and then tells everyone whose records it may have signed.

(f) *What a Registry signs.* A Registry signs, with a time from a reliable source, every version of a Statement it Authenticates, every answer to a Request, every Record, Authorisation and Hand-over, every report of a Stop or withdrawal and every Code Lookup answer about a code; each answer states how long it may be relied on.

(g) *The Steward.* The Steward is not a Registry, holds no code and ranks no Registry above another.

## 4. Codes and Registration.

(a) *Codes.* A Registry issues ToG Codes only in the specified form and under its own Prefix, draws each serial at random and never issues a serial again, even after its code is deleted or expires. It never accepts a `PG-` string as a code.

(b) *One code, one home.* A Holder, a domain and an account's own Person each have one ToG Code, and each Holder has one home Registry, which alone registers the Holder (Licence Section 13(c)). Where a Holder has two homes, the stricter answer decides until one remains.

(c) *No recognition.* A Registry never searches faces or voices one-to-many, never identifies a person from a picture or a sound, and never requires or adds a watermark.

(d) *A code permits nothing.* A code, badge or summary permits nothing by itself (Licence Section 2(g)), and a Registry never presents one as proof that a use is permitted.

(e) *The Registration Process.* A Registry that takes Statements follows the Registration Process, word for word where it fixes words, offers only its closed answers and adds none. It may translate or restyle the screens as long as every rule holds.

(f) *Age.* The date of birth decides, on the person's device, only whether the person is 18 or over, and never reaches the Registry. For a person under 18 only a legal representative may file, and under this version of this Standard only a no.

(g) *At the Registry.* A Registry receives the Answers only as the Registration Process prescribes and never repairs them. It shows the Holder the statement they make, the Conditions first, says that a Person's Conditions are public once the code is Active, and asks the Holder to confirm. It asks only for an account with a confirmed email address and a second factor and for what Section 6 requires, and never a question that changes the outcome.

(h) *Issue.* A Registry issues the ToG Code at once, Pending, and returns the Holder as the Registration Process prescribes. The statement it gives the Holder cites the Licence by identifier and hash and never changes its text.

(i) *`tog:no`.* A Holder's `tog:no` on its own Channel is a Stop that needs no Registry (Licence Section 2(h)). A Registry says so and never presents registration as needed for it.

## 5. Pending Codes and Proof.

(a) *Pending.* A new ToG Code is Pending until it is proved. A Pending code permits nothing and forbids nothing, and the Registry signs nothing for it.

(b) *Seven days.* The Registry reminds the Holder on the third day and deletes a code not proved within 7 days of issue. A deleted code answers `expired` and permits and forbids nothing; the Holder may register again.

(c) *Proof.* A code is proved, and becomes Active, by the Proof Line at a Channel; for an Entity, by its file at `https://<domain>/.well-known/tog.json` (its "**Domain File**"); or for a Person, by being Identity Verified; each as the identity specification prescribes. An email address is never proof.

(d) *What proof does.* Proof by a Channel or a domain shows control, not identity: from then the Holder's no counts, and nothing opens. Only Section 6 lets a yes open.

(e) *Domain lapse.* When a Domain File stops naming the Registry's record, the Registry notifies the Entity and allows 30 days of grace. After that nothing opens on the code until the file is restored, and a Stop in force stays in force until the Holder lifts it (Licence Section 7(g)). A code is never deleted for a lapse.

## 6. Verification Before Anything Opens.

(a) *The rule.* A Registry never signs or reports as in force anything that opens until each verification this Section requires is complete and recorded. Until then a yes permits nothing (Licence Section 2(b)).

(b) *Persons.* A Person is Identity Verified before anything the Person makes opens, with the person's explicit consent. The Registry binds the Identity Provider by contract to delete the check's images and biometric data within 7 days of the result, and offers anyone not verified a review by a person. Until a Registry has an Identity Provider, it opens no yes, and every no keeps working (paragraph (h)).

(c) *Entities.* Before anything an Entity makes opens, the Registry verifies from a public register that it exists, that the person acting for it is Identity Verified and has authority, and that it controls its domain.

(d) *Other Matter.* Before an item of Matter other than the Likeness opens, the Registry verifies ownership or control of it as Licence Section 16(f) requires.

(e) *Second factor.* The Registry requires the Holder's second factor for each act that opens.

(f) *What is kept.* The Registry records what was verified, how and when. Of an identity check it keeps only the outcome and the Identity Provider's reference, never images or biometric data.

(g) *Sexual content; minors.* A Registry accepts a Deal that opens the category `sexual` or `adult` only from a Person personally (Licence Section 5(a)), and may decline such Deals. For a minor it accepts only a Stop by a legal representative whose identity and authority it has verified (Licence Section 2(c)).

(h) *A no needs no identity check.* A Holder's no counts once the code is proved under Section 5(c), and a minor's as paragraph (g) provides.

(i) *Error.* On a claim of deception or error, a Registry reports the record as disputed and does what Licence Section 12(d) requires.

## 7. Code Lookup and Records.

(a) *Code Lookup.* A Registry answers what a code is (its "**Code Lookup**"), as the lookup specification prescribes, to anyone, with no account and free of charge, for every code it holds and every code under its Prefix, and points to the Directory for any other.

(b) *What it shows.* For an Active code the answer shows the level of proof, whether the Rules are Authenticated, the current Statement and a Person's Conditions exactly as given. It never shows a yes as open unless the level of proof is `verified` and the Rules are Authenticated, shows nothing the Holder did not choose to publish, and never repairs a code. It shows for which marks, works, places and uses ownership or control was verified, so that a Provider never reads a Person's `verified` as opening a mark.

(c) *Lifetime.* An answer that reports Rules may be relied on for at most 5 minutes (Licence Section 8(b)).

(d) *After a Move.* The old Registry answers a moved code as moved, with the date; when it is gone, the Registry that answers for the Holder under Section 11(c) answers in its place.

(e) *Anchors.* A Registry publishes daily its signed anchor list of public persons, as the identity specification prescribes.

(f) *Never rewritten.* Nothing signed is ever changed; a change is a new version. Versions are kept and removed as Licence Section 7(h) states.

(g) *Public checks.* Anyone who holds a Record can fetch and check the version it names. A Deal's terms are shown only to its parties.

(h) *Stops and withdrawals.* A Registry reports every Stop and withdrawal from the moment it receives it, passes a withdrawal from a Deal to the licensee at once, and never makes either depend on a payment, an account, a Move or a dispute.

(i) *Approvals and Records.* Outputs relayed for Approval are shown to no one else and deleted as Licence Section 8(e) requires. A Record is reported as withdrawn only as Licence Section 9(j)(3) allows.

## 8. Authorisations.

(a) *Optional.* A Registry may hold Authorisations. One that does says so in its Published Policy and follows this Section.

(b) *The issuer.* Before it holds an Authorisation, the Registry verifies that the issuer is an Authority competent for each computer system it names, or the owner of that system for that system only, and verifies the identity and authority of the natural person who acts for the issuer.

(c) *Answering.* The Registry tells anyone who gives the Authorisation's identifier whether it is current, and shows what it covers only to the issuer and to Providers that have given an Undertaking. It reports a withdrawal from the moment it receives it.

(d) *Limits.* A Registry never issues an Authorisation itself and never states that an act under one is lawful.

## 9. ToG Documents.

(a) *What it is.* A "**ToG Document**" is the published text of the Licence, checked against its hash and unchanged, followed by the Appendices that Licence Section 16(g) sets out, with every value taken from the Registry's record. A Registry issues one for a Holder only for an Active code it holds.

(b) *Page Foot.* Every page of a Holder's ToG Document shows at its foot, outside the text: `ToG: [code] · v[n] · [first eight characters of the version's hash] · Check: pregen.org/lookup?code=[code] · Page [k] of [N]`.

(c) *The record decides.* Each ToG Document states that where it differs from the record, the record decides.

## 10. Notices and Removal.

(a) *Receiving.* A Registry receives notices to Remove content from anyone, with no account and free of charge, and acknowledges each with the time it received it.

(b) *Content it holds.* For content the Registry hosts, it acts on a complete notice as Licence Section 12(f) sets: within 48 hours for content the notice says is sexual or adult or shows a minor or anyone as under 18, and within 7 days for anything else.

(c) *Content elsewhere.* For other content, the Registry passes a complete notice within 24 hours to the Holder and to any Provider or Platform it names that has an identifier at the Registry.

(d) *Reply.* The Registry logs every notice and tells whoever gave it what it did and when.

## 11. Moving and Closing.

(a) *Move Policy.* A Holder may Move to any listed Registry that accepts it, under the published policies of both (each a "**Move Policy**"), and must Move when its home Registry stops serving it (Licence Section 13(c)). On a Move the old Registry makes the Hand-over. A Move Policy states the steps, times and prices of a Move and is shown before a Holder registers. A Move may be paid, but never more than the price shown when the Holder registered.

(b) *A no is never held hostage.* Whatever a Holder has paid or owes, its Stops and withdrawals keep working, free of charge, before, during and after a Move; the old Registry reports them until the new one does.

(c) *Records pass on.* When a Registry closes, is revoked or stops serving a Holder, it makes that Holder's Hand-over, free of charge, to the listed Registry the Holder chooses or, if the Holder chooses none, to one the Steward names. If it does not, the Steward directs another listed Registry to answer for the Holder's codes from what it holds.

(d) *Effect.* A Move changes the home Registry and nothing else (Licence Section 13(c)). The new Registry checks each item of a Hand-over by that item's own signatures, whoever makes the Hand-over.

(e) *Notice of closing.* A Registry that intends to close, or to stop serving a Holder for a reason its Published Policy does not list, notifies each Holder concerned and the Steward at least 90 days before, and keeps answering for each Holder until its Hand-over is made.

## 12. Fees and Own Terms.

(a) *Fees.* A Registry may charge for its services at the prices its Published Policy states.

(b) *Always free.* A Registry never charges for a change, withdrawal or Stop of a Statement (Licence Section 13(b)); a first Statement that only closes and the proof of its code; a withdrawal from a Deal; the Code Lookup; a notice to Remove content; a complaint; or what Section 11(b) and 11(c) make free.

(c) *Own terms.* A Registry's terms with Holders, Providers and Platforms keep Licence Section 13(b), and the Registry returns payments as Licence Section 12(d)(2) states. They state that the Registry is liable for a wrong identity, age, authority or ownership only where it broke its own published procedures (Licence Section 16(f)).

## 13. Operation.

(a) *Data protection.* A Registry collects only the personal data this Standard needs and processes it as the data protection law that applies to it requires, including a privacy notice, published retention periods and written contracts with its processors. Personnel use a second factor and have only the access their task needs; personal data is encrypted in transit and at rest; and a breach is reported as the law requires and, without undue delay, to the Holders concerned and the Steward.

(b) *Audit Log.* A Registry keeps an append-only, signed log of every act this Standard requires, each entry linked by hash to the one before and naming people only by codes or pseudonyms, and shows a Holder the entries about its own code.

(c) *Availability.* A Registry keeps its Code Lookup, keys and answers to Requests open to all on the same terms, and publishes its availability target and, each month, its measured availability. When it cannot answer reliably, it gives no answer rather than a permission. Its rate limits never stop a Provider from making the Lookups Licence Section 9(e) requires of it.

(d) *Backups.* A Registry keeps tested backups in a separate place.

(e) *Conflicts.* At a Registry, no one decides a matter that is their own, that of someone close to them or that of the Operator's group. A Registry tied to a Provider or Platform declares it and treats all alike, and never presets a yes or ties a service to one. A Steward that also operates or owns a listed Registry discloses this publicly and gives written reasons for every decision about that Registry.

## 14. Complaints.

(a) *At the Registry.* Anyone may complain to a Registry about one of its codes or records. The Registry decides within 7 days on evidence a third party can check, never on a name or a resemblance alone, and meanwhile answers for the code as disputed. A code is reported as disputed only once for the same claim, and again only on new evidence.

(b) *To the Steward.* A complaint the Registry has not decided within 7 days, or one about the Registry itself, goes to the Steward, which decides within 30 days. A Registry carries out the Steward's decision. Disputes about a Registry's own service are decided as its terms provide; this Standard chooses no law and no court.

## 15. Versions and Copying.

(a) *Fixed text.* This version is named the ToG Registry Standard, Version 1.0, and has the identifier `ToG-RS-1.0`. Its text never changes and is identified by the SHA-256 hash of the lines of its published Markdown text between "Standard begins" and "Standard ends", those two lines and the blank line next to each excluded, in Unicode NFC with LF line endings. In a final version, each text in square brackets is replaced by the completed text before hashing.

(b) *New versions.* Only the Steward publishes a new version, with a new number and hash, after at least 30 days of public comment. It binds every Registry from a date at least 90 days after publication; an act is judged under the version that bound the Registry when it was done.

(c) *Transition.* Until this version binds, the Steward may list a Registry that publishes dated plans for the duties it does not yet meet. A code proved by a method this Standard does not allow keeps its no and opens nothing until proved again.

(d) *Copying.* Anyone may copy and distribute this text unchanged, or publish a changed text under a name that does not begin with `ToG` and does not claim to be this Standard or approved by the Steward.

END OF STANDARD