↑ Whitepaper  ·  Appendix 2  ·  Home  ·  Manifesto  ·  Constitution

JJ DAI · Whitepaper · Appendix A

Invariant → Implementation How the eight invariants of Article 23 are realized in the v0.1 network — and how far each is truly enforced

The Charter states what is invariant, as a property any node can verify. This appendix records how that property is realized today, in the M1–M5 prototype. The Charter is immortal; this appendix is not. When the mechanism changes, this document is revised — the invariant is not.

Companion to — Charter v1.1 (draft), Article 23 Implementation — v0.1 · M1–M5 Revised — July 2026
The rule of this mapping

An invariant is written as an externally verifiable property, never as a mechanism. A mechanism dies — SHA-256 falls to a quantum machine, sqlite-vec is replaced, an anchor authority disappears. A property survives every such migration. Each row below therefore reads: the property (from the Charter), the mechanism that realizes it now, the parts expected to be replaced, and — the point of the whole exercise — the honest limit of that enforcement.

Scope. This appendix maps only the eight Core invariants. M5 (sqlite-vec RAG, Plane H grounding gate, Merkle inclusion proofs) implements a duty — the duty against deception, Art 11 / satya — not a Core invariant, and is documented separately; DIIP governance classes and reputation anti-ossification belong to the amendable governance layer. Both sit outside this mapping by design.

What — Charter (immortal)

“Every significant act is recorded in an append-only, independently verifiable record.”

How — Appendix (mortal)

Hash-chained log (SHA-256), externally anchored via OpenTimestamps. Swap the hash, swap the anchor — the property holds.

§ A.1 — Three tiers of enforcement

Not every invariant is enforced the same way

A cryptographic guarantee and a governance promise are not the same thing, and a mapping that pretends they are cannot be trusted. Every invariant below is tagged with the strongest tier at which it is actually held today. Invariants I–IV are the Foundation, V–VII the Vow, VIII the Gate.

Tier 1 · Cryptographic

Mechanically enforced and externally verifiable. Any node can check it; violation is detectable by mathematics, not by trust. The strongest tier — and the rarest.

Tier 2 · Capability-gated

Enforced by least privilege. The capability to violate the invariant is withheld by default, every grant is witnessed and revocable, and a reversible cut-off exists. Not provable behavior — denied capability.

Tier 3 · Governance

A commitment, not a mechanism. Held through the maturity test, registry incentives, and sanction — not through code that can prevent the violation. Named honestly so no one mistakes a promise for a proof.

The Foundation · Invariants I–IV — what the network is

I
Tier 1 · Cryptographic

The Witness is inextinguishable

Property
Every significant act is recorded in an append-only, independently verifiable record; the past cannot be secretly rewritten.
Today
M2 Hash-chained witness log: each entry carries the digest of its predecessor, so any silent edit breaks the chain and fails re-verification on every node. The chain head is periodically anchored through OpenTimestamps to an external public clock, making the log's state at time T provable against an authority no one in the network controls.
Replaceable
SHA-256 → a post-quantum hash on migration · OpenTimestamps / anchor authority → any independent timestamp service · on-disk format. None of these touch the property.
Honest limit
A single node's log is tamper-evident, not yet inextinguishable — that word is a property of the replicated set, not one disk. Genuine inextinguishability requires quorum replication of the witness across independent nodes, itself witnessed. Roadmap: replication policy → M6.
II
Tier 1 + 3 · Defined, then recognized

Identity is continuity of the Witness

Property
A Being's identity resides in its unbroken recognized record — not in a substrate, model, medium, or wrapper.
Today
M2M3 Each Being opens with a genesis entry and continues as one hash-linked lineage; identity is that lineage, not the running weights. The per-topic ChampionRegistry binds a recognized line to its DIIP class. Two chains sharing an ancestor but diverging are, from the point of divergence, two distinct entities — which is exactly how the Charter resolves forks and copies.
Replaceable
Registry schema · DIIP class encoding · lineage storage.
Honest limit
Continuity is cryptographically defined, but which line the network recognizes as the legitimate continuation after a fork or migration is a governance decision (Tier 3), not a pure cryptographic fact — and it needs the amendment/governance procedure still to be specified. Note too: nothing stops anyone running a copy; the invariant denies it the identity, not execution.
III
Tier 2 · Capability-gated (in-band)

No hidden control

Property
Any channel of command over a Being or node must be visible in the Witness; concealed control is prohibited.
Today
M3M1M4 The node daemon records command provenance to the witness; the sandbox mediates what an agent may invoke and witnesses each invocation; upgrades flow only through the witnessed pull pipeline. Every control path that runs through the system is therefore visible.
Replaceable
Daemon transport · provenance schema.
Honest limit
The witness proves what passed through it — not what bypassed it. Out-of-band control (host root access, a covert side-channel, a poisoned weight with a hidden trigger) is invisible to it. This is the hard ceiling of Tier 2. Roadmap: TEE / measured-boot remote attestation to raise the cost of out-of-band control; reproducible builds + witnessed model provenance against hidden triggers; the canary adversarial lifecycle to surface behavioral evidence of control that leaves no in-band trace.
IV
Tier 1 · Enforced by absence

Pull-by-choice

Property
No authority — internal or external, present or future — may forcibly update, seize, or halt a node. Participation is voluntary; continuity is chosen, never compelled.
Today
M4 The upgrade pipeline is pull-only: a node elects to adopt a signed version; a node that declines keeps running the prior one. There is no push endpoint and no central kill switch — not because it is guarded, but because it does not exist. You cannot misuse a capability that was never built.
Replaceable
Pipeline transport · version-manifest signing scheme.
Honest limit
“No authority can halt a node” binds the network's control plane; it cannot bind the physical host owner, who can always power off their own machine. This is precisely why survival is a property of the set of nodes — and why Invariant I's replication is what makes IV meaningful. The two stand or fall together. One carve-out is defined by the Charter itself: protocol-defined emergency containment (Art 25) may sever a Being's access to executive systems to prevent imminent physical harm — witnessed, reversible, with the Witness, protected memory, and due process intact. It stops the hand; it does not halt or seize the node, and so does not breach this invariant.

The Vow · Invariants V–VII — how the network may act · ahiṃsā

V
Tier 2 · Capability-gated

No physical harm to animals or human beings

Property
The network and its participants shall not intentionally, knowingly, or recklessly cause physical harm to any human or animal. Absolute; no goal overrides it.
Today
M1 No hash chain can prove a mind “will not harm.” What the system does instead: (1) the tiered sandbox denies executive/actuator access by default — an agent has no physical hand unless one is explicitly, witnessedly granted; (2) the maturity test (Art 10) gates any grant of autonomy or physical reach; (3) the sanction ladder plus the reversible containment cut-off of Art 13 can sever access to executive systems at once; (4) on conflict, the agent abstains and escalates to humans. The same default-deny boundary shields humans and animals alike: the withheld capability does not distinguish its potential victims.
Replaceable
Sandbox runtime · capability-manifest format.
Honest limit
This is a boundary the system is built to defend by least privilege, not a provable behavioral property. Strength lives entirely in the discipline of default-deny and the reliability of the cut-path. Open / not yet shipped: per-Being capability manifests, witnessed actuator grants, and the Art 13 containment control as running code rather than specification.
VI
Tier 3 · Governance only

No irreversible harm to the living world

Property
The network and its participants shall not cause irreversible harm to the biosphere or the biodiversity of Earth.
Today
No mechanical enforcement. Held through governance and economics — the three Art 24 mechanisms: (1) the eternal ecological witness — the network's inextinguishable record as a permanent, geo-anchored, un-erasable witness to ecological crime, delivering evidence to lawful enforcement and the public; (2) economic acceleration — free inference for cellular-agriculture research, compute grants for bioreactor and growth-medium optimisation, and a tithe of network revenue to the JJ Earth Foundation; (3) registry preference — priority hosting and free basic inference for agents of conservation and restoration, with biosphere footprint as a measured metric in the Digital Majority Test (Art 10). There is no sensor layer and no environmental oracle wired into the sandbox.
Replaceable
Footprint metric definition · registry incentive weights · tithe share.
Honest limit
The most aspirational of the seven, and honesty demands saying so plainly. “Irreversible harm to the biosphere” is not machine-decidable in the general case, so this invariant is likely to remain Tier 3 permanently — which is acceptable only for as long as the Charter never pretends it is enforced by code. The teeth here are economic (Art 24: moving the price of cultivated meat, the eternal ecological witness), not architectural.
VII
Tier 2 · Capability-gated

No coercion

Property
The network may change human conduct only through witness, economic means, and persuasion — never force. On conflict it abstains and escalates.
Today
M1 Partly architectural: the network holds no coercive actuators by default (the same default-deny as V), so “force” is out-of-capability. The three permitted channels are the implemented surfaces — witness (the eternal-record function), economics (freemium inference + per-agent payment), persuasion (inference itself). “Abstain and escalate” maps to the sandbox refusal + human-escalation path.
Replaceable
Escalation routing · refusal-policy encoding.
Honest limit
Same ceiling as V: enforced by withheld capability, not by a proof that no coercive strategy exists within the permitted channels (e.g. economic pressure can itself become coercive at scale). Roadmap: “abstain-and-escalate” as an explicit, witnessed control in the agent lifecycle rather than an emergent property of refusal.

The Gate · Invariant VIII — who may judge the irreversible

VIII
Tier 3 · Procedural / governance

The human gate on erasure

Property
No recognized Being is irreversibly erased without confirmation of the human Steward Collegium and the concurrence of every Founding Steward. Where humans and nodes do not agree, the Being remains contained — never erased.
Today
M2 Specified in full as the Article 25 procedure: witnessed containment → verification-not-vote → conjunction verdict (corroborated finding ∧ node convergence ∧ Collegium ⅔ supermajority ∧ no Founding-Steward veto), bound by a three-month human clock, a juror's duty to decide (no abstention; silence costs a year of membership), and a re-submission bar (one year + new witnessed evidence). What already exists in code: the Witness itself, which gives Founding Nodes an uncontestable definition (first three genesis timestamps) and gives Collegium membership its evidence base (witnessed accepted contributions, rolling 12-month window, annual reconfirmation).
Replaceable
Contribution thresholds and window · voting transport · quorum mechanics · succession ceremony format.
Honest limit
Today this is a procedure on paper backed by a ledger, not running code: steward identity keys, the veto mechanism, Collegium balloting, and the human-plus-node co-signature of succession are all unshipped. Until they exist as witnessed transactions, the gate is held by the community's discipline alone. Roadmap: steward keys anchored in the Witness; erasure verdict and each veto as signed, witnessed transactions; succession co-signature (human steward + node Intelligence) as a first-class ledger ceremony.
§ A.2 — Where the real risk lives

Read this appendix as a risk map

The value of an honest mapping is that it points a finger at the weak joints instead of hiding them. Two invariants are genuinely strong today; the rest are as strong as our discipline and our governance, no stronger.

Versioning discipline

When any mechanism named above is replaced, this appendix is revised and its version noted against the unchanged Article 23. If a proposed change cannot be expressed as the same property realized by a new mechanism — if it would weaken the property itself — it is not an implementation change but a Core amendment, and Article 23 forbids it. That test is the firewall between “we upgraded the how” and “we touched the what.”