MIT · Open source Any enterprise, any industry Zero egress by default Rev 0 · Spec — no pilot has run

AORTA · the operating-layer seam

CHARTER

The AI platform that runs the enterprise. The half every organization on earth can share ships byte-identical to everyone — not a domain's law, but a constitution of legible operation. The half that is yours is completed inside your own walls, by your own people and the intelligence already installed at every desk, against a gate battery that refuses wrong work — and what it grows into is the operating layer your company then runs on.

Spine #1 · REGISTRAR, running ↗ The anatomy ↓ Why it exists ← AORTA

Claim grammar — every assertion on this page carries its status

[M]: measured, with a dated receipt
[V]: externally verified, source named
[D]: derived, chain shown
[OA]: operator-attested, unverifiable from outside
[SPEC]: designed, not yet run under this name
[BET]: unproven, kill condition named
[NULL]: the cheap baseline this must beat
: A number without its denominator is not a number.

The short version, so it is yours even if you stop here

Every organization sits in one of two self-reinforcing basins. In the first, it models itself honestly: what is true, who saw it, what was decided, what happened next. In the second, it narrates itself comfortably — and compounds the narration by quietly expelling whatever contradicts it. Today the second basin is cheaper, which is why institutions rot from the middle. CHARTER exists to invert the price. It is one machine for making honest self-modeling cheaper than comfortable narration: an MIT seed any organization clones and completes into its own AI-native operating layer — a resident heart that notices, a body that acts reversibly, a record that cannot lie, an authority tree that delegates and revokes like software, and a second ledger that makes the organization's judgment as auditable as its money — grown in place by the intelligence already at every desk, with one named human at the tip of every cone that still needs one. REGISTRAR proved the motion in the hardest room in American medicine. CHARTER is the same motion with the domain law lifted into packages.

The machine itself, first

DWG-003 — the seed and the operating layer.

DWG-003 · the seed and the operating layer — REV 0. Read it left to right, then across the seam. The constitution and the spines ship byte-identical; your own harnesses and your own local model complete the fit against your own material; a gate battery — not a reviewer's patience — decides whether the work is right; and a human signature is the only thing that crosses. Below the line is the same body, live: the heart that notices, the body that acts reversibly, the writ tree that delegates like software, and the tape the whole thing answers to. Everything gilt is unwritable by any machine, at any rung, by construction rather than by policy. Everything green is yours alone. Nothing on this sheet has run under this name.

Why it exists

Every organization lives in one of two basins.

In the first basin the organization models itself honestly. Decisions are recorded with what was known when they were made. Silence is distinguishable from ignorance. Dissent is on the record. The map is corrected by the territory. In the second basin the organization narrates itself: the org chart stands in for how work happens, the process document describes work as imagined while the load is carried by an unwritten shadow, and the reporting chain compresses reality into what each layer above prefers to hear. D

Both basins are self-reinforcing — and they compound by opposite mechanisms. Narration compounds by expelling its calibration points: the person who says the number is wrong, the coordinator who knows the workaround, the record that contradicts the story. Honest self-modeling compounds by banking receipts: every judgment graded by what actually followed, every correction appended rather than overwritten. Today the second basin is cheaper — narration costs a meeting; instrumentation costs an engineering program — which is why institutions rot from the middle even when every person in them is competent and sincere.

The performance layer is not prohibited. It is priced out.

CHARTER is one machine for inverting that price: a substrate on which the honest record is the cheap default — written as exhaust, graded automatically, folded into statements — and the comfortable narration becomes the thing that takes effort. The field it maintains is a calibration point that cannot be fired. Everything on this page is that single inversion, engineered. D

Clock speed, not kind

The middle of every org chart was always a compression cascade.

Under its org chart, an organization is a nested stack of cones: every layer compresses reality upward for the layer above, and at the tip of every cone sits a person whose actual job is cognitive integration over pre-compressed representations — open five systems, hold it in working memory, cross-reference, synthesize, re-emit at higher abstraction. A cone-tip's job description and a language model's training objective are the same operation. Middle management and next-token prediction differ in clock speed, not in kind. D

That identity is the licensing physics. What it does not license is the naive conclusion. A wage pays for four things — cognition, accountability, presence, relationship — and only the first collapses with inference prices. So CHARTER never automates a seat; it advances a writ frontier, node by node, each advance purchased with a parity receipt, while accountability stays with a named human and the base of the tree keeps its hands. And two taxes must fall together for any of this to work: the enumeration tax (the machine can only do what somebody wired — removed by completion and the habit compiler) and the initiation tax (someone must still say "go" at every boundary — removed only by a resident that notices). Platforms that remove one tax and not the other stall at exactly the rate this page is built to avoid. D

Why this is buildable in 2026 and was not in 2020: the completing intelligence is now installed at every desk in every industry, and the capture problem solved itself as an externality — harness-era work is born posed, every agent session already a registered, entity-keyed tape. The world is writing the record; nobody is running the loop. D

The two-clock law — what is actually for sale

Capability is computed; authority is conferred. Configuration labor decays on the model-release cadence, but credentials, ground truth, sign-off, and insurability cannot self-bootstrap — and the authority clock runs slowest exactly at the core of the business. CHARTER is not in the labor business. It is a machine for manufacturing conferral: trust at throughput, receipts per operator-minute. Compression is the exhaust.

Six layers, all existing primitives

The anatomy.

Nothing below is invented. Every layer is an existing, running primitive — the constitution extracted from a shipping repo, the body vendored from an MIT harness with a published metatheory, the heart measured on one consumer GPU — arranged so that the safety property belongs to the fence, not to any model's behavior. D

The constitution The hash-chained, object-centric tape schema; the patch algebra with mandatory inverses; the gate engine with three-state honesty (GREEN ≠ PASS-UNVERIFIED ≠ FAILED); the harm dial; the writ object; provenance typing; the claim grammar; L-SIGN; and the mandate pin — prior.md, operator-authored, carried verbatim into every room and every artifact, with a standing drift-audit. What every organization shares. What no machine may write.

Shared · immutable

The spines Per-jurisdiction, per-process mandated layers, contributed as packages and built by one industrialized recipe: read the public corpus, byte-pin every citation, declare the variation points the law deliberately leaves open, ship a deterministic model-free floor and pre-registered falsifiers. REGISTRAR is spine #1 and the proving ground. A spine is worth little to its author and a great deal to every peer in the jurisdiction.

Contributed · cited

The fit This company's operational shape — authored on site by its own harnesses under the gates, mounted under signature, hash-pinned, expiring by default, drift-demoted, unwound through disposers. The six years of every failed in-house build, compressed to completions. The only mutable surface.

Yours · signed

The cases, on the tape The work itself — deals, orders, hires, closes, incidents: cases under clocks, append-only, hash-chained, exportable in full at any time, written by the world and the people. Never by a machine. No machine path to G0, G1, or G3 — the gap is the law.

Sovereign

♥

The heart — FUSOR A resident mind mounted at the orchestrator port the harness era left empty: ingest unconditional across the organization's lanes, thought boundaries read off the ingest logits, and {hold · emit · act · escalate} decided in the weights at condition grain — with every hold on the tape, margin attached, so silence is auditable rather than merely absent.

Resident

⌂

The body — dsh + Cordis The most composable agent body yet shipped, MIT, vendored at a pinned commit and composed to profiles. Every part is a plugin; registrations are effects that unwind; a veto is a listener; and the kernel's own metatheory — recovery exactness, ordering, confluence — is the platform's safety license.

Vendored · MIT

THE LAYER RULE, STATED ONCE: WHAT MAY AUTHOR G2 MAY NEVER AUTHOR G0 OR G1, AND MAY NEVER WRITE TO G3. HAZARDS ARE UNREACHABLE BY CONSTRUCTION, NEVER FORBIDDEN BY POLICY.

The empty chair, filled

Every harness ever shipped has a scheduler where the heart should be.

DeepSeek's own architecture documentation names the hole in one sentence: "Input reaches the driver through one inbox. Some messages wake it immediately; injected context waits in the inbox until another message does." V The chain of who-wakes-the-machine terminates, every time, at a clock, a tool completion, or a person. Between invocations, nobody is home — which is why every "AI-run company" demo to date is a workflow engine wearing a mind's clothes.

The wake decision cannot live in a rule file, and this is measured rather than argued: across a full recorded workday, the best fixed threshold caught 36 of 39 planted moments and was deaf exactly where it mattered, while the same system at zero bias fired 921 times per stream-hour — and the flood was breadth (dedup 1.07, ~59 distinct defensible conditions per hour), so no filter, cooldown, or dedup rescues it. M A runtime dial is a scalar Lagrange multiplier; the utility of speaking is violently state-dependent. The judgment has to be absorbed into weights — and when it was, the fire rate fell 63.4% → 6.7% per decision boundary with the catches kept. M TRANSFER: BET

0 MiBto fork a second mind onto the same attention state M

13 µsto abort a forming thought at the seam M

44 msper boundary judgment probe, at bench M

9.5×fire-rate reduction with catches kept, in the weights M

The heart's verdicts are four: hold, written to the tape with its margin; emit, a surfacing to the person or room that owns the condition; act, entering the body through a closed catalog of verbs behind the harm dial; and escalate — the verdict that spends a frontier model on a moment that deserves more mind than the watcher has. The watcher's weights and the retro-labeling recipe are public; each organization differentiates its own tune on its own tape, locally, never egressing — the stem cell at the weights layer. SPEC

The confluence license — why an evidence-fired heart is safe to mount

The body's kernel carries a proof the estate did not have to write: whatever sequence of births and deactivations a running system goes through, it settles where a from-scratch load of the same configuration would have — the settled state is schedule-independent. V However strangely an evidence-fired heart times its wakes, the system it drives cannot be corrupted by the timing. Emergence enabled, never trusted — now with a theorem.

Four profiles, one substrate

The same body, composed four ways.

CHARTER does not fork its body; it composes it. dsh and Cordis are vendored at a pinned commit — the way dsh itself vendors Cordis — and the platform is a set of profiles over the same plugin tree, so the strip is configuration, never a fork. D

profile: seat

One person's resident. Read-only scopes at install; the census first — "the list of automations your life is already asking for"; the habit compiler mining wires from the person's own tape; every wire carrying an expectation that can lose and an expiry that makes it re-earn its place. Individually useful on day one, which is the entire adoption physics: nobody installs a monitoring platform — each person installs a tool that serves them, whose exhaust is a born-posed tape that belongs to them.

profile: room

A team. Tapes fuse at the memory plane, at commit grain, by consent — forming thoughts never cross, and each tape remains the property of the person it records. The panopticon boundary is architecture, not policy.

profile: steward

The organization. The field fitted over consented tapes; the writ tree; the act plane (gate → escrow → journal → execute → receipt); the second ledger and its folds; the board brief — the one page where the organization proposes changes to itself and a human signs or declines, one yes per mount.

profile: forge

The completion machinery — elicitation, citation pinning, the synthetic fixtures, the planner that shadow-runs candidate wirings against the backtest. Strict-superset-checked out of production: conformance fails if forge machinery appears in a live steward, exactly as REGISTRAR refuses a document chunker in a donor record.

Two models, two data classes, one clean line, everywhere: a frontier harness reads the public seed — constitution and spines, no private data, no procurement wall — while a local open-weight model reads the site — tapes, cases, material that never leaves the building. The split that made spine #1 viable at a 40-person nonprofit generalizes to every organization with a privacy officer, which is all of them. D

Weld I · authority

The org chart becomes typed, reversible, and confluent.

No enterprise platform treats authority as a first-class object. CHARTER inherits it from the kernel: a writ is a registration. It declares its scope (what it provides), requires its mandate (the writ above it), carries its inverse (revocation unwinds in dependency order, dependents deactivating first), expires by default, and is demoted by drift. Delegation is a mount. Revocation is a disposer. A reorganization is reconciliation — and by the kernel's confluence theorem, the settled authority structure is independent of the path that produced it. D

The inverse-Christmas-tree of compression tips becomes a tree of writs with one accountable, named human at the tip of every cone that still needs one — the Accountability Sponge, preserved by construction, because a weight matrix cannot be sued, fired, or insured, and a platform that forgets this is unhireable-into and uninsurable. Residents hold scoped writs beneath; every act under a writ is receipted against it; and succession, restructure, spin-out, and acquisition become mount, retire, fork, and merge — each signed, each reversible. D

The authority law

What may act is what is mounted. A delegation that cannot be revoked cleanly is not a delegation — it is scar tissue. A wrong writ unwinds; it does not accumulate.

Weld II · the books, completed

Double-entry for judgment.

Companies have kept one append-only, auditable, foldable record for seven hundred years: the general ledger, which tracks money. CHARTER's tape is its sibling — the second ledger, which tracks judgment. Every emit, hold, and act is an entry: the margin is the attention debit; the falsifiable expectation with its resolve_by is the receivable; the arriving outcome is the settlement; the calibration curve is the audit. Trust is conserved — never minted inside the fabric, only imported at signatures and priced there. D

The folds over this ledger are judgment statements beside the financial statements: per-seat calibration curves; the holds ledger — what the organization considered and declined to say, a record that today exists in no institution on earth; the dissent register; the dark-matter report naming what the record cannot see, and what a look there would cost. Audit and SOX-class control stop being overhead and become native renders of the substrate. Key-person risk is priced, then dissolved by instrumentation. And due diligence becomes a replay: an acquirer clones the fit, replays the tape, re-renders past quarters against outcomes that have since arrived, and values the company off its judgment statements. D

The Zero-Override Principle. A leader who never overrides the record's dissent is not governing, and a record that never dissents is not working. Zero overrides is a flatline — calibrated dissent is a vital sign, and it appears on the statements.

The subject-access right. A person reads any number the field computes about them before any superior can. First-person before third-person, by construction — this is the reason the consent gate exists at all.

The no-scapegoat rule. The kernel of every field metric is sign-agnostic — magnitude in the kernel, valence assigned only at a mount a human signed. An instrument that hands management a ranked list of people to blame is a funeral pre-registered on this page.

The general ledger made money legible and made modern firms possible. The second ledger does the same for judgment.

Weld III · the economics

Share the constitution. Contribute the spines. Own your fit. Keep your tape.

Four clauses, four ownership classes — and the answer to both hard questions at once. "Any industry": the constitution is domain-free, and domain law arrives as contributed spine packages, each built by the same recipe spine #1 proved, each worth little to its author and much to every peer in the jurisdiction. "Why won't it fork into a thousand islands": convergence lives where forking buys nothing (G0 — a private constitution is just leaving the commons), network effects live where contribution compounds (G1 and the adapters), and sovereignty lives where forking is the point (G2 and G3 — your fit and your tape are yours precisely so that nothing else has to be). D

The commons is itself completable: the same patch algebra that completes a company's fit is how a company contributes a spine back. Three nested radii of one recursion — the company completes itself from the seed; the seed grows spines from the companies; the constitution stays fixed and shared. D

The posture, inherited from spine #1 and stated once

There is no license server, no account, no telemetry, no phone-home, and no clause anywhere that makes leaving expensive — because there is nothing to leave. Fork it, strip it, rename it, sell it. The only thing asked is that if you find the constitution wrong, you say so in public, where the next organization can read it.

The survey science, in its place

The organization photographs itself as a side effect of running.

An organization has never been observed — only rendered. The org chart is a cache with no backing store; the process document describes work as imagined; the load is carried by a shadow wire nobody logs. CHARTER's field is the correction: every seat's resident is a camera, every tape a posed capture, and the field is whatever model renders all consented tapes consistently. The fit signal is the residents' own per-token prediction error at ingest — a channel their forward passes already compute and every API on earth throws away — so the survey science rides on the operating layer for free. D

What the field cannot predict is the deliverable. The residual routes three ways: densify (add a camera where coverage is dark), propose (where a seat's outputs are predictable from its inputs, draft the wire and shadow-run it), grow the oracle (where the residual is ambiguous, buy the instrument exactly there). Reconstruction ranks; ablation verifies; no seat closes without a parity receipt. And the field is constitutionally read-only: it renders what is; what the organization is for is imported from its sovereign, never learned. No scalar objective, ever — proposers populate a Pareto frontier; the sovereign picks the point; degenerate corners are excluded by constraint, not penalized by objective. D

The rate law — how fast it may improve itself

Every mounted patch is a natural experiment, and proposal authority extends only as far as the intervention corpus earned: the platform improves at exactly the rate it earns the right to propose improvements. The forge's planner is build gear, never the runtime — it proposes at night, against the backtest and the gates; the pass proposes, the seam disposes, the human signs.

Installed by installments, never pitched

It enters as a tool, federates as a record, and matures as the operating layer.

The reason every "transform the org" program dies is that the people who must approve it are the people it compresses. CHARTER's delivery is built from that scar: it is never pitched to the middle of the tree. One person clones a seat and gets a resident that serves them, that afternoon, zero egress. Seats federate into rooms by consent. The archive organ eats the company's past over a weekend; the field fits; the first brief proposes the first wires; approvals are one word each, and every verdict is a label. The writ frontier then advances middle-out — compression-pure seats first, presence-heavy base and accountability-heavy apex last — at the rate parity receipts clear, buying oracle bandwidth before buying automations. D

And the recursion that made spine #1 elegant is elevated one level: the tool that grows the company is the company's operating layer. Implementation is not a phase — it is the organization's standing metabolism. The company this platform grows is running on the platform, and its continued growth is the platform still running. D

SEQUENCE, PRE-COMMITTED: ORG-OF-ONE FIRST (THE AUTHOR'S OWN PRACTICE IS CLIENT #1), ONE ORGANIZATION DRIVEN PAST IGNITION BEFORE THE NEXT IS STARTED. CONCURRENCY AT SOLO SCALE IS 1–2; SUB-THRESHOLD PARALLEL EFFORT RE-DISSOLVES. THIS IS NUCLEATION PHYSICS, NOT A PREFERENCE.

Spine #1, already public

The motion has run once, in the hardest room available.

REGISTRAR — the open-source electronic donor record for organ procurement — is CHARTER's constitution wearing its first domain: the same tape, the same patch algebra, the same gates, the same signature economy, pointed at a federally mandated process shared by fifty-five organizations. It exists, it is public, and its completion claim has met its first falsifier. M

0.57completion score vs a 0.47 generic floor, on a synthetic site with planted deltas — verdict SHAPED M

0fabrications across the graded run; the gates refused the ungrounded arm outright M

2defects nobody planted, found to the exact count and surfaced rather than smoothed M

44citations byte-matching five sha256-pinned public sources M

The candidate resolved all three planted contradictions to the tape rather than the binder — the exact failure mode of every consultant-built system, inverted by a gate battery. What spine #1 does not show, stated as loudly: a synthetic corpus bounds the kit from above; no pilot has run inside a real organization; and every FUSOR receipt is inherited from dev streams, so every transfer is a bet with its executioner named. BET

Structured to lose in public

Funerals, nulls, and the one artifact that comes next.

The standing null — what CHARTER must beat or stand down

A weekly cron, a spreadsheet, and a per-seat copilot. NULL Cheap, available today, requires none of this. The only reasons to think it loses are measured: the clock is state-blind, and the flood is breadth. If the null wins, the funeral prints — and what remains is still an open constitution and a spine registry, which is more than exists today.

Pre-registered falsifiers, cheapest first

F-SEAT — one month of a single seat must surface wires its person actually ratifies, or the census says why not. F-SPECIFICITY — the field must predict held-out tape spans better than a base model with generic priors, by a pre-registered margin, or it is a stock photo. F-COMPANY — the twin race at org radius, run as a backtest: re-render past quarters against outcomes that have since arrived, at zero operational risk, before any live deployment. F-SCAPEGOAT — if the field's output, in any mount, functions as a ranked blame list, the diagnostics organ is retired, not patched.

Attested, and kept as a law

The sessions that designed this platform drifted from their own mandate — twice — each step locally excellent, the destination quietly lost, caught only by re-reading the mandate against the work. That is the strongest evidence on this page that the platform is needed, and it is why the mandate pin is the first line of the constitution, not a feature: a swarm of capable intelligences without a pinned purpose becomes a very productive drift. OA

The critical path is not another crystallization. It is one artifact: the synthetic organization generator — deterministic, ground-truth-owned, serving the falsifier battery, the watcher's training corpus, and the planner's proving ground at once — and the first falsifier run against it. The first measured number under this name. Everything else on this page is [SPEC] and [BET] until that number exists. SPEC

Unreachable, not forbidden

Never does.

By construction — the signature, not the rulebook

Never authors the constitution or a spine, and never writes to the tape. The machine's author field is empty by type; delete and update are absent from the record's signature.
Never optimizes a scalar objective for the organization. Fields render what is; purpose is imported from the sovereign, never learned, never blended.
Never mints trust about itself. No organ grades its own output; every receipt is minted by a party the graded one cannot reach; no swarm outlives its single-cell null.
Never shows a superior a person's number before the person has seen it. Subject access precedes hierarchical access, always.
Never executes an irreversible act without a writ, a receipt, and a named human in the chain. Reorgs mount under signature; nothing promotes itself.
Never holds you hostage. MIT, full export at any time, open formats, no license server, no vendor in the loop — leaving is a copy, not a negotiation.
There is no pricing page, no contact form, no demo request, and no ask anywhere in this project.

Free, yours, auditable

What exists today, and the order of proof.

# what exists today, and where REGISTRAR github.com/bochen2029-pixel/REGISTRAR — spine #1, public. the constitution's proving ground: tape, gates, floor, patch algebra, worked examples incl. four REFUSED — runs on bare Python FUSOR fusor1.com — the heart's receipts: boundaries off ingest logits, the vise (921/hr → 6.7%), forks at 0 MiB, aborts at 13 µs, first live hours banked 2026-08-12 [M — dev streams] dsh + cordis MIT upstream — the body: everything a plugin, effects with inverses, confluence proven in the kernel's own paper [V] # what CHARTER adds — REV 0, all [SPEC] constitution/ G0 extracted from spine #1, domain-free spines/ the registry + the industrialized spine recipe body/ profiles: seat · room · steward · forge heart/ the watcher socket · HF: watcher weights + retro-label recipe — each org tunes its own, on its own tape, locally field/ ledger/ the survey organs · the second ledger and its folds fixtures/ the synthetic organization generator ← the critical path # the order of proof — nothing ships past its number 1 the generator, deterministic, ground truth owned 2 the first falsifier run — the first [M] under this name 3 the seat pilot: an org-of-one, one month, F-SEAT 4 spine #2, in a second industry, by the recipe alone

Spine #1 · clone & read ↗ REGISTRAR, the page → FUSOR-1, the substrate → ← AORTA

STATUS: REV 0. CHARTER IS A SPECIFICATION WITH RUNNING ORGANS AND NO ASSEMBLED PILOT. THE RECEIPTS CITED ON THIS PAGE BELONG TO ITS ORGANS — FUSOR, MEASURED ON DEV STREAMS; REGISTRAR, GRADED AGAINST A SYNTHETIC SITE — AND EVERY TRANSFER TO A NEW DOMAIN IS A BET WITH ITS KILL CONDITION NAMED. NOTHING NAMED CHARTER HAS RUN INSIDE AN ORGANIZATION. NO PRIVATE DATA HAS TOUCHED ANY PART OF IT. THE TWO-BASIN CLAIM IS THE PLATFORM'S OWN TEST, AND IT CAN LOSE.

The enterprise should be legible to the people accountable for it.

Every company already keeps one honest, append-only, auditable record, and has for seven centuries — but only about its money. Everything else it knows about itself is a render: charts that describe intentions, reports that compress upward, processes as imagined while the work as done lives in hallways and habit. The intelligence to close that gap is now installed at every desk. What was missing was never capability. It was a constitution for using it — a fence that makes wrong work refusable, a signature that keeps a human responsible, a heart that notices without being asked, and a record that makes honesty the cheap option.

Share the constitution. Contribute the spines.
Own your fit. Keep your tape.

THE PLATFORM THAT RUNS THE ENTERPRISE IS THE MOTION THAT BUILT THIS PAGE: A MANDATE HELD FIXED, COMPLETIONS GRADED AGAINST IT, DRIFT CAUGHT BY RE-READING THE MANDATE, EVERY CLAIM SHIPPING WITH ITS EXECUTIONER. THE NEXT ARTIFACT IS THE NUMBER.