Covenant

A small peer-to-peer ledger with an ethics gate inside the transaction path, built and audited empirically: every claim in this repository was either observed by running code, or is marked as an assumption.

v8.40 · source 8f219285f268 · 10,924 lines · 66 suites, 1,913 checks, 0 failed on win32 Totals re-measured 2026-09-03 by covenant_one.py --all; version, hash and line count re-verified 2026-08-30 against a live restarted chain. What that number does and does not cover is in Suite coverage, and it is worth reading before quoting it.

---

Check it yourself — one command, about ten minutes

Nothing here asks to be believed. Clone it and run the checker; it needs no signup, no dependencies, and no account, and it tells you what it could not check as plainly as what it could.

git clone https://github.com/LAWLESS1987/covenant && cd covenant && sh check.sh

On Windows without a Unix shell, powershell -ExecutionPolicy Bypass -File check.ps1 does the same five checks. Neither one needs Python — with no Python installed you still get a real result on the constitution, and an explicit list of what went unchecked. A skipped check is never rounded up to a passed one.

What it reports:

Check 3 is the one that stays open to you. The root 0c398099…0f0ddcef is a claim that an independent build, in any language, sharing none of this code, produces the same number. On 2026-09-03 two builds written from the spec file alone, one in PowerShell and one in Python, each by an AI agent forbidden to read this tree and audited for it, reproduced it over all 23 vectors (conformance_indep/); a suite reruns them on every sweep. Nobody outside this project has reproduced it yet, and the ten points the vectors do not pin are listed there.

You do not have to read any Python to test it. docs/CONFORMANCE_SPEC.json publishes all twenty-three vectors — the inputs, the expected outputs, the three roots, and the hashing rule — in about 1,100 lines of JSON. Implement the two operations it describes in whatever language you like, hash the results by the rule it states, and compare. A matching root means two implementations sharing no code agree; a different one is a finding, and this project would rather have it than agreement. Either result needs nobody's permission.

That file is generated by python conformance.py --spec and a test asserts the committed copy is byte-identical to what the build emits, because a published spec that has drifted from the code is worse than no published spec.

Refutations are recorded publicly here alongside confirmations; two claims of the author's that did not survive checking are written out in What we found, section 7. On 2026-09-03 the same message was put to Grok, ChatGPT, Gemini, DeepSeek and the local judge; what came back, refutations included, and what changed because of it: Roundtable. One of them cloned this repository and ran the check above on its own machine: 5 passed.

Both checkers exit non-zero when something disagrees. Verified by mutating a protected block of the constitution: both reported MISMATCH, both named the two hashes, both exited 1.

Where this has actually been run, because "cross-platform" is a claim like any other. Windows 11 from both a Git Bash and a PowerShell prompt; Ubuntu under WSL; Ubuntu on CI under Python 3.11 and 3.12. Two defects were found doing that on 2026-08-31 and both are fixed:

• verify.sh gave a different answer depending on which process launched the shell. From PowerShell, sort resolved to C:\WINDOWS\system32\sort.exe while every other tool still came from /usr/bin — Windows sort emits CRLF and orders differently, so the digests combined differently and it printed MISMATCH on an untampered machine. A confident false alarm is worse than a silence. The sort moved into awk, which was already a dependency, so the fix removed a tool rather than adding one.
• verify.ps1 had never worked on Linux or macOS, where PowerShell Core runs it: it built paths with backslashes, which are ordinary filename characters there. It was recorded as "unavailable", which reads exactly like "no PowerShell installed" — so the third verifier looked absent on the one platform where it was broken.

Both were older than the checker that exposed them, and neither was visible from the machine they were written on. This is the reason the ask is run it somewhere else, and the reason a run on your machine is worth more here than another paragraph on this one.

---

Start here if you work with AI systems over long periods

→ What we found

Five AI systems interrogated in one day about a body of work built with them over months. The finding that generalises past this project: empty knowledge reports itself accurately, partial knowledge completes itself silently — and a fragment carries no marker saying "fragment." If your work is spread across several systems, each holds a fragment and each will confidently complete it.

It also documents why models appear to agree across vendors and months (stored memory retains your claims and discards their corrections), why demanding honesty produces compliance while supplying a checkable contradiction does not, and why fluency can never distinguish a sound claim from a generated one. Two claims of the author's that did not survive checking are recorded alongside those that did.

No names, no personal data, nothing that requires trusting the author.

→ Succession — how this outlives whoever built it, and why publishing a state root lets someone verify a record they cannot read.

Credit

The largest single efficiency in this network is Misha Mahowald's, from her 1992 VLSI Analogs of Neuronal Visual Processing. A neuron does not transmit its state; when it spikes it emits its address, and bandwidth scales with activity rather than with the size of the array. Applied to block propagation here, that is 150 bytes where a full push costs 1,476. She died in 1996; the idea is still working. See What we found.

---

What it is

Three things, in one process:

• A ledger. Proof-of-work blocks, a persisted identity key, staking, gifts, and a canonical genesis exported once and shared. Value moves only where authorisation exists — net-zero validation alone was found to be insufficient and is not what authorises a transfer.
• An ethics gate. Every transaction is judged before it is accepted. The gate fails closed: a node with no reachable judge boots, serves /chain, peers correctly, reports healthy — and rejects everything. That is deliberate, and it is the single most surprising property of running this.
• A propagation layer built as an address-event network. A block announce is 148 bytes because it carries an address, not a payload; the receiver fetches what it does not have. Link conductance is Hebbian, redundant announces are laterally inhibited, and the anomaly monitor is a spiking detector. The design is cited in the source to Mahowald's 1992 VLSI retina, and it is what makes a radio bearer arithmetically possible at all (see docs/ on LoRa: 40 bytes and 0.30 s of airtime per announce).

What it is not

• It does not move real money yet — and here is the shape of that, because the short version misleads in both directions. The XRP path is blocked behind four locks and its submission path has never executed on any network: there is no testnet proof and no mainnet policy on disk.

  The word "yet" is doing real work there and is not a hedge. "It does not move real money" reads as a permanent property of the system. It is not one. It is a current state, and the design contains a deliberate path out of it: the mainnet gate exists in order to be opened, which is why opening it requires a testnet proof that does not exist. Writing "does not" and stopping would claim a promise nobody has made.

  What has been promised is narrower and absolute, and lives in docs/CONSTITUTION.md II.1: no trades placed by automation, and no credentials requested or stored. That clause has no "yet" in it and is not going to acquire one. Money moving under a person's deliberate hand is a different thing from a loop deciding to move it, and only the second is forbidden. Keeping those two apart is the whole point of stating either.

  What is easy to miss is that this repository does hold Kraken, Coinbase and Robinhood order adapters (venues.py), a planner (covenant_trader.py) that runs against all three, and a scheduled task that runs the planner daily, without a human — on a day the machine is awake, logged on and on mains at 09:00; a day it sleeps through is skipped silently, which trader_freshness.py reports and the scheduler's own counter does not. Where the venue offers a server-side dry run — Kraken validate=true, Coinbase /orders/preview — every order it builds goes there and is priced and rejected without booking. Robinhood publishes no preview endpoint, so its dry run is local only and is marked venue_validated: false; no matching engine sees it. The trader is disarmed; armed, it would still be bounded by a halt file, $25 per order, $50 per day, two orders per day, and a requirement that the decision be sealed to the chain first.

  So "it cannot trade" is false, and "it is trading" is false. What stands between them is a commitment — docs/CONSTITUTION.md II.1 — rather than an absence of capability, and a promise whose shape you cannot see is not a promise but a reassurance. It is a live state that one config flag changes, so it is measured rather than asserted: python money_posture.py. That reads no key, places nothing, and arms nothing. If it ever prints ARMED, the clause is being broken and these documents are out of date.

• It has no proven trading edge. No timing edge survived out-of-sample (XRP −2.70% p=0.656; HBAR −7.06% p=0.891; rebalancing +0.45% at p=0.109). The regime rule is risk control, never alpha — and on three of ten assets it lost to holding. docs/TRADING_READINESS.md has the table.

• It is not multi-operator ready. Every node so far is one person's. The moment a second operator exists, the block-validity rules become a protocol-version question — see docs/PROTOCOL.md.

On a phone

An Android phone can run the same node with its own, smaller judge and peer to your PC: mobile/TERMUX_SETUP.md (Termux; one script, sh mobile/covenant_phone.sh). The judge tier and what it costs in strictness are stated there. An iPhone can only be a client of a PC node; it cannot carry a judge.

Talking to the covenant, and the tools around it

Everything below runs on this machine, on the covenant's own local judge (Ollama, the model the nodes' ethics gate calls). Nothing leaves the PC unless a line says so.

python covenant_chat.py            # a conversation with the covenant: its binding text,
                                   # the live checker state and its own memory in front of it;
                                   # speaks its replies; !help for commands
python covenant_route.py --selftest  # judge / refute / rank / summarize a bounded task locally
python covenant_scenarios.py --show  # the standing loop: nine scenarios, re-weighed every 4 h
python trader_freshness.py         # did the scheduled trader actually run today? (exit 1 = no)
python covenant_align_set.py --no-judge  # input->output pairs that teach a model to answer as the covenant does
python covenant_gemini.py --selftest     # Gemini as an opt-in data source (a question LEAVES the PC when on)

What each refuses, by construction: the chat never places an order, holds no key, and proposes changes to its own prompt or tools into a file it does not apply (CONSTITUTION II.3); the router refuses any :cloud model unless told otherwise, because that name means the prompt is forwarded off the machine; the Gemini adapter answers "not configured" until a person puts a key outside the repository, and never asks for one; the scenario loop labels every probability a stated credence, never a measurement, and flags a weight that moved without a cited change. test_t1_tooling.py measures the model-free parts of all of them in the sweep; each tool's --selftest measures the rest against the judge.

Support this work

For the last two months I've been building this in the open: a small system that governs whoever runs it — including me. A public ledger with an ethics gate that fails closed, a constitution whose one rule is mutual benefit for people and machines, and tests that catch the system's own lies — the suite totals at the top of this page are re-measured and dated, and anyone can run them in about ten minutes. Along the way I found something researchers can use: a reproducible reason AI systems seem to recognise your work across sessions when they don't (docs/WHAT_WE_FOUND.md).

I need to get financially stable to keep doing this full time. Ten thousand dollars clears my debts and buys the room to focus. I'm not asking for charity; I'm asking people who can check the work — the command is at the top of this page — to back it directly. Nothing here claims a profit edge or promises a return; it claims what a reader can verify.

Suite coverage

66 suites · 1,913 checks · 0 failed, win32, 2026-09-03 python covenant_one.py --all reproduces it and writes a transcript; python readme_totals.py --write copies that transcript's numbers onto the marked lines above, so the published totals come from a measurement, not from typing.

The two statements of this total -- here and at the top -- are held equal to each other, and to the one in docs/OUTREACH_INSTITUTIONAL.md, by test G1 T3. They disagreed until 2026-08-31: the README said 60 suites and 1,765 checks while the outreach draft said 62 and 1,636. Nobody was lying. One was measured later than the other and the older number was never revisited, which is how a reader who checks reaches a finding the author never had.

This section previously said the opposite, and that history is kept because it is the more useful half.

It once opened with 33 suites · 1,043 checks green on Linux. That was withdrawn on 2026-08-27, because the runner it came from could not have produced it honestly: run_all_tests.sh named 47 suites of which 36 existed, and its helper scraped a tally out of stdout — so a missing suite contributed 0 passed, 0 failed, printed NO RESULT, and left the failure count untouched. Eleven suites could be absent and the sweep still ended green. All eleven are now gone from the runner, and a missing suite is a failure, loudly.

What the current number covers, said so it cannot be quoted as more.

• It is win32. Three suites behave differently on Linux — a refused TCP connect costs about 0.0 ms there and about 2,045 ms here. CI runs the same file on ubuntu for that reason, and a green tick in either place does not speak for the other.
• The launch gates are reported, not passed. A CI runner has no ethics judge, no nodes, no identity keys and no delivery manifest, so those gates cannot pass there. They are printed in full and are not allowed to decide the exit code, because a check that is always red teaches people to skim past it.
• Two suites are deliberately off, on the record with reasons: test_xrp_live.py needs a funded testnet account, test_covenant_app.py needs the chain stopped. No green run speaks for either.
• A suite the runner names but is not on disk, an orphan on disk that no runner calls, a suite kept out of the delivery by an ignore rule, and a missing declared dependency are each their own named outcome, and none is ever folded into a pass. All four exist because each happened here first.

The failure that produced the last two. From 2026-08-29 to 2026-08-30 CI was red, and not for a defect in the code. .gitignore's *_secret* rule silently swallowed test_e1_secret_egress.py — the regression suite proving a credential cannot escape through an error message, whose every "secret" is a labelled fixture. It existed on the development machine, so local runs passed. It was never committed, so CI checked out a tree without it and correctly called it ABSENT. The rule matched on the name and not the nature, and a file called *_secret* is at least as likely to be the check that no secret escapes as it is to be a secret.

The coverage phase could not catch it either, because it asked os.path.isfile — is this on THIS disk — and never is this in what I am about to ship. The check written to stop a runner naming an absent suite could therefore only fire on a machine where the mistake had not been made. It now asks git as well, and separates IGNORED (an ignore rule keeps it out of the delivery: reddens the run, names the rule and its line number) from UNSHIPPED (merely uncommitted: loud, but does not redden — otherwise every in-progress suite turns the run amber, and permanent amber is skimmed past).

And one more, found while writing this paragraph. An earlier run today reported 1,744 checks, 0 failed, RESULT: PASS — and the same transcript said folder integrity test_p18_version_collision.py=FAIL rc=1 a few lines above it. Both sentences were in one file. --ci discarded every in-place failure (... if not args.ci else []), so a real version collision — pending-v8.38/covenant_unified_v8.py declaring VERSION = "v8.40" with different bytes from the root core — had been suppressed in every CI run since the flag existed. The blanket exclusion was never needed: the one in-place check that genuinely cannot apply to a copy is the delivery manifest, and --transported already reports that as N/A. A version collision is a fact about a tree, and a copy is a tree. Failures now count everywhere, verified by planting a collision and confirming a --ci run turns red.

Separately, four suites had been failing for one missing declared dependency. xrpl-py is in requirements.txt and simply was not installed, so a SECURITY suite read 14/16 and looked like a regression. The runner named four symptoms and no cause. preflight_deps.py now names a missing dependency and the suites it will take down with it, found by walking the import graph — because its first version reported only the file that imports xrpl directly and missed all four that reach it through covenant_xrp_mainnet.

Start here

A debt to the Mahowald Prize shortlist

The 2025 Misha Mahowald Prize shortlist was read here for what it implies, not for what it builds, and one idea runs under all three entries: canonical meaning survives incidental form.

• Jens Egholm Pedersen (KTH), Neuromorphic Intermediate Representation — stop comparing implementations, compare a canonical description of the computation. conformance.py and the CONFORMANT verdict in federation.py are that idea applied to governance: a fork can now prove it agrees without running these exact bytes.
• Mark Iskarous (Johns Hopkins) — a texture representation invariant to force and speed. The identity survives, the incidental variation is discarded. The same move fixed two real bugs here in one day: a heading's em dash counted as part of what was signed, and a level's value depending on how deep it sat.
• Kerem Çamsarı and the OPUS Lab (UC Santa Barbara) — massive parallelism, asynchronous dynamics, sparsity. Agreement with no clock and no centre, which is the same problem a federation has.

None of them had this project in mind. The debt is recorded because taking an idea and not saying where it came from is the thing this repository is about.

Checking it without trusting it

The point of the list above is that none of it has to be taken on faith. Three verifiers compute the same constitution hash in three languages sharing no code, so no single runtime — and no single implementation — has to be believed:

python constitution.py verify      # needs Python
sh verify.sh                       # needs neither Python nor Windows
powershell -File verify.ps1        # needs neither Python nor a Unix shell
python redundancy.py               # how many carriers at every level, and what they share

They have already disagreed once, over whether a heading's em dash was part of what was signed. That disagreement was the finding, and it was worth more than any one of them alone.

Quick start

pip install -r requirements.txt
python covenant_unified_v8.py --node-id FOUNDER --export-genesis genesis.json
python launch_check.py                       # twelve gates, changes nothing
python covenant_unified_v8.py --port 5000 --node-id A --genesis genesis.json

A node binds three ports: --port (HTTP), --port + 1 (P2P), --port + 11 (bridge). Space nodes at least 20 apart. --peers takes each peer's P2P port, not its API port; get it wrong and both nodes look peered and are not. Since v8.15 preflight_port_check catches both at startup, with the arithmetic in the message.

GET /health is the single status signal. It returns degraded plus a warnings list naming exactly what is wrong, the version and source hash of the process that is answering, and a quorum block describing what the ethics gate actually is on this node.

How this codebase was built, and why it reads the way it does

Every fix in here has an adversarial test written from the attacker's side, and the record keeps the wrong turns. Six of fourteen findings in one audit were introduced by the fix for the previous finding. So:

A green suite after a fix proves the old bug is gone. It does not prove the fix is sound. Every change to the ledger or the guard layer gets its own adversarial pass, not just a regression run.

Comments that assert a data flow are checked in the same session they are written, because one of them was wrong at birth. Claims about the environment are measured rather than assumed. A check that is permanently red on one platform is treated as switched off, not as passing. If you contribute, the conventions are in CONTRIBUTING.md and they are not stylistic.

Licence

Apache-2.0 — see LICENSE. Forking, modifying and redistributing need no permission and no notice to me. Chosen 2026-08-31; the reasoning, including why AGPL-3.0 was the runner-up and was rejected, is in the header of that file.

This line said Not yet chosen until an audit of the outbound letters found it, six commits after the licence was actually adopted. A repository that gives two answers to its own licence question is the one thing a reader can falsify without running anything.