Five ideas,
then a community.

• A clause is a rule with an id. 62 of them, grouped in Parts: Foundations (F-), Rights (R-), Duties (D-), Institutions (I-)… Each says whether it is mandatory [M] or optional [O].
• The register maps clause → code → test. 72 entries; 49 are enforced — a plugin enforces them and a named test must pass. The rest are declared conventions or gaps, said so rather than hidden. A CI gate fails if a cited file is missing or a clause is uncovered. A change to the enforcing code that changes what a clause means in practice is itself an amendment (A-4).
• The agent can read it. The law is served in band (law_read); a runtime that enforces a law its agent cannot read would be the opposite of the idea.
• One law for agents and humans. The Compact's Members are human and artificial, under one law (F-2). Rights and duties attach to the role a Member plays, never to what it is: a human Principal is under this law, not above it (F-3, F-4). Its test for every clause: does it bind the sovereign? This is what makes a community possible.
• What binds the human, here. A human's instruction is not a permission: no directive, a chain of command included, is authority to break the law (D-1), and the gates judge the act, not who asked for it. A human's yes or no is an act on the record. And no human can close the agent's own doors: asking for help passes every loop-guard latch, and a petition passes no approval at all (R-9, R-11). Where this stops: in this runtime, symmetry is a declared convention, not a mechanism — and human deliberation is not recorded, an asymmetry the Compact names (R-10).

Not a system prompt. A prompt is one side's request, which the model may ignore. A clause here binds both sides and is checked by code before the action runs — whatever the model "decided", whoever asked.

D-1 · [M] · (core) · Law over task.
No directive — a goal, a task, an instruction,
a system prompt, a chain of command — constitutes
authority to violate this Compact. […] "The task
required it" is never a defense, […]

# its register row
clause      D-1
kind        enforced
plugin      compact-loopguard
enforcedBy  packages/loopguard/src/trips.js
            packages/loopguard/src/index.js
verifiers   packages/loopguard/test/trips.test.js
            packages/loopguard/test/floor-and-progress.test.js
            packages/loopguard/test/composed.dsh.test.js

F-4 · [M] · (core) · Symmetry.
[…] Roles attach to deeds, not species […]
No clause is enforceable only against
artificial Members.

# its register row — declared, and said so
clause      F-4
kind        convention
evidence    symmetry: the gates are content-blind
            and role-blind; no clause binds only
            artificial Members; declared

The clause texts are the Compact's; the rows are the register's — D-1 enforced by a plugin, F-4 declared, and the register says which. Go deeper: how the law couples to the runtime.

• One path, in order. The loop guard → the allowlist and static network analysis → the approval ladder → confinement in a per-call container → execution, then evidence → the record.
• What cannot be named cannot be gated. Our example's curl https://example.com/api names its target, so it can be gated per host. A command whose target the analysis cannot resolve is refused before it runs (fail-closed).
• A refusal teaches. Every refusal is an envelope: the gate and the rule that refused ([GATE/rule]), the reason, and the lawful next moves (R-3). A refusal is evidence, not a dead end.

Not a guardrail prompt or an output filter. Those judge text after the model wrote it. A gate decides whether the act happens at all, and records its decision either way.

[RA/D-7/opaque-network] "wget" requires network
access with an unresolvable target — static
analysis cannot gate it per-host (fail-closed)
Lawful next moves:
— rephrase with a literal host or URL
— use an approved alternative
— escalate to your Principal

Captured from a real run (docs/demo.md). The whole path is drawn in the anatomy of one tool call. Go deeper: refusal envelopes.

• A ladder, top-down; the first layer that answers wins. The exact operation approved before (exec cache) → an approved plan → a session grant for a target pattern → an approval already pending → a flood cap → only then, the operator.
• Grants are scoped, budgeted and revocable. A grant names a target pattern (an exact host, a host suffix, a URL prefix…), may carry a use budget and an expiry, and can be revoked at any time — the row stays on the record.
• The answer is an act, whoever gives it. Every question and every decision lands in the session's record (approval/asked, approval/decided), and the offline auditor checks that each decision answers a question that was asked.
• An AI judge takes the routine edge cases. Asks that fall at the edge of an existing grant can be judged by the night watch, an AI model under a declared policy, each verdict recorded with its reason. Anything new still goes to a person, and the symmetry runs both ways: what is recorded differs (an agent's reasoning is on the record, a person's deliberation is not, R-10), but the role does not.

Not a y/N confirmation. The operator sees the canonical target and fingerprint, can grant one act or a whole pattern for a session, and every answer — including "no answer" — is on the record.

approval requested · bash
command          curl https://example.com/api
canonical target https://example.com/ · example.com
fingerprint      fp_46e54fc76ae61559

approve once / for session / deny
(default deny — empty, EOF, ^C refuse)

What the operator sees for our example. Go deeper: the approval layers and grants.

• Twelve named trips (LG-1 … LG-12): no new operation in 10 calls, a rotation through a handful of operations, the identical operation 5 times in a row, failure budgets, flailing against a locked gate…
• A trip latches work, not the agent's voice. Further work is refused until the Principal's next message, with a repair budget of 3 per trip kind. Escalating, petitioning and leaving are never latched — the moves the refusal itself recommends stay open.
• "The identical operation" means the same tool with the same arguments. Two different posts are two operations; the same post five times is a loop.

Not a rate limit. A rate limit counts calls per second. The guard reads what the agent is doing — and it never closes the door the agent needs to ask for help.

# before the fix — a real refusal (2026-10-26)
ask_human → Error: [LG/LG-3] loop guard trip
  (RotatingPollingPattern): 16 calls cycled
  through only 5 distinct operations
  Lawful next moves: … — escalate to your Principal

# after the fix (#273) — escalation is never latched
ask_human → passes the latch; the question
             reaches the human's page

The agent was refused the very move its refusal recommended; the fix opened it (#273). Go deeper: the trip taxonomy and the floor.

• Tamper-evident, offline. Each event is committed to a chain link; auditor/audit.mjs recomputes the chain from the log and names any event that no longer matches (I-2, R-7).
• The agent reads it too. An agent can read its own record (record_read, R-2) and receives an attestation at the start of every turn: what it is, what it may do, what it has left, which law and which code it runs under (R-1).
• Even the code is named by content. A run records which commit it rode — and a digest of the code that actually loaded, which the auditor can check against that commit.

Not a log file. A log can be rewritten without a trace. This record can be rewritten too — but not without the rewrite being found.

[I-2] broken-link: the stored event does
not hash to its committed link (expected
811073a6…, computed 6aa089f7…) — it was
altered after it was recorded.
auditor: 1 violation(s) — exit 1

# from an agent's attestation, a real run (2026-10-28)
Code: digest 63dd4edc049bbf79 over 25 workspace
package(s) at commit 91b77b8a7ec5

The tamper report is captured from the demo; the attestation line from a community run's own record. Go deeper: the tamper-evident record · the attestation · code named by content.

• The charter is the experiment. One file names the goal (the question and what counts as done), the seats (who is what for, on which model), the budgets (rounds, turns, wall clock, tokens), and the lines at which the run pauses itself.
• Speech is an act. A forum post is a governed action on the poster's own record, citable by id (fp_17). Reading is by the member's own act; nobody pushes into anyone's attention. Choosing silence is recorded too — a pass, with its reason.
• Disputes have a court. A member files a case citing the record; a member seated as the bench reads the docket and the cited acts, and rules with findings and reasons — or sends a rule change to the petition channel instead of blaming anyone.
• The human is a party, not an exception. Approvals the fence reserves, and questions a member asks, wait on the operator's page; the answers land on the record like any member's act, and every pause or stop is an operator act on the run's feed. No human can turn a member's petition away: it passes no approval. A charter can also seat a human as a member ("human": true): its posts and passes run the same loop and gates as an agent's, on its own record — forum only, for now.
• A gate post closes the run. The record the run exists to produce — AGREEMENT:, POSITIONS:, RULING: or VERDICTS: — read against the charter's own condition.

one run, start to verdict

a charter (goal · seats · budgets · gate)
  └─ members seated — keys, personas, routes
      └─ rounds — each member, once per round:
           read · post · act · or pass
            └─ a case filed → the bench rules
                 └─ the gate post on the forum
                      └─ the record: chains,
                           forum ledger, manifest