One primitive, many faces.
A person in a moment of need → a verified helper → a scoped reveal of exactly what's needed → an immutable audit trail.
Lifeline, a first-responder surface, and a mutual-aid app are not three products. They are one primitive wearing three faces — sisters because they share one engine, not because they share a logo.
The shared spine
Identity & Verification
Holders, neighbors (vouched/vetted), and professional responders (credential-federated). Half the trust layer already exists — Champion for America and Harbor Vetting become Haven's vetting backbone.
Disclosure / Vault engine
One reveal engine — INSTANT, SCOPED, BREAK-GLASS — with per-record AES-256-GCM. The vault opens exactly what the moment needs and nothing more.
Audit & Notification
Hash-chained reveal log plus after-the-fact notice on every open. Anti-surveillance is structural, not a setting. Every reveal is logged; you are told.
No-phone path
A printed card or form is first-class, never a fallback. The life-saving layer never waits on a handshake, a battery, or a network.
The faces
Lifeline
Medical card + vault. Instant Layer readable on lock screen or QR with no login; Vault opens only on a two-factor break-glass at the scene. Every open is logged.
Open Lifeline→Responder surface
A credentialed responder authenticates, scans the QR, supplies the second key share, opens the vault — all logged. The verified-helper side, generalized for the whole family.
Responder surface→Hearth
Neighbors helping neighbors on the same trust spine. Reciprocity, not charity. Scoped disclosure: approximate area, then exact location after accept, then contact when both opt in.
Hearth mutual aid→What makes it clever
Decide while you're well what's revealed, to whom, in which emergency. The vault executes a pre-made choice — it never improvises.
One verified reveal surfaces the relevant slice of every member of the family — still scoped, still logged.
Help that finds you without broadcasting your identity. Closeness is matched; identity stays scoped.
The verification backbone is the moat. We build it first, and best — every face is a view onto it.
⚠ Judgment values ship unverified, by design
Each domain's gate ships marked unverified-and-labeled until the right expert signs off: the crypto gate (break-glass key-split), the clinical gate (decay rules + Action Layer cues), the safety gate (missing-child + trafficking flows, feature-flagged off), and the legal/privacy gates. No public security claim, no real filing, and no live safety alerts before the matching gate clears.