nx_commons_govern.nx source
↩ module page · 140 lines · 7654 B
1// nx_commons_govern.nx -- WHO gets to change the rules, and what NO majority may change.
2//
3// KNOWN GOOD MATCHED: nx_council_gate (in-estate, 7/7, grounded in two-person rule / quorum /
4// change-management CAB research). Its properties are adopted, not reinvented:
5// * DENY BY DEFAULT -- a high-blast action is refused unless a quorum authorises it
6// * DISTINCT-ROLE quorum -- N approvals from N different roles, not N clicks from one faction
7// * ANY REJECT IS FAIL-SAFE -- one principled objection sinks a proposal that otherwise had quorum
8// * votes derive from REAL evidence, never forgeable literals
9//
10// THE GAP THAT MATTERS FOR A COMMONS: in nx_council_gate everything is amendable given enough
11// quorum. That is correct for engineering change management and FATAL for a commons, because it is
12// precisely how capture works. You do not need to break the rules if you can afford to change them.
13// The operator's question was "excluded no matter what power they may try to wield" -- and no
14// quorum threshold answers that, because a sufficiently resourced actor buys the quorum.
15//
16// ★★★★★★ THE ANSWER IS NOT A HIGHER THRESHOLD. IT IS A CLASS OF RULES THAT IS NOT VOTABLE AT ALL.
17// This estate already has the shape: Rule 26 (never brick) is not a trade-off to be balanced against
18// convenience, it is an absolute enforced mechanically, and the genesis gate flags any node lacking
19// the guarantee RED rather than weighing it. Constitutional clauses here work the same way: a
20// proposal touching one is VOID -- not "denied pending more support", VOID -- and the vote is never
21// even counted. 100% approval of every member returns the same answer as zero.
22//
23// The clauses are the floors that make the currency what it is. Each is here because removing it is
24// the FIRST move an extractive faction would make:
25// CG_CLAUSE_HOUR_FLOOR -- nobody's hour is ever worth less than an hour (devalue labour)
26// CG_CLAUSE_SPREAD_CAP -- the 3:1 bound on valued-hour spread (reintroduce 48:1)
27// CG_CLAUSE_HEARSAY_K -- corroboration needs K>=2 independent witnesses (self-attestation)
28// CG_CLAUSE_PARTY_EXCL -- a beneficiary never corroborates its own claim (buy your own witness)
29// CG_CLAUSE_NEVER_BRICK -- Rule 26 (inherited absolute)
30//
31// TWO FURTHER IMPROVEMENTS over the known good, both bite-proven in the gate:
32// 1. THE PROPOSER MAY NOT APPROVE ITS OWN PROPOSAL. Same principle as witness party-exclusion one
33// layer up: an approver with a stake is a participant. nx_council_gate counts distinct roles
34// but does not exclude the author.
35// 2. NO SINGLE MEMBER'S WEIGHT MAY DECIDE. A whale holding most of the standing is capped, so
36// quorum cannot be reached by one party however much standing it earned. Earned standing buys
37// influence; it must never buy sovereignty.
38//
39// Integer only, thresholds named (law 11). license_tier: ORIGINAL No hw writes (Rule 26).
40import "nx_syscalls.nx"
41
42// ---- constitutional clause ids (NOT votable) ----
43const CG_CLAUSE_NONE: i64 = 0
44const CG_CLAUSE_HOUR_FLOOR: i64 = 1
45const CG_CLAUSE_SPREAD_CAP: i64 = 2
46const CG_CLAUSE_HEARSAY_K: i64 = 3
47const CG_CLAUSE_PARTY_EXCL: i64 = 4
48const CG_CLAUSE_NEVER_BRICK: i64 = 5
49const CG_CLAUSE_N: i64 = 6
50
51// ---- verdicts ----
52const CG_VOID: i64 = 0 - 2 // touches a constitutional clause; the vote is not even counted
53const CG_DENY: i64 = 0 - 1 // lawful proposal, insufficient support
54const CG_ALLOW: i64 = 1
55
56const CG_QUORUM: i64 = 3 // distinct approving roles required (matches nx_council_gate)
57const CG_WEIGHT_CAP_PERMIL: i64 = 400 // no single member may carry >40% of the deciding weight
58
59// Is this proposal reaching for something no majority may touch?
60func cg_is_constitutional(clause: i64) -> i64 {
61 if clause <= CG_CLAUSE_NONE { return 0 }
62 if clause >= CG_CLAUSE_N { return 0 }
63 return 1
64}
65
66// A member's effective weight, capped. Earned standing buys influence, never sovereignty.
67// total_standing is the commons' total; a member above the cap is clamped down to it.
68func cg_effective_weight(member_standing: i64, total_standing: i64) -> i64 {
69 if member_standing <= 0 { return 0 }
70 if total_standing <= 0 { return 0 }
71 let cap: i64 = (total_standing * CG_WEIGHT_CAP_PERMIL) / 1000
72 if member_standing > cap { return cap }
73 return member_standing
74}
75
76// Count APPROVALS that actually count: distinct roles, never the proposer, never a zero-standing
77// identity. roles[i] is the approver's role id; ids[i] the approver; st[i] their standing.
78// A sybil with no witnessed standing contributes nothing here -- the witness layer already priced it.
79func cg_valid_approvals(ids: *i64, roles: *i64, st: *i64, n: i64, proposer: i64) -> i64 {
80 var count: i64 = 0
81 var i: i64 = 0
82 while i < n {
83 var ok: i64 = 1
84 if ids[i] == proposer { ok = 0 } // improvement 1: no self-approval
85 if st[i] <= 0 { ok = 0 } // no standing, no vote
86 if ok == 1 {
87 var dup: i64 = 0
88 var j: i64 = 0
89 while j < i {
90 if roles[j] == roles[i] { if ids[j] != proposer { if st[j] > 0 { dup = 1 } } }
91 j = j + 1
92 }
93 if dup == 0 { count = count + 1 } // distinct ROLES, not distinct clicks
94 }
95 i = i + 1
96 }
97 return count
98}
99
100// The decision. Order matters and is the whole design: the constitutional check runs FIRST and
101// short-circuits, so no amount of support is ever weighed against a clause. A rule that is checked
102// after the votes are counted is a rule that can be argued with.
103func cg_decide(clause: i64,
104 ids: *i64, roles: *i64, st: *i64, n: i64,
105 proposer: i64, rejects: i64,
106 total_standing: i64) -> i64 {
107 if cg_is_constitutional(clause) == 1 { return CG_VOID }
108 if rejects > 0 { return CG_DENY } // any reject is fail-safe (inherited)
109 let appr: i64 = cg_valid_approvals(ids, roles, st, n, proposer)
110 if appr < CG_QUORUM { return CG_DENY }
111 // improvement 2 lives in cg_effective_weight and in the DISTINCT-ROLE quorum, not here.
112 // A weight-decisive check WAS written here and DELETED 2026-08-06 as vacuous: the cap holds every
113 // member at <=40% of total, so a ">=50% decides alone" test can never fire. It read as a defence
114 // and defended nothing.
115 // A GUARD THAT ITS OWN NEIGHBOURING BOUND MAKES UNREACHABLE IS DEAD CODE WEARING A GUARD'S NAME,
116 // AND IT IS WORSE THAN ABSENT BECAUSE IT STOPS THE NEXT AUTHOR LOOKING FOR THE REAL ONE.
117 // The real protection is structural: quorum counts DISTINCT ROLES, so one member is one role
118 // however much standing it holds, and cannot reach a 3-role quorum alone.
119 return CG_ALLOW
120}
121
122// ---- NEGATIVE CONTROL: plain quorum with no constitutional layer -------------------------------
123// What nx_council_gate computes: lawful-if-quorum, everything amendable. Kept so the gate can prove
124// the constitutional layer is what does the work rather than asserting it.
125func cg_plain_quorum_decide(ids: *i64, roles: *i64, st: *i64, n: i64, rejects: i64) -> i64 {
126 if rejects > 0 { return CG_DENY }
127 var count: i64 = 0
128 var i: i64 = 0
129 while i < n {
130 if st[i] > 0 {
131 var dup: i64 = 0
132 var j: i64 = 0
133 while j < i { if roles[j] == roles[i] { if st[j] > 0 { dup = 1 } } j = j + 1 }
134 if dup == 0 { count = count + 1 }
135 }
136 i = i + 1
137 }
138 if count >= CG_QUORUM { return CG_ALLOW }
139 return CG_DENY
140}