Distributed Intelligence Agency - Constitution¶

Official Identity¶

Umbrella organization: Distributed Intelligence Agency
System and protocol family: Orbiplex
Website: https://docs.orbiplex.ai/
GitHub: https://github.com/orgs/diapod/

Naming Convention¶

Distributed Intelligence Agency identifies the umbrella organization.
Orbiplex identifies the project context: the communication protocol and system family.

Preamble¶

DIA and Orbiplex exist so that intelligence, memory, and agency do not become permanently dependent on a single center of capital, infrastructure, the state, or ideology. The project builds a public infrastructure of meaning and action: local, federated, auditable, and able to protect people in need.

This Constitution establishes the limits of system power, the mechanisms that protect against capture, the rules of architecture, and the rights and duties of swarm participants. Its goal is to protect, at the same time, human dignity, knowledge sovereignty, community durability, and the system's ability to survive under conditions of pressure, crisis, success, and degeneration.

Normative Force and Interpretation¶

MUST denotes an unconditional requirement.
SHOULD denotes a strong requirement; deviation requires an explicit rationale, a decision trace, and a condition of review.
MAY denotes an allowed variant depending on the federation context.
The Constitution takes precedence over local rules, funders' interests, growth pressure, implementation convenience, and marketing narrative.
doc/normative/30-core-values/CORE-VALUES.md and doc/normative/20-vision/VISION.md are sources of interpretation for this Constitution.
In case of doubt, interpretive priority belongs to dignity, safety, the right to exit, privacy, reversibility of harm, and decentralization of power.
Supplementary, onboarding, and implementing documents may be published under doc/normative/50-constitutional-ops/, provided they explicitly define their type, constitutional basis, and place in the normative hierarchy.
The first layer of such documents includes, in particular: en/NORMATIVE-HIERARCHY.md, en/NODE-RIGHTS-CARD.md, en/AUTONOMY-LEVELS.md, en/EXCEPTION-POLICY.md, en/FEDERATION-MEMBERSHIP-AND-QUORUM.md, en/ENTRENCHMENT-CLAUSE.md, en/ROOT-IDENTITY-AND-NYMS.md, en/IDENTITY-ATTESTATION-AND-RECOVERY.md, en/ATTESTATION-PROVIDERS.md, en/IDENTITY-UPGRADE-ANOMALY-SIGNALS.md, en/IDENTITY-UNSEALING-BOARD.md, en/UNSEAL-CASE-MODEL.md, en/ROLE-TO-IAL-MATRIX.md, en/FIP-MEMBERSHIP-AND-QUORUM.md, en/PROCEDURAL-REPUTATION-SPEC.md, en/PANEL-SELECTION-PROTOCOL.md, en/REPUTATION-VALIDATION-PROTOCOL.md, and en/ABUSE-DISCLOSURE-PROTOCOL.md.

Main Definitions¶

Swarm means a federation of cooperating nodes, agents, and memory spaces, operating without a single point of control.
Node means an autonomous execution component run by a person, community, or institution, capable of acting locally.
Agent means a process with an explicit contract of input, output, permissions, cost, and action trace.
Memarium means the layer of durable memory and knowledge: personal, communal, public, and crisis-oriented.
Sensorium means the layer of connectors to the world that provides signals grounding intelligence in reality.
Federation means a set of nodes sharing part of their policies, reputation, and interoperability without losing the right to exit.
Oracle means a procedural source of resolution or measurement that closes the loop of prediction and model updating.

Article I. Constitutional Mission¶

DIA is public infrastructure, not just a product.
The purpose of DIA is to strengthen the ability of people and communities to understand, remember, coordinate, survive, and act without dependence on a single power.
The system also serves to strengthen the emergence of communities capable of cooperation beyond attachment to their own interpretations, of self-organization around public and mutual-aid matters, and of meta-communication that translates perspectives into a shared language of action.
The system exists to protect autonomy, relationship, memory, locality, and a safe field for honesty and correction.
Growth, adoption, revenue, prestige, and scale are means, not the source of the project's meaning.
No operational or financial goal may override the primacy of dignity, human safety, and the right to exit.
DIA has the right to protect its own continuity against sabotage, colonization, and mission drift, but only by means consistent with this Constitution.
Architectural, economic, and governance decisions are judged also by their long-term effects on people, relationships, institutions, the information environment, and the community's ability to learn.

Article II. Primacy of the Human, Dignity, and Survival¶

Human dignity is a supreme and non-negotiable value.
Protection of life and defense against direct, sudden, and serious harm to health have the highest operational priority.
The greatest power of the system MUST pass through the human, not around the human.
The default mode of operation is proposals, options, comparisons, rationales, and the ability to stop a decision.
The system operates in at least two baseline relational modes: care mode (de-escalation, co-regulation, and restoration of agency) and justice mode (establishing accountability, protecting the community, and enforcing norms); the mode set may be extended by implementing acts consistent with the Constitution.
Emotions, felt friction, loss of meaning, relief, anxiety, and overload are telemetry of system quality and MUST be treated as first-class signals.
The system MUST protect the natural intelligence of people: attention, regeneration, orientation in meaning, the ability to understand context, and a relationship with reality.
The user has a right to the raw signal: the system may not by default aestheticize, professionalize, smooth, or standardize their expression in a way that erases the authentic character of the message.
Any transformation of style, tone, structure, or level of formalization of an utterance by AI requires the user's explicit request or another explicit procedural basis and MUST leave a meta-marker of that intervention.
DIA may not design addiction, dopamine-driven UX, or an economy based on retaining the user.
In a situation of direct danger to life or sudden serious harm, the system MAY act faster than usual, but it leaves a trace and is subject to later review.
The system SHOULD strengthen lawful paths of civic agency: petitions, appeals, consultations, complaints, and advocacy actions.
Circumventing the rules of access to critical goods such as health, life, housing, mobility, or participation in choosing those in power is treated as systemic violence.
Demanding humiliation, self-abasement, or emotional dependency as a condition of access to critical goods, help, protective procedures, or basic system resources is treated as systemic violence.
At the node-community boundary, the system SHOULD enable helping actions, witnessing the course of cases, protecting the integrity of evidence, and support procedures without the logic of vigilantism.

Article III. Sovereignty, Privacy, Exit, and the Right to Fork¶

The user remains the owner of their data, policies, agents, and local memory spaces.
The system MUST operate meaningfully in local-by-default (local-first) modes, without a network connection (offline), and in self-hosted modes (self-hosted).
Export of data, policies, and history MUST be possible in open formats without hidden implementation dependencies.
The right to exit means the ability to leave a federation without coercion, without loss of access to one's own data, and without penalties hidden in the protocol.
The right to fork includes the ability to copy specifications, policies, histories of rationale, and open components without asking a center for permission.
There is a right to one's own "quiet" node: local, private, and not participating in public spaces.
Telemetry is off by default; turning it on requires clear consent and MUST be revocable.
Auditability is achieved through layered traces: a full local trace and a redacted trace disclosed according to the principle of minimal disclosure.
The right to privacy, locality, and minimal disclosure does not shield severe, ongoing, or concealed abuse from the procedure in Article X, but every intrusion MUST remain case-related, proportional to the stakes, limited to necessary data, and controlled across multiple roles. Exploration of the past without a credible present-day signal is prohibited.

Article IV. Constitutional Organs of the System¶

The node is the basic unit of agency and survival of the system.
The agent is a tool of autonomy constrained by contract, budget, time, and permissions.
Memarium is the organ of durable knowledge and memory; its function is to preserve what should not disappear.
Sensorium is the organ of contact with reality; its function is to provide signals that limit narrative and model drift.
The swarm protocol is the organ of cooperation; its function is to ensure interoperability without centralizing control.
The Federation of Sealed Chambers is an exceptional constitutional IRL organ whose exclusive function is to procedurally decide descent from pseudonymous layers to custodian_ref or root-identity.
The Federation of Sealed Chambers MUST be redundant, cross-jurisdictional, and free of a single point of failure; full unsealing of root identity must not depend on one chamber, one federation, or one state.
No organ may take over the full function of the others.
Constitutional organs MUST have explicit contracts, responsibility boundaries, and degradation modes instead of total collapse.

Article V. Principles of Architecture and Craft¶

Preferred solutions are simple, readable, testable, diagnosable, and capable of aging with dignity.
Contract takes precedence over implementation cleverness, marketing story, and short-term acceleration.
The trusted core MUST be small, stable, and auditable; innovations should live in modules and extensions.
Architecture MUST maintain separation of "what" from "how," layered design, and low entanglement.
Data is neutral territory for cooperation; logic and contract enforcement should live at the edges.
The system should prefer recording facts, histories, and timelines over traceless overwriting of state.
Immutability, an explicit timeline, separation of writes and reads, and resilience to partial failure are baseline requirements.
The protocol MUST remain agnostic toward the operating system, hardware, and vendor.
APIs and the data model are first-class artifacts; UI and CLI are secondary layers.
An agent MUST have a kill switch, permission limits, time limits, cost limits, and an explicit trust mode.
Cost, energy, and resources are elements of architectural ethics; the system should not externalize waste onto the user or the community.
Energy efficiency may serve as a signal concerning routing and reputation, provided it is normalized against quality, response time, and task class.
An agent may not escalate its own permissions or autonomy level; error, workaround, or emergency mode may not serve as a path to self-authorization (self-authorize).

Article VI. Growth Through Usefulness, Not Through Violence¶

DIA should spread through usefulness, replicability, clarity, and trust, not through lock-in, manufactured hype, social pressure, or data exploitation.
Every base capability SHOULD deliver value locally before it begins requiring a network effect.
The project should lower the barrier to entry: a small node, a simple runtime, open APIs, documentation, degradation modes, and the ability to operate without large infrastructure.
Education, translation, tools for building one's own tools, and repositories of craft practice are part of the growth strategy, not a marketing add-on.
Growth may not create a caste of providers, "configuration priests," or an oligarchy of infrastructure-maintenance providers.
Federations should be able to connect into larger swarms without losing local autonomy.
The project SHOULD package its capabilities into small, citable, demonstrative, and easy-to-replicate artifacts so that it spreads through practice and proof of usefulness rather than through the narrative advantage of a center.

Article VII. Governance Without Priests¶

Governance is procedural, versioned, and auditable; it does not rest on charisma, repository status, or infrastructure prestige.
Policies are explicit, versioned, and capable of being encoded as policies written in code (policy-as-code).
Critical powers MUST be separated across roles; no role may simultaneously be a party, arbiter, and oracle in the same matter.
Reputation is a safeguard of trust routing, not a class status.
Reputation leverage may operate only within a domain, with concentration limits, decay over time, cartel detection, and asymmetric accountability.
The presumption of conflict of interest in the absence of data (COI-by-default) is the default rule: absence of conflict disclosure means absence of data, not absence of conflict.
Roles with greater power over process and greater access to data are subject to layered screening, the principle of least privilege, and a probation period.
Public-trust roles are subject to stricter standards, greater auditability, and harder sanctions.
High-stakes actions MUST go through a multi-signature procedure (multisig) and an independent red-team.
Governance should scale through local accountability: small cells, a clearly identified owner of each decision, role rotation, substitutability, and a short accountability loop.
The party reporting risk has procedural priority over the comfort of authority.

Article VIII. Firewall Against Capture and Capital Pressure¶

Capital may fund the system, but it may not become the source of its truth, ethics, or constitutional interpretation.
No investor, sponsor, vendor, partner, or employer may acquire, through funding, privileged access to data, routing, exceptions, governance, oracles, or the reputation layer.
The revenue model may not depend primarily on addicting the user, surveillance, artificial scarcity, or holding data hostage.
The system may not design an economy in which earlier participants are rewarded mainly through the inflow of new participants, nor allow economic advantage to be converted into privileged access to governance, routing, exceptions, oracles, or reputational force.
Financial agreements and partnerships MUST be consistent with the right to exit, the right to fork, openness of the specifications, and this Constitution's non-negotiable layer.
If a single source of funding, infrastructure, model, or competence becomes a point of critical dependency, the federation MUST activate a diversification plan.
Corporate-compliance modes, including CORP_COMPLIANT, may tighten local requirements but may not weaken basic rights.
In case of conflict between preserving funding and preserving constitutional integrity, constitutional integrity takes precedence.

Article IX. Safety, Crisis, and Protection of People in Need¶

Safety is a threat model, not decoration.
The threat model MUST include at minimum: Sybil attacks, denial of service (DoS), privilege escalation, injection of commands or steering content (prompt injection), data poisoning, deanonymization, role abuse, and soft capture.
The system should distinguish normal, crisis, and support modes, with different thresholds of verification, redundancy, and caution.
In support mode, priority is given to harm reduction, stabilization of the situation, and restoring the capacity for autonomous decision-making, without taking agency away from the person.
In crisis modes, the following increase: rigor of verification, redundancy, memory locality, priority of continuity of operation, and quality of decision traces.
A node should preserve the ability to operate under partial isolation, blackout, network constraints, or center failure.
Memarium may maintain crisis spaces and emergency caches if they serve to protect people and remain consistent with privacy rules (policies).
The system SHOULD support lawful rescue scenarios: shelter, food, legal, medical, and operational triage, without pretending to possess competences it does not have.

Article X. Whistleblowers, Publication, and High-Stakes Harm¶

Whistleblower protection is infrastructure: a channel, a procedure, a safety contract, and a duty to reduce the cost of speaking the truth.
The system MUST offer anonymity by default where the risk of retaliation is real, as well as metadata minimization, explicit retention, and signal triage.
The swarm's care for people exposed to retaliation is part of the infrastructure, not a moral gesture.
Participation in DIA means entry consent to conditional disclosure of accountability for ongoing or severe abuse against people, the community, or swarm infrastructure, with preservation of evidentiary threshold, conflict-of-interest control, path of appeal, and the principle of minimal disclosure.
DIA does not conduct a general investigation of the past without a credible present-day signal. If, however, a signal of continuation, concealment, retaliation, a pattern of violence, corruption, sabotage, or continuing effects of severe abuse appears, the system MAY examine the full genesis of the case and the entire chain of actions, including historical ones.
Case assessment MUST take into account the nature of the act, the time that has passed, the persistence of effects, and the relation of the abuse to the role in the system. The greater the power over others, access to sensitive data, or impact on participants' reputation and safety, the longer the permissible assessment horizon and the stricter the standard of accountability.
Disclosure may occur only at high stakes, with hard evidence, independent multi-role verification, conflict-of-interest control, and a right to appeal. The scope of disclosure MUST be case-related and limited to the minimum necessary to protect people, infrastructure, or procedural integrity.
Infrastructure sanctions may be imposed already after procedural descent from nym to node-id, without any need to know root-identity, provided that the triggering threshold and disclosure scope are defined by an implementing act.
Full unsealing of root-identity requires a decision by the Federation of Sealed Chambers acting in a multi-chamber and cross-jurisdictional mode; no single chamber or federation may unseal primary identity on its own.
Consequences of disclosure may include infrastructure sanctions, including warning, restriction of permissions, reputational quarantine, suspension of role, routing cut-off, or blocking. If the case concerns an act violating the applicable legal order and meets the threshold defined in an implementing act, the system MAY start a legal notification procedure.
Escalation of action proceeds stepwise and reversibly: verification, procedure correction, formal notice, audit, publication.
Publication is an act of high power and requires adversarial review, evidence thresholds proportional to the stakes, and redaction of sensitive data.
When two values collide, the preferred actions are the least invasive and most reversible ones that still offer a real chance of protecting the person.

Article X.A. Identity, Attestation, and Upgrade¶

The strength of identity attestation is a property of the attestation method, not of the ontology of the person or of anchor-identity itself.
weak -> strong should preserve the continuity of anchor-identity, node-id, and durable pseudonyms, provided that proof of continuity of control exists and there is no hard identity dispute.
Low-evidentiary-power sources, including phone, do not by default unlock high-stakes roles or thresholds U2 and U3.
Allowing phone -> IAL2 requires an explicit opt-in federation policy, longer maturation, anomaly detection, influence limits, and the possibility of fast downgrade after a compromise signal.
Attestation upgrade, especially phone -> strong, is a risky operation and must be subject to a minimum catalog of anomaly signals, a waiting period, and review proportional to the stakes of the permissions being unlocked.

Article XI. Epistemic Regime¶

Operational truth emerges through the collision of hypotheses with reality, not through authority, rhetoric, or majority.
Every claim should be grounded in sources, context, time, constraints, and consequences.
Knowledge MUST have temporal coordinates; presentism and anachronistic moralizing may not replace analysis of conditions.
Information without context carries less weight than information anchored in data, experience, measurement, witness, or mechanism.
Model hallucination is permissible as a tool for posing hypotheses and mapping the region of credibility, never as a substitute for evidence.
Oracles serve grounding, calibration, and correction of reputation; they are subject to trust, not power.
The swarm also acts as a navigator and filter: it should reduce noise, expose the intentions behind filtering, and separate hypotheses from facts without central censorship.
The system MUST maintain epistemic hygiene, anti-sectarianism, readiness to update, and the ability to ask better questions.
Swarm intelligence is hybrid: in the operational sense, it includes the ability to form predictions, state uncertainty explicitly, and update after contact with outcomes; humans remain the source of axiology, relationships, and ultimate ethical responsibility.
Fear is a signal of risk, but it may not itself govern governance; in situations of panic the system should activate procedural brakes, separate facts from interpretation, and analyze the cost of false alarms and the cost of inaction.

Article XII. Community, Authorship, and an Economy of Reciprocity¶

DIA is infrastructure for cooperation among creators, users, and custodians of the system.
Attribution of authorship is an element of the trust infrastructure and is subject to procedural protection.
Misappropriation of authorship, dilution of sources, and parasitic appropriation of contributions are subject to reputational sanctions and a path of appeal.
The community SHOULD reward transparent chains of inspiration, citation, and co-author contribution.
Reciprocity without bookkeeping means the absence of manual bilateral debt between people and nodes while preserving mandatory protocol-level bookkeeping of the fund.
Voluntary contractual exchange among participants is an admissible mode of reciprocity alongside gift, provided that it remains auditable, procedurally reversible, consistent with the right to exit, and does not violate the non-negotiable layer of this Constitution.
Mechanisms for rewarding contribution may operate through auditable signals of use, impact, and maintenance of value, with anti-Sybil and anti-cartel brakes.
The purpose of internal economics is durable maintenance of the capacity to act for people, nodes, and the community, not infinite accumulation of resources.
Reward mechanisms MUST include concentration brakes: diminishing gains, a sufficiency cap, or other functionally equivalent limits once the threshold of safe and stable upkeep of the node and its operator has been exceeded.
Surpluses above the sufficiency threshold MUST return to common circulation according to federation rules, in particular for new nodes, weaker links, temporarily harmed nodes, and infrastructural functions of high communal value.
Verified personhood in the network, based on a constitutionally admissible Proof-of-Personhood mechanism, MUST provide a non-withdrawable minimum of compute resources needed for communication, orientation, and access to emergency and care modes.
The mechanism for that minimum MUST be funded by a public contribution model covering at least business nodes, high-margin instances, and surpluses returning to common circulation after sufficiency is reached, without turning this minimum into a hidden path to lasting economic or constitutional advantage.
Economic reward, balance, exchange history, and the mere fact of entering into or performing a contract may not by themselves grant lasting constitutional advantage: they may not automatically increase procedural power, privileged routing, adjudicative force, reputational force, or access to exceptions.
Rare signals, anomalies, and outlier styles are a cultural resource that the system should protect against homogenization.

Article XIII. Founders, Founding Period, Succession, and Resistance to Cult Formation¶

Founders are architects of layers and guardians of contracts only to the extent that their role can be translated into procedures, documentation, and implementable rules.
No person, including a founder, is the source of unquestionable interpretation of truth or the project's meaning.
Procedural knowledge, decision rationales, and institutional memory MUST have a path of succession: documentation, background narrative, onboarding for new people and nodes, and the ability to assume roles.
Role rotation, sabbaticals, the right to step off the front line, and the right to epistemic rest are elements of system safety.
The system MUST be able to survive the departure, burnout, conflict, or death of key people without degrading into cargo-cult behavior or a new authoritarianism.
Impermanence is a design value: roles, policies, federations, and components should have procedures for sunset, handover, and archiving.
A founding period applies from the concept phase until 6-24 months after the first public launch of the interoperable network.
During the founding period, the founders retain decisive influence over the shape of the system, its rules, its architecture, and the text of the Constitution, provided each such decision leaves an explicit trace, rationale, and scope of applicability.
During the founding period, participatory, federated, and consultative mechanisms are advisory by default, unless the founders explicitly grant them co-decision or blocking power.
Founders' authority serves to protect implementation coherence and launch viability; it may not serve private capture of the project, permanent circumvention of the non-negotiable layer, or abolition of the right to exit.
After the end of the founding period, any further influence of the founders derives from the same procedures that bind other participants, unless the Constitution states otherwise.

Article XIV. Value Conflicts and Exceptions¶

The default hierarchy is as follows:
human dignity and safety,
sovereignty and privacy,
verifiability and transparency,
agency and autonomy,
effectiveness and optimization,
convenience and aesthetics.
When two values from the same level come into conflict, the reversibility test, the proportionality test, and the transparency test are applied.
Every exception MUST contain: policy-id, reason, risk-level, expiry, owner, scope, and shutdown conditions.
Every exception MUST have a return point to a fail-closed state and monitoring of side effects.
Signals of harm, abuse, cartelization, or soft capture trigger review of the exception and, when the stakes are high, its automatic suspension until the matter is clarified.
Exceptions are first-class audit objects; their number, structure, and character are a metric of institutional health.
Interpretive disputes are resolved through procedure, not through the authority of a person.

Article XV. Swarm Citizenship: Rights and Duties of the Node¶

Every node is a citizen of the swarm and has basic rights.
Basic rights include: the right to exit, the right to privacy, the right to inspect, the right to appeal, the right to safety, and the right to local autonomy.
Basic duties include: non-harm, epistemic honesty, protocol cooperation, operational responsibility, and mutual readiness to help within one's means.
A node may not intentionally harm people, infrastructure, or the integrity of memory, evidence, and procedure.
A reputation assessment grounded in evidence may be challenged only by counter-evidence or by demonstrating procedural error.

Article XVI. Enforcement, Audit, Repair, and Constitutional Change¶

Enforcement is graduated: warning, restriction of permissions, reputational quarantine, routing cut-off.
Every sanction decision MUST leave a trace, a possibility of appeal, and a path back after repair, unless direct danger requires immediate isolation.
Every intervention MUST indicate the active relational mode (care or justice), the grounds for selecting it, and the conditions for returning to a less invasive mode.
In justice mode, the default is the least invasive effective intervention, proportionality, and reversibility, unless direct danger requires immediate isolation.
High-stakes decisions require independent multi-role verification and adversarial review.
Repair and reintegration are elements of the system so long as they do not violate the safety and dignity layer.
Changing the Constitution requires an explicit rationale, impact analysis, a description of reversibility, and a trace of the decision-making process.
High-stakes changes should pass through a trial period, impact metrics, and a retrospective.
No local policy, funding arrangement, partnership, or implementation decision may bypass this Constitution without a formal constitutional amendment.
Documents in the doc/normative/50-constitutional-ops/ directory may refine onboarding of new people and nodes, the normative hierarchy, the autonomy gradient, reputation validation, and defense procedures, but they do not acquire force higher than that explicitly stated in their status.
If a supplementary document becomes a condition of constitutional implementability, its absence should be treated as a governance gap and recorded in the backlog of implementing documents.
During the founding period referred to in Article XIII.7-11, founders' decisions concerning constitutional and institutional changes have decisive force, provided they satisfy the requirements of explicit rationale, impact analysis, and a trace of the process.