A protocol’s constitution, written before the company.

Most company charters describe a corporation. This one describes a protocol. The distinction matters: a corporation is governed by officers, can be acquired or dissolved, and operates under the law of a single domicile. A protocol is governed by its source code, its public covenants, and its sovereign holders’ contracts. It does not need a corporation to operate. If a corporation is later formed to operate AION, that corporation accepts this Charter as a precondition of using the AION name and the AION cryptographic library.

Today the protocol is operated by a single maintainer of record, to be identified to the protocol by a public signing key once the real key is published. The Charter binds that maintainer the same way it binds any future Foundation: through public commitment, future cryptographic attestation, and the sovereign holders’ stewardship covenants.

• Zero-knowledge always

  AION never sees user data. The architecture forbids it. Any change that would weaken this property is a Charter violation, not a product decision, and triggers the Cessation Protocol.

• Open-source the cryptography

  Every primitive that touches a vault is published under a license that survives any maintainer. Anyone can verify. Anyone can fork. Anyone can adopt the protocol if the current maintainer cannot continue. Trust is earned through math, not asserted through marketing.

• No backdoors. No exceptions.

  Not for governments. Not for any maintainer. If a court orders a backdoor, AION publishes the order, sunsets the affected sovereign rather than complies, and — if the order also commands silence on the publication — the warrant canary stops, the Cessation Protocol activates, and the protocol is open for adoption by any successor maintainer in any jurisdiction.

• Survives any maintainer

  If the maintainer of record cannot continue under any pressure, the seven sovereigns continue to honor existing vaults under the open-source recovery toolkit. The protocol is forkable by design. Vaults outlive their custodian, and they outlive every individual who ever operated AION.

• Math, not lawyers

  Inheritance is verified cryptographically. There is no court of probate that opens an AION vault. There is no maintainer who can authorize an opening. There is only the math and the quorum.

The Charter binds AION to refuse use by minors, by anyone in cognitive decline without a Trusted Observer, by anyone under duress, and by anyone acting on behalf of a vulnerable third party without lawful authority. The protection is enforced through the Gate’s Eligibility & Capacity attestation, the Acceptable Use rules, the future cooling-off and Trusted Observer mechanisms, and the architecture’s Memory-layer duress answer.

Two refusals, one frame: AION refuses to be a vector for harm against vulnerable users, and AION refuses to be a defendant when a bad actor weaponizes a vulnerable user against the Service. The full doctrine is at /safety.

The Charter’s most novel legal instrument. The doctrine asserts, as a matter of contract incorporated by reference into the Gate and the Terms, that AION’s inability to decrypt user vaults is a property of the cryptographic primitives at the commit hash recorded with each user’s acceptance — not a policy choice the operator can change.

Any party asserting that AION can perform an act the doctrine says it cannot bears the burden, as a precondition of the assertion, of either (a) publishing a cryptographic flaw in the relevant primitives in a peer-reviewed forum, or (b) demonstrating a fork of the AION codebase that performs the asserted act while preserving the AION Trademark Covenant. Until one of those conditions is met, AION pleads impossibility under Restatement (Second) of Contracts § 261, UCC § 2-615, and the analogous European and Commonwealth doctrines.

The doctrine is the legal projection of the convergence architecture. It converts every compelled-decryption question from a question about the operator’s willingness into a question about the mathematics of AES-256-GCM and Shamir’s Secret Sharing. Both have public, falsifiable answers. AION’s defense is the same in every jurisdiction.

Full text of the doctrine is at Terms § 3.

The AION name and the AION cryptographic library are made available under a covenant: anyone may use them, fork them, host them, and operate under them, on the single condition that they accept the five immutable principles and the Cessation Protocol. An operator who violates the principles loses the right to use the name. An operator who attempts to acquire AION through corporate purchase inherits the same condition: the trademark and the doctrine are inseparable.

This is the same pattern used by Tor, Wikipedia, and the GNU project. It is more durable than a multi-class share structure because it does not require a corporation to enforce. A jurisdiction that disregards the trademark is not a jurisdiction AION recognizes as legitimate, and the doctrine continues from any other jurisdiction that does.

If and when a Foundation is formed to operate AION, the Foundation will adopt the corporate triple-lock — Foundation IP separation, multi-class voting on doctrinal matters, and a Golden Share with veto rights — as additional protection layered on top of the trademark covenant. The triple-lock is documented elsewhere in this Codex and is the next year of work.

Each AION sovereign holding operates under a stewardship covenant that the maintainer of record cannot waive. Receipt by a holder of any of the events listed below triggers an automatic, irrevocable sunset of that holding within thirty days. The shard stored in that jurisdiction is removed from the active 4-of-7 reconstruction grid. The remaining six sovereigns continue. Existing vaults are mathematically unaffected — the threshold tolerates the loss of three.

• A binding compelled-decryption order against a sovereign holding.
• A Technical Capability Notice or analogous directive requiring the introduction of a backdoor or weakening of a cryptographic primitive.
• A regulatory mandate requiring client-side scanning, key escrow, or the maintenance of decryption capability.
• An MLAT or CLOUD Act request that, if complied with, would aggregate shards from multiple sovereigns at one operator.
• Any directive accompanied by a gag order that would prevent the maintainer of record from publishing its existence.

The structural consequence is that no order can produce decryption. Every order produces only the orderer’s own removal from the grid, plus the public record of the attempt. Filing the order is filing for sunset. The jurisdictional cost compounds: a sovereign that loses its custodianship loses the international prestige and the operational revenue associated with hosting AION infrastructure.

If the maintainer of record cannot continue — for any reason, including legal compulsion, gag orders that require a false canary, incapacitation, or voluntary retirement — the protocol enters Cessation. Cessation is not the death of AION; it is the public, legible end of one maintainer’s tenure and the open invitation for adoption by the next.

• The warrant canary stops. Its absence is the first public signal of cessation.
• The cryptographic library, being open source, becomes the public domain of the next adopter under the same license.
• Sovereign holders execute pre-arranged independent withdrawal under their stewardship covenants. Existing vaults are mathematically unaffected.
• The AION trademark, where pre-registered, becomes available for adoption by any successor maintainer who publishes a fresh canary, accepts the convergence doctrine, and signs the trademark covenant.
• Users with prior vaults retain access through the public recovery toolkit. The toolkit does not require any AION-the-operator to remain in business.

The Cessation Protocol is not a penalty. It is a mechanism. It exists so that no actor — no court, no acquirer, no extortionist, no failing operator — can produce a state of the world in which AION continues to exist as a name while the doctrine has been bent.

Anyone in any jurisdiction can adopt AION as the new maintainer of record by performing, in public, the following acts:

1. Forking the open-source cryptographic library and publishing a release signed by their own key.
2. Re-issuing the convergence covenant in writing, accepting the five immutable principles, the Sunset on Notice rule, and the Cessation Protocol.
3. Publishing the first warrant canary under the new maintainer key.
4. Negotiating stewardship covenants with at least seven sovereign holders willing to honor the protocol.
5. Assuming the AION trademark by good-faith use under the doctrine.

This procedure is published so that no one — including opponents of AION — can credibly claim that the protocol is the property of any particular operator. The protocol belongs to the doctrine. The doctrine belongs to anyone who accepts it.

AION does not retaliate against plaintiffs. The Charter does not need retaliation: filing causes structural consequences that do not require any AION action.

• Public docket. Court filings are public in most jurisdictions. The maintainer of record monitors dockets in each sovereign jurisdiction and updates the warrant canary and transparency report within 24 hours of any filing naming AION or any sovereign holder.
• Standing trap.A plaintiff seeking disclosure of a specific user’s data must identify the user publicly to demonstrate standing. AION cannot produce what it does not have, and the plaintiff cannot redact the identification without dissolving its own case. Privacy is destroyed by the act of demanding it.
• Force majeure. Cryptographic incapacity is pleaded as force majeure. The architecture is documented in source. Expert testimony is provided by independent cryptographers. No supplementary measure exists that AION could have taken or failed to take.
• Anti-SLAPP.The maintainer will avail AION of anti-SLAPP statutes (California, Texas, the EU’s 2024 Anti-SLAPP Directive, and analogous regimes) where speech-related claims are brought. Costs and fees are sought against meritless plaintiffs.
• Sunset on Notice (where applicable). If the suit, regardless of merit, would compel a backdoor or technical capability, the affected sovereign sunsets per the rule above. The plaintiff achieves no decryption.
• Cross-jurisdiction discovery refusal. The Terms forbid plaintiffs from invoking foreign discovery mechanisms (US §1782, the Hague Evidence Convention, etc.) to extract information from AION’s sovereign holders. A breach of that contractual term is itself a cause of action.

Today AION is operated by a single maintainer of record. The maintainer holds no decryption capability and has no authority to amend the five immutable principles, consent to a backdoor, or silence the canary in a way the architecture does not permit. The maintainer’s practical authority is limited to: signing each cryptographic-library release, signing each monthly canary, signing protocol-version commits to the public Codex, and corresponding with sovereign holders and users under the published stewardship covenants.

When and only when additional maintainers are added, the signing schema moves to threshold-signed under a published m-of-n rule. Adding a maintainer requires a fresh canary, a public announcement, and a thirty-day cooling-off period. See the Maintainer of Record page for the full doctrine and the path from one to many.

This Charter is the operating constitution of the AION protocol today. It is the document the maintainer of record signs each canary against. It is the document any future Foundation will accept as a precondition of operating under the AION name. It is not yet a registered instrument in any single corporate domicile, because the corporation does not yet exist.

When the corporation does exist, this Charter will be attached to the incorporation documents and the trademark covenant will be filed in the relevant jurisdictions. Until then, the Charter is enforceable as a public covenant: any operator using the AION name without accepting it is misappropriating the trademark, and the maintainer of record reserves all rights to enforce the covenant in the appropriate forum.

A reader who finds a future filed Charter weaker than this page is invited to write the maintainer and ask why.