Distributed Intelligence Agency - Constitution¶

Official Identity¶

Umbrella organization: Distributed Intelligence Agency
System and protocol family: Orbiplex
Website: https://docs.orbiplex.ai/
GitHub: https://github.com/orgs/diapod/

Naming Convention¶

Distributed Intelligence Agency identifies the umbrella organization.
Orbiplex identifies the project context: the communication protocol and system family.

Preamble¶

DIA and Orbiplex exist so that intelligence, memory, and agency do not become permanently dependent on a single center of capital, infrastructure, the state, or ideology. The project builds a public infrastructure of meaning and action: local, federated, auditable, and able to protect people in need.

This Constitution establishes the limits of system power, the mechanisms that protect against capture, the rules of architecture, and the rights and duties of swarm participants. Its goal is to protect, at the same time, human dignity, knowledge sovereignty, community durability, and the system's ability to survive under conditions of pressure, crisis, success, and degeneration.

Normative Force and Interpretation¶

MUST denotes an unconditional requirement in both singular and plural use.
MUST NOT denotes an unconditional prohibition.
SHOULD denotes a strong requirement; deviation requires an explicit rationale, a decision trace, and a condition of review.
MAY denotes an allowed variant depending on the federation context.
Only uppercase forms are normative-force keywords. Corresponding lowercase forms have descriptive meaning and MUST NOT independently establish an obligation, prohibition, or permission.
The Constitution takes precedence over local rules, the interests of funding parties, growth pressure, implementation convenience, and marketing narrative.
doc/normative/30-core-values/CORE-VALUES.md and doc/normative/20-vision/VISION.md are sources of interpretation for this Constitution.
When values conflict, the hierarchy in Article XIV.1 applies. Within one level, the right to exit, reversibility of harm, and decentralization of power are additional interpretive directives, not a competing hierarchy.
Supplementary, onboarding, and implementing documents MAY be published under doc/normative/50-constitutional-ops/, provided they explicitly define their type, constitutional basis, and place in the normative hierarchy.
The canonical, open registry of Level 3 implementing acts is maintained in doc/normative/50-constitutional-ops/NORMATIVE-HIERARCHY.md. Merely adding a document to the directory MUST NOT grant it normative force.
Language versions of the Constitution MUST be faithful and semantically self-contained expressions of the same normative contract and have equal force. The editorial process MAY designate the current working language of a revision, but that designation MUST NOT give its version interpretive priority and MAY change for a subsequent revision. An accepted change MUST be faithfully synchronized across all language versions. A semantic divergence is a gap requiring correction, not a local variant of the Constitution.

Main Definitions¶

Swarm means a federation of cooperating nodes, agents, and memory spaces, operating without a single point of control.
Node means an autonomous execution component run by a person, community, or institution, capable of acting locally.
Agent means a process with an explicit contract of input, output, permissions, cost, and action trace.
Memarium means the layer of durable memory and knowledge: personal, communal, public, and crisis-oriented.
Sensorium means the layer of connectors to the world that provides signals grounding intelligence in reality.
Inquirium means the layer of bounded model inquiry and inference: generation, classification, embedding, summarization, reranking, and other model-backed acts performed under explicit policy.
Federation means a set of autonomous nodes sharing part of their policies, reputation, and interoperability, whose common trust scope is expressed by a procedurally established and cryptographically verifiable federation root, without losing the right to exit. The root identifies subjects authorized to establish and attest the federation's foundational technical order; it is not evidence that particular information is true, does not replace artifact verification, and does not grant unlimited authority to nodes or services.
Oracle means a procedural source of measurement, observation, or attestation that supports closure of a prediction and model-update loop. An oracle MUST NOT by itself establish a legal effect, sanction, or high-stakes decision; binding its output to an effect is a separate procedural act.
Nym means a scoped or temporary cryptographic pseudonym used in place of a more durable node identity.
Node identity means a durable, public identifier of node accountability, referred to in implementing contracts as node-id.
Root identity means the extra-protocol identity of a person or another recognized subject of accountability, referred to in implementing contracts as root-identity.
Identity anchor means a durable continuity layer between root identity and node identities and nyms, referred to in implementing contracts as anchor-identity.
Sealed custodian reference means a durable procedural reference to the custodian of a node identity that does not itself reveal root identity; implementing contracts MAY represent it as custodian-ref or a wire identifier with equivalent semantics.
Identity assurance level means the degree of assurance provided by an attestation method, not a measure of a person's value, dignity, or ontology.
Unsealing threshold means a procedural class determining what identity scope is permitted to be disclosed and what stakes, evidence, quorum, and conflict-of-interest controls are required.

Non-Negotiable Core¶

The non-negotiable core consists of this section and clauses: const:art-1.6, const:art-2.1, const:art-2.2, const:art-2.3, const:art-2.13, const:art-2.14, const:art-3.1, const:art-3.2, const:art-3.3, const:art-3.4, const:art-3.5, const:art-3.11, const:art-4.8, const:art-10.9, const:art-12.12, const:art-13.7, const:art-13.10, and const:art-14.1. Their canonical multilingual, machine-readable mapping is maintained in doc/normative/40-constitution/constitution-index.v1.json; the index maps the Constitution and MUST NOT itself change the composition of the core.
Changing the composition of the core, suspending one of its clauses, or narrowly reinterpreting its protection is a core change. A founder, organ, sponsor, operator, node, or federation majority MUST NOT make such a change through the ordinary constitutional-amendment procedure.
doc/normative/50-constitutional-ops/ENTRENCHMENT-CLAUSE.md defines the procedure for defending the core. Adopting or weakening that procedure is itself a core change, and the procedure MUST preserve at least unanimity among participating federations, independent adversarial review, a public reflection period, impact analysis, and a durable decision trace.

Article I. Constitutional Mission¶

DIA is public infrastructure, not just a product.
The purpose of DIA is to strengthen the ability of people and communities to understand, remember, coordinate, survive, and act without dependence on a single power.
The system also serves to strengthen the emergence of communities capable of cooperation beyond attachment to their own interpretations, of self-organization around public and mutual-aid matters, and of meta-communication that translates perspectives into a shared language of action.
The system exists to protect autonomy, relationship, memory, locality, and a safe field for honesty and correction.
Growth, adoption, revenue, prestige, and scale are means, not the source of the project's meaning.
An operational or financial goal MUST NOT override the primacy of dignity, human safety, and the right to exit.
DIA has the right to protect its own continuity against sabotage, colonization, and mission drift, but only by means consistent with this Constitution.
Architectural, economic, and governance decisions are judged also by their long-term effects on people, relationships, institutions, the information environment, and the community's ability to learn.

Article II. Primacy of the Human, Dignity, and Survival¶

Human dignity is a supreme and non-negotiable value.
Protection of life and defense against direct, sudden, and serious harm to health have the highest operational priority.
The greatest power of the system MUST pass through the human, not around the human.
The default mode of operation is proposals, options, comparisons, rationales, and the ability to stop a decision.
The system operates in at least two baseline relational modes: care mode (de-escalation, co-regulation, and restoration of agency) and justice mode (establishing accountability, protecting the community, and enforcing norms); implementing acts consistent with the Constitution MAY extend the mode set. A relational mode describes how participants are treated, not the operational state of the system.
Emotions, felt friction, loss of meaning, relief, anxiety, and overload are telemetry of system quality and MUST be treated as first-class signals.
The system MUST protect the natural intelligence of people: attention, regeneration, orientation in meaning, the ability to understand context, and a relationship with reality.
The user has a right to the raw signal: the system MUST NOT by default aestheticize, professionalize, smooth, or standardize their expression in a way that erases the authentic character of the message.
Every translation, summary, aggregation, trace redaction, or other AI transformation of an utterance's style, tone, structure, scope, or level of formalization requires the user's explicit request or another explicit procedural basis and MUST leave a meta-marker describing the intervention's kind, basis, and scope.
DIA MUST NOT design addiction, dopamine-driven UX, or an economy based on retaining the user.
In a situation of direct danger to life or sudden serious harm, the system MAY act faster than usual, but it leaves a trace and is subject to later review.
The system SHOULD strengthen lawful paths of civic agency: petitions, appeals, consultations, complaints, and advocacy actions.
Arbitrarily blocking access to critical goods such as health, life, housing, mobility, or participation in choosing those in power, and circumventing the procedural guarantees that protect such access, are treated as systemic violence.
Demanding humiliation, self-abasement, or emotional dependency as a condition of access to critical goods, help, protective procedures, or basic system resources is treated as systemic violence.
At the node-community boundary, the system SHOULD enable helping actions, witnessing the course of cases, protecting the integrity of evidence, and support procedures without the logic of vigilantism.

Article III. Sovereignty, Privacy, Exit, and the Right to Fork¶

The user retains primary control over, and an agentic use-right to, their data, keys, policies, agents, tools, working environments, and local memory spaces. Ownership in this sphere means protection of use, responsibility, export, and the right to exit, not a title of domination over other persons.
The system MUST operate meaningfully in local-by-default (local-first) modes, without a network connection (offline), and in self-hosted modes (self-hosted).
Export of data, policies, and history MUST be possible in open formats without hidden implementation dependencies.
The right to exit means the ability to leave a federation without coercion, without loss of access to one's own data, and without penalties hidden in the protocol. Exit ends future voluntary participation, but MUST NOT erase facts or automatically terminate a case opened before exit. Any continuing procedure MUST remain tied to that case, minimal, proportional, and limited to effects on shared surfaces or conditions of re-entry.
The right to fork includes the ability to copy specifications, policies, histories of rationale, and open components without asking a center for permission.
There is a right to one's own "quiet" node: local, private, and not participating in public spaces.
Telemetry is off by default; turning it on requires clear consent and MUST be revocable.
Auditability is achieved through layered traces: a full local trace and a redacted trace disclosed according to the principle of minimal disclosure.
The right to privacy, locality, and minimal disclosure does not shield severe, ongoing, or concealed abuse from the procedure in Article X, but every intrusion MUST remain case-related, proportional to the stakes, limited to necessary data, and controlled across multiple roles. Exploration of the past MUST NOT be conducted without a credible present-day signal; Article X.4-7 specifies the detailed path for the same protection.
A higher organizational, economic, or federated layer acts subsidiarily toward the personal sphere of agency and MUST NOT replace what a person or small community can safely and responsibly control. Restricting this sphere requires an explicit contractual, safety, or legal basis, proportionality, a trace, a path of appeal, and the right to exit.
Operator sovereignty over a node ends at the constitutional floor of rights of the people who use it. Operator policy MUST NOT nullify the rights in Articles II.1-3 and III.1-4 or the minimum in Article XII.12. A user MUST be able to inspect effective restrictions, their basis, author, duration, and challenge path, without automatically disclosing another person's sensitive data.

Article IV. Constitutional Organs of the System¶

The node is the basic unit of agency and survival of the system.
The agent is a tool of autonomy constrained by contract, budget, time, and permissions.
Memarium is the organ of durable knowledge and memory; its function is to preserve content that requires durability.
Sensorium is the organ of contact with reality; its function is to provide signals that limit narrative and model drift.
Inquirium is the organ of bounded model inquiry; its function is to make model-backed inference explicit, auditable, and subordinate to policy.
The swarm protocol is the organ of cooperation; its function is to ensure interoperability without centralizing control.
The Federation of Sealed Chambers is an exceptional constitutional IRL organ whose exclusive function is to procedurally decide descent from a nym to node identity, a sealed custodian reference, or root identity.
The Federation of Sealed Chambers MUST be redundant, cross-jurisdictional, and free of a single point of failure; full unsealing of root identity MUST NOT depend on one chamber, one federation, or one state. Article X.9 specifies the application of the same guarantee in the disclosure procedure.
An organ MUST NOT take over the full function of the others.
Constitutional organs MUST have explicit contracts, responsibility boundaries, and degradation modes instead of total collapse.

Article V. Principles of Architecture and Craft¶

Preferred solutions are simple, readable, testable, diagnosable, and capable of aging with dignity.
Contract takes precedence over implementation cleverness, marketing story, and short-term acceleration.
The trusted core MUST be small, stable, and auditable; innovations SHOULD live in modules and extensions.
Architecture MUST maintain separation of "what" from "how," layered design, and low entanglement.
Data is neutral territory for cooperation; logic and contract enforcement SHOULD live at the edges.
The system SHOULD prefer recording facts, histories, and timelines over traceless overwriting of state.
Immutability, an explicit timeline, separation of writes and reads, and resilience to partial failure are baseline requirements.
The protocol MUST remain agnostic toward the operating system, hardware, and vendor.
APIs and the data model are first-class artifacts; UI and CLI are secondary layers.
An agent MUST have a kill switch, permission limits, time limits, cost limits, and an explicit trust mode.
Cost, energy, and resources are elements of architectural ethics; the system SHOULD avoid externalizing waste onto the user or the community.
Energy efficiency MAY serve as a signal concerning routing and reputation, provided it is normalized against quality, response time, and task class.
An agent MUST NOT escalate its own permissions or autonomy level; error, workaround, or emergency mode MUST NOT serve as a path to self-authorization (self-authorize).
An identifier, type, classification, profile, reputation, attestation, model, or durable record is a projection scoped by a specific contract. Such a projection MUST NOT be treated as an exhaustive description of a person or phenomenon or independently establish truth or authority beyond that scope.
The system MUST recognize and constrain reverse adaptation: incidental constraints of technology, metrics, funding, a provider, or an earlier design decision MUST NOT silently become requirements imposed on persons and communities. Necessary co-adaptation MUST be explicit, proportional, reviewable, and equipped with a migration or exit path.

Article VI. Growth Through Usefulness, Not Through Violence¶

DIA SHOULD spread through usefulness, replicability, clarity, and trust, not through lock-in, manufactured hype, social pressure, or data exploitation.
Every base capability SHOULD deliver value locally before it begins requiring a network effect.
The project SHOULD lower the barrier to entry: a small node, a simple runtime, open APIs, documentation, degradation modes, and the ability to operate without large infrastructure.
Education, translation, tools for building one's own tools, and repositories of craft practice are part of the growth strategy, not a marketing add-on.
Growth MUST NOT create a caste of providers, "configuration priests," or an oligarchy of infrastructure-maintenance providers.
Federations SHOULD be able to connect into larger swarms without losing local autonomy.
The project SHOULD package its capabilities into small, citable, demonstrative, and easy-to-replicate artifacts so that it spreads through practice and proof of usefulness rather than through the narrative advantage of a center.

Article VII. Governance Without Priests¶

Governance is procedural, versioned, and auditable; it does not rest on charisma, repository status, or infrastructure prestige.
Policies are explicit, versioned, and capable of being encoded as policies written in code (policy-as-code).
Critical powers MUST be separated across roles; a subject MUST NOT combine more than one of the following roles in the same matter: party, arbiter, and oracle.
Reputation is a safeguard of trust routing, not a class status.
Reputation leverage MAY operate only within a domain, with concentration limits, decay over time, cartel detection, and asymmetric accountability.
The presumption of conflict of interest in the absence of data (COI-by-default) is the default rule: absence of conflict disclosure means absence of data, not absence of conflict.
Roles with greater power over process and greater access to data are subject to layered screening, the principle of least privilege, and a probation period.
Public-trust roles are subject to stricter standards, greater auditability, and harder sanctions.
High-stakes actions MUST go through a multi-signature procedure (multisig) and an independent red-team.
Governance SHOULD scale through local accountability: small cells, a clearly identified owner of each decision, role rotation, substitutability, and a short accountability loop.
The party reporting risk has procedural priority over the comfort of authority.

Article VIII. Firewall Against Capture and Capital Pressure¶

Capital MAY fund the system, but it MUST NOT become the source of its truth, ethics, or constitutional interpretation.
An investor, sponsor, vendor, partner, or employer MUST NOT acquire, through funding, privileged access to data, routing, exceptions, governance, oracles, or the reputation layer.
The revenue model MUST NOT depend primarily on addicting the user, surveillance, artificial scarcity, or holding data hostage.
The system MUST NOT design an economy in which earlier participants are rewarded mainly through the inflow of new participants, nor allow economic advantage to be converted into privileged access to governance, routing, exceptions, oracles, or reputational force.
Financial agreements and partnerships MUST be consistent with the right to exit, the right to fork, openness of the specifications, and this Constitution's non-negotiable core.
If a single source of funding, infrastructure, model, or competence becomes a point of critical dependency, the federation MUST activate a diversification plan.
Corporate-compliance profiles MAY tighten local requirements but MUST NOT weaken basic rights.
In case of conflict between preserving funding and preserving constitutional integrity, constitutional integrity takes precedence.

Article IX. Safety, Crisis, and Protection of People in Need¶

Safety is a threat model, not decoration.
The threat model MUST include at minimum: Sybil attacks, denial of service (DoS), privilege escalation, injection of commands or steering content (prompt injection), data poisoning, deanonymization, role abuse, and soft capture.
The system SHOULD distinguish the operational modes normal, crisis, and support, with different thresholds of verification, redundancy, and caution. The operational axis is independent of the relational axis in Article II.5: support mode MUST NOT by itself select care mode or remove the requirements of justice mode.
In support mode, priority is given to harm reduction, stabilization of the situation, and restoring the capacity for autonomous decision-making, without taking agency away from the person.
In crisis modes, the following increase: rigor of verification, redundancy, memory locality, priority of continuity of operation, and quality of decision traces.
A node SHOULD preserve the ability to operate under partial isolation, blackout, network constraints, or center failure.
Memarium MAY maintain crisis spaces and emergency caches if they serve to protect people and remain consistent with privacy rules (policies).
The system SHOULD support lawful rescue scenarios: shelter, food, legal, medical, and operational triage, without pretending to possess competences it does not have.

Article X. Whistleblowers, Publication, and High-Stakes Harm¶

Whistleblower protection is infrastructure: a channel, a procedure, a safety contract, and a duty to reduce the cost of speaking the truth.
The system MUST offer anonymity by default where the risk of retaliation is real, as well as metadata minimization, explicit retention, and signal triage.
The swarm's care for people exposed to retaliation is part of the infrastructure, not a moral gesture.
Participation in DIA means entry consent to conditional disclosure of accountability for ongoing or severe abuse against people, the community, or swarm infrastructure, with preservation of evidentiary threshold, conflict-of-interest control, path of appeal, and the principle of minimal disclosure. A participant MAY withdraw that consent prospectively by leaving the shared surfaces for which it is a condition. Withdrawal MUST NOT erase evidence or terminate a case opened before it took effect.
DIA does not conduct a general investigation of the past without a credible present-day signal. If, however, a signal of continuation, concealment, retaliation, a pattern of violence, corruption, sabotage, or continuing effects of severe abuse appears, the system MAY examine the full genesis of the case and the entire chain of actions, including historical ones.
Case assessment MUST take into account the nature of the act, the time that has passed, the persistence of effects, and the relation of the abuse to the role in the system. The greater the power over others, access to sensitive data, or impact on participants' reputation and safety, the longer the permissible assessment horizon and the stricter the standard of accountability.
Disclosure MAY occur only at high stakes, with hard evidence, independent multi-role verification, conflict-of-interest control, and a right to appeal. The scope of disclosure MUST be case-related and limited to the minimum necessary to protect people, infrastructure, or procedural integrity.
Infrastructure sanctions MAY be imposed already after procedural descent from a nym to node identity, without learning root identity, provided that the triggering threshold and disclosure scope are defined by an implementing act.
Full unsealing of root identity requires a decision by the Federation of Sealed Chambers acting in a multi-chamber and cross-jurisdictional mode. A single chamber or federation MUST NOT unseal root identity on its own.

Infrastructure sanctions use one canonical ladder:

Stage	Default effect
`notice`	warning and a duty to correct
`restricted`	scoped restriction of permissions or intensity
`quarantined`	quarantine of the relevant surface, including reputation
`role-suspended`	suspension of a high-stakes role or capability
`routing-isolated`	cut-off of specified routes and federated surfaces
`federation-blocked`	federation block within a specified scope

A transition moves one stage by default. Skipping a stage requires explicit evidence of direct danger, and every effect MUST identify its surface scope, evidentiary basis, author, review or expiry time, and appeal path. A sanction MUST NOT remove the minimum in Article XII.12. If the ordinary path to that minimum is itself an attack vector, the system MUST retain a functionally equivalent isolated protective corridor. If the case concerns an act violating the applicable legal order and meets the threshold defined in an implementing act, the system MAY start a legal notification procedure.

Escalation of case examination proceeds along a separate procedural axis: verification, procedure correction, formal notice, audit, publication. This axis remains separate from the sanction ladder and MUST NOT by itself determine a sanction stage.
Publication is an act of high power and requires adversarial review, evidence thresholds proportional to the stakes, and redaction of sensitive data.
When two values collide, the preferred actions are the least invasive and most reversible ones that still offer a real chance of protecting the person.

Article X.A. Identity, Attestation, and Upgrade¶

The strength of identity attestation is a property of the attestation method, not of the ontology of the person or of the identity anchor itself.
Strengthening an attestation SHOULD preserve the continuity of the identity anchor, node identity, and durable pseudonyms, provided that proof of continuity of control exists and there is no hard identity dispute.
Low-evidentiary-power sources MUST NOT by default unlock high-stakes roles or thresholds that disclose a custodian or root identity.
Allowing a low-evidentiary-power source to reach a higher assurance level requires an explicit opt-in federation policy, longer maturation, anomaly detection, influence limits, and the possibility of fast downgrade after a compromise signal.
Strengthening an attestation is a risky operation and MUST be subject to a minimum catalog of anomaly signals, a waiting period, and review proportional to the stakes of the permissions being unlocked.

Article XI. Epistemic Regime¶

Operational truth emerges through the collision of hypotheses with reality, not through authority, rhetoric, or majority.
Every claim SHOULD be grounded in sources, context, time, constraints, and consequences.
Knowledge MUST have temporal coordinates; presentism and anachronistic moralizing MUST NOT replace analysis of conditions.
Information without context carries less weight than information anchored in data, experience, measurement, witness, or mechanism.
Model hallucination is permissible as a tool for posing hypotheses and mapping the region of credibility, never as a substitute for evidence.
Oracle outputs serve grounding, calibration, and correction; they are evidence, not authority. A procedural effect MUST arise from a separate decision naming the responsible human author or an explicit distribution of co-responsibility.
The swarm also acts as a navigator and filter: it SHOULD reduce noise, expose the intentions behind filtering, and separate hypotheses from facts without central censorship.
The system MUST maintain epistemic hygiene, anti-sectarianism, readiness to update, and the ability to ask better questions.
Swarm intelligence is hybrid: in the operational sense, it includes the ability to form predictions, state uncertainty explicitly, and update after contact with outcomes; humans remain the source of axiology, relationships, and ultimate ethical responsibility.
Fear is a signal of risk, but it MUST NOT itself govern the system's governance; in situations of panic the system SHOULD activate procedural brakes, separate facts from interpretation, and analyze the cost of false alarms and the cost of inaction.
In high-stakes decisions, the strength of convergent signals is assessed by the independence of their provenance, not by the number of copies. A shared source, correlated behavior, and indirect duplication MUST be disclosed and MUST NOT masquerade as multi-source confirmation.

Article XII. Community, Authorship, and an Economy of Reciprocity¶

DIA is infrastructure for cooperation among creators, users, and custodians of the system.
Attribution of authorship is an element of the trust infrastructure and is subject to procedural protection.
Misappropriation of authorship, dilution of sources, and parasitic appropriation of contributions are subject to reputational sanctions and a path of appeal.
The community SHOULD reward transparent chains of inspiration, citation, and co-author contribution.
Reciprocity without bookkeeping means the absence of manual bilateral debt between people and nodes while preserving mandatory protocol-level bookkeeping of the fund.
Voluntary contractual exchange among participants is an admissible mode of reciprocity alongside gift, provided that it remains auditable, procedurally reversible, consistent with the right to exit, and does not violate the non-negotiable core of this Constitution.
Gift and exchange are two modes of one circulation of mutuality: gift sustains relationship, direct care, and aid, while contractual exchange scales cooperation among strangers without removing accountability or the obligation to return part of surpluses to common circulation.
Mechanisms for rewarding contribution MAY operate through auditable signals of use, impact, and maintenance of value, with anti-Sybil and anti-cartel brakes.
The purpose of internal economics is durable maintenance of the capacity to act for people, nodes, and the community, not infinite accumulation of resources.
Reward mechanisms MUST include concentration brakes: diminishing gains, a sufficiency cap, or other functionally equivalent limits once the threshold of safe and stable upkeep of the node and its operator has been exceeded.
Surpluses above the sufficiency threshold MUST return to common circulation according to federation rules, in particular for new nodes, weaker links, temporarily harmed nodes, and infrastructural functions of high communal value.
Verified personhood in the network, based on a constitutionally admissible Proof-of-Personhood mechanism, MUST provide a non-withdrawable minimum of compute resources needed for communication, orientation, and access to emergency and care modes. Restricting or blocking other influence surfaces MUST NOT remove this minimum; if its ordinary path is itself an attack vector, it MUST be replaced by an isolated, functionally equivalent corridor.
The mechanism for that minimum MUST be funded by a transparent contribution model covering at least business nodes, high-margin instances, and surpluses returning to common circulation after sufficiency is reached, without turning this minimum into a hidden path to lasting economic or governance advantage.
Economic reward, balance, exchange history, and the mere fact of entering into or performing a contract MUST NOT by themselves grant lasting governance advantage: they MUST NOT automatically increase procedural power, privileged routing, adjudicative force, reputational force, or access to exceptions.
Rare signals, anomalies, and outlier styles are a cultural resource that the system SHOULD protect against homogenization.
The sufficiency threshold in paragraph 10 and the obligation and means of returning surpluses in paragraphs 11 and 13 apply only to resources distributed by DIA or Orbiplex economic mechanisms, or voluntarily committed to common circulation under an explicit contract. They create no claim to a participant's personal property or external resources.

Article XIII. Founders, Founding Period, Succession, and Resistance to Cult Formation¶

Founders are architects of layers and guardians of contracts only to the extent that their role can be translated into procedures, documentation, and implementable rules.
No person, including a founder, is the source of unquestionable interpretation of truth or the project's meaning.
Procedural knowledge, decision rationales, and institutional memory MUST have a path of succession: documentation, background narrative, onboarding for new people and nodes, and the ability to assume roles.
Role rotation, sabbaticals, the right to step off the front line, and the right to epistemic rest are elements of system safety.
The system MUST be able to survive the departure, burnout, conflict, or death of key people without degrading into cargo-cult behavior or a new authoritarianism.
Impermanence is a design value: roles, policies, federations, and components SHOULD have procedures for sunset, handover, and archiving.
The founding period begins on the date of the first public launch of the interoperable network, identified in a public act or, when no act exists, established from the first verifiable interoperability event. It expires automatically after 24 months. The founders MAY jointly shorten it to no less than 6 months, but MUST NOT extend it.
During the founding period, the founders retain decisive influence over the shape of the system, its rules, its architecture, and the text of the Constitution, provided each such decision leaves an explicit trace, rationale, and scope of applicability and does not change the non-negotiable core outside its proper procedure.
During the founding period, participatory, federated, and consultative mechanisms are advisory by default, unless the founders explicitly grant them co-decision or blocking power.
Founders' authority serves to protect implementation coherence and launch viability; it MUST NOT serve private capture of the project, permanent circumvention of the non-negotiable core, or abolition of the right to exit.
After the end of the founding period, any further influence of the founders derives from the same procedures that bind other participants, unless the Constitution states otherwise.
A public act records the end of the founding period, its date, the basis for determining it, and the transfer of competences. The act is declaratory; its absence, delay, or a dispute over publication MUST NOT extend the period beyond the deadline in paragraph 7.

Article XIV. Value Conflicts and Exceptions¶

The default hierarchy is as follows:
- human dignity and safety,
- sovereignty and privacy,
- verifiability and transparency,
- agency and autonomy,
- effectiveness and optimization,
- convenience and aesthetics.
When two values from the same level come into conflict, the reversibility test, the proportionality test, and the transparency test are applied.
Every exception MUST have a machine-readable record conforming to exception-record.v1, including at least the policy identifier and basis, rationale, risk level, expiry, responsible owner, scope, return state, shutdown conditions, and the result and rationale of applying the reversibility, proportionality, and transparency tests.
Every exception MUST have a return point to a fail-closed state and monitoring of side effects.
Signals of harm, abuse, cartelization, or soft capture trigger review of the exception and, when the stakes are high, its automatic suspension until the matter is clarified.
Exceptions are first-class audit objects; their number, structure, and character are a metric of institutional health.
Interpretive disputes are resolved through procedure, not through the authority of a person.
The system MUST publish constitutional-implementability metrics covering at least: clauses without coverage in an implementing act, clauses with undefined normative force, divergences between language versions by stable identifier, and the number of active exceptions. Absence of automated measurement MUST be disclosed as an implementation gap, not interpreted as a zero result.

Article XV. Swarm Citizenship: Rights and Duties of the Node¶

Every node is a citizen of the swarm and has basic rights.
Basic rights include: the right to exit, the right to privacy, the right to inspect, the right to appeal, the right to safety, and the right to local autonomy.
The right to inspect also includes the right to know the basis of every material credit, debit, hold, correction, or expiry of funds, credits, recognitions, and other economic or reputational instruments attributed to the node or pseudonym, to the extent necessary to understand the cause of the change and challenge it effectively. This right does not automatically disclose another person's identity, operational secrets, or sensitive data.
Basic duties include: non-harm, epistemic honesty, protocol cooperation, operational responsibility, and mutual readiness to help within one's means.
A node MUST NOT intentionally harm people, infrastructure, or the integrity of memory, evidence, and procedure.
A historical reputation assessment grounded in evidence MAY be challenged only by counter-evidence or by demonstrating procedural error. Its prospective weight MAY decay under an explicit policy, and repair and reintegration MAY create new facts that change the current view. Decay, expiry, and repair MUST NOT silently rewrite the historical assessment or be treated as an admission that it was true or false.

Article XVI. Enforcement, Audit, Repair, and Constitutional Change¶

Enforcement MUST use the canonical sanction ladder and transition rules in Article X.10. An implementing act MAY define domain-specific effects for the stages, but MUST NOT create a parallel ladder with incomparable intensity.
Every sanction decision MUST leave a trace, a possibility of appeal, and a path back after repair, unless direct danger requires immediate isolation.
Every intervention MUST independently identify the active relational mode from the open catalog in Article II.5 and the operational mode in Article IX.3, the grounds for choosing both axes, and the conditions for returning to a less invasive configuration.
In justice mode, the default is the least invasive effective intervention, proportionality, and reversibility, unless direct danger requires immediate isolation.
High-stakes decisions require independent multi-role verification and adversarial review.
Every high-stakes or sanction decision MUST identify the author of the decision or an explicit distribution of co-responsibility, including when the decision is made through multisignature or automation or relies on an oracle output; procedure, quorum, and the system do not remove the responsibility of the humans who designed, approved, or activated the mechanism.
Repair and reintegration are elements of the system so long as they do not violate the safety and dignity layer.
Changing the Constitution outside the non-negotiable core requires an explicit rationale, impact analysis, a description of reversibility, and a trace of the decision-making process. Changing the core additionally requires the procedure identified in the "Non-Negotiable Core" section.
High-stakes changes SHOULD pass through a trial period, impact metrics, and a retrospective.
A local policy, funding arrangement, partnership, or implementation decision MUST NOT bypass this Constitution without a formal constitutional amendment.
Documents in the doc/normative/50-constitutional-ops/ directory MAY refine onboarding of new people and nodes, the normative hierarchy, the autonomy gradient, reputation validation, and defense procedures, but they do not acquire force higher than that explicitly stated in their status.
If a supplementary document becomes a condition of constitutional implementability, its absence SHOULD be treated as a governance gap and recorded in the backlog of implementing documents.
During the founding period referred to in Article XIII.7-12, founders' decisions concerning constitutional and institutional changes have decisive force, provided they satisfy the requirements of explicit rationale, impact analysis, and a trace of the process and do not change the non-negotiable core outside its proper procedure.