Principles
Our Principles
Every social product that started out "anti-Instagram" has a story about the quarter where someone said engagement is flat... let's just A/B test suggested posts in the main feed. The protection isn't the current design. The protection is the written invariant that makes it embarrassing to add that signal back.
These are Talisman's. Mirrored into the code as a module docstring, enforced in CI against a forbidden-pattern list, and published here so any future version of this company has to publicly break a promise to walk them back.
Why this document exists
In March 2026, the K.G.M. v. Meta verdict and the underlying MDL 3047 rulings drew a line: content is protected, but design choices that optimise for compulsive use are not. The court named the flagged patterns: infinite scroll, autoplay, return-rate-optimised notifications, retention-optimised ranking, suggested posts injected to extend sessions, opt-out defaults for passive consumption. It also named the safe-side example: Instagram's abandoned "you're all caught up" feature.
Talisman is structurally on the safe side of every flagged pattern. No infinite scroll. No likes. No comments. No ads. No autoplay. Finite surfaces. Deliberate, user-initiated exploration. Opt-in capture defaults. These invariants keep it there.
The invariants
The feed scorer takes contextual inputs only. Never engagement signals.
What you do in the app (how long you dwelled, how fast you scrolled, how often you came back) never enters the feed's ranking function. Ever.
The contextual-aptness score is a function of celestial conditions, temporal alignment, social distance via your explicit follow graph, and contextual fit. Reflows, hides, and DM shares are logged into a schema-firewalled observation table for offline human review, never as inputs. The moment an engagement signal leaks into the scorer, contextual ranking becomes engagement optimisation: the exact pattern the court named as actionable.
No notifications about feed content.
Talisman will push you a direct message or a follow. It will never push you your feed is ready, you have new posts, or come back to see what you missed.
Return-rate-optimised notifications were the smoking gun in the Meta case. The only carve-out is transactional: a reminder about a process you started (a data export completing, a pre-ordered release arriving, a specific item you asked to be told about). The test is written down: would the notification exist if you hadn't explicitly requested the underlying thing? If not, it's allowed. If it exists to bring you back, it's forbidden.
No time-in-app metric. Anywhere.
Talisman does not track, display, log, or compute how long you spend in the app. If the metric does not exist, no one can accidentally optimise against it.
Session logic uses when a session started, never how long it lasted. There is no duration column, no time_in_app counter, no "average session duration" in any dashboard. One carefully-fenced distinction exists: world-time — how long you stood under the sunset where you found an aligned release — may be recorded as a memento of a moment that already happened. It is bounded by the world, not the screen; it is never a ranking input, never compared, never leaderboarded, and never the subject of a nudge to make the number grow. The instant a duration measures presence in the app rather than presence in the world, it is forbidden.
Discovery is a deliberate tap. Nothing auto-injected.
What you follow is what you see. Discovery content is reached by a deliberate next action, never by something sliding in between the things you chose.
No "you might also like" mixed into your home surface. No "people you may know" injected mid-stream. Suggestions live in their own clearly-marked, capped space, and you control the boundary.
Home is finite by construction. It ends, visibly.
There is no infinite river to exhaust and no secret path into more. Home is a finite row of the worlds you follow; each world is a finite mosaic of things that really happened. Both end in a visible fin.
The original version of this invariant policed a single interleaved feed with a terminal "you're all caught up" state and a silent six-hour refresh cool-down — the design the court named as the safe-side example. In July 2026 that feed was retired for something structurally stronger: finitude by construction rather than by policing. The worlds row is bounded by your follow list; a world's archive is bounded by that account's real history; nothing refills, and every door tells you its state before you open it — no lever to pull blind. The cool-down machinery is kept dormant, and this page records the standing rule: if any future feature reintroduces a single ranked, re-fillable stream, the cool-down protection must be reinstated for it.
Every capture toggle defaults OFF. Opt-in only.
Location, weather, sensors, anything that adds a signal to a post's contextual stamp, all default to OFF. You turn them on deliberately or not at all.
No coercive UI ("turn this on for a better experience"). No nudge dialogs. No "skip" buttons that look smaller than "enable". The default is OFF, and the path to ON is a real, considered tap. The same spirit governs live presence: whether your friends can see you're listening right now is yours to switch off, it is only ever shown to people you already follow as an individual fact (never "N people are online"), and it is computed live — never stored, never scored, never counted.
No streaks. No badges. No daily quests tied to returning.
Nothing in Talisman rewards you for opening the app N days in a row, or for being the first to view, or for logging in every day this week.
Conditional unlocks tied to externally-anchored events (a release that drops on a specific moon phase, an artist event in your time zone, a venue tied to a geographic radius) are fine. Those are anchored to the world, not to your return rate. Return-frequency rewards are not. The same rule covers quieter shapes: the surface where you turn a real moment into a published one never shows a count of "unposted" candidates, a badge, or a completion prompt — a to-do list of your own life is a daily quest wearing a curation costume.
A written age policy ships before algorithmic ranking reaches minors.
The Meta case turned partly on internal documents stating "if we want to win big with teens, we must bring them in as tweens." The bar is not "we're safer than Meta." The bar is "we had a written age policy in place when the feature shipped."
Talisman's current status: closed invite-only beta, manually curated, population verified 18+, so no under-16 users by construction. The zero-knowledge age verification infrastructure for public launch is fully built (NFC passport reading, on-device biometric face match against the passport photo, proof generation that never sends your documents anywhere). The enforcement gate lands with the feed release; no algorithmically-ranked feed reaches a production user before it does.
Reveal features are silent by default. Physical presence is a precondition.
Drops, nearby peers, ambient discovery: these features have no empty state, no top-level entry, no notifications, no onboarding. They appear in front of you when the world makes them relevant, and disappear when it doesn't.
Every other social product gets more interesting the more you scroll and silent the more you live. Talisman is supposed to be the inverse: living gives you more, scrolling gives you nothing. That inversion does not survive conventional empty states ("no signals nearby, try again later") or conventional entry points ("Tap the radar icon"). The reveal pattern protects the inversion structurally. One consent rule rides with it: a moment that discloses someone else's physical presence with you renders anonymously until that person independently confirms — the world sees "a shared listen", not their name, until they say so.
Artist tools are transparent, artist-scoped, and never engagement-optimised.
There is no scheduled-post primitive, no "best time to post" recommender, no pay-to-reach, no boost button, and no reach analytics. Artists time a moment by attaching a real-world condition — a moon phase, a place, a season — not by choosing a clock time calculated to catch you.
A "campaign" tool that wraps a release in scheduled posts and optimised send times is engagement optimisation professionalised — the same flagged pattern from the artist's side of the glass. Talisman refuses the primitive rather than guardrailing it. What artists get instead is transparent: a view of their own releases against live world-state, and the option of a public manifest that says openly "this is my release window, these are its conditions." The written test: would the feature still be useful in a system with no notion of reach, sessions, or return rate? If not, it doesn't ship.
Things deliberately not in Talisman
Written down now because someone will propose each of these in six months. Adding any of them requires a redesign that satisfies the invariants above, not a relaxation of the invariants.
- Likes, comments, public view counts, read receipts on posts
- Trending tabs, "most reflowed today" sorts, popularity leaderboards
- Notifications about feed content
- Streaks, badges, daily login quests
- Infinite scroll, autoplay, auto-injected suggested posts
- Dwell-time tracking, time-in-app counters
- Aggregate live counters ("N people listening now", "N fans online")
- Scheduled posts, send-time recommenders, pay-to-reach, artist reach analytics
- Any "see more" or "load older" escape hatch from a finite home surface
- Per-user reference vectors built from reflow history
How these invariants are enforced
Writing principles down is necessary but not sufficient. These invariants are enforced on three layers:
- In code. Invariant 1 is mirrored verbatim as a module docstring inside the scorer itself. The scorer is the load-bearing copy; this page is the discoverability layer.
- In CI. A forbidden-patterns list (
dwell_time,session_duration,time_spent,view_count,engagement_rate,return_rate,scroll_velocity,time_in_app,session_length,read_receipt) fails the build on any hit in the scoring modules. Belt and suspenders. - In schema. Observation tables (reflows, hides, DM shares) have no foreign-key path back into the feed-serving query graph. Physical separation makes accidental contamination structurally hard, not just policy-hard.
How to read this page in five years
If you are looking at this page in 2031 and an invariant on it has been quietly softened or removed, the company has broken a promise. That is the whole reason this page is here.
The invariants are not updated to relax existing commitments under engagement-flat pressure. They are updated when a new flagged pattern emerges from regulation or case law, when a new invariant is needed because of a real near-miss, or when a feature genuinely tests an invariant and the adjudication is published — as happened when the interleaved feed retired (Invariant 5) and when artist tooling was designed (Invariant 10). Each such change is dated in the canonical principles document, carve-outs included, so the reasoning is checkable rather than quietly absorbed.
You'll be able to check
Today, this page is the public copy of the canonical principles document. The code that enforces it — the scorer's mirrored docstring, the forbidden-pattern list, the CI tripwires — is not yet public; it goes public with the planned open-source release, at which point every claim on this page can be checked against the code that enforces it. Repos, licenses, and schedule live at Source & Open Source.