ECHO · THE CORE LAWS

The constitution of the system.

Version 1.0 · June 2026 · Doc 0 of the platform

Read this before any spec. The specifications describe how Echo is built; these laws describe what Echo is not allowed to stop being.

A system becomes durable when its principles become constraints instead of preferences.

These are not marketing, not a roadmap, not a vision. They are the rules the architecture already obeys — extracted from what was actually built (Vault, Recovery Circle, Kernel, Oracle) — and written down so that future work is judged against them. When something new is proposed, the question is no longer "is it a good idea?" It is "which law does it violate?" If it violates one, it is not built that way. This is how the architecture defends itself as it grows.

Each law is followed by what it forbids or requires, and by where it already lives — the layer that enforces it today. A law with no enforcement point is a wish; every law below has one.

I

Ownership

Who holds the memory — and who can never take it.

  1. Nobody owns your memory but you.

    Memory lives in the user's vault, under the user's key. No company, server, or model holds the authoritative copy.

    Enforced bythe local-first vault, the .echo file.

  2. There is no backdoor.

    Recovery is social (the Recovery Circle), never corporate. No reset, no master key, no recovery email. Lose the passphrase with no circle and it is gone — irreversibly, by design. The cost of real ownership is real.

    Enforced bypassphrase-derived encryption; Recovery Circle (Shamir K-of-N).

  3. Keys are never grantable.

    The passphrase, recovery fragments, and encryption keys are not data the system brokers. No scope, no agent, no administrator, and no future model can ever be granted them. They are the keys to the Kernel, not contents of it.

    Enforced byAgent Kernel §2 & §3.2; File Format §12.Kernel →

II

Governance

The Kernel stands between the intelligence and the memory.

  1. The Kernel decides what crosses — not the model, not the agent.

    Every access to memory passes through the Kernel. Agents request; the Kernel grants or denies. The intelligence never reaches past the governor.

    Enforced byAgent Kernel — Permission Engine (§3.2).See the Kernel →

  2. Disclosure is minimized by default.

    Default is deny. What isn't explicitly permitted stays sealed, and what is permitted is reduced to the smallest sufficient slice before it crosses any boundary.

    Enforced byAgent Kernel — Context Engine (§3.3), default-deny scopes (§3.2).See the Kernel →

  3. Every access is visible and inspectable.

    The user can see what was accessed before it happens and audit exactly what crossed afterward. The receipt is not optional. Verify, don't trust.

    Enforced bythe Kernel visibility demo; the Oracle handoff and breadcrumb; the vault ciphertext view.Kernel audit →Oracle →

III

Intelligence

The model is a guest. The memory is the host.

  1. Agents are stateless with respect to memory.

    An agent holds no memory of its own. Everything it knows about the user is handed to it per request by the Kernel — scoped, minimized, revocable. An agent that persists memory is not an Echo agent.

    Enforced byAgent Kernel — the Cardinal Rule (§2).Agents →

  2. The human is sovereign; agents advise, never rule.

    Agents emit proposals. Only the user commits them. No agent writes to the vault or acts on the world without human confirmation.

    Enforced byAgent Kernel — the Council, proposed-action model (§4, §6).

  3. Models are replaceable; memory remains.

    The model is an external, swappable, untrusted reasoner. The intelligence layer is the user's memory and the Kernel that governs it — it survives any model being replaced.

    Enforced byAgent Kernel — model-agnostic inference (§5); the Oracle's provider switch.Oracle →

IV

Trust Boundaries

Assume the server is the adversary. Build so it does not matter.

  1. Infrastructure is assumed hostile.

    The relay, any proxy, and the model are treated as potentially compromised. The system must protect the user even if they are fully breached. A correct design holds when the server is the adversary.

    Enforced byRelay §9 (threat model); Agent Kernel §5.

  2. Proof, never data.

    Where Echo touches a public surface (the chain), it publishes a hash — a commitment that proves existence without revealing content. The memory itself never leaves the device unsealed.

    Enforced bythe memory fingerprint (Sync & Recovery §7); the .echo format.Hash-chain ledger →

  3. Source and proof are never merged.

    A claim has a source (first-person vs third-person) and, separately, a strength of proof (self-asserted, self-proven, mesh-verified). These are never collapsed, and a self-asserted figure is never displayed as if it were verified.

    Enforced byReputation §2.1; provenance carried through the Agent Kernel.Signals →

THE FILTER

How to use the laws

The laws are a filter. Hold any proposal up to them. When the laws answer the question, the debate is over — that is the point of having them.

"Add a new agent."

Does it keep its own memory, or reach past the Kernel? If yes, redesign or reject.

Law 7 · Law 4

"Add a cloud sync shortcut that's faster if the server can read the data."

Rejected — not slower-but-acceptable, rejected.

Law 1 · Law 10

"Add a 'forgot passphrase' recovery email."

The honest alternative already exists: the Recovery Circle.

Law 2

"Let the model decide what context it needs."

The Kernel decides; the model receives.

Law 4 · Law 5

"Show one clean reputation score."

A decomposable profile passes; an opaque scalar does not.

Law 12
THE COMPILER

Which laws a machine can keep

A constitution becomes a compiler only when violations are caught, not merely stated. These laws split into two kinds — and the split decides how each is defended. Put the four checkable laws in CI; put the eight review-required laws in the PR template. Half the constitution then enforces itself, tirelessly.

CI

Machine-checkable

A violation fails the build — not a code review someone might wave through.

  • Law 3No code path ever places passphrase, recovery, or key material into a context package, a scope, or any outbound payload. grep-able and testable.
  • Law 7No agent module declares persistent memory; agent state must be reconstructed from a Kernel-supplied package each request.
  • Law 9No model name or endpoint is referenced outside an inference adapter; the core must not know which model it's talking to.
  • Law 11The only value ever written to an anchor/chain call is a fixed-length hash, never a payload.
PR

Review-required

No test can judge these. They go on the checklist: "which law does this touch, and how does it comply?"

  • Law 1, 2Any new storage, sync, or recovery path gets an ownership/backdoor review.
  • Law 4, 5Any new memory-access path: does it route through the Kernel, and is the disclosure minimal? Human judgment.
  • Law 6Is the new access visible and inspectable by the user? Reviewer confirms the receipt exists.
  • Law 8Does any new agent capability act without human confirmation?
  • Law 10Threat review: does it still hold if the server is the adversary?
  • Law 12Does any aggregated display blend source or proof tiers?
THE HONEST PART

The laws in tension

A constitution that hides its own strains is propaganda. These are real, and naming them is itself required by Law 6. They are not failures — they are the edges where the laws meet the physical world, stated so no one mistakes an aspiration for a guarantee.

Law 11 vs live reasoning.

“Proof, never data” holds perfectly for storage and anchoring. It cannot hold for cloud inference: a model that reasons must see the package you send it. The resolution is not to pretend otherwise — on-device inference honors all the laws, while cloud inference honors Laws 4, 5, and 6 (governed, minimized, visible) but discloses the scoped slice. Echo promises governed, minimized, auditable disclosure during reasoning — never zero disclosure. Claiming zero would break Law 6 by lying.

Law 6 vs metadata.

Access is visible to the user, but a relay still observes timing, sizes, and identifiers. “No content” is kept absolutely; “no metadata” is never claimed. (Relay §6.)

Law 5 vs usability.

Default-deny is correct and exhausting. The standing risk is “approve all” — the moment consent becomes a rubber stamp, Laws 4 and 8 erode in practice while remaining intact on paper. The UX must keep grants legible and rare, or the laws win on parchment and lose in use.

ARTICLE XIII

Amendment

A constitution without a process for changing it either ossifies or gets quietly edited. This article exists so the laws can defend themselves against their own future authors — because the most likely threat to a law is not repeal, it is being hollowed by small exceptions until nothing is left.

  1. §1

    Bedrock — unamendable.

    Law 1 (Nobody owns your memory but you) cannot be amended or removed. It is the definition of Echo, not a feature of it. A version of this system that crosses Law 1 is a different system and may not carry the name. Laws 2 and 3 are near-bedrock: they may be clarified or strengthened, never weakened.

  2. §2

    No silent drift.

    Editing the text of any law without a recorded amendment is itself a violation — of Law 6 (visibility). Every change to this document is explicit, versioned, and dated. The git history is not the record; the Amendment Log is.

  3. §3

    Every amendment carries its reasons.

    An amendment is not valid without: (a) the exact before/after text, (b) a written rationale, (c) the list of layers/specs it affects and how they will comply, and (d) a version bump.

  4. §4

    Weakening costs more than strengthening.

    Strengthening a law (narrowing what's permitted, adding a protection) is a normal change. Weakening or removing a law requires, at minimum: an explicit rationale, a stated migration for everything that relied on it, and a deliberate second confirmation separated in time from the first — never same-session, never in the heat of a deadline. Convenience is not a rationale.

  5. §5

    Tombstones, not deletions.

    A removed or weakened law is never erased. Its original text remains, struck through, with the date and reason. Anyone reading the constitution must always be able to see what Echo used to refuse, and when it stopped. A constitution that can hide its own retreats protects nothing.

  6. §6

    Authority — founder decision.

    Who may enact an amendment is a governance choice the project must set explicitly. Default for now: amendments are founder-held and follow §1–§5. Before any external party, investor, or maintainer can alter the laws, that authority must itself be written here, as an amendment, under these rules. Until it is, no one else can.

Amendment Log

This log is live — backed by a real record, not page text. Every change below was written through Article XIII's own gate: bedrock laws refused (§1), reasons and before/after text required (§3), weakenings forced through a cooling-off period (§4), and removals kept as tombstones (§5).

  • v1.0RatifyLaws 1–12 + Article XIII2026-06-01

    Ratified the Core Laws

    RationaleConstraints emerged from Vault, Recovery, Kernel, Oracle; written down so future work is judged against them.

    AffectsAll layers — Vault, Recovery Circle, Kernel, Oracle, Mesh.