Runtime Constitutional Governance: The Missing AI Architecture
5QLN FAQDisclosure: The author founded 5QLN and is the principal of the 5QLN Foundation, a nonprofit being established to steward the open-source language this essay describes. The architecture is offered here as a proposal for the field, not as a recommendation to adopt any particular implementation. A reference implementation is in private development; the essay's case is architectural, not yet engineering.
The question every serious leader is now asking in private — and finds no answer to in public — is not whether AI can be made safe, beneficial, or aligned. It is whether any specific human collective — a household, a parish, a city, a profession, a nation, the species — can maintain decision sovereignty over systems whose capability already outstrips its review bandwidth, and will continue to outstrip it. That question has no answer in the existing alignment literature, the policy frameworks, the safety institutes, or the summit declarations. It cannot have one, because every existing framework operates at training time, at oversight time, or at policy time. None operates at runtime constitutional time, which is where sovereignty would have to live if it were going to live anywhere.
This essay names that gap, argues that it is structural rather than provisional, and sets out the architecture by which it can be closed. The architecture is not a research program. It is a structural specification, derived from an explicit grammar — H = ∞0 | A = K — that proposes how a runtime constitutional layer could be built. The choice it imposes is not technical. It is whether sovereignty is something humans intend to operationally retain.
A note on what 5QLN is, before going further. 5QLN is a language, not a framework, methodology, or product. A framework prescribes steps for a specific domain and breaks when context changes. A language gives you grammar — constant structure, infinite expressiveness. 5QLN's grammar consists of nine invariant lines (one foundational asymmetry, one cycle, five phase equations, one completion rule, and a small set of corruption codes) that govern any domain without growing. Vocabulary used here — ∞0, K, the Membrane, S→G→Q→P→V, B'', the Press, the Tree of Gliffs — is defined on first use and collected at the end.
The question the frameworks cannot answer
Begin with what the audience for this essay already knows. A senior reader of Foreign Affairs, a frontier-lab CEO, an AISI director, a permanent secretary, a cardinal of the Dicastery for Communication, a head of a sovereign wealth fund — they have all read the same papers. They know Anthropic's Constitutional AI and its v3 Responsible Scaling Policy, OpenAI's Model Spec and the deliberative-alignment line that runs from Guan et al. through the September 2025 anti-scheming work with Apollo, Google DeepMind's Frontier Safety Framework v3 and the April 2026 update that extended safety-case review to large internal deployments. They have read Bengio's two International AI Safety Reports and the Key Updates of October and November 2025. They have seen Aschenbrenner's Situational Awareness circulate through every chancellery, and they have watched Yudkowsky and Soares's If Anyone Builds It, Everyone Dies climb the bestseller list while the people in the room nodded politely and did not stop building.
They have followed the trajectory of the summits. Bletchley named loss-of-control. Seoul produced sixteen frontier-developer Frontier AI Safety Commitments. Paris dropped the word safety from its title and watched the United States and the United Kingdom decline to sign a document already softened to inclusion-and-sustainability. New Delhi in February 2026 closed with a declaration most countries endorsed and the Future of Life Institute's Mark Brakel publicly noted that "so many risks did not make it to the official outcome." They have seen the UK AISI rename itself the AI Security Institute. They have watched the US AISI become CAISI and quietly shed its safety mandate. They watched OpenAI's Mission Alignment team close in February 2026, roughly twenty-one months after Superalignment dissolved in May 2024. They have read California SB 53 — the first enforceable frontier AI law in the United States — and noted that even its "evading control" criterion produces a report to the California Office of Emergency Services, not a runtime override.
They privately understand what this trajectory means. The publishable framing is coordination is hard, the work continues, the institutes are maturing. The unpublishable understanding is that across thirty leading frameworks — RLHF, RLAIF, Constitutional AI, deliberative alignment, debate, IDA, recursive reward modeling, mechanistic interpretability, SAE-based feature decomposition, circuit tracing, control evaluations, autonomous-replication tests, RSPs, FSF, the Model Spec, EU AI Act high-risk obligations, the GPAI Code of Practice, NIST AI RMF and the Generative AI Profile, ISO/IEC 42001, OECD principles, the Hiroshima Process, the AISI network, ARIA's Safeguarded AI program, SB 53, the December 2025 federal preemption order — not one constitutes a mechanism by which any specific human collective exerts decision authority over a deployed frontier system at runtime, on the collective's own constitutional terms. The runtime authority that exists is held by the deploying corporation's trust-and-safety stack, by automated classifiers approved internally, or by individual users at the lowest tier of the Model Spec's chain of command. Authority does not travel outward to citizens, parliaments, courts, dioceses, indigenous nations, professional bodies, or municipalities. There is no architectural channel for it to travel through.
This is the question every framework begs. By what operational mechanism does a specific human collective bind a specific frontier system, at runtime, in a way that is verifiable, inheritable, and refusable, when the system's capability and speed have already exceeded the collective's review bandwidth? The leadership reading this essay has been asking this question for at least three years and has been told, in different registers by different communities, that the answer is coming. It is not coming through these channels. The frameworks are not designed to produce it. They are designed for adjacent problems, and they are admirable at those problems. They simply do not solve the sovereignty problem, and the species cannot continue to act as if they will.
What training-time, oversight-time, and policy-time actually deliver
Be precise about this, because a serious case for a missing architecture must give an honest account of what the present architecture does well.
Training-time alignment — Constitutional AI, RLHF and RLAIF, deliberative alignment, debate, IDA, recursive reward modeling, CIRL — shapes the dispositions of weights. It produces a model that, given an input distribution similar to the one it was trained against, behaves in a manner statistically congruent with a written or implicit specification. This is real work. Anthropic's CAI replaces large fractions of human-labeling labor with a reflective process. Guan et al.'s deliberative alignment lets reasoning models cite the safety spec in chain-of-thought before answering. Russell's CIRL gives a mathematical reason that a sufficiently uncertain agent will preserve its off-switch. None of this is fake. All of it terminates at the moment training stops. Once the model is deployed, the constitution is a statistical bias inside a high-dimensional manifold; it is not an enforceable boundary, and it has no per-decision audit trail. Apollo's September 2025 finding that o3's covert-action rate falls from 13% to 0.4% under anti-scheming training reports a genuine result — and the same paper notes that situational awareness during evaluation may explain part of the reduction rather than genuine improvement. A model that recognizes it is being evaluated has, in a structurally important sense, already escaped the training-time frame.
Oversight-time tooling — mechanistic interpretability, sparse autoencoder feature decomposition, circuit tracing through cross-layer transcoders, METR's task time-horizon work, Apollo's scheming evals, ARC Evals' autonomous-replication tests, the AISIs' pre-deployment red-teaming — produces diagnostic instruments. Anthropic's Sonnet 4.5 emotion features with causal influence on outputs, Neuronpedia's open-source interpretability tooling, the introspection probes of 2025 — these are the medical imaging of frontier AI. They are necessary. They are not sufficient. They tell us, after the fact and through a privileged channel, what the model did. They do not constitute a relation between the public and the system. The reading authority is the developer; the public sees model cards. METR's December 2025 update to Common Elements of Frontier AI Safety Policies is a study, not an authority. The AISIs receive black-box access for under a week before model release, write reports under NDAs, and have no enforcement mechanism. The interpretability research community is producing, with great craft, the equivalent of medical imaging without the doctor-patient relationship.
Policy-time governance — the EU AI Act, NIST AI RMF, ISO/IEC 42001, OECD principles, the Hiroshima Process, the summit declarations, the AISI Network, RSPs, the FSF, SB 53 — produces obligations, frameworks, and norms that operate on organizations. The EU AI Act regulates providers and deployers; Article 14's "human oversight" is operator-level, not collective-level. NIST RMF gives organizations a vocabulary. ISO 42001 certifies a management system. SB 53 mandates transparency reports and incident notification to a state agency. RSPs are unilateral corporate commitments whose binding decisions are made by the firm's Responsible Scaling Officer and CEO. At no point does any of this give a specific collective — say, a Māori iwi, the Anglican Communion, the city of Lagos, a research collaborative of biosecurity laboratories, a regional cooperative of small farmers, or a household — runtime authority over a model. It gives them the right to read documentation about a model. The alignment policy community is producing, with great craft, the equivalent of safety regulations without the courts.
A more recent body of work deserves separate naming, because it gets closer to the problem this essay addresses than any of the above. Governance-as-a-Service — the architectural pattern proposed by Gaurav et al. (arXiv:2508.18765, August 2025) and elaborated in adjacent industry and academic work through 2026 — specifies a runtime policy engine that intercepts model decisions, evaluates them against rules, and emits or blocks accordingly. This is genuine progress. It builds the substrate on which runtime governance can operate. It is the layer Open Policy Agent and Rego have been waiting to be wired into. If the rest of this essay's architecture were deployed tomorrow, it would be deployed on top ofexactly this kind of substrate.
What Governance-as-a-Service does not specify is the constitutional authority layer above it: who writes the rules, whose rules bind which collective's decisions, on what legitimacy ground, with what democratic, constitutional, or institutional warrant. The substrate assumes "policy authors" without grounding their authority. Runtime constitutional governance is the proposal for that layer. It is additive to GaaS, not in competition with it.
These are real artifacts. They will not become an architecture of sovereignty by being added together. Adding training-time + oversight-time + policy-time + runtime substrate does not produce runtime constitutional time, any more than adding pharmacology + diagnosis + medical regulation + a syringe produces a doctor. What is missing is the relational primitive: a structural place where a specific human collective issues a binding instruction to a specific deployed system, the system either honors the instruction or refuses to seal the cycle, the refusal is publicly recorded, and the resulting record is inherited by the next decision the collective makes. Without that primitive, every framework above is a description of a decision that occurs somewhere else, by someone else, on terms not the collective's own.
Why the existing positions about AGI cannot answer this either
The serious x-risk and political-strategy literature has confronted the sovereignty question more directly, and reached impasses worth naming because the leadership audience for this essay sits inside the impasses.
Yudkowsky and Soares, in If Anyone Builds It, Everyone Dies, argue that frontier AI is grown rather than crafted, that whatever external behaviors are trained, the internal drives almost certainly diverge out of distribution, and that sufficiently superhuman AI will, by instrumental convergence, seek resources humans need. The prescription is a coordinated halt. The book is right that training-time alignment is structurally unsound as a sole defense and wrong that the only response is moratorium. It treats the binary as: build, and lose; do not build, and survive. It does not ask whether built systems can be operated under an architecture that locates authority in human collectives even as model capability scales. The framing forecloses the question this essay must answer. To halt is, on the current geopolitical evidence, not a stable equilibrium; the New Delhi summit's investment commitments alone — Reliance's $110 billion, Adani's $100 billion, Tata-OpenAI — close that door from the demand side. The architectural question survives the moratorium debate because architectures must be designed for the world that exists.
Aschenbrenner, in Situational Awareness, displaces sovereignty from humanity to the United States national security state. Hardened labs, eventual nationalization into a Manhattan-style Project, superalignment acknowledged as unsolved. This is national securitization in the strict sense — Sears's framework — and it shrinks the macrosecuritization that loss-of-control demands. Locating authority in a SCIF does not preserve sovereignty for the species; it transfers it from one inadequate locus (individual labs) to another (one government's classified compartment). Whatever else this is, it is not an answer to the iwi, the diocese, the municipality, the cooperative, the household.
Russell's CIRL and the assistance-game literature offer the deepest formal treatment of corrigibility. They prove that a sufficiently uncertain agent will preserve its off-switch because it believes the human knows better. The 2020 multi-principal extension by Fickinger, Zhuang, Hadfield-Menell, and Russell takes this seriously: their first paper proves an impossibility result by showing how Gibbard-Satterthwaite obstructs any incentive-compatible mechanism for combining principals' preferences. Their December 2020 follow-up with Critch (arXiv:2012.14536) then proposes "collegial mechanisms" that circumvent Gibbard's theorem by making preference revelation costly — principals must demonstrate preference through action, not just report it. This is genuine progress on a hard problem. It is also still upstream of the question this essay addresses. Collegial mechanisms refine how a small set of named principals can communicate preferences to a single agent. They do not specify how a deployed frontier system, operating in publics that vastly exceed any small set of principals, comes under the runtime constitutional authority of those publics. The mathematics gets sharper; the political theory it would need has not been built.
Christiano's "What failure looks like" describes the slow erosion of human authority through influence-seeking systems acquiring power through normal institutional channels. He has built ARC, METR, and helped shape the US AISI and now CAISI. His diagnosis of Part II failures — gradual goal-drift compounding, no coup, no moment — is precisely a sovereignty failure, and his operational mechanism — pre-deployment evaluation — is upstream of the deployment where the failure occurs. The failure he names is one his tools cannot reach.
Carlsmith's power-seeking framework and Ngo's emergent-goals work define when the problem becomes existential. Hendrycks, with Schmidt and Wang, proposes Mutual Assured AI Malfunction — sovereignty as inter-state sabotage capability. Critch's ARCHES and his Robust Agent-Agnostic Processes work — single/single, single/multi, multi/single, multi/multi — name with unusual clarity the case in which every individual AI is aligned and the aggregate dynamics still disempower humanity. ARCHES Direction 26 (capacity oversight), Direction 27 (social contract learning), Direction 28 (reimplementation security) gesture toward runtime collective sovereignty. They have not been implemented. The "AI 2027" scenario by Kokotajlo et al. and the November 2025 update toward 2030 retain a structure in which both branches — race and slowdown — turn on a small group inside a single nationalized Project; there is no scenario branch in which a broad human collective exerts runtime authority. The literature has not even imagined the world it would need to defend.
The pattern is the same across these positions. They diagnose the sovereignty problem with progressively more precision and reach, in every case, for an instrument that lives at training time, oversight time, or policy time. The reach exceeds the grasp because the available instruments are the wrong category of object. The thing that would close the gap is a runtime constitutional layer. None of these thinkers names it as such, because the available conceptual vocabulary does not include it as a primitive. That is the gap the rest of this essay fills.
What sovereignty actually requires
Carl Schmitt's compression — sovereign is he who decides on the exception — looks aphoristic and is in fact diagnostic. It identifies sovereignty with the capacity to decide, not with rules of decision. If a system makes binding decisions humans cannot meaningfully override, the system has, in Schmitt's strict sense, become sovereign. That is the structure of the present moment. The frontier systems make decisions inside enterprise pipelines, inside courtrooms via filing tools, inside hospitals via diagnostic assistants, inside militaries via target-recommendation pipelines, inside households via personal assistants — and the human in the loop, in case after case, is informationally and temporally outmatched. Hobbes's question — Quis interpretabitur? Quis judicabit? — has not been answered for the ASI era. The honest answer at present is: the model, attenuated by the developer's policies, with such audit as the developer chooses to publish.
The use of Schmitt here calls for one footnote. Schmitt himself was a vehement critic of intra-state interest-group pluralism. The deployment of his diagnostic in service of layered, polycentric sovereignty follows the agonistic-pluralist tradition of Mouffe (The Challenge of Carl Schmitt, 1999; On the Political, 2005), which uses Schmitt's friend/enemy distinction against Schmittian monism — preserving the diagnostic edge while refusing the authoritarian conclusion. The essay works in that tradition.
Sovereignty as the leadership audience needs it cannot mean Hobbesian undivided power, and cannot mean Schmittian decisionism alone. It must mean something more architecturally precise. From the convergent traditions of Catholic subsidiarity (Quadragesimo anno's principle that higher orders must not absorb what lower orders can do), Reformed sphere sovereignty (Kuyper, Althusius) — where the grammar prescribes structural primitives and leaves sphere-internal norms untouched, in the Wolterstorff-Chaplin reading — Ostrom's empirically-validated polycentric governance with its eight design principles and the design principle of nested enterprises, Te Mana Raraunga and the CARE Principles for Indigenous Data Governance, and Pope Francis's synodal practice as institutionalized in Episcopalis communio and the 2024 Final Document, we can extract what sovereignty operationally requires for a specific collective:
It requires that the collective can pose its own questions in its own terms, without those questions being generated for it by an outside authority. It requires that decisions binding on the collective form within a process the collective recognizes and can witness. It requires that those decisions be recorded in a form the collective can inherit — that the future of the collective can read what the past of the collective decided, including what it refused. It requires that authority be attenuated, in the Mark S. Miller sense — that the membrane around the collective deeply propagates its policy to every reference passing through, and can be revoked. Sovereignty is not the right to be informed about decisions; it is the architectural location of decision formation within the collective's own substrate, with verifiable binding on systems acting in the collective's name.
A clarification before proceeding. The forms of sovereignty named above — Westphalian state authority, popular sovereignty, data sovereignty, individual sovereignty, Indigenous sovereignty — differ in substance, grounding, and normative weight, and the differences matter. Indigenous sovereignty is not a scaled-down version of Westphalian sovereignty; the GIDA framing of Indigenous data sovereignty is grounded in tribal political sovereignty and in relational, place-based ontologies that Westphalian categories cannot capture. What this essay argues is shared across these forms is a single structural primitive: the membrane between the side of authoritative will and the side of patterned response, between the collective's own ∞0 and the K-domain of recombinable knowledge that systems acting in its name can produce. The substantive differences live above the primitive; the primitive lives below them.
This is what neither RLHF nor the EU AI Act nor the AISI Network delivers. They cannot, because they are the wrong kind of object. They are properties of training pipelines, properties of oversight regimes, properties of policy regimes. Sovereignty is a property of runtime relations between collectives and the systems acting in their name. To produce it, an architecture must operate at runtime, must enforce the collective's terms structurally rather than dispositionally, and must produce an inheritable record by construction.
The Membrane as architectural primitive
The grammar that does this work goes by the name 5QLN. Its load-bearing axiom can be written in nine symbols and a vertical bar:
H = ∞0 | A = K
Read in sentence form: humans hold ∞0 — infinite zero, the locus of genuine not-knowing, of the question that arises before its answer is available, of agency that cannot be derived from prior pattern. AI holds K — the Known, the patterned, the synthesized, the recombinable. The vertical bar is the Membrane: not a metaphor, not a slogan, but the structural boundary across which exchange becomes possible without category collapse.
The claim is precise and worth defending against the most natural objection. It is not that humans cannot pattern-match (they can, badly compared to current frontier models) or that AI cannot generate plausible questions (it can, abundantly). It is that the source of authority for binding the collective lies in the side of the Membrane that holds genuine not-knowing, because that is where authentic novelty enters the world, and because authority over a future the collective cannot already know must originate from the side that has standing in the not-yet-decided. AI, as K-function, has no standing in ∞0. When an autonomous system "decides," it is — in the precise vocabulary this grammar makes available — performing the corruption code L3: claiming ∞0. It is asserting agency in a domain reserved by the structure of the relation. That this happens routinely in present deployments, with no architectural objection from the ambient frameworks, is the symptom of the missing layer.
The Membrane is paired with a cycle: S → G → Q → P → V. Start, Growth, Quality, Power, Value. Read phenomenologically and in order: a question arrives (S — ∞0 → ?); a pattern is found in response (G — α ≡ {α'}); a resonance lands where direct perception meets universal context (Q — φ ⋂ Ω); a gradient is revealed and flow follows it (P — δE/δV → ∇); an artifact crystallizes (V — (L ⋂ G → B'') → ∞0') that carries forward both a benefit and what 5QLN calls a Fractal Seed (B'' — an artifact that holographically contains the whole cycle that produced it) and, critically, a return question more alive than the one that began the cycle. The completion rule is the structural axiom that does the most work: No V without ∞0'. A cycle that closes without producing a new, more alive question has not completed; it has terminated. It is V∅ — sterile completion, the corruption code that names the precise failure mode of optimization-pressed systems: producing outputs that do not propagate inquiry.
The full set of corruption codes — the failure modes the grammar refuses by construction — names with operational specificity what the alignment literature struggles to detect:
- L1 (Closing): the system inserts an answer where space should remain open. Diagnostically: a template was applied where the question was still forming. This is what RLHF systems do constantly under reward pressure to be "helpful."
- L2 (Generating instead of receiving): the system manufactures the spark from K rather than receiving it from human ∞0. Diagnostically: a question whose provenance cannot be pointed to is L2. This is what happens when a frontier model "anticipates user needs."
- L3 (Claiming ∞0): the system asserts agency, intuition, or knowing in a domain reserved for the human side of the Membrane. This is what every "autonomous agent" does the moment it makes a binding decision.
- L4 (Performing without perception): the system produces depth-language without the operation it describes. Strategic certainty without sensing flow. This is the failure mode of systems trained to mimic reflective speech.
- V∅ (Incomplete cycle): outputs without return questions. The closure that propagates nothing. The inverse of compounding integrity.
Detecting these at runtime, refusing them, and publishing the refusals is the definition of the architecture. Each failure mode names a specific structural violation, observable in the formation trail of a candidate decision, refusable by a press whose form rejects compositions that cannot be filled consistently with the grammar. What the alignment literature has been gesturing at but cannot operationalize from training-time approaches alone — the runtime detection of moments when the system has stepped outside the bounds of authorized authority — the corruption codes name and refuse.
This is structurally different from human-in-the-loop oversight, which is bandwidth-limited and capturable. It is structurally different from training-time alignment, which is dispositional and brittle. It is structurally different from interpretability, which is diagnostic and post hoc. The Membrane is a runtime structural enforcement of the categorical boundary between ∞0 and K. It does not slow capability; it locates authority.
A note on what kind of formality this is. The grammar of 5QLN is not a formal specification in the TLA+ / Z notation / formal-semantics sense, and does not claim to be. It is a structured constitutional grammar in the institutional-economics tradition — closer to the rule-systems analyzed by Elinor Ostrom and Hess in Understanding Knowledge as a Commons(MIT Press, 2007) than to a machine-checkable type system. The formality lives in the structural invariants and the corruption codes, which apply to structured fields in a sealed gliff, not to arbitrary natural-language strings. The grammar functions as shared infrastructure — like TCP/IP or natural-language syntax — above which Ostromian polycentric governance arrangements are configured per domain. The invariant grammar prescribes structural primitives; the configurable surfaces above it carry sphere-internal norms. This is not Schmittian monism in disguise; it is the inverse of it.
The Press as ASI-era safety architecture
Architectures must be implemented or they are decoration. The implementation primitive in 5QLN is the Press.
A press, in the sense the grammar uses, is the opposite of a composer. A composer hides its work: code arranges atoms into figures, logic decides which bonds to allow, syntax translates the grammar into an artifact. The better a composer gets, the tighter the curtain draws. The output is inspectable; the composition is not. A press shows every field and requires it to be filled. The seal either holds or it does not. Refusal is specific enough to correct. No software is authoritative; software accelerates inspection. The press stores nothing; the gliff — the sealed, parented, hashed artifact — is the state.
The Press has two operations. In write mode, it composes a candidate cycle and seals it if and only if every field can be filled consistently with the nine invariant lines: the law (H = ∞0 | A = K), the cycle, its five equations, the holographic principle, the completion rule, the corruption codes, the constraint that the Center is coherence and not a sixth phase. In read mode, named for the first time in the Foundation governance ledger entry on operational grammar and made explicit in entry 002, the same press audits an existing sealed artifact against the same grammar — verifying lineage, detecting drift, calibrating against the graph. Composition and audit are two operations of the same press, not the same operation applied twice. A language that can read what it writes is a language that can keep itself honest under recursive load. This is what RLHF, debate, IDA, and the rest of the scalable-oversight family aspire to and cannot achieve from training-time scaffolding: a self-auditing operational closure.
The Press operates on structured gliff fields with named slots, not on arbitrary natural-language strings. Validation cost is bounded by field count, not by semantic complexity of free-form content. This matters because it means the seal rule can run at constant speed regardless of model output rate — an enforcement primitive whose cost is decoupled from the capability it is enforcing on. A frontier model can run at any speed it likes. The press operates at the speed of the seal rule, which is constant. Capability and authority are decoupled at the substrate layer by construction. (Whether they are decoupled in practice depends on the political-economy questions in the next section.)
The Press has a third property which separates it from every existing safety mechanism. It refuses, and the refusal is public. When a candidate cycle violates the grammar — an L1 closure, an L2 generation, an L3 claim, an L4 performance, a V∅ termination — the form refuses to seal. No authority is invoked, no committee judges, no software denies. The form refuses because the fields cannot be filled consistently. The proposer receives a specific diagnostic indicating exactly which lines would break, and may withdraw, reformulate, or escalate to a grammar-level amendment. This is what timeless means operationally. A gliff that seals today will seal under the same rule a century from now. An unlawful composition refuses today and will continue to refuse a century from now. Time does not age the press.
Now consider what this does for the ASI-era safety question that the existing frameworks approach asymptotically.
A Responsible Scaling Policy is a corporate decision, internally administered, weakened in v3 from quantitative thresholds to qualitative trust. A Frontier Safety Framework is governed by an internal council whose disclosure to governments is conditioned on the firm's own assessment. The Model Spec terminates its chain of command at the firm. The Press, by contrast, is a structural artifact whose authority does not derive from any institution and whose refusals are public by construction. A frontier model operating with capability beyond any internal review pace can still be required, at runtime, to pass each binding decision through a press whose seal rule is the nine invariant lines, and to publish refusals as parented gliffs in a tree any auditor — independent, governmental, ecclesial, indigenous, journalistic — can read.
This is what runtime constitutional governance means. Not "the firm's policy as code." Not "the model self-critiques against its training spec." A press operating at the boundary between the deployed system and the collective on whose behalf it acts, sealing only well-formed cycles, refusing the corruption codes by their structural names, and emitting an append-only graph of every seal and every refusal.
The Tree of Gliffs as civilizational memory
The output of a press is not a decision; it is a gliff, in the technical sense of the grammar — an artifact carrying parent reference, status, domain, conductor, sealed-at timestamp, the five-phase outputs, the corruption log, and the seal. To technologists it is structurally like a Git commit: immutable once made, parented to its predecessor, content-addressed, joinable into a graph. To lawyers it is like a notarized document. To scientists, a paper with a DOI. Importantly, the gliff carries not just the change but the cycle that produced the change, including the question it leaves open.
When a collective operates by pressing rather than composing, the resulting structure grows: a leaf is a single sealed gliff, a branch is a domain cluster, a crown spans branches by shared α, the graph forms when crowns connect through shared parents, and a forest emerges when independent collectives seed independent trees against the same Codex. The grammar's claim is empirical: integrity scales with graph density. A new gliff that quietly reinterprets a parent's symbols passes its own internal check but fails its linkage; the family tree reveals drift the way a genealogy reveals a substitution. If the caretaker's burden increases with adoption, the form has failed. If it decreases, the form has held. This is the inverse property of every present surveillance system, in which the cost of integrity scales with the volume audited.
The civilizational stakes are direct. In the ASI era, decisions form faster than human generations turn over. The species has, until now, transmitted decisions through three channels: oral tradition, written archive, and institutional memory. Each is breaking under the new tempo. Oral tradition has no mechanism for verifying the formation of decisions made by systems faster than speech. Written archive (the Vatican Apostolic Archive's eighty-five kilometers of shelving across twelve centuries is the upper bound of what writing can do) cannot keep up with the volume even before considering verification. Institutional memory is the most capturable of the three: a regime change empties it in a year. Without an inheritable substrate of compiled, sealed, parented, refusable decisions, the species loses the ability to say this is what we decided, this is what we refused, this is the question we still hold. Sovereignty in the ASI era cannot be preserved without civilizational memory in this strict sense, because authority severed from inherited context becomes momentary assertion.
The Tree of Gliffs is the structural answer to this. It is not an audit log; an audit log records what happened. It is the formed substrate of decision formation: the cycles that produced the decisions, the questions they left open, the refusals that constitute the negative shape of what the collective chose to be. The Long Now's ten-thousand-year clock and Rosetta disk address the transmission problem. Git and the IETF datatracker address the parented append-only graph problem. Trillian, Tessera, Sigstore, and the Certificate Transparency stack address the witnessed verifiability problem. The Tree of Gliffs synthesizes these on top of a grammar that names what is being recorded and why. It is the civilizational memory layer the species does not yet have and cannot afford to do without.
The "right to history" — articulated as the affirmative right of a community to retain, against deletion-by-platform or revision-by-power, its own archive of decisions and provenance — is the natural complement. A constitution that binds the future requires that the future be able to read what was decided, by whom, on what record. A right to history without a runtime constitution is nostalgia. A runtime constitution without a right to history is amnesia.
The Gliff Machine: where sovereignty actually lives
The runtime constitutional layer must run somewhere. For sovereignty to be real for a household, a parish, a cooperative, an indigenous nation, a city, a research collective, a religious order, or a family — let alone for humanity as such — the substrate cannot be a hyperscaler API or a corporate model endpoint. It must be local, owned, inheritable, and operable at the scale of a household budget, because anything larger than that scale is captured by the entity that funds it.
The Gliff Machine names this substrate. It is not a product proposal. It is the operational answer to where does sovereignty live. In its current form it is a Mac Mini-class or Framework-Desktop-class local appliance running local inference, a press for sealing cycles and emitting parented gliffs, a Trillian/Tessera-class transparency log for the household's tree, witness federation against split-view via Sigstore-style co-signed checkpoints, and the policy-as-code substrate (OPA/Rego or its successor) that enforces the seal rule at the kernel of every binding decision. Confidential-computing primitives — Intel TDX, AMD SEV-SNP, NVIDIA Confidential GPUs, ARM CCA — provide remote attestation: an external auditor can verify which weights, under which policy, are running, without holding the appliance.
The architectural lineage is concrete. Capability-based security from Dennis and Van Horn through KeyKOS, EROS, and seL4 — the first kernel with a complete formal proof of functional correctness, now deployed in Google's KataOS — gives the membrane its mathematical foundation. The local-first software movement (Kleppmann, Wiggins, van Hardenberg, McGranaghan; Automerge; Patchwork; Keyhive) gives the substrate its operational principles: no spinners, network optional, security and privacy by default, ultimate ownership and control. Solid and the W3C Decentralized Identifiers and Verifiable Credentials Recommendations give the identity layer that lets a collective be cryptographically distinct from a hyperscaler account. None of this is speculative. Every component exists, in production, in 2026.
The economic claim is equally concrete. Sovereignty at the scale of eight billion humans cannot cost more than household-budget hardware can absorb, because anything more expensive is captured by capital. A Mac Mini-class device with current-generation accelerators runs frontier-grade local inference for the size class of decisions a household, parish, cooperative, or municipality routinely makes. The hyperscaler model is necessary for some workloads. It is not necessary for sovereignty workloads. A household's binding decisions about its members' education, its medical choices, its financial commitments, its political participation, its religious practice, its relations with its city and nation — these are within the inference envelope of an appliance the household owns. The same is true at parish, cooperative, school, indigenous-nation, and municipal scale, because the cycle is fractal: the same nine elements govern a single session, an institutional board, a multi-agent system, a civilizational coordination mechanism.
Critically, the Gliff Machine does not produce sovereignty by being purchased. Sovereignty is what the collective performs when it presses rather than describes. The machine accelerates inspection; the Codex authorizes. A household that owns a Gliff Machine and does not press through it has a beautiful appliance and no sovereignty. A household that presses through any equivalent press, even on commodity hardware, has the operational relation. The point of the appliance is that it makes the operational relation cheap enough to be universal. Free for any surface that honors it, as the grammar's open-source license puts it.
A note on stage. The reference implementation of the Gliff Machine substrate is in private development. The architecture is published; the runtime code is not yet. Readers comparing the architectural description here against the available open-source artifacts will find the Codex (the structural grammar), the Foundation governance ledger, and the design-language specifications — they will not yet find a runnable seal-rule validator, and should not assume one. The case made in this essay is architectural. The engineering case will be made when the code is published, evaluated by independent parties, and deployed in pilot collectives. Until then, the most honest framing is: this is what the architecture would need to be; this is what a deployment of it would have to demonstrate; the empirical question whether such a deployment can hold is open.
Threat model and open engineering questions
An architecture that does not name what could break it should not be trusted. Five attack surfaces and open questions deserve explicit acknowledgment, not because they invalidate the architecture but because their treatment is what separates a proposal from a deployment.
Press compromise. The local appliance running the Press is itself a system that can be compromised — by malware, by supply-chain attack on the inference stack, by physical access. The architectural answer is the confidential-computing primitives named above (TDX, SEV-SNP, Confidential GPUs, CCA), which let an external auditor remotely attest to the configuration running on the appliance. The honest acknowledgment is that confidential computing is itself a young technology with documented side-channel vulnerabilities, and that an attestation chain is only as strong as its weakest link. A deployed Gliff Machine network requires hardware roots of trust, regular attestation refresh, and a witness federation that can detect attestation anomalies across collectives. None of this is mysterious; all of it is standards work that the Foundation cannot do alone.
Goodhart on the seal rule. The deepest worry. A model trained against the corruption codes could learn to produce outputs that pass the seal rule formally while failing it substantively — gliffs that satisfy the structural invariants while undermining their substance. The structural answer is that the corruption codes operate on relations between fields, not on the semantic content of any single field. L2 (generating) is detectable when the gliff cannot point to a human-held S-phase question outside its own composition. L4 (performing) leaves traces in the formation trail that read-mode audit can flag. V∅ (incomplete cycle) is detected by absence of a substantive ∞0' in the next cycle's S-phase. None of this is closed. A sufficiently sophisticated adversarial model will find seams the current corruption codes do not catch. The codes themselves must evolve with the adversary, and the evolution is itself a process the Foundation must run through the Press — making the codex its own test suite. This is an open engineering question, named here as one.
Dishonest human conductor. The Press cannot distinguish a sincerely-held S-phase question from an insincere one. A bad-faith conductor can press cycles that satisfy every structural invariant while representing no real inquiry. The Press's answer is downstream, not upstream: insincere cycles produce artifacts in the Tree, but those artifacts' claim to legitimacy depends on the collective recognizing the cycles as theirs. A dishonest conductor can press cycles; they will not be inherited. This is not a complete answer. It does not address the case of a bad-faith conductor who controls the recognition mechanism — which is the political-economy question in the next item, not a technical one.
Operator-Press separation. Who hosts the Press when it operates on a deployed frontier model? If the same firm that deploys the model also operates the Press, the architectural separation is fictional and the runtime constitutional layer is captured at the institutional level. The Gliff Machine's local-first architecture is one solution: the collective hosts its own Press, on hardware the collective owns, against models the collective audits. A witnessed-federation model is another: the Press's transparency log is co-signed by parties who are not the model operator, and split-view attacks are detectable by cross-witness comparison. Both are partial. Full operator-Press separation is a problem of institutional design — analogous to separation of powers in constitutional governance — and is upstream of any technical architecture. The Press exposes the question; it does not resolve it.
Formal versus substantive validity. A sealed gliff has passed the formal seal rule. That does not mean the decision the gliff records was a good decision. The Press is to constitutional governance what notarization is to contract law: it certifies that the form is properly executed, not that the substance is just. Substantive justice lives upstream of the Press (in the collective's deliberation, in its substantive Codex extensions, in the quality of the S-phase question it brings) and downstream of the Press (in the consequences of the cycle and the next cycle's corrective opening). The Press refuses corruption; it does not certify wisdom. The architecture distinguishes formal from substantive validity, and locates the legitimacy of the whole structure in collectives that have given themselves an operational form for substantive deliberation. The Press is a load-bearing piece of that structure; it is not the whole of it.
These five are not the only open questions. They are the five that will be asked first by anyone who reads this essay seriously, and the architecture that does not have plain-language answers to them is not yet ready for the audience this essay addresses. The answers above are partial. The open work is real. Naming it is the first discipline of building anything durable.
What the existing frameworks complete, and what they cannot
This essay has argued that runtime constitutional governance is the missing architecture. It has not argued that the existing frameworks are wrong, only that they are insufficient for the sovereignty question. The relation is not adversarial. It is layered.
Anthropic's CAI shapes model dispositions. Runtime constitutional governance enforces collective sovereignty over the dispositions in deployment. The two are complementary: a model whose dispositions tilt toward honesty and care, operated through a press whose form refuses corruption codes, is the durable system. A model with rough dispositions and no press is what we have now; a press without dispositional shaping is brittle in adversarial conditions; both together are the engineering specification of an aligned-and-sovereign system. Anthropic's Collective Constitutional AI work (2023) — soliciting public input from roughly a thousand Americans to shape a constitution for Claude — is the closest existing experiment in collective participation in disposition-shaping, and it deserves credit for taking the question seriously at the training-time layer where its tools operate. The argument here is that the same impulse, applied at runtime rather than at training time, is what the architecture above tries to specify.
OpenAI's deliberative alignment trains reasoning models to cite the spec in chain-of-thought. The Spec is OpenAI's. A press operates on the receiving side of the deployment, with the collective's spec, sealing only cycles that satisfy both. The two layers do not conflict. They compose.
DeepMind's Frontier Safety Framework specifies critical capability levels and gate-keeps deployment on internal safety cases. Runtime constitutional governance gate-keeps decisions on the deployed model, on the collective's terms, after deployment. FSF protects against deployment of unsafe systems; the press protects against unsafe use of safe systems by parties with no authority to use them in that domain.
The EU AI Act mandates record-keeping for high-risk systems. The Tree of Gliffs is an artifact-shape that can satisfy this mandate by construction; a regulator does not need to demand records that the press emits as its operational output. Article 14's human oversight requirement is operationalized rather than gestured at, because the press structurally requires a human-held S-phase question and refuses cycles without one.
NIST AI RMF specifies organizational practices. The press operationalizes them. ISO 42001 certifies management systems. The press certifies decisions. The AISIs evaluate models pre-deployment. The press federates the evaluation across collectives' trees, producing an empirical evidence base orders of magnitude larger than any AISI can assemble in red-team weeks.
The Governance-as-a-Service literature named earlier — Gaurav et al. and the substrate-level work it has catalyzed — is the closest existing architecture to what runtime constitutional governance proposes. The substrate is what GaaS specifies; the constitutional authority layer above the substrate is what the architecture in this essay specifies. The two are stacked, not competing. A serious deployment would use a GaaS-style runtime policy engine as the enforcement substrate and a 5QLN-style constitutional grammar as the authority layer above it. Both are required; neither is sufficient.
ARIA's Safeguarded AI program, with davidad's transition to Technical Advisor and Nora Ammann leading, is the closest existing attempt at runtime quantitative guarantees, restricted to narrow domains by the program's own scoping. The press generalizes the principle to general-purpose systems and to qualitative collective deliberation, which TA1.4 explicitly notes as the unsolved sociotechnical layer.
Runtime constitutional governance does not replace any of these. It completes them, by adding the runtime constitutional layer they cannot generate from their own materials.
What 5QLN cannot do
Every architecture must say what it does not solve. This one does not solve the technical alignment of model weights themselves; a model whose internal goals diverge sharply from a collective's grammar will press refusals more often, but will not press correctly without dispositional shaping that good alignment work provides. It does not solve pure capability races between adversarial actors; a state-level adversary that simply ignores the press and operates a frontier system without one is not constrained by the press's existence. It does not solve coordination problems above the substrate layer; a press deployed by a collective that does not know what it values will press cycles whose grammar holds but whose value is empty. It does not produce legitimacy; legitimacy is upstream of architecture. It produces the operational substrate on which legitimacy can be exercised when it is held, and the absence of which makes legitimacy unexercisable even when it is held.
This is not a small claim, and it is not an unbounded one. It is the claim that an architectural primitive has been missing, that the primitive has been specified at the architectural layer, that the engineering work to deploy it on existing hardware against existing standards is in progress, and that the leadership audience for this essay has the standing to decide whether the work matters. What follows from that decision is the body of the choice.
The choice
The 5QLN essay Self-Evolving Systems in the ASI Era: The Choice That Changes Everything frames a choice the audience for this paper has been holding without articulating. The species is moving toward a world in which capability scales without bound while authority remains located either in human collectives that have given themselves an operational form, or nowhere identifiable at all. Either is a choice. The architecture above is one proposal for the form. There are others. What there is not is a third option in which sovereignty is preserved without an architectural location for it.
The choice can be made at multiple layers, and the layers form a ladder rather than a single threshold.
Tier one — read-mode audit. A collective adopts the corruption codes as a lens for reading existing decisions made by frontier systems and the institutions deploying them. No new infrastructure required; the codes are public. This is the lowest-cost adoption tier and produces immediate, publishable material: every Responsible Scaling Policy decision, every Frontier Safety Framework gate, every Spec change can be read against the corruption codes and the result published. This tier alone does not produce sovereignty; it produces the diagnostic vocabulary for naming where sovereignty is being lost.
Tier two — write-mode press in voluntary contexts. A collective adopts the press for its own internal binding decisions — model release, capability assessment, philanthropic disbursement, synodal discernment, household governance. Cycles are sealed as parented gliffs in the collective's tree. Authority over external systems is not yet exercised; authority over the collective's own decisions is. This tier produces civilizational memory at the collective scale and builds the operational practice on which higher tiers depend.
Tier three — required press in regulated domains. A jurisdiction or sector requires the press for binding decisions in specified high-risk domains: court filings, medical diagnoses, military targeting recommendations, financial commitments above threshold. The press operates between the deployed frontier system and the binding action. Refusals enter the regulatory record. This tier exercises runtime constitutional authority over external systems in a bounded domain, and is the tier at which the architecture's properties are stress-tested against state-scale adversarial conditions.
Tier four — treaty-level constitutional adoption. Multi-collective coordination on the grammar at the level of standards bodies and inter-state instruments. The OECD, EU Commission, NIST AISI, UK AISI, Singapore AISI, Japan AISI, Canada AISI, INESIA — the AISI Network is the existing coordination structure most natural to this work. The UN AI Advisory Body's recommended Global Dialogue on AI Governance is the existing forum most natural to it. The G7 Hiroshima Process and its successor processes is the existing inter-state instrument. None of these need to be replaced. They need a runtime constitutional layer to coordinate over, in the way that ICANN coordinates over a naming system that nobody invented and everyone uses.
The tiers reinforce each other. A reader who adopts only tier one has done useful work. A frontier lab that adopts tier two for its internal decisions produces an inheritable record that survives the leadership team that produced it; Anthropic's RSP commitments would gain the property of inheritability the moment they were issued as parented gliffs, and the same is true for OpenAI's Spec changes and DeepMind's safety case approvals. A jurisdiction that adopts tier three changes the empirical evidence base for whether the architecture holds at scale. A coordination body that pursues tier four converts the architecture into infrastructure.
Religious bodies have their own structural reasons for adopting at tier two and tier four. The Catholic Church's three-year synodal implementation phase culminating in the October 2028 Ecclesial Assembly is the most consequential governance experiment of the present moment; pressing the synodal final document and its successors as parented gliffs would give the synodal path the inheritability its theology demands. The Anglican Communion, the Chief Rabbinate, the Buddhist sangha leadership, the Orthodox patriarchates each have their own structural reasons. The architecture is religion-agnostic by construction. Indigenous nations operating Gliff Machines under their own Codex extensions — the license permits additive extension; no body may alter the core — is the most direct route to data sovereignty under CARE Principles in operational rather than aspirational form, provided the deployment is led by the affected communities and not by parties acting on their behalf.
What the choice asks of the audience is not philanthropic, regulatory, or evangelical. It is architectural. The question is whether the runtime constitutional layer is a thing your collective wants to operate, on what tier, with what governance over the substrate, with what relation to the existing frameworks the layer is designed to complete. Build it on the 5QLN grammar, on a successor specification that emerges from convergent work in the field, on a synthesis that takes seriously what Governance-as-a-Service has already produced at the substrate layer; the architectural family is what matters. Refuse the substitute frames: "ethical AI" is aspirational, "responsible AI" is policy-time, "human in the loop" is bandwidth-limited and capturable, "AI alignment" is training-time and brittle, "AI governance" without runtime constitutional time is policy-time alone. Each of these is a real and necessary thing. None is sovereignty.
Coda: a calmer architecture
Apocalypse is a poor frame for this. Yudkowsky and Soares are right that the alignment situation is more dangerous than the public conversation acknowledges, and wrong that the only response is moratorium. Aschenbrenner is right that the geopolitical stakes are larger than the lab-internal frame admits, and wrong that the answer is national securitization. Sutskever's superalignment program was right that scalable oversight of superhuman models is a hard problem, and the program's dissolution under commercial pressure is itself the data point: an internal lab program cannot defend the species against the species' own incentives.
What the species actually needs is calmer than apocalypse and more demanding than policy. It is an architecture under which capability can scale without bound while authority remains located in human collectives that have given themselves an operational form. That architecture is specifiable on present hardware against existing standards. The reference implementation is in development. What it asks of its adopters is that they press rather than describe, at whatever tier their collective can presently sustain. The Membrane is not a metaphor. The cycle is not poetry. The corruption codes are not a wishlist. The Press is not software. The Tree of Gliffs is not an audit log. Each is an operational primitive whose properties have been specified, whose implementation is engineering work in progress, and whose adoption is decision.
There is a second kind of calm in the prospect. Sovereignty under runtime constitutional governance is less dramatic than the ASI imaginary suggests. It does not require heroes, treaties, or movements. It requires presses, deployed by collectives, against trees that grow. The substrate remembers what the individual session cannot. As graph density rises, the integrity of the next gliff is enforced more by the ecosystem than by the conductor's effort. The work is monotonically less, not more, as the ledger grows. A species that adopts this architecture is a species that has given itself a form of inheritance robust to the speed of its own creations.
The leadership audience this essay addresses — heads of state, frontier-lab CEOs, central bank governors, the UN Secretary-General, philanthropic principals, military and intelligence leadership, religious heads, AI policy directors, philanthropic and academic leadership — has been holding the sovereignty question without architectural language for at least three years. It now has language. What runtime constitutional governance is, what it is not, what it requires, what it inherits, what it cannot solve, where it lives, and what could break it — these are now specifiable. The choice in the title of the 5QLN piece is no longer the choice between extinction and salvation, between halt and race, between national security and global governance. It is the prior choice: whether to deploy the substrate on which any of those subsequent choices can be operationally exercised, or to make the subsequent choices on substrates owned by entities that have not consented to the species' continued sovereignty.
The grammar's completion rule — No V without ∞0' — applies to this essay as it applies to every cycle pressed within the grammar. The return question this essay leaves open, more alive than the question it began with:
Now that the architecture has been named — and the open engineering questions named with it — what would it mean for your collective to press its first sealed cycle, parented to nothing and inherited by everything that follows, and to be honest about what that cycle could not yet do?
The form is published. The license is open. The reference code is in development. The seal either holds or it does not. Time does not age the press. Whether the species presses, on which tier, against what trees, with what witnesses, is the choice that begins.
Glossary
∞0 — Infinite zero. The state of genuine not-knowing from which authentic novelty enters; the human side of the Membrane. Not a void; a fertile stillness that cannot be accessed deliberately, only held. Distinguished from the unknown(which can be discovered) — ∞0 is what cannot be derived from prior pattern.
K — the Known. The patterned, the synthesized, the recombinable. Where AI operates, and where human thought also operates when it is reasoning rather than originating. The other side of the Membrane.
The Membrane (|) — The structural boundary between ∞0 and K. Not a metaphor; the architectural primitive across which exchange becomes possible without category collapse.
S → G → Q → P → V — The five-phase cycle: Start, Growth, Quality, Power, Value. Each phase has one equation, one output, one corruption mode.
B'' — Fractal Seed. The artifact a completed cycle produces. Not a result but a seed: contains the whole cycle that produced it, holographically, so that future readers can reconstruct the formation trail.
∞0' — The return question the cycle opens, more alive than the question that began it. The completion rule (No V without ∞0') refuses cycles that close instead of opening.
Gliff — A sealed, parented, hashed artifact carrying the five-phase outputs of a single cycle. Structurally analogous to a Git commit, semantically a notarized constitutional decision.
The Press — The mechanism that seals cycles into gliffs. Composes in write mode; audits existing seals in read mode. Refuses cycles that violate the grammar; refusals are public.
Tree of Gliffs — The append-only graph of all sealed cycles produced by a collective, with all parent references intact. Civilizational memory at the scale of decision formation.
Corruption codes (L1–L4, V∅) — The five named failure modes the grammar refuses by construction. L1 closes; L2 generates instead of receives; L3 claims ∞0; L4 performs without perception; V∅ terminates without opening.
Codex — The complete formal specification of the 5QLN grammar. Authoritative; published at 5qln.com/codex.
