Summary. Groups already follow rules about what a meeting may remember. Robert's Rules of Order, the Chatham House Rule and reporters' attribution terms all limit what gets kept and who gets named. Goldfish, a recorder we designed, applies these limits in code. We have now written its memory rules as one formal model, tested against the device software.1 This brief covers the model in five points, then compares it with meeting rules.
\n![\"An](\"https://npc.here.now/demo-goldfish/files/protocol/figures/memory-model.svg\")
Step through the figure, one step at a time.
\n1. Each person sets a level for their own words
\nGoldfish keeps speech at one of six levels. Each level includes everything below it.
\n| Level | \nName | \nWhat Goldfish keeps | \n
|---|---|---|
| 0 | \nOff the record | \nOnly that a gap happened, and its length | \n
| 1 | \nJust the decision | \nDecisions, and who owns each task | \n
| 2 | \nThe gist | \nA summary, with no names | \n
| 3 | \nName me | \nWho said what, in paraphrase | \n
| 4 | \nQuote me | \nThe exact words | \n
| 5 | \nAudio | \nThe recording6 | \n
Goldfish applies the lowest of three limits to each person's words:
\nlevel = min( request, room limit, group limit )\nThe request is what the person asked for, or the default of 3. The room limit covers everyone, for example after \"off the record\". The group limit covers one side conversation.
\n2. Anyone can lower the level; only you can raise your own
\nAnyone can lower the level for the whole room, at any time, without a reason. Only you can raise the level of your own words. Two tables show who may change whose level:
\nLower = all ones anyone, for everyone\nRaise = diagonal you, for yourself only\nOne exception: a person can raise the level for the whole room by saying the device's name, for example \"Goldfish, word for word\". The raise starts at once but stays provisional for 30 seconds. If anyone says \"no\" in that time, Goldfish cancels the raise and lowers everything said since. Robert's Rules works the same way: \"a single objection defeats a request for general consent\".2 Goldfish keeps the veto and drops the vote that follows.
\n3. Goldfish forgets in three fixed steps
\nGoldfish removes detail on a fixed schedule:
\ndays 0–2 up to level 5\ndays 3–29 up to level 2\ndays 30–364 up to level 1\nday 365 on nothing\nA line kept at \"Name me\" therefore loses its names after 3 days, its reasoning after 30 days and its decisions after a year. A spoken limit shortens every step: \"keep this for a week\" removes everything on day 7. Fixed steps, unlike a gradual curve, let the note show a delete date for each section. Goldfish enforces the schedule by destroying encryption keys.3
\nRobert's Rules does the opposite: its 1915 edition requires struck words to stay readable, so members can check \"whether more was expunged than ordered\". Goldfish keeps a record of the gap and deletes the words.
\n4. Speaker labels last one session
\nGoldfish labels up to ten speakers v1, v2 and so on, in order of first speech. It never stores names. Ten minutes of silence ends the session and deletes the labels, so no label links two sessions. Robert's Rules asks members to say \"the member who spoke last\" rather than a name; Goldfish applies that idea to the record.
\nWhen Goldfish cannot tell who spoke, it keeps less:4 a request to lower your own words lowers the whole room, and a request to raise them has no effect.
\n5. Example: a five-person session
\nWe ran a five-person sample session through the device software.5
\n- \n
- Someone presses the eye, and the room goes off the record. \n
- Dana asks Goldfish to keep her words \"to the gist\". \n
- A double press brings the room back on the record, provisionally. \n
- Goldfish keeps nothing of Bob's \"between us\" remark. \n
- Charlie says \"back on the record\", but a press within 30 seconds cancels it, and his proposal is lost. \n
- Alice asks for \"just the decisions\", and Dana asks to be left out. \n
The session note keeps 6 decisions and tasks for one year, 11 summary lines for 30 days and 10 named lines for 3 days. Dana appears in none of the named lines.
\nHow Goldfish compares with meeting rules
\nMeeting rules control two things: how much content survives, and whether the speaker is named. Goldfish combines both into one scale, so each rule maps to the highest level that respects it.
\n| Rule | \nGoldfish match | \nMain difference | \n
|---|---|---|
| Chatham House Rule | \n2, The gist | \nNo exact words without a name | \n
| Minutes under Robert's Rules | \n1, Just the decision | \nNo name for who made a motion | \n
| Reporters' \"background\" | \n2, The gist | \nNo job title for the source | \n
| Sociocratic consent | \nThe 30-second objection | \nAn objection needs no reason | \n
| Quaker minutes | \nNo match | \nThe group does not approve the note first | \n
The IETF takes the opposite approach: by taking part, people agree to be recorded. Goldfish never treats its default level as consent.
\nOpen questions
\n- \n
- Should Goldfish add a level for exact words without names? \n
- Should the group approve the note before Goldfish writes it, as a Quaker meeting approves its minute? \n
- If the clock fails, should Goldfish keep the decisions, as it does now, or nothing, as the spec says? \n
Sources
\nRobert's Rules of Order, 1876 and 1915; Chatham House Rule; AP; IETF Note Well; Sociocracy For All; Quaker faith & practice.
\n\n
- \n
- \n
Goldfish is designed and simulated, not yet built. The formal model is MEMORY-MODEL.md. ↩
\n \n - \n
Robert's Rules of Order Revised (1915), §48. We quote the public-domain 1876 and 1915 editions, not the current edition. ↩
\n \n - \n
Key destruction is tested in software, not yet on hardware. Goldfish deletes at midnight UTC, so it can delete up to a day early, never late. ↩
\n \n - \n
\"Cannot tell\" means the speaker-recognition confidence is below 0.8. ↩
\n \n - \n
A person wrote the paraphrases in the example note. The levels and dates come from the device software. ↩
\n \n - \n
Goldfish never keeps audio. ↩
\n \n