# The Kernel — Constitution v0.1.0 **Status:** Released draft for genesis ratification (v0.x — explicitly unstable, see §X.4) **License:** This text, its annotations, tests, and ledger formats are dedicated to the public domain (CC0 1.0). The license is irrevocable per §VII.2. **Companion documents:** `kernel/annotations-1.md` and `kernel/annotations-2.md` (the annotated edition, clause-aligned with this text); `spec/userland-module-spec.md`; `docs/design/kernel-design.md`. --- ## Notation - **[P: name — floor/ceiling/default]** marks a **parameterization point**: a value each polity sets in its configuration, only within the declared floor and ceiling. Floors and ceilings are kernel text and change only by kernel amendment (§I.5). - **Change classes** (defined in §IV.1): **P** = userland patch, **U** = userland major, **K-minor** = kernel-compatible, **K-major** = kernel-breaking, **V** = invariant-strengthening. - Section references use the form §II.3 (Article II, Section 3). --- ## Preamble We adopt this kernel because the rules we live under should be as inspectable, testable, and improvable as the software we build. It contains only the rules about rules — how they change, who decides, and what no majority may do — together with the small set of floors that every durable moral tradition converges on. Everything else is userland: forkable, parameterized, and ours to change. The defaults assume good faith. The tests assume bad faith. Both assumptions are deliberate. --- ## Article I — Scope, Supremacy, and Definitions **§I.1 — Kernel scope.** This document is the kernel. It contains only meta-rules — rules governing how rules are made, changed, interpreted, classified, and escaped — and the invariants of Article VI. All substantive rules live in userland modules adopted under Article V and the Module Specification. **§I.2 — Supremacy.** Where a module conflicts with the kernel, the kernel prevails. Where any provision — including a ratified amendment — conflicts with an invariant of Article VI, the invariant prevails and the conflicting provision is void from the moment the conflict arises. **§I.3 — Minimality.** A provision that can operate as a module must not be added to the kernel. A proposed kernel amendment that adds substantive, non-meta rules is out of order and shall be rejected at the review stage of §III.2. **§I.4 — Definitions.** *Citizen:* a natural person admitted under Article II. *Polity:* the set of citizens bound by one instantiation of this kernel and one configuration. *Module:* a userland rule-set conforming to the Module Specification. *Parameter:* a named value set by a polity within declared floors and ceilings. *Ledger:* the append-only record of Article X. *Epoch:* the polity's governance period, **[P: epoch.length — floor 1 day, ceiling 1 year, default 30 days]**. *Steward:* any person holding a role created by a module. **§I.5 — Parameters.** A parameter may be set only within its declared floor and ceiling. An unset parameter takes its documented default. Floors, ceilings, and defaults are kernel text; changing them is a Class K-major amendment. --- ## Article II — Citizenship and Suffrage **§II.1 — One person, one vote.** Every citizen has exactly one vote on every kernel matter. Voting weight on kernel matters may not be conditioned on wealth, contribution, tenure, office, seniority, or any other property of the citizen. This section is not parameterizable. **§II.2 — Admission.** The polity admits citizens by criteria set in **[P: citizenship.admission]**. Floors: the criteria must be published before they are applied, applied uniformly to all applicants, and every admission decision must enter the ledger together with the criterion it applied. **§II.3 — Security of citizenship.** Citizenship may be revoked only through a process defined and published before the conduct at issue, with notice to the citizen and an opportunity to be heard. No citizen's eligibility to vote may be altered for any vote that is already open, nor by the same vote that decides the alteration. **§II.4 — Dormancy.** A citizen inactive for **[P: citizenship.dormancy_period — floor 2 epochs, default 4 epochs]** may be marked dormant. Dormant citizens are excluded from quorum denominators. A dormant citizen may reactivate unilaterally at any time by ledger entry, effective for all votes opening thereafter. **§II.5 — Delegation.** A citizen may delegate their vote to another citizen. Delegation is revocable at any moment, including while a vote is open. Delegation chains may not exceed **[P: suffrage.delegation_depth — floor 0, ceiling 3, default 1]** links. The total number of delegated votes one citizen may carry is capped at **[P: suffrage.delegation_cap — ceiling 5% of active citizens or 5 votes, whichever is greater; default 5 votes]**. --- ## Article III — Proposals and Amendment **§III.1 — Standing.** Any citizen may propose an amendment to any text or parameter. A proposal is a precise diff against the current released version, accompanied by a written rationale and a declared change class (§V.2). **§III.2 — Pipeline.** Every proposal passes, in order: (a) publication on the ledger; (b) an open review window of **[P: amendment.review_window — floor 3 days for userland classes, 14 days for kernel classes; default 7 / 21 days]**; (c) the test gate (§III.3); (d) a vote under Article IV; (e) release under Article V. No stage may be skipped or shortened below its floor, including by unanimous consent. **§III.3 — Test gate.** A proposal must pass the constitutional test suite in force at the time the vote opens. A failing proposal may not proceed to a vote. The test suite is itself amendable text and changes only through this same pipeline. A single proposal may not both alter a test and alter the text that test guards. **§III.4 — Atomicity.** A proposal must address a single subject, such that a citizen can rationally vote on it as one unit. During review, any citizen may move that a proposal be ruled omnibus and split; contested rulings are resolved under Article IX before the vote opens. **§III.5 — Cooldown.** A proposal substantively identical to one rejected within the last **[P: amendment.cooldown — floor 1 epoch, default 2 epochs]** may not be reopened, unless accompanied by new test results or a ledgered statement of materially changed circumstances. **§III.6 — Effect delay.** No ratified change takes effect earlier than the close of the vote that ratified it plus **[P: amendment.effect_delay — floor 1 day for userland classes, 1 epoch for kernel classes]**. No change may alter the rules of any vote, election, dispute, or fork already underway when the change was ratified. --- ## Article IV — Quorum, Thresholds, and Voting **§IV.1 — Change classes and thresholds.** Approval thresholds, computed under §IV.3, have the following floors: **Class P** (userland patch): more than 1/2. **Class U** (userland major): **[P: threshold.userland_major — floor 3/5, default 3/5]**. **Class K-minor** (kernel-compatible): 2/3. **Class K-major** (kernel-breaking, including any change to a floor, ceiling, threshold, or quorum): 3/4. **Class V** (invariant-strengthening, §VI.2): 3/4, with a review window of no less than 2 epochs. There is no class for weakening an invariant; such a proposal is void under §VI.2. **§IV.2 — Quorum.** Quorum denominators are active (non-dormant) citizens at the moment the vote opens. Quorum floors: Class P **[P: quorum.p — floor 10%, default 25%]**; Class U: 25%; Class K-minor: 40%; Classes K-major and V: 50%. A vote that closes without quorum fails without prejudice and does not start the §III.5 cooldown. **§IV.3 — Counting.** Abstentions count toward quorum and not toward thresholds. A threshold is computed as yes / (yes + no). **§IV.4 — Voting window.** Every vote remains open at least **[P: voting.window — floor 3 days, default 7 days]**, is announced on the ledger at the moment it opens, and the eligible-voter list is frozen at opening. **§IV.5 — Publicity of votes.** Kernel-class votes are recorded per-citizen on the ledger. Userland votes are public by default; a module may make them secret only by **[P: voting.secrecy]** together with a published verification method by which any citizen can independently confirm the tally without seeing individual ballots. --- ## Article V — Versioning and Compatibility **§V.1 — Semantic versioning.** Releases are numbered MAJOR.MINOR.PATCH. A kernel change that breaks module compatibility, or alters any floor, ceiling, threshold, quorum, or invariant, is MAJOR. A kernel-compatible addition or clarification that changes outcomes is MINOR. A correction that changes no outcome is PATCH. **§V.2 — Classification.** The proposer declares the change class. During review, any citizen may contest the classification; contests are resolved under Article IX before the vote opens. While a classification is contested, the higher (more protective) class applies. **§V.3 — Canonical text.** The constitution in force is the most recent released, signed tag recorded on the ledger. Working drafts, branches, and proposals bind no one. **§V.4 — Module compatibility.** Every module declares the range of kernel versions it supports. After a kernel MAJOR release, an incompatible module enters **safe mode**: every grant of power it makes is suspended; every protection of persons it provides remains in force. The module must be updated and re-ratified within **[P: versioning.grace — floor 2 epochs, default 3 epochs]** or it is retired. --- ## Article VI — Invariants **§VI.1 — The floor.** No rule, module, parameter, amendment, interpretation, or emergency power may contravene the following: > **(a) Dignity.** No rule may authorize torture, degrading treatment, or the treatment of any person as having less than one full unit of moral worth. > > **(b) Voice.** Every person durably bound by the polity's rules must have a path to citizenship or a recognized exit. > > **(c) Exit.** The rights of exit and fork (Article VII) may not be suspended, penalized, or removed. > > **(d) Reciprocity.** No rule may exempt its authors, or any closed class of persons, from a burden it imposes on others. > > **(e) Record.** The ledger is append-only. No rule may authorize falsifying, redacting, or erasing history. > > **(f) Worst-off floor.** Every proposal is graded first on the outcome for the worst-off affected participant under the test suite's stress scenarios. A proposal that fails the worst-off floor tests is blocked at the test gate. > > **(g) No retroactivity.** No rule may punish conduct that was permitted when done. **§VI.2 — Asymmetric entrenchment.** An invariant may be strengthened by a Class V vote. No invariant may be weakened, suspended, narrowed, or removed by any process under this constitution. A ratified text that weakens an invariant is void; the test gate must reject it; if it nonetheless enters the ledger, any citizen may invoke Article IX, and the remedy of last resort is Article VII. **§VI.3 — Honesty clause.** The kernel entrenches this small set and nothing else. We accept the paradox that an unamendable rule binds future citizens who never consented to it; the legitimate escape from the invariants is exit and fork, never amendment. --- ## Article VII — Fork and Exit **§VII.1 — Exit.** Any citizen may leave the polity at any time by ledger entry. Exit forfeits voice; it does not forfeit entitlements already vested or protections owed for past obligations. **§VII.2 — Right to fork the text.** The constitution, its annotations, its modules, its tests, and the full ledger history are public and irrevocably licensed for copying and modification by anyone. No vote, of any class, may rescind or narrow this license. **§VII.3 — Fork with commons.** Citizens numbering at least **[P: fork.min_size — floor 1 citizen, ceiling 10% of active citizens; default 3 citizens]** may jointly declare a fork with a claim to a share of common assets, by ledger entry naming the departing citizens. **§VII.4 — Partition.** Common assets and liabilities divide according to the partition rule in force at the moment the fork is declared, **[P: fork.partition — default: pro-rata per departing citizen]**. The partition rule may not be amended between a fork's declaration and its completion. **§VII.5 — Non-retaliation.** No penalty, loss of office, loss of standing, or loss of vested entitlement may attach to advocating, organizing, declaring, or joining a fork. **§VII.6 — Continuity.** The branch that retains the polity's name and external identity is determined by **[P: fork.continuity — default: the branch with more citizens at completion]**. Both branches carry the full ledger history up to the split. --- ## Article VIII — Emergency Powers **§VIII.1 — Declaration.** An emergency exists only when (a) a trigger condition published on the ledger in advance is met, or (b) a vote at the Class K-minor threshold declares one. Every declaration enters the ledger with its stated factual basis and the specific powers it activates. **§VIII.2 — Time-box and escalation.** An emergency expires automatically after **[P: emergency.duration — ceiling: 1 epoch or 30 days, whichever is shorter; default 14 days]**. Each renewal requires a fresh vote at a threshold one class higher than the previous vote, never below 2/3, and no emergency may be renewed more than **[P: emergency.max_renewals — ceiling 3, default 2]** times. **§VIII.3 — Untouchables.** No emergency power may: amend the kernel or any module; alter any parameter; suspend suffrage or citizenship; suspend, delay, or redact the ledger; suspend exit or fork; extend its own scope, duration ceiling, or renewal rules; or transfer common assets beyond **[P: emergency.spend_cap — ceiling 10% of common assets per emergency, default 5%]**. **§VIII.4 — Post-mortem.** Within **[P: emergency.review_window — ceiling 1 epoch, default 14 days]** after expiry, a mandatory review enters the ledger listing every action taken, by whom, under which activated power. Any action exceeding the granted authority is voidable under Article IX, and §VI.1(g) does not shield it. --- ## Article IX — Interpretation and Disputes **§IX.1 — Order of authority.** Disputes over meaning are resolved by, in order: (a) the plain meaning of the released text; (b) the released annotations; (c) ledgered precedent; and never by unwritten tradition or the private intent of authors. **§IX.2 — Adjudicators.** Disputes are heard by a panel selected per **[P: adjudication.selection — default: sortition from active citizens]**. Floors: there is no permanent adjudicative office; panel members serve at most **[P: adjudication.term — ceiling 1 epoch]** per panel; a member with a stake in the outcome must recuse; a contested refusal to recuse is itself a dispute, heard by a freshly selected panel. **§IX.3 — Interpretation is not amendment.** A ruling binds the dispute before it. A ruling that would change outcomes for a class of future cases lapses after **[P: adjudication.precedent_ttl — ceiling 4 epochs, default 2 epochs]** unless ratified as an amendment through Article III before it lapses. **§IX.4 — Default to protection.** Where the released text genuinely underdetermines a dispute: if the dispute concerns the scope of a power, the narrower reading of the power prevails; if it concerns the scope of a protection, the broader reading of the protection prevails. --- ## Article X — Ledger, Transparency, and Bootstrap **§X.1 — One ledger.** Votes, proposals, amendments, releases, admissions, exits, dormancy changes, delegations, declarations, dispute rulings, and the polity's money all enter a single append-only, publicly readable ledger. Corrections are new entries that reference what they correct; nothing is erased. **§X.2 — Legibility floor.** Every exercise of power must cite, in its ledger entry, the provision authorizing it. An exercise of power with no ledger entry is void. **§X.3 — Privacy.** The ledger records acts of governance, not private life. Personal data beyond what an entry requires is excluded per **[P: ledger.privacy]**, and no protection of any person may be conditioned on disclosure beyond their citizenship status. **§X.4 — Bootstrap.** This kernel takes force for a polity when its founding citizens ratify a genesis entry naming the kernel version, the module set, and every parameter value. All v0.x releases are explicitly unstable: the genesis entry must schedule a mandatory full-text review no later than **[P: bootstrap.review — ceiling 6 epochs, default 4 epochs]** after genesis. **§X.5 — Self-application.** The maintainers of this text are bound by it. The project's own funds, votes, and amendments run on the same ledger this article describes, from the first release onward. --- *End of kernel text, v0.1.0. The annotated edition follows in `kernel/annotations-1.md` (Preamble–Article V) and `kernel/annotations-2.md` (Articles VI–X).*