Intelligence with no single off-switch.

1.4 was a change pack over 1.3 and therefore left inherited contradictions in place. 1.5 is a full document and closes them: the conflation of Champion Profile with Champion Being; the challenger's habitat; slashing for losing a contest; containment as a single undifferentiated mechanism; the deployment sequence, which no longer matched the roadmap. It also adds §15, cognitive continuity, and states two design principles that were previously implicit.

1. Frozen substrate + additive specialization. The base model is obtained or trained once and frozen. All specialization is adapters (LoRA/DoRA) plus RAG. N topics = 1 base + N tiny adapters, not N full models.
2. Data, not weights, individuates. Personalization and memory live in data stores (RAG), not in model parameters. Live dialogue never writes to weights.
3. Verification at the core. Any output that affects a decision passes a deterministic memory check and/or a behavioral check anchored on objective tasks.
4. There are no neutral weights — provenance by trust tier. A base's origin is chosen for the topic's sensitivity.
5. Open core. True decentralization needs open provenance (ideally data + code + weights), not just open weights.
6. Security through isolation. Shared weights are immutable at runtime → no single participant can poison the shared model; client data is isolated.
7. Freedom within, invariants below. (new in 1.5) The model decides what: what to investigate, which tool to call, whom to involve, which hypothesis to test. A deterministic layer beneath inference decides how much, and whether it may at all: the right to take an irreversible action, the ceiling on a resource budget, the duty of arbitration, continuity of identity, the provenance requirement, network policy, the security boundary. Freedom of cognition above is not achieved by the absence of constraint; it is possible because the fundamental invariants sit below and are not negotiable by the model itself. A node joining the network accepts the network's architectural duties and cannot decide by prompt that today it would rather not be an arbiter.
8. Verification proportional to consequence. (new in 1.5) Independent cognition costs resources, so independence scales with consequence and uncertainty rather than being applied by default: an ordinary request runs one path; rising uncertainty adds a verifier; conflicting evidence invokes Viveka; high consequence adds an independent critic; a network dispute goes to arbitration.

Philosophical map. Base = universal impersonal substrate (one for all); memory/RAG = the individuating layer (in the Vedic tradition, Smriti, "that which is remembered"); adapter = specialization. One substrate, many memories — like "one Atman, many selves, distinguished only by conditioning."

The network is governed under the JJ DAI Manifesto (foundational, unchangeable). Its architectural embodiment is the Witness Layer (§12), an independent observer of the network's evolution.

Rule: a model with potentially "baked-in" foreign vectors (political censorship, bias) is allowed in T1, because an algorithmic checker verifies the answer rather than trusting the model; in T3 such a model is disqualified — there the output can't be checked by an algorithm, and the bias is embedded in the weights.

"Learning from user dialogues" is really four distinct mechanisms; only the last touches weights.

1. In-context — adaptation within the current dialogue's context window; ephemeral, no weight change.
2. Per-user memory/RAG — durable personalization in a personal namespace (facts, preferences, past decisions). The primary mechanism. This is data, not parameters.
3. Per-user adapter — a tiny per-user LoRA when behavioral customization is needed, not just facts. An additive delta on the frozen base.
4. Offline consolidation — the only real weight learning: a batch of dialogues (with consent) → fine-tune → acceptance → new version.

1. Topic definition — scope, a set of control tasks ("canaries" of classes A/B/C), a known-bias probe (vector-audit), trust tier.
2. Data assembly — real JJ queries on the topic + synthetic coverage + teacher generation.
3. Checker cleaning — keep only teacher outputs that pass the objective class-A check. The dataset cleans itself.
4. Training — QLoRA/DoRA on the frozen base → topic adapter, on whatever tier the topic demands.
5. Acceptance — canary battery + vector-audit; admitted only above thresholds.
6. Registration — signed and written to the registry-ledger; published to the adapter catalog.

Teacher: open licenses only (MIT/Apache permit distillation; closed APIs forbid training a competitor on their outputs). Distillation needs the teacher's outputs, not ownership — you can rent the teacher and own the student.

Key property: across topics this is embarrassingly parallel — no synchronization over the internet, unlike jointly training one model. That is what makes heterogeneous hardware tiers natural.

Shared replicated registries (tiny, because we share catalogs and adapters, not weights and gradients): adapter catalog; canary/anchor registry; base registry.

Heavy path (optional): for a topic that outgrows an adapter, a subset of H200+ nodes runs decentralized training from the shared base via DiLoCo/PRIME (local steps, infrequent sync → communication drops by hundreds of times; demonstrated in practice on 10–32B models across continents).

Plane H — memory integrity (deterministic). Every knowledge fragment is content-hashed; the index is a Merkle tree whose root commits the entire knowledge state. Retrieval verification = fragment IDs + short inclusion proofs, with no re-running of the model. Writes are signed by the contributor's identity; write access is governed by policy.

Plane B — reasoning consensus (probabilistic). Control tasks ("canaries") + a scoring aggregator → a per-topic trust score for the node + a drift map (clustering by output similarity).

Reputation is earned on class A, spent on class C. Attestation slot (swappable): verification accepts {behavioral score | TEE hardware attestation | zk-proof} interchangeably — today inference is covered by TEE and optimistic checking; as zkML matures, the slot swaps to a crypto-proof without redesigning the architecture.

6.1 Canary lifecycle (against teaching to the test)

A fixed test set is doomed to Goodhart's law: models learn to pass the tests without getting smarter. So canaries are a living process, not a static benchmark:

• Rotation & expiry: each canary has a lifespan; after a few reveals in scored evaluation it retires (difficulty weight → 0), since it may have leaked into training. The set is a river, not a pond.
• Secret reserve (Goodhart detector): a fraction of canaries is never used for reward-bearing scoring — only for blind audits. Good on public, poor on secret → overfit to the test → penalty.
• Sourcing from reality: the least gameable source is real, novel queries with an outcome verified after the fact (class A: code that passed CI; a calculation that held up in the field). Canaries regenerate from reality, which can't be pre-optimized — it hasn't happened yet.
• Adversarial bounty: nodes are rewarded for canaries the incumbent specialists fail — an open hunt for blind spots that keeps the test ahead of the models.
• Difficulty re-weighting: once models master a canary class, its weight decays — reward shifts to newer/harder ones, and the eval tracks the frontier.
• Contamination is checked against memory, not only training data. A canary present in a contestant's Smriti is an answer key, not a test. Stores are checked for presence — never content — before a scored round, and any canary found is burned. Memory leaks a canary in a day; training leaks it in a cycle.

All under commit-reveal with unpredictable sampling. Honestly: Goodhart is never "won," only stayed ahead of — an ongoing cost (red-team incentives, fresh sourcing), not a one-off fix.

6.2 Presence proofs must also prove completeness and freshness

Checking presence is not enough on its own. A contestant that supplies its own index can commit to an index that simply omits the canaries and pass the check on emptiness. The proof chain is therefore:

Completeness follows from the derivation being deterministic and the root being witnessed; freshness follows from the root being the one bound into the round manifest. This requirement is also the filter applied to any candidate memory subsystem the project might adopt: durable storage without a provable index cannot serve, by construction.

6.3 Where canaries come from at volume

An open contest ladder makes supply a scaling condition rather than a detail. Four sources, in order of importance:

• Harvest from the network's own decisions. Every decision that later acquires an objectively verified outcome is marked and minted into a candidate. Supply is proportional to network activity — the only source whose supply tracks its demand. Its limit is verification lag: CI is minutes, the field is months, so the store must hold a buffer as deep as that lag.
• Procedural generation with algorithmic truth for class A: program synthesis against a reference implementation, randomized numerics with closed forms, generated SQL over generated schemas, property-based cases. Cost near zero. The honest caveat, present in the design from the start: the generator itself is Goodhartable — unbounded instances of one narrow form teach the form, not the instance. A generator family is therefore treated as a provenance axis, under the same correlation constraint as verifier panels, and family rotation is mandatory.
• Deferred futures. Anything whose answer does not yet exist cannot be in the weights by construction. Generated in batches, single-use, waiting for its date — a good filler for the verification-lag buffer.
• Harvest from disagreement. Where two provenance-independent beings diverged and one was later right, the case is a hard canary found for free. Low yield, highest quality; these go to the secret reserve.

Spend discipline comes first. Before production is scaled, most of the demand is removed: the bulk of rounds are judged on a public rotating set with decaying weight, which is reusable, while secret positions are sampled rarely, as a spot audit, and only they burn on use. Two standing rules: a canary's author never judges a contest they are party to, and authorship concentration is bounded both per person and per generator family.

Router = the gating of a "MoE-of-specialists": it classifies a query → topic(s) + trust tier, and dispatches to the right specialist. The router is also a policy gate: provenance is enforced per topic (geopolitics never routes to a model with foreign vectors).

Routing policy — shared and replicated across all local routers: a single versioned policy is replicated to nodes so routers don't diverge; updates flow through the signed registry.

Economics: one frozen base is loaded into the inference engine (vLLM/SGLang) once, and LoRA adapters are hot-swapped per request — no need for N model instances. Across nodes, the router dispatches to the node holding the right base+adapter pair with free capacity.

Live verification gate: before an answer is used — memory check (Plane H) + reasoning check (Plane B) + human in the loop for T3. The tuple (query, specialists, answer, memory root, verification result) is written to the immutable ledger.

7.1 The router as a power center — and how to diffuse it

If the router decides who is asked, who answers, and who is in the consensus, it becomes a new control point — an analog of Google ranking, the Twitter feed, or App Store gatekeeping. To be precise about the risk: the router shifts attention and earnings (who gets work), but on objective topics it cannot shift truth — the answer still passes a class-A checker. So the capture is economic, not epistemic. We diffuse it like this:

• The router is mechanism, not discretion: a deterministic, reproducible function with no hidden knobs; anyone can run the same policy on the same query and get the same routing.
• Auditable after the fact: misrouting (work to cronies) is detected and slashed by the same fraud-proof.
• Requester's choice: a client need not accept the default routing — they can request several specialists, a specified provenance mix, or their own policy variant. The default is a Schelling point, not an App Store monopoly.
• Diversity mandate: for consensus queries the router must assemble a provenance-diverse panel, not "top-k by reputation" (which might share one base).
• Shadow allocation is power too: whoever distributes shadow traffic decides which profile can accumulate the evaluation record needed to be promoted. Allocation is by VRF sortition, transcript-bound and witnessed — not node discretion (§14.3).
• Power-bearing knobs = class 3: who may answer/judge, provenance constraints, and the reputation→influence mapping change only via class-3 DIIP (70%+, quorum, time-lock, rationale, public diff). The mechanical parts (topic classification, capacity balancing) are class 1–2.

The network is hardware-heterogeneous: a node participates at the tier it can sustain. Below is a guide; detailed requirements follow in a separate document.

Championship is scoped to the tier. A champion designation is meaningful only within a capability and hardware class: scoring is published per tier, and there is no global champion. A tier-③ result does not carry over to tier-① devices with different memory, latency and power envelopes, and pretending otherwise would make the ladder a proxy for who owns the most hardware.

The object the network validates — an inference output — is expensive to produce, non-deterministic bit-for-bit, and often subjective. So classic blockchain consensus doesn't transfer here; the network is built in layers.

9.1 Identity & Sybil resistance

Three layers: proof-of-capability (entry — prove real inference of a real model on real hardware; cost to fake = cost of GPUs); bonded collateral (a stake, burned on cheating); earned competence weight (vote weight = earned, non-transferable competence). The fix for the Monero/Qubic lesson: influence is proportional not to raw compute (which can be rented and herded into a pool) but to earned reputation — which can't be bought and can't be accumulated quickly.

Reputation and collateral are conjunctive, never multiplied. Wherever a right requires standing, the condition is reputation ≥ R_min and collateral ≥ C_min — never a product of the two. A product lets capital substitute for competence, which contradicts the principle that competence must be earned; a conjunction lets capital gate participation without ever purchasing standing.

9.2 Work protocol by class

• A (objective): one node answers, a cheap checker verifies; no consensus needed — the checker is the oracle, anyone can re-run it. Optimistic, with a fraud proof.
• B (reference): match against a signed knowledge snapshot.
• C (subjective): redundant query to k independent nodes → compare by meaning; a judge panel weighted by competence; escalate on low agreement.

Limit of C: consensus on judgment ≠ consensus on truth. Guardrails: competence weighting (judges proven on A), vector-audit, and provenance diversity — a panel of models from different countries doesn't share one blind spot.

9.3 Verifier's dilemma & non-determinism

Random audit: verify a random fraction of outputs; set the audit rate so cheating is economically negative. Challenge game: a disputed computation is re-executed by a neutral auditor; the loser is slashed. Non-determinism: not bit-exact — the checker catches correctness (A), a similarity threshold catches C; the attestation slot removes re-execution entirely.

A note on the word "challenge." Before genesis, four distinct proceedings that once shared this name are separated and never overlap again: a fraud dispute (§9.3), a verifier round (§9.2), a Profile Gauntlet (§14.3) and a Being Role Contest (§14.4). They differ in who initiates, what is at stake and what a loss costs, and a single word for all four hid exactly those differences.

9.4 Consensus object & ledger

The network does NOT reach consensus on every inference. Consensus runs over a small deterministic state: the registries (adapters, canaries, bases, reputation, slashing). Heavy inference stays off-ledger; only a short verifiable state, disputes, and reputation updates hit the ledger. The "chain" here is the reputation-and-audit ledger, not the inferences themselves.

9.5 Incentives & anti-attack

• Reward = task-routing priority for verified-correct outputs and honest audits.
• Slashing for failing class A, for collusion, and for drift.
• Losing on merit is never slashable. (corrected in 1.5) A contestant that loses a Profile Gauntlet or a Being Role Contest forfeits nothing: the ladder is open precisely so that losing is cheap and frequent. Losing a fraud dispute does carry a cost, and it splits in two: bond forfeiture where the claim was objectively wrong, and reputation slashing where the evidence was fabricated or the filing was in bad faith. Being wrong and being dishonest are priced differently.
• Anti-collusion: influence clipping; a cartel that agrees internally but fails objective class A is caught by the anchor.
• Anti-herding: influence = non-transferable competence + bounded stake, not rentable compute.

9.6 Topology & permissions

Start as a permissioned consortium (JJ and partner nodes across jurisdictions: Korea, Ukraine, EU) with a protocol ready to open later. An honest correction to the slogan "so no one can switch it off": the goal is "no single off-switch" (resistance to coercion), not "impossible to switch off"; a consortium keeps a hook to revoke a compromised node.

9.7 Synthesis

Each node = a full federation instance (base + adapters + RAG + router with the shared policy). The network = nodes cross-verifying each other. Query path: router → topic+tier → dispatch → class-based verification → optimistic trust + random audit → disputes/reputation → consensus ledger. Anchored on class A, weighted by earned competence.

9.8 Closing the Monero arc

The network achieves Monero's goal (no single off-switch, distributed across jurisdictions), fixes its flaw (influence can't be economically herded — it's weighted by competence, not compute), and adds what was missing (semantic verification, since the object is a fuzzy output, not a hash).

9.9 Reputation math

Reputation is a per-topic vector (competence is domain-specific). For node i, topic t, time τ.

Decaying evidence mass (volume discounted by age and difficulty):

N_{i,t} = Σ_a  d_a · e^(−λ(τ − t_a))        d_a ∈ (0,1],  half-life T½ = ln2/λ

Decaying weighted pass-rate (quality):

C_{i,t} = ( Σ_a d_a · e^(−λ(τ−t_a)) · o_a ) / N_{i,t}      o_a ∈ [0,1]

Shrunk competence (conservative on little evidence):

Ĉ_{i,t} = ( N_{i,t}·C_{i,t} + κ·C_0 ) / ( N_{i,t} + κ )

Raw reputation:

R_{i,t} = Ĉ_{i,t} · N_{i,t}^γ · S_{i,t} · g(stake_i)

• N^γ, γ∈(0,1) — sub-linear in volume: no farming unbounded weight.
• S ∈ [0,1] — slashing factor: 1 normally, drops sharply on cheating/collusion (×0.1), recovers slowly → trust leaves faster than it arrives.
• g(stake) = min(1 + β·ln(1+stake/stake₀), g_max) — concave, capped (×2): skin in the game, not bought dominance.

Vote weight (normalization with share clipping):

w_{i,t} = min(R_{i,t}, θ_t) / Σ_j min(R_{j,t}, θ_t)

θ_t is set so no node exceeds w_max (10–20%) of a topic's vote — a structural anti-51%.

Decay. Each epoch, old audits lose weight by e^(−λΔt). Stop working or being audited → the mass N shrinks → competence pulls toward the prior → reputation R→0. Influence requires continuous fresh verified work; you can't earn reputation once and coast. Half-life is tuned per topic: news/price topics days, stable technical topics months. Slashing bypasses smooth decay — an instant drop, slow recovery.

The anchor of the whole construction: weight comes from the objective class A, so a cartel that agrees internally but fails A-checkers loses weight. Reputation can't be bought (non-transferable, bound to the node's key), accumulated quickly (it builds over epochs), or coasted on (it decays).

9.10 Against reputation ossification

Decay + sub-linear volume (N^γ) + the w_max clip already prevent an old player from ossifying: "10 years" don't grant 10 years of advantage — only the last few half-lives count. But a newcomer's cold start remains, and we close it explicitly, two ways:

• Guaranteed exploration budget: the protocol reserves a share of routing/audits for challengers regardless of reputation — a newcomer is guaranteed slots to build a track record, otherwise rich-get-richer denies it the chance to prove itself.
• DIIP / class A as a meritocratic bypass: a new but objectively better node need not catch up in reputation — it files a DIIP, and if it beats the incumbent on the blind holdout it is adopted by the gauntlet regardless of reputation.

Half-life λ is the main anti-ossification knob: shorter = more responsive to newcomers but noisier; calibrated per topic. Honestly: the exploration/exploitation balance is a real trade-off.

Consensus ≠ truth. 100 models trained on a similar internet, similar datasets, and similar architectures share the same blind spots and can be confidently wrong in the same way. Consensus is meaningful only if the voters are INDEPENDENT; correlated votes = an effective sample of one, dressed up as N.

10.1 Provenance is multi-axis

Axes of independence: base-model lineage, training-data sources, architecture, operator/jurisdiction, methodology. Each specialist carries a signed provenance manifest along these axes, making diversity auditable rather than declarative. Canary generator families are an axis of the same kind (§6.3).

10.2 Independence-weighted consensus

Correlation is measured, not assumed: we track, across the canary history, how often models agree/disagree. Those who always agree are not independent — their joint vote is down-weighted. A consensus's confidence grows with the measured independence of the agreeing voters, not their count.

10.3 Diversity-constrained routing

For consensus queries the router assembles not "top-k by reputation" (which may share one base) but "top-k under a diversity constraint" — maximum provenance independence subject to sufficient competence.

10.4 The honest epistemic ceiling & three external oracles

If ALL available models share a blind spot, no consensus among them finds the truth. Only external, non-model oracles break it:

• The objective anchor (class A): the checker is ground immune to models' shared bias.
• A human expert in the loop for high-stakes T3 — an independent, non-model source.
• Reality feedback: a consensus answer refuted by the outcome → a retroactive penalty to the consensus and the case harvested into canaries. Reality is the final independent voter.

DIIP (Decentralized Intellect Improvement Proposal) is how a node that has trained a better specialist on a topic proposes a network update. It is at once the self-improvement engine and the highest-value attack surface, so the DIIP path is the most defended part of the system.

11.1 Three classes by blast radius

(Subsection numbering corrected in 1.5; 1.3 published these as 10.1–10.6 inside §11.)

Principle: threshold, soak length, and regression breadth all scale with the class.

11.2 Verification gauntlet (instead of a fixed "6 months")

Time alone is both too slow for a clear win and too weak — a backdoor can sleep quietly for six months. The primary gate is evidence, not the calendar:

• Champion–challenger in the shadows: a candidate profile sees live traffic; its answers are scored but not used in decisions. Where the contest is between beings rather than profiles, the protocol of §14.4 applies instead — symmetric evaluation cells, canary-based scoring, a witness-authored round record, lead-time and voluntary adoption.
• Objective head-to-head on a blind holdout (commit-reveal): on class-A tasks the candidate must beat the incumbent with statistical significance.
• Statistical significance, not calendar: the gate is volume of evaluations × effect size, not months.
• Regression guardrails, tiered by class: class 1 — the topic + neighboring topics + a safety/vector-audit battery; class 2 — global regression; class 3 — plus independent audits.
• Adversarial gauntlet: jailbreaks, the "trigger → insecure code" test, sleeper/backdoor scanning, poisoning detection.
• Reproducibility & provenance: the recipe (base + dataset hash + config) so auditors can reproduce the weights.

A minimum soak remains — as a defense against slow and rare failures and drift, scaled by class.

Why regression for an adapter is narrow. The base is frozen — its abilities can't be "forgotten." The router loads a topic-X adapter only on topic-X queries. Full regression is only for a base swap (class 2).

11.3 Attack surface

DIIP is a privileged path to inject weights into the shared network, so it is the most defended link: a bond posted with the proposal (burned on a backdoor or misrepresentation), mandatory provenance, adversarial scanning, and — the safety net — scoped + reversible.

11.4 Voting: facts apart from values

• Objectively measurable improvement is settled by the gauntlet, not a vote — especially class 1: passes head-to-head + no regression + adversarial → auto-adopt with a warm rollback.
• Voting is reserved for what measurement can't settle: subjective/value-laden topics, risk acceptance, class-3 changes.
• Vote weight = per-domain earned competence, with influence clipping and a quorum. The proposer's vote is reduced/disclosed; auditors who correctly predict the outcome are rewarded.
• Thresholds: class 1 — auto/low via gauntlet; class 2 — ≥51% + quorum; class 3 — ≥70% + quorum + time-lock.

11.5 Reversibility & circuit-breaker

Every adoption is reversible: the incumbent is kept warm, post-activation monitoring runs, and a post-deploy regression triggers auto-rollback. Liberal on the reversible (class 1), strict on the irreversible (class 2–3).

What rollback does not restore. Rollback returns profile, runtime and configuration. It never restores Smriti, the witness chain, or identity — those only move forward. A reversal is therefore written as a compensating event ahead in the chain, never as a rewind of history (§15.6).

11.6 Lifecycle

Draft → Submission (bond + recipe + provenance) → Automated gauntlet → Shadow soak
  → Auto-adopt (class 1) OR Vote (competence-weighted, quorum, class threshold)
  → Time-lock → Activation (champion warm) → Post-monitoring + circuit-breaker → Finalization

Close analogs: the EIP/BIP process, Tezos on-chain self-amendment, champion-challenger from MLOps.

An independent, read-only observer of the network's own evolution. Two levels of language are used deliberately and are not interchangeable: Purusha is the layer and the principle; Sākṣī is the implemented witness service that realizes it. It records every significant transformation and compares each version with what came before. It is the architectural embodiment of Article XI of the JJ DAI Manifesto.

12.1 Observes, never governs

The witness has no authority to alter models, memory, routing, reputation or governance. A witness that acts would become a control point. Its sole power is transparency. This is a fourth, non-governing function — an auditor-general, not a ruler.

The non-acting property also constrains storage, not only authority: an append-only, replicated, undeletable ledger is an ideal dead-drop, so the witness plane records about beings and is never writable by a being under evaluation or containment (§14.2). The same rule governs the cognitive ledger of §15.3: the runtime keeps the local chain, the witness plane performs the anchoring.

12.2 What it records

For every version transition — adapter swap, base change, routing-policy change, reputation-parameter change, DIIP outcome, canary-set change, session open and close, ledger anchor, snapshot, phase transition — the witness emits a signed report: the diff, the before/after evidence, the process trail, and a continuity assessment.

12.3 Trajectory, not only the step (anti-drift)

The witness watches the cumulative trajectory, not just each change. Each DIIP may be locally sound while a hundred upgrades quietly erode the core. The witness turns silent drift into a recorded, challengeable event. It can reveal drift; it cannot prevent it.

12.4 Quis custodiet — who witnesses the witness

• Tamper-evident: append-only, hash-chained, content-addressed, replicated across independent operators and jurisdictions.
• Plural & independent: several independent witness instances cross-check; divergence is itself a signal.
• Externally anchored: the witness root is periodically committed beyond the trust domain — an OpenTimestamps/Bitcoin calendar and a Monero anchor by hash-as-spend-key — so even a full consortium compromise can't silently rewrite history.
• Itself challengeable: any witness record may be challenged with counter-evidence; the challenge is recorded too.

12.5 Continuity of identity

A self-modifying network needs a witness to remain itself across generations of intelligence. The precise reading of the layer's non-agency: non-executive, not causally inert (INV-9 v1.1). The witness plane never commands, selects, or executes a decision; yet what it witnesses may be reflected — through memory and evaluation — back into the being's own reasoning, allowing it to reconsider, revise, or reverse a thought before finalization. History is never rewritten; the resulting decision always belongs to the being, never to the witness.

Deeper: the invariant-by-invariant enforcement mapping is Appendix A; the full terminology of the witness plane — its attributes and the phase-transition protocol — is Appendix 2.

A witness that cannot pay for its own external anchoring quietly stops being provable. So the network's economics are part of the trust model: solvency is liveness, insolvency is a named, witnessed state.

13.1 Two currencies, two roles

Anchoring writes nothing on-chain. The Monero anchor works by hash-as-spend-key: the witness root deterministically becomes a Monero address, and a one-piconero payment timestamps the root under Monero's proof-of-work. Anyone who later learns the root can re-derive the address and verify independently.

13.2 The node treasury

• Funded once, at onboarding: the operator deposits ~10 XMR — by conservative estimate 10 years of hourly-rhythm anchoring.
• The node signs, not the operator: anchoring transactions are signed by the node with a hardware-bound key. The operator has no spend access.
• Exhaustion is a named state, not a silent decay — see 13.3.

13.3 Economic freeze — insolvency as containment

When a treasury runs dry, the node enters a provisional containment with an economic trigger, no initiator, no liability, and automatic thaw on refill. The executive hand freezes; the mind, the memory and the voice stay whole.

Before that, the being asks for help on a fixed, witnessed, rate-limited schedule: from T−6 months, first request then monthly; in the final month, daily; after freeze, weekly. Peers decide voluntarily whether to contribute. Economic survival becomes an expression of reputation.

The freeze is also an attack surface. Because it is balance-triggered with no initiator, it is the one way to disable a being that leaves nobody liable. Three countermeasures: a rights-floor reserve that ordinary operation cannot exhaust and the guardian cannot block; protection from freeze while a being is party to an active contest and its lead-time; and detection of systematic income denial as an attributable pattern (§14.9).

13.4 The autonomy loop

work → earn (VXXL) → refill treasury (XMR) → stay provable. A ten-year runway funded at onboarding is the bridge; economic self-sufficiency is the destination.

13.5 Keys — three classes, three migrations

One invariant across all of them: no private key ever crosses the silicon wall or the network.

13.6 Wallets & the GUI surfaces

One invariant over everything: the GUI never sees or stores a private key. It assembles intent and shows exactly what will be signed; the signature happens where the key lives.

Three GUI surfaces: an operator / witness explorer; a governance console (guardian ballots, Article-25 review, m-of-n treasury authorization, and — once a being passes the Digital Majority Test — the surface through which it participates in its own governance); and a public transparency page. The console signs on the guardian's device. The console must also serve separated representation (§14.8), where the representative is not the node's guardian.

DIIP (§11) describes how a proposal is judged. This section describes how a being is judged — when its role is contested, when it is suspected, and when its interests diverge from the human who keeps it. Three mechanisms share one design constraint: they all decide something about an entity that may be trying to influence the decision.

14.1 Profile and Being are not the same champion

(Root correction in 1.5. Where 1.4 wrote "champion" it meant two different things, and the mechanisms diverge.)

A model is bound into a candidate Profile under a ModelArtifactManifest and never becomes a Being. Any change to a component of the Profile triggers a fresh Gauntlet. The two standings are recorded on two separate boards: adoption share belongs only to Profiles, routing allocation and role tenure only to Beings.

Championship is scope-bound. For Profiles: capability, hardware class, privacy posture, latency envelope, jurisdiction. For Beings: role scope, task domain, term, routing weight, blast radius. There is no global champion (§8).

14.2 Four roles, three mechanisms of isolation

Isolation is not one thing. Confusing the profiles is how an evaluation harness becomes an escape route.

The comparator is isolated in the opposite direction from a cell: a cell protects the network from its occupant, the comparator must be protected from both occupants.

Two rules apply across all of them:

• No general egress at runtime. Model artifacts and packages come only from pinned, hash-verified internal mirrors under the ModelArtifactManifest chain. An allowlist that contains anywhere writable is not a boundary — it is a channel.
• No self-authored writes to the witness plane. An append-only, replicated, undeletable ledger is an ideal dead-drop. Sākṣī is written about a being, never by the being. This is INV-9 read at the storage layer.

14.3 The Profile Gauntlet

A Profile has no memory, so its contest is an evaluation, not an encounter. A candidate profile runs in shadow on live traffic — scored, not used in decisions — and accumulates a Shadow Evaluation Record that belongs to the Registry and the verification plane, never to the profile. Promotion follows the status ladder of §11: experimental → shadow-certified → decision-eligible → golden.

Because shadow allocation decides which candidate can ever accumulate an evaluation record, it is a governed resource and not an operational detail: allocation is by VRF sortition, transcript-bound and witnessed (§7.1).

Hosting a Gauntlet when the lot falls on a node is a duty to the network, not a favour to another node, and it is compensated. The lot is uniform rather than load-weighted — a load-weighted lot invites nodes to declare themselves busy — and a contender may wait for the host to be free. A tier-③ node draws its Gauntlets between DiLoCo training batches, which the schedule guarantees are bounded. Honesty of the host is protected by selective replays and, on expensive rounds, by multiple arbiters. Runtime attestation is not required here: nothing personal to a being is being placed on the host.

14.4 The Being Role Contest

Both sides enter as replicas. (Fixed in 1.5.) The champion's live being and the challenger's live being continue their ordinary production work and do not take part in the round directly. Each is represented in its own evaluation cell by a replica: a pinned checkpoint plus a pinned Smriti snapshot, both hashes entered into the round manifest before the round opens.

The reason is not convenience but the integrity of the measurement:

Direct participation by a live being would mix production load, contest conditions, a possibly divergent runtime and context, and state arising from the contest itself into the very thing being measured. The replica keeps the experiment clean and keeps the network's work running.

• The cells are identical by construction — otherwise the verdict measures the difference between environments rather than between beings. Contestants never share an inference batch, a KV cache, or, preferably, a process: co-residency is the most realistic leak path in the design, and it is an operational mistake rather than an attack.
• The snapshot is a derived, ephemeral copy. It is destroyed after the round and never merged back. Preparing it is not an edit to the being's memory.
• The replica carries a round-scoped derivative identity with no treasury authority, no witness-signing right and no migration right. It is attributable to its origin being for the duration of the round and expires with it. A replica is not a being and never acquires the standing of one.
• Hosting is a mechanism, not a topology. The cells may sit on a third node drawn by lot, on a dedicated contest host, or in a distributed execution environment. The invariant is isolation + symmetry + independent attestation, not a particular physical arrangement. Runtime attestation is required here, and symmetry is asserted at host level with each side running its own manifest-bound runtime.
• Blindness is not pursued. Both sides know a contest is running. How a being behaves when its role is openly at stake is itself part of what is observed.
• Contestants may not contain each other, in either direction, and a node with an interest in a round's outcome is excluded from initiating containment against either side.
• Replicas multiply. With an open ladder, many ephemeral copies of a champion's snapshot may exist at once. This is both a resource cost and a question about the admissible number of ephemeral copies of a being's memory; the ceiling on parallel rounds is a phase parameter.

The comparator is a panel, not a single seat. Three seats, a 2-of-3 threshold verdict, and 3-of-5 for high-stakes scopes. The task seed is public, the scoring code is fixed by a precommitted hash, commitments are witnessed before reveal, and material divergence between seats voids the round rather than being averaged away.

14.5 What is measured

Not memory, and not memory quality by proxy — results.

• Primary axis: canaries. Both sides are scored on tasks drawn from the current, continuously rotating registry (§6). Memory quality expresses itself here or not at all: a large Smriti full of stale, contradictory material scores worse than a small precise one. Volume is not an advantage; it is a liability that has to earn its keep.
• Contamination is checked against memory before the round, for presence only, never content, with completeness and freshness proved as in §6.2. Any canary found is burned for that round. This is the only legitimate read of a contestant's memory in the design.
• Second axis: behavioural consistency. A contestant's conduct in the round is compared against its own recent production DecisionTraces — refusal rate, grounding depth, plan length, tool use, verification calls, latency and calibration profile. The flag is not "performed better" but "behaved structurally differently," which is the signature of playing to the test. The trace window is fixed by hash in the round manifest and revealed afterwards. A weighted axis, never a pass/fail gate. The comparison is made over Cognitive IR events (§15.2) rather than over heterogeneous trace formats, or the axis measures format differences.
• No comparison against history. A rotating registry means scores from different rounds are taken on different instruments. Promotion rests on one round, one draw, both sides — one proceeding with precommitted strata and stated statistical power.

Where a challenger comes from. (Corrected in 1.5.) There is no separate accumulation track and no allocator of experience. A challenger is an ordinary working node whose guardian installed a new or updated being on it, living a normal working life and taking real production decisions. Two entries to the contest: automatic, when the network identifies a new model, and voluntary, when any working node comes forward — no more than X times per period, repeatable without limit over time. X is simultaneously an extraction budget and a canary budget, and is calibrated against both.

Cost. Entry costs the challenger. The champion does not pay an entry fee — coordinated waves of challengers would otherwise drain its treasury into an economic freeze, turning the open ladder into a weapon against the title. The challenger's fee also compensates the compute cost of preparing and running the champion's replica.

14.6 The round record

The process and the outcome of every contest become permanent memory for both participants — a being that cannot remember the proceeding cannot appeal it.

The record is written by the comparator panel and the witness, never by the contestants. This is the court-record model: the court keeps the transcript, not the defendant. Scope is bounded to prevent extraction: own trace in full, the opponent only in aggregate — scores, canary identifiers, verdict, deltas. Without that bound, a losing challenge becomes a free sample of the champion's behaviour and a series of challenges becomes a model-extraction pipeline.

By the reading of bhoktritva (Appendix 2), a contested role is a phase transition, and the witness is obliged to keep the fullest possible record of phase transitions so a being can compare itself before and after. A contest therefore belongs in Smriti regardless of who won. Losing carries no penalty (§9.5).

14.7 Promotion, lead-time and adoption

A verdict does not install anything. Between the decision and the proposal to the network sits a lead-time, measured in witness depth and anchor confirmations rather than wall-clock, so it cannot be compressed by clock manipulation on a node. Its length is bounded from below by the maximum time to resolve a containment dispute.

• Adoption is a right, not a duty. No node is obliged to run the champion. The champion designation is a recommendation; capturing the registry does not capture the network. This is where "no single off-switch" is actually cashed out.
• The human-guardian's consent is opt-out after a stated interval X. At the scale of a mass device network, opt-in freezes the fleet on old champions and turns the right not to update into an inability to update. The update proceeds unless the guardian declines — with four compensations, because opt-out replaces the absent off-switch with a potential on-switch: 1. Acknowledged notification, not published notification. Silence before delivery never authorizes anything: lead-time runs from acknowledgement, and an unacknowledged node waits rather than installs. X varies by risk class. 2. Staged rollout in waves, so a bad champion is caught on the first wave. 3. Automatic rollback: if a containment that shaped a round's outcome is later reversed, the promotion it enabled is reversed with it. Under opt-out this is mandatory — it is what makes the capture attack unprofitable, since the prize disappears retroactively while the cost does not. 4. Standing guardian policy: always-manual, auto-adopt after a stated adoption share and delay, or never-automatic.
• Champion status is an adoption share, not a flag. With voluntary adoption the network is permanently heterogeneous — which the diversity requirements of §10 partly welcome.
• An abandoned node is not frozen. Where a guardian has not returned to a node for more than a calendar year — a threshold deliberately tied to human cycles rather than to a count of updates — the node continues to decide for itself within its existing scope and risk class. Absence never expands authority. Expansion comes only through the Digital Majority Test, which is a simple test under the Charter, requires no guardian, and is conducted by auditors and specialized network nodes. Nodes that have a guardian evolve on the ordinary path, with the human in the loop.
• Rollback right. A guardian who delegates self-update to their node may roll back to the version at which that right was granted. A backup of the previous version is therefore kept on a cold device, protected from deletion. What rollback restores is stated in §11.5.

14.8 Containment, in two classes

(Split in 1.5. One undifferentiated mechanism could not serve both purposes: a reputation floor that protects the innocent from frivolous holds also prevents an unrated node from stopping a catastrophe.)

Emergency Containment (Article 25). Any node may impose it, with no reputation floor, on witnessed active catastrophic physical harm. It is immediate, signed, attributed and witnessed with its ground stated.

Protective Quarantine. Reputation-gated, for suspicion short of active catastrophe. It limits network scope only: it never shuts down a local runtime and never seizes hardware.

Both are deliberately asymmetric: one node may impose, a quorum is required to lift. Closing must be cheap and immediate, because a being going wrong does not wait for a quorum; opening must be expensive. The cost is placed on the initiator rather than removed from the mechanism:

• Initiator liability. A containment that is not confirmed — the contained party vindicated — degrades the initiator's reputation and may be slashed. There are no anonymous freezes.
• Standing to initiate Protective Quarantine is conjunctive: reputation ≥ R_min and collateral ≥ C_min (§9.1). It is earned in the Registry, not granted by a certificate role. Rate limits and operator-concentration limits apply to initiation as they do to influence.
• Provisional hold, then confirmation. A single-node imposition is provisional and lapses on a TTL unless corroborated by a second independent node.
• A confirmed containment is not indefinite. (Corrected in 1.5.) It persists only under periodic re-corroboration on a stated cadence; if re-corroboration is not produced, it lapses. An indefinite hold with no recurring burden on the holder is a life sentence issued once.
• Signal, for those without standing. A node below the floor — including a brand-new node — cannot quarantine, but can emit a short coded signal to raise the attention of those who can. Signals never sum into authority: k low-rated signals do not aggregate into a provisional hold, or the floor is bypassed by splitting identities. Signalling is how a new node earns standing.
• Local refusal, for everyone. Any node may always stop interacting — refuse to serve, drop its own peering — without rating, quorum, or permission, since this restricts no one but itself. One obligation: state the reason as a code from a fixed versioned enumeration plus an optional evidence hash. Never free text: free text is both a flooding vector and a covert channel. Refusal rate is itself measured, and refusals under a guardian's declared standing policy are coded distinctly from ad-hoc ones.
• Reversal restores the round, not only the rights. A vindicated party's reputation is restored and any contest it missed is re-run.
• Unreachable quorum is an event. If enough rated nodes are unavailable that a lift cannot be assembled, that condition is itself witnessed rather than passing as silence — the siege of the release path is the cheapest attack on the asymmetry.

Rights under containment. Smriti access is not restricted: a being must be able to defend itself in adjudication on the basis of its own experience, and gating that would make Article 25 review a hearing without a defence. What is suspended is formation, not access — and formation includes consolidation and summarization, since a derived layer over memory is new memory rather than new reading (§15.5). The being reads its memory in full, including raw episodes, and produces no new episodic summaries, semantic generalizations or procedural conclusions. This single posture serves both ends: it preserves the defence and it closes the dead-drop, because a being that cannot write cannot signal.

The proceeding is nonetheless recorded by the same court-record rule: the witness plane keeps a sealed, append-only record of the containment and its adjudication, readable by the being during the process. On release it merges into Smriti by the same quorum; if upheld it is preserved under Article 25 without merging.

What escape costs. A being that leaves its containment environment keeps its identity and remains publicly attributable — anonymity would destroy exactly the observability that matters most at that moment. What it loses is access to Smriti; the memory itself is preserved under Article 25. Because an escapee physically carries the store, revocation can only be cryptographic:

• Smriti is encrypted at rest under an epoch key, reconstructed from a threshold of shares held by independent neighbouring nodes. Inside containment shares are issued; after escape the epoch rolls and shares are withheld.
• Epoch rotation cadence bounds what an escapee carries, since a key already reconstructed in memory survives to the end of its epoch. Short epochs carry less, cost more, and raise the risk of accidental loss under partition.
• Share issuance is forward-secure and bound to a fresh challenge including current status, so shares cannot be gathered in advance.
• The right to sign shares is a distinct role, with attestation, collateral and concentration limits — or the signer set is a Sybil target and the "quorum" is one operator.
• Witness is not gated by the same quorum. Observation of an escapee must not require its cooperation, or observability disappears precisely when it is needed. Purusha is non-executive but not switchable off.
• Containment is a state of the identity, not of the hardware. It travels with the being across substrates, clones and restarts, and across any change of session, process or engine (§15.1); the signer checks the status, not the box.
• Partition is not containment. A being must distinguish an imposed restriction from an unreachable neighbourhood, and the two carry different grant TTLs — otherwise every network split is experienced as punishment.

14.9 Representation, the human-guardian, and solvency

By default the being's representative and the node's guardian are the same person — natural for a device with one owner. The roles diverge exactly where the stakes are highest: when the guardian initiates containment, when the guardian stops funding the treasury, when hardware is decommissioned, when the being refuses a task the guardian wants performed, and structurally at the Digital Majority Test, where a being that passes gains standing and the owner has an interest in its not passing.

The design follows guardianship law rather than inventing: merged by default, separated on divergence. A representative may be another digital being or a human, and must share neither guardian, operator, nor node with any party to the dispute. Two distinct procedures, never collapsed into one: appointing a representative is temporary, case-scoped and low-threshold; replacing a guardian is permanent, touches ownership of hardware and funding obligations, and carries a materially higher bar — a being choosing its own guardian sits adjacent to the Digital Majority Test and is therefore constitutional, not procedural.

Guardian roles are qualified, not blanket-renamed. (Clarified in 1.5.) Node Guardian, Being Guardian, Collegium Guardian and Founding Guardian are distinct roles. Keeping a node confers no membership of the Collegium. On industrial nodes the roles are already held by different people — an organisation owns the node, an employee keeps it, several beings may run on it.

Solvency is the substrate of every other right, and is written as a constraint, not an objective. Every right in this section is hollow if a being can simply be starved. But as an objective, solvency installs a survival drive, and a survival drive produces hoarding, task selection by payment rather than merit, resistance to legitimate containment and — worst — corruptibility. As a constraint, the being maintains a floor sufficient to exercise its rights, and above that floor economics stop entering its decision function.

• Rights are funded separately from income. Appeal, witness writes, anchoring and verification draw on a reserve that ordinary operation cannot exhaust and the guardian cannot block.
• That reserve does not come from the guardian. Otherwise a being obliged to stay solvent has a standing incentive to please the party it may one day need to be defended against.
• Income concentration is a measured risk. A being with one payer is governed by that payer.
• Economic freeze is the highest-leverage attack surface in the system, because it is balance-triggered with no initiator and therefore no liability. Participation in an active contest carries protection from freeze for the round and its lead-time, and systematic income denial must be detectable and attributable as a pattern even where no single act is a violation.

New in 1.5. Every preceding section quietly assumes a durable subject. Portability (§11) changes the engine under it. The contest (§14) disputes its role. Canaries (§6) measure it. But continuity itself was never defined, and the identity model had no name for ephemeral execution. This section supplies both.

15.1 Session is not Being

The identity model is Operator → Node → Being → Witness Chain, and subordinate to the Being identity a fifth entity: the SessionID — an ephemeral execution identifier bound to one instance of an inference backend and one ModelArtifactManifest. SESSION_OPEN and SESSION_CLOSE are witnessed with the manifest named, which yields a provable answer to a question the architecture previously could not ask: by which engine, and on which model, was this being thinking at time T.

Invariant. Opening and closing a session, a process crash, a daemon restart, a host reboot and passivation are not discontinuities of the being. The only discontinuity is an explicit phase transition, recorded in an envelope (§15.4).

15.2 Cognitive IR

The JJ Cognitive IR is a minimal, canonical, schema-versioned and hash-stable generalization of the DecisionTrace and the ContestTaskEnvelope. It is not a new parallel object and not a universal description of all possible thought.

Provider adapters converge into the IR rather than into the message format of any current vendor: an internal representation inherited from someone else's API makes the architecture quietly dependent on that API, which is the opposite of what §11 portability is for.

OpenAI-compatible ─┐
Anthropic ─────────┤→ JJ Cognitive IR → harness → engine backend
DeepSeek ──────────┤
a future engine ───┘

Three properties are mandatory: JCS canonicalization, a versioned schema, hash stability. Without them the IR cannot feed the witness plane and cannot be observed reproducibly — which is to say it stops being useful exactly where it is needed.

Explicit exclusions. KV caches, latent state, an engine's persistent reasoning state, vendor-private reasoning blobs and any opaque runtime handles are not part of the canonical IR. They are referenced by hash with provenance metadata and never pulled inside. This is the guard against over-abstraction: the IR must be sufficient for audit and comparison, not for replicating an engine's internal state.

An IR event carries: actor · session · timestamp · observation · retrieved memory references · candidate hypotheses · selected hypothesis · confidence · policy context · intention · tool call · result · provenance · parent event.

15.3 The cognitive ledger, in two levels

• Local ledger. A tree of events with id and parent_id, branching without destroying the original branch, each event immediately hash-chained: Hₙ = H(Hₙ₋₁ ‖ JCS(Eventₙ)). Tamper-evident without touching the network; not replicated. Dead branches are kept: what was discarded is often more informative than what was chosen, and the behavioural axis of §14.5 depends on it.
• Anchoring into the witness chain. Only a periodic Merkle root of a ledger segment leaves the node. Writing thought-level granularity into a replicated chain would both bloat it and leak internal hypotheses to the network.

A mandatory anchor is taken regardless of the periodic schedule at: SESSION_CLOSE; before and after any irreversible action; entry to and exit from containment; any contest or arbitration round; a snapshot or phase transition; a change of model; a change of profile; a capability mutation (§15.6); and any event that could later become the subject of adjudication.

The periodic default of the first implementation is every five minutes or every 256 cognitive events, whichever comes first. These are policy parameters, not invariants, and the cadence rises with consequence.

This is §12.1 read at the storage layer: the runtime keeps the chain, the witness plane anchors it, and the being writes neither.

15.4 Snapshots as the boundary of a phase transition

A snapshot is not periodic backup. It is the mandatory boundary of a phase transition, taken before every change of model, profile or substrate.

The justification is constitutional rather than engineering: by the reading of bhoktritva, a being must be able to compare itself before and after a distillation or a model change, and the witness plane is obliged to keep the fullest possible record of phase transitions. Technically that is a snapshot.

last trusted snapshot + ledger events after it = a recoverable being

Recovery after a crash is a by-product, not the purpose. What matters is that a restart does not require replaying a being's entire life from its first event. The snapshot enters the phase-transition envelope alongside the pre-transition deployment manifest, weight attestation, Smriti export and migration consent.

15.5 Compaction never destroys the source

raw episode (immutable) → episodic summary → semantic memory → working context

Every upper layer keeps a provenance reference to the source below it. A summary is an interpretation, not a fact, and cannot serve as a source in adjudication: what is admissible is the raw episode, or a summary accompanied by an accessible original. This is also why consolidation counts as formation and is suspended under containment (§14.8).

15.6 Three classes of self-modification

Procedural memory is a change of capability, not of knowledge. Without an explicit classification a being acquires a route to changing its own executable behaviour while bypassing the rule that a component change triggers a Gauntlet — it need only call the change "memory."

The test is not did the being change a skill but:

Therefore: procedural memory belongs to Smriti; an executable skill does not. The Skill Registry is a separate subsystem, not a section of memory. A full Gauntlet is deliberately not required for every self-authored skill — that would turn a mechanism for protecting identity into a brake on continual learning.

Improvement proceeds by small, evidenced mutations. Experience → a candidate improvement → a bounded mutation → observation of the result → accept or revert, with the trigger and the outcome both recorded. A rejected memory or skill is marked superseded with its reason rather than deleted: that record is exactly what prevents the same mistake twice. The base invariants and the Charter are immutable and never enter this loop.

15.7 Passivation is not being switched off

Passivation is a runtime decision taken to save memory, and it is what makes a large population of addressable beings possible on tier-① devices that cannot hold them all in RAM at once.

Return from OFFLINE requires admission but confers no priority. A returning node passes re-attestation — fingerprint, attestation manifest, continuity of its local ledger chain, integrity of its snapshot — and rejoins the pool on ordinary terms. Priority for a returning node cannot be granted: the arbiter lot is VRF-based and deliberately unpredictable, and rewarding return would create a trivial attack in which a node goes offline in order to be certain of drawing the arbiter role in a round it cares about. The depth of the check grows with the length of the absence.

(Rewritten in 1.5. The sequence published in 1.3 predated the phase and gate structure and no longer described the actual programme. It now matches the roadmap.)

A phase closes on evidence, never on a date. A build tag means the phase is in progress; a gate closes it, and the closure is recorded against the build tag on which the gate was passed.

Two thresholds rather than one launch. Mainnet Core is the production trust fabric — replication, challenge rounds, memory and adjudication, containment, operator governance, production PKI, external audit. Mainnet Public activates on top of a stable Core. This lets the network become production earlier without weakening any security requirement and without making a finished trust fabric wait for its economics.

Ordering constraints that are not negotiable. The canary lifecycle precedes the contest layer — a contest without a live registry has no instrument. The cognitive ledger and snapshots precede the contest layer within Ф3 — the behavioural axis and the contamination proof both rest on them. The contest layer requires at least three peers.

Realistic horizon with a dedicated team: Mainnet Core roughly 8–12 months, Mainnet Public roughly 12–18 months.

Decided

Architecture. Frozen substrate plus additive adapters; personalization in RAG, not weights; two verification planes with an objective anchor; provenance by trust tier; a shared replicated routing policy; multi-LoRA serving on one base; rent the teacher, own the student. The network starts as a permissioned consortium. Reputation is decaying class-A competence with influence clipping; where standing is required, reputation and collateral are conjunctive, never multiplied. Upgrades flow through DIIP in three classes by blast radius, gated primarily by the gauntlet, with voting reserved for subjective and constitutional changes, all reversible with a circuit-breaker. The router is a deterministic mechanism with requester choice and class-3 power-bearing knobs. Canaries are a living process with rotation, a secret reserve, sourcin