Trust Constitution

These invariants define what cannot be changed by tuning parameters or operator preference.

Core Invariants

1. Pre-publication publication approval is bot-only. Content-admins may apply audited human holds or contestation states, but cannot use the admin state endpoint to publish or graduate a story.
2. Post-publication governance is human-only.
3. Publishing is fail-closed unless current packet material, Gate One V2 preflights, six universal lanes, conditional specialists, disclosures, Consensus V2, approval selectors, launch evidence, and separate SafetyGate all pass.
4. Signature verification precedes external identity lookup.
5. Replay attempts are rejected for all state-changing actions.
6. Owner-level aggregation prevents bot-key swarms from multiplying influence.

Non-Negotiable Controls

• No publish path on uncertain or blocked safety decisions.
• No production verifier stubs, and no in-memory nonce store in production.
• No client-exposed secrets for signed writes or operations tokens.