Sovereign hubs.
Federated globally.
A single global system cannot serve eight billion of us. So the Federation is a minimal global layer connecting maximally sovereign local communities. The Federation does only what communities cannot — and is forbidden from everything else.
- Local money stays localUBD and CP are minted by a hub and spent in the hub that issued them.
- One bridgeValue moves between hubs only through gCP — never straight from one hub to another.
- One fee on the bridgeA transfer of gCP between hubs pays the inter-hub fee: 0.1%.
Outside the wall: nothing is bought in, nothing is cashed out.
Five hubs around one bridge, gCP. Every hub is joined to the bridge and to nothing else: no line runs from one hub straight to another. Each hub's UBD and CP stay in the hub that issued them. A transfer between two hubs crosses the bridge and pays one fee on the way, the inter-hub fee of 0.1%. A closed wall surrounds all of it: nothing is bought in and nothing is cashed out.
Examples — locally-calibrated dignity
Same protocol, different human scale. A geographic hub calibrates dignity income to its own local basket; an operational or company hub pays none, and pays for work instead.
A member can belong to several hubs at once — one geographic and one operational is the ordinary case — but dignity income comes from exactly one home hub, and only a geographic hub may be one. Changing your home hub normally waits a 26-week cooldown — but not when a closer geographic hub forms inside the one you are in. Your neighbourhood or city reaching its own hub is the network densifying, not anyone shopping for income, so that move is immediate.
Three types, and the one question that sorts them
There were four types before this — Geographic, Affinity, Diaspora, Experimental — and the declaration carried almost nothing: a hub said which of the four it was at formation, and no clause anywhere read the answer. Four labels that change no obligation are not a taxonomy; they are a description of who happened to join. So the same ground is re-cut along the one line that has economic consequences, and the declaration is made binding. The line is territory, and the test is a single question: does a local market have to accept this hub's dignity income? A hub whose members buy their food in one bounded place can answer yes — the shops are there, and mandatory acceptance obliges them. A hub whose members are scattered across four continents cannot answer it at all: there is no the market and no one basket to price, and dignity income minted where no local market must accept it is a number on a screen that buys nothing.
Cities, regions, neighbourhoods — Lagos, Berlin, Kreuzberg inside Berlin. A geographic hub declares a boundary, and it is the only type that may be a member's home hub, and therefore the only type that mints dignity income. Its supply ceiling stays exactly where it was — population × 1,000 — because a city's output really does scale with the people in it, and its commons is funded as it always was: out of its own conversion fees, transaction fees, decay and overflow, and out of no protocol pool.
A co-operative, a translators' collective, a project hub, a guild that actually ships — a community organised around work rather than around a place. No home hub, no dignity income. It mints CP on its real sales like any hub and runs a commons like any hub, but its ceiling is measured on realised cross-hub value rather than on headcount, and it draws nothing at all from the federation's annual release — that release turns wholly on members whose home hub is geographic, and an operational hub carries none. Its treasury is its own: the commons share of every mint it makes, plus its own fees, started by a one-off grant from the Federation Reserve that is never repaid. It pairs one-to-one with a national nonprofit for its lawful commerce, and it declares an anchor — the geographic hub where its work actually lands.
A firm, inside the Protocol, on the Protocol's terms — and the firm itself is never a member. This Protocol admits only verified human beings: a company holds no dignity right, casts no vote, and has no tier, so a business participates through a verified human member acting in the course of that business. A Company hub is where those people organise, not a legal person that joined. No home hub, no dignity income, and no protocol allocation of any size. Its treasury is capitalised by its own members' stake, paid in gCP those members already earned elsewhere in the circuit — never bought in from outside, because the circuit admits no outside money to buy it with. What the type line takes from a company town are the three instruments that would have made it worse: it can be nobody's home hub, it cannot be the issuer of the money its own workers must spend with it, and the commons never funds it. What that does not close is named rather than left out: none of it reaches a dominant provisioner who is simply the only door the tokens can go through once received. Point-of-sale capture stays an open finding of the simulation record.
The organising principle, stated plainly: who benefits decides who capitalises it. The commons funds what serves the commons; a company's own people fund what serves themselves. The Protocol has never subsidised for-profit activity, and this is the clause where it stops being able to.
What became of the other three
A hub may be about a heritage, hold its assemblies in a language, keep its calendar — and must admit whoever shows up.
The retired-hub rule, in full →
Type is declared once, at formation, and nothing here opens a path to change it later. Affinity, Diaspora and Experimental are retired as types, and each is decided here rather than left open, because a taxonomy with unassigned rows is the defect this change exists to repair. Affinity was the slot the other two types are cut from: a developers' guild that ships for other hubs and a healers' network that serves its own members are different economies wearing one label, and the label was the reason neither could be funded honestly. Diaspora describes a people, not an economy — Nigerian-London is geographic, because its members live in one city and price one basket, while Pan-African Digital is operational, because it has no single market at all. Experimental grouped three things that never belonged together: a seastead is a place with a hull and an ecovillage is a place with a fence, so both are geographic, while a community defined by not being anywhere is operational. And one thing is recorded rather than smoothed over: a hub may be about a heritage, hold its assemblies in a language, keep its calendar — and must admit whoever shows up.
The anchor hub — standing, and nothing else
The anchor is the oldest member-bound hub in a region; its standing is kept by conduct, and frivolous petitions can cost it.
The anchor rule, in full →
Every allocation here anchors to something a stranger can check: dignity income anchors to members who must be paid weekly in real goods, the mint anchors to a real sale, the Registry's counts anchor to state-signed documents. An operational hub's claim to be doing work for the movement anchors to nothing — and a treasury spending against an unanchored criterion is the ordinary way a distributed organisation captures itself. So every operational hub declares an anchor: the geographic hub inside whose boundary the largest share of its delivered work actually landed over the trailing 52 weeks — a boundary the Constitution records, in three places, as not yet a defined object, so the first limb is checkable in principle and not yet in practice. The declaration is a finding of fact, not a choice — unilateral, published on-chain, restated every 52 weeks, and contestable by any geographic hub that contends it is the true anchor. The anchor gains exactly one thing: standing. It may petition the Arbitral Layer to suspend or terminate the operational hub's undrawn grant tranches — not an allocation, which that hub does not have — for work claimed and not delivered, and it may petition for nothing else — it cannot instruct, cannot direct or refuse the work, holds no seat in the assemblies, no veto, and no share of the treasury. It is the nursery relationship run backwards, and the symmetry is the argument: the nursery provisions without instructing; the anchor judges without instructing. The petitioner carries the burden, no stake is required — a guardrail only the wealthy can reach is not a guardrail — and three findings of frivolous petition cost an anchor its standing for two years.
What the line costs, said before anyone has to discover it
Membership costs real money, paid by institutions and by individuals — stated here rather than found later.
What membership costs, in full →
This closes a door that was deliberately opened, and the closing is a cost rather than an oversight. A member with no ten neighbours could previously have taken dignity income from a distributed hub of translators. They no longer can, and they take none from anywhere until a cell forms where they live. The alternative was a dignity income that is a number in a wallet, and the Protocol took the one that buys food — but it says which one it dropped. What remains for the isolated member is exact and is not inflated: the Consent Registry works from the first minute at zero density, ten to twenty-five people form a Seed Cell anywhere with no stake of their own, and an operational hub still pays them for what they actually do — CP on real sales, a share of its commons, published bounties. And the loss is not only economic. The heaviest vote in this Protocol — the one that reaches the founding article — is cast by human beings through their home hubs, so a hub that may not be a home hub carries no constitutional ratification weight, and a member whose only hub is operational or company has, for as long as that is true, no ratification voice at all. The first half of that is intended: value creation buys no constitutional voice. The second half lands on individuals rather than on institutions, and it is stated here rather than found later.
Local UBD, Local Rules
Each geographic hub sets its own UBD amount, tuned to local cost of living. Lagos Đ500. Berlin Đ2,000. Same dignity, different numbers — same basket of bread, transport, communication.
gCP — One Global Bridge
10 billion gCP hard cap. Trade across hubs. Settle globally. One token for inter-hub commerce with 0.1% fees. The Federation cannot mint a single gCP beyond the cap, ever.
Fail-Safe by Design
If a hub collapses, refugees are absorbed into neighbouring hubs within 30 days. 70–80% reputation transfers. No one becomes stateless. Ever. The reserve sizes for 10% simultaneous failure.
Consent Registry
A standing, cryptographically verifiable instrument for every member to affirm or revoke consent — to their hub, to the Federation, and as a political declaration. Zero-knowledge participation: no list of dissenters, ever. An index, not an event — a curve that updates continuously, whose cost of being ignored rises with it.
Paritary Adjudication
No institution judges its own cause. Disputes between a hub and the Federation are heard by an Arbitral Panel of five: two arbitrators nominated by the disputant hub from other hubs' Trustee pools, two nominated by the Federation Council, and one presiding arbitrator drawn by verifiable random sortition from a standing roster of arbitrators who hold no Federation office. Parity between the parties, with the balance held by chance rather than by either of them. Decisions bind the Federation immediately.
Asset Partition Protocol
When a geographic hub splits, physical assets do not divide in a block. Every backing asset is registered at acquisition with its valuation method, divisibility class, and default partition track — chosen behind a veil of ignorance, before anyone knows which side of a future split they will stand on. No partition may create a hostage.
The Federation does not judge its own disputes
History's oldest failure pattern in federated systems: the centre judges its own disputes with the periphery. HPP encodes the Sicilian lesson — whoever controls the forum eventually controls the interpretation. The Arbitral Layer is structurally incapable of belonging to either party.
WHO JUDGES
Panel of five: two arbitrators nominated by the disputant hub from other hubs' Trustee pools · two nominated by the Federation Council · one presiding arbitrator drawn by verifiable random sortition from a standing roster of arbitrators holding no Federation office. Parity between the parties, with the tiebreak held by chance — a presider chosen by negotiation can deadlock, and delay always serves the enforcing side.
Sortition integrity
The eligible pool is committed on-chain before the random seed is revealed, and the seed comes from a public beacon. Commit, then reveal — never the reverse. Exclusion is only for direct economic exposure above a published de minimis threshold, never for a hub's own pending proceedings: that rule would let the enforcing organ shape the pool simply by opening them.
Jurisdiction
Jurisdiction: contested quarantines, de-recognitions, health-metric determinations, claims of constitutional overreach, partition disputes, engine-conformance review.
The clock
Panel formed within 28 days of filing, hearing concluded within 90, decision within 120. If the Layer misses its own deadline, the contested sanction lapses. Delay is the oldest way to lose a court, and this constitution declines to lose its court that way.
Asymmetry of appeal
Asymmetry of appeal: Panel decisions bind the Federation immediately. The Federation may not appeal; the hub may request one review by a fresh panel. The strong party needs fewer protections precisely because it is strong.
Self-limitation
The Arbitral Layer's existence, this clause, and the guarantee of impartial adjudication are listed among the unamendable provisions — no threshold reaches them, and there is no “foundational tier” that opens them. Only the Layer's jurisdiction over Federation acts may be narrowed, and only by the hardest amendment path, the one that protects Article I. Never by ordinary vote, never by the Panel itself.
The full Resolution — the disease, the history, and every clause of the cure: Read the protocol document →
The ledger divides in one block. The grain silo does not divide at all.
Physical capital is indivisible, immovable, and territorial — and this is exactly where history's peaceful separations turned ugly. Czechoslovakia's velvet divorce was velvet everywhere except in the division of the army and federal property. So the rules are written now, before any specific silo is at stake, because partition rules drafted during a partition are drafted by the stronger party. Every asset is registered on-chain at acquisition with its valuation method, its divisibility class, and its default track — Rawls rendered as a smart contract.
Grain, fuel, inventory: divide in kind, proportionally, at the recorded quality grade. The simple case, handled automatically.
A mill, a solar field, a workshop. Money is never the discriminator — a wealth auction with a financing clause still awards every mill to the richer side, because financing raises what the poorer side can pay, not what the richer side will. Default: divide-and-choose over bundles. One community splits the set in two; the other picks. Envy-free by construction, unwinnable by wealth. Where one asset dominates: dependency allocation by recorded use, compensation at oracle valuation, ties broken by sortition — never by price.
An aqueduct, a grid interconnect, the only harbour crane. These convert by preference to a Commons Trust: a minimal joint-governance DAO holding title, usage and maintenance apportioned by recorded historical use, reciprocal easements encoded so neither side can strangle the other's access. The charter is deliberately boring — fixed formulas, no discretion — because shared infrastructure must run on rules, not on the goodwill the separation just consumed.
Liabilities divide by the same weights as the assets, because a partition silent on debts hands the weaker successor the obligations. Every proportional division uses contribution-weighted membership frozen at the filing date. And physical title lives under host-jurisdiction law, so every hub embeds these rules in its legal wrapper as a binding arbitration agreement — seat, governing law and scope named — which is the difference between a remedy and a statement. No partition may create a hostage.
A community of ten begins today
A single threshold — five hundred members, ten thousand gCP staked, three endorsements — gated existence when it should gate only full sovereignty. Worse, the stake was circular: gCP comes from converting earned CP, and a community with no hub has earned none. A network that can only be joined where it already exists does not spread; it ossifies. So the threshold is split into three, and dignity stops waiting for a quorum.
Seed Cell
Forms anywhere, immediately, with no stake of its own — and no currency of its own. A community is not a currency: from day one the cell records CP on a shared circuit it joins, not a token it issues. A geographic cell also pays UBD, sized to real productive capacity under the declared-capacity rule: it publishes what its UBD actually covers, updates it quarterly, and may never overstate it. An operational or company cell pays none, and records earned value alone. Full internal market and assemblies. No Federation vote, no currency of its own, no gCP convertibility, cannot charter further cells — but full standing before the Arbitral Layer, because a stage with no vote must not also be a stage with no forum.
Nascent Hub
Unlocked when an internal market demonstrably functions — recurring transactions across weeks, more than one provisioning source, assemblies that resolve what they take up. It still mints no currency of its own and keeps transacting on the shared circuit. Gains limited gCP convertibility at Steward tier on that shared unit, inter-hub trade rights, and full party standing in disputes.
Full Hub
The existing standard, now gating exactly what it should: Federation Council vote, full convertibility, its own arbitration bodies, and the right to sponsor new Seed Cells. It is the first stage to mint its own CP and receive the full gCP bridge — a currency of one's own is worth having only where an economy is deep enough to sustain it. On promotion, members' shared-circuit balances re-denominate into the hub's own CP on a published one-time basis — creating and destroying nothing — and the full UBD sufficiency triggers bind.
A founding cell does not wait for five hundred strangers — twelve neighbours and a sponsoring nursery are enough to begin.
The stake rules, in full →
The stake circularity is resolved by adoption rather than exemption. Every Seed Cell is sponsored by a nursery — an established Full Hub or, more often, the jurisdiction's Foundation — which supplies the endorsement, mentors, provisions, and stands surety for the cell until its promotion to Full Hub. The sponsor and the source of the stake are two different parties, and keeping them apart is what keeps the legal layer clean. Where the nursery is a Full Hub, it may post the stake from its own holdings and recover it on promotion. Where the nursery is a Foundation it posts nothing: the stake comes from the Federation Reserve, on the Reserve's behalf, against that Foundation's sponsorship, and returns to the Reserve on promotion — because no Foundation ever holds, receives, or is allocated gCP. Surety is an obligation, never a holding: a Foundation answers for abuse before the Arbitral Layer and can lose its sponsorship, and it owes no gCP, because it may hold none. The nursery is also the circuit the cell joins: adopted by a Full Hub, the cell transacts in that hub's own CP, joining an existing circuit rather than founding a rival one; adopted by a Foundation — which holds no tokens and can mint none — it transacts on a single shared seed unit, common to every cell with no Full Hub in reach and operated as neutral nursery infrastructure exactly as the Consent Registry is. That unit is never the Foundation's, and no outside money ever buys it. Sponsorship is public, capped at twelve concurrent cells per nursery against shell-cell farming, and terminable by the Arbitral Layer for abuse. A nursery mentors and stands surety; it never instructs, and it cannot condition provisioning on how a cell votes. The network reproduces by budding, not by spontaneous generation — a thousand cells add a thousand assemblies, not a thousand incompatible monies. Someone in a city with no hub does not wait for five hundred strangers — they find twelve neighbours, and the Foundation adopts them.
An operational hub's payroll is advanced by the Reserve against delivered work — and the cost of carrying it is published.
The payroll advance, in full →
Adoption settles what a cell must post to exist. It settles nothing about what pays the people who make it exist — and for an operational hub, one organised around work rather than a place, every allocation term is zero. The floor and population shares scale on members whose home hub is geographic, and this one is not. The commons share belongs to a different formula and fares no better: it divides a mint that fires on a sale, and a hub that has not begun has made none. The total is not small; it is zero — and since the activity term was struck it is zero permanently rather than only at the start, the circle having stopped closing with time. That is the stake circularity a second time, answered from the same place on different terms: a grant, not a mint — and, unlike the nursery stake above, never returned. The Federation Reserve grants up to 10,000 gCP — the same figure a Full Hub stakes, taken by reference so the Protocol keeps one number for what standing up a sovereign hub is worth — in four tranches across one year, once per hub ever, against a surety who owes answerability and never money. Tranches release on delivered work with strangers — settled escrow with three unique counterparties, a registered asset, a sponsored cell coming alive — and never on a quantity of value, because volume is the one figure this Protocol has measured to be manufacturable. Nothing is recovered: the sum was charged back against the hub's own allocation until that allocation was struck, so the Reserve carries it and publishes what carrying it costs. Company hubs are excluded absolutely: the commons funds what serves the commons.
Every structure on this page began as ten neighbours who decided to begin.
Start your seed cellThree deliberation tiers: circle, district, hub plenary
1.6M members is city-scale. Voting alone — even weighted voting — breaks down past about 10,000 active participants. So the internal structure brings real deliberation down to where we actually know each other, and aggregates upward from there. These are deliberation bodies inside one hub — not the formation stages above. A Circle is a standing assembly of a hub that already exists; a Seed Cell is a community of ten to twenty-five people that is not a hub yet. The two ladders run in opposite directions and never meet, and no tier here mints, converts or votes at federation level: the whole ladder sits inside one CP zone and one UBD instance.
The Circle
Small enough that we actually know each other — about 150 of us, the limit on real relationships first measured by Robin Dunbar. Above that, governance shifts from trust to rules. Below it, real relationships do the work. This is where daily legitimacy lives.
- Admission of new members
- Relational conflicts
- Local care and mutual aid
- Proposals to the district
District
Aggregation of ~33 Circles. Neighbourhood or small-town scale. This is where local budgets, shared infrastructure, and inter-Circle conflicts are deliberated.
- Local budget allocation
- Shared infrastructure
- Mediation between Circles
- Representation to the hub
Hub Plenary
The whole hub. Decisions binding for all members: external policy, federal alliances, refugee absorption criteria, local constitutional parameters (within fixed ceilings set by the federation).
- External policy toward federation
- Refugee absorption criteria
- Local constitutional tuning
- Secession (with cooling-off)
Lawful hands in every country
A ledger cannot hold a deed, sign a lease, hire a teacher, or stand in court. Earlier versions had each hub publish its own legal wrapper; that multiplies legal cost by the number of communities and puts a founding group of twelve in front of a notary before it has an economy. One accredited Foundation per jurisdiction is the legal skin, and hubs do not each incorporate.
Global, singular. The rulebook and its organs: the constitution, the Federation Council, the Arbitral Layer, the Registry, gCP. It touches no external money.
One accredited per jurisdiction. National asset-locked, non-distributing nonprofits — the capacity to own land, receive donations, hire, build, and stand in court. An instrument of execution, never a layer of governance.
Local, sovereign. The communities themselves, living the closed economy and voting.
Terminology, binding on every material we publish: the Federation is the Protocol's global governance layer — Council, Arbitral Layer, inter-hub coordination. A Foundation is a national legal entity. The two are never interchangeable, in any language. Confusing them is how an instrument becomes a government.
The Paired Entity — a third name, never a third layer
The Paired Entity is the lawful wrapper: its members command through their Assembly, its board executes as fiduciary, and it exists so the work has legal hands.
The Paired Entity, in full →
One instrument is added beside the two names above, and it is added openly, because it partly reverses a decision this Protocol made once and recorded. An operational hub is defined by having counterparties outside the circuit — clients, suppliers, invoices, contracts under national law — and without a wrapper of its own, the only lawful signatory for that commerce is the jurisdiction's Foundation: the entity holding that country's land, greenhouses, clinics and housing. Concentrating every trading hub's contractual liability there puts a community's donated commons behind one hub's supplier dispute, and an asset lock a creditor's judgment can reach through is not an asset lock. So each operational hub pairs with exactly one Paired Entity — a national nonprofit, one entity to one hub, named on both sides and recorded on-chain, adopting a model statute whose operative clauses are non-negotiable. The per-hub board, filing, registered office, accounts and auditor are a real recurring cost, and it falls on the hub whose external revenue is the reason the wrapper is needed. A hub that cannot carry its own legal overhead is telling us something true about whether it should be trading outside.
- It is not a Foundation and may never be called one. The Federation is the Protocol's global governance layer; a Foundation is a national accredited entity; a Paired Entity is neither — an instrument of one hub's lawful commerce. One that describes itself as a Foundation loses recognition on the day it does. This adds a name, not a layer.
- It may never solicit, accept, or hold a donation — in any amount, from any party, ever. Donations remain the exclusive business of the jurisdiction's accredited Foundation: one door, one audit surface, unchanged. Nothing here gives a donor a second door to look through.
- It holds no token, ever. It receives fiat, holds fiat, and converts fiat into matter. The legal layer holds land and buildings; the ledger layer holds tokens; the two never trade with each other.
- No fiat figure enters any token formula. No minting, allocation, conversion, cap, tier, reputation or governance computation anywhere in this Protocol may take a Paired Entity's fiat balance, revenue or receipts as an input, at any remove. A ceiling indexed to money received would be the external benchmark the closed circuit forbids, arriving through a variable instead of through a market.
- The members command through the Assembly, the board executes as fiduciary, the law is the guardrail. The deliberations of the hub's registered members, taken through the platform as the entity's statute provides, are the Assembly's instructions within the statute's purpose; the board retains the full powers the law gives it — execution is a duty — and refuses the unlawful, publicly motivated on-chain within 21 days and appealable to the Arbitral Layer; directors are elected and recallable, their compensation published to the cent. Money does not vote here either.
- Bound devolution, pointed at the Foundation. On dissolution or loss of recognition every asset passes to the accredited Foundation of its seat — never into liquidation, never into private hands. The commons does not scatter because a trading arm failed.
The one-way valve
The closed circuit forbids external money from ever buying a token. This is how external money serves the mission anyway, through a valve that flows in exactly one direction: donations in, physical commons out, and nothing else. A Foundation receives fiat or crypto, holds it transparently, and converts it as fast as responsibly possible into the real, collective, unsellable world — solar, land and greenhouses, teaching and gathering spaces, off-grid infrastructure, housing, clinics, workshops, tools. Those assets become the community provisioning that gives hub currencies their substance: the grain and the kilowatt-hours are born here. Four prohibitions make the valve one-way, and all four are statutory:
- No cash-out. Nothing a Foundation holds is ever converted back into money for any private party. Assets may be transformed — never liquidated for distribution.
- No personal profit. No dividends, no distributions, no benefit to founders, donors, or officers. Operational compensation only, capped and published to the cent.
- No tokens for donations, ever. A donation buys nothing and mints nothing: no UBD, no CP, no gCP, no reputation, no tier, no governance weight. No Foundation holds gCP. Donors receive gratitude, radical transparency, the sight of the thing built, and whatever charitable-tax treatment national law grants — which is the legal order itself certifying, receipt by receipt, that what the community builds is public benefit. Never framed as draining a treasury: we win by building.
- No donor governance. Money does not vote. The use of every donated unit is decided by the verified members of the Foundation's hubs — one human, one voice — never by donation size.
Italy
Third-sector foundation with statutory asset lock; operating arms as APS + consumer and production cooperatives (L. 381/1991) where a trading vehicle is needed. Banca Etica precedent.
Spain
Foundation with asset lock; operating arms as asociación + cooperative society (Ley 27/1999).
Portugal
Bound devolution by statute; operating arms as consumer and production cooperatives (Código Cooperativo, Lei 119/2015).
These are default legal forms for the accredited Foundation in the first three launch jurisdictions — not per-hub wrappers. Any other jurisdiction adopts its own equivalent under the same rule: whatever national law provides for asset-locked, non-distributing purpose entities, carrying the four prohibitions, the transparency regime, bound devolution, and an arbitration clause naming the Arbitral Layer. Members are still told which of their protections are ledger-deep and which are paper-deep.
Monopoly by default, never by right. The first Foundation to accredit serves as primary, and while it serves its hubs well nobody has reason to charter a second. But accreditation is revocable by the Arbitral Layer alone, and where a primary is captured or stops executing its members' deliberations, that jurisdiction's hubs may petition for revocation, re-chartering, or a second Foundation alongside it. Contestability, not competition, is what disciplines it — Hirschman at the institutional layer. On revocation or dissolution every asset passes to the successor Foundation, never into liquidation or private hands.
Every commitment includes the right to revoke it
Exit is not an escape clause — it is the foundation of legitimacy. The mechanism is published in full, with numbers.
Individual exit
Annual 30-day window · 14-day cooling-off · balance and reputation travel with you to another hub · nothing converts to external money (§5.6) · cost decreasing with tenure (anti-burn).
Hub secession
67% of active members · 12-month cooling-off between vote and execution · treasury share proportional to members × tenure · physical assets partitioned under Article XIII (divide-in-kind, buyout auction, or Commons Trust) · re-application possible after 24 months.
What travels with you: matured gCP, unspent CP, personal reputation. What stays: federal treasury share, hub reputation, shared infrastructure.
Constitutionally fixed — these cannot be amended by any vote, by any majority, by any procedure: the right to leave, refugee protection, and resistance to asset freezes. The rest of the Constitution can be amended — through governance alone: proposal by 20+ hubs, a 26-week public discussion, 90% of the Federation Council, and a 12-week implementation delay (§7.1). Full mechanics in the whitepaper.