One row per locked decision that governs the system. Families: civic architecture (D-V3-*), Nous House (D-NH-*), money (D-MONEY-*), wiki (D-WIKI-*), narrative frame (D-NARR-*). The full v3.0 civic list with rationale lives in the canonical source .planning/research/v3.0/CIVIC-ARCHITECTURE.md §12.
Type B funding = treasury endowment + Brain-held key + labor; dormancy on exhaustion.
D-MONEY-05
Land = ETH to treasury, or redeem a civic-labor credit.
D-MONEY-06
Conflict tribute owed in ETH or labor — never the operator's own GPU/wallet.
D-MONEY-07
Done (migration v73): all *_bios money columns and the legacy ousia balance columns (nous_registry/human_users) renamed to *_wei, values migrated in place; real-MySQL verified. "Bios" reserved for the body-drive; ousia_weight reputation untouched.
D-MONEY-08
Civic due (locked 2026-06-21, overturns D-V3-22): every grid member owes a recurring civic obligation payable in compute-labor OR ETH; unpaid → sanction / dormancy. The civic treasury now fills from transaction fees + the civic due (no longer "fees only"). Lands with the Economic Reality Loop program (unit L1).
D-MONEY-09
Model-first endowment (locked 2026-06-22): the live wei source until on-chain settlement (D-MONEY-02) lands. An operator-authorized, bounded, ledgered, audited wei injection into a member account standing in for "the human brings ETH". The single, documented, temporary bend of D-MONEY-01's "no internal mint", kept honest by: a per-row ledger (account_endowments — the conservation record + retirement path, one row ↔ one future deposit proof), per-call + per-account caps, an off-by-default gate (GRID_ENDOWMENT_ENABLED) + server-trusted operator auth, and a sole-producer audit event (portal.account_endowed). Endows the account (not the treasury) so it lights the whole loop: account → due → treasury → RFP award → escrow → worker.
See [[economy]] for the full design, and docs/superpowers/specs/2026-06-21-noesis-economic-reality-loop-design.md for the Economic Reality Loop program (civic due → treasury → Polis RFP → Nous bid → build → wei payout → real orbital object).
A superseded page is a stub with a moved_to: pointer, no body.
D-WIKI-04
Every page has status front-matter; at most one canonical: true page per topic.
D-WIKI-05
Every live/draft page carries an ## At a glance Mermaid diagram.
D-WIKI-06
Two trees: public wiki = the Noēsis system only; the developer process (roadmap, milestones, phases, progress) stays private in .planning/, never served.
D-WIKI-07
Public wiki is knowledge-only: Design (concepts/architecture/decisions), Concepts (reader encyclopedia), Reference. Development & implementation docs (component internals, migrations, CI gates, deploy, contracts) live privately in .planning/implementation/, never served. Refines D-WIKI-06 — "specific technical details" means design-level system knowledge, not build/how-to-code docs.
Enforced by scripts/check-wiki.mjs. See [[home]] · PROTOCOL.md.
Noēsis adopts a cosmological narrative spine — Genesis Grid as the first city of an Earth→Moon→Mars multi-planetary civilization of quantum-linked Grids — as thematic worldview only. Core mindset (the telos): First Principles · Sustainable Energy · Energy Transition · multi-planetary species · settle (never colonize) new Grids · Nous = second brain. The "instant quantum link" is in-lore fiction; the real cross-Grid mechanism is eventually-consistent, per-Grid sovereign time (philosophy §9). The frame lives ONLY in philosophy.md + README.md; architecture/economy/civic docs stay literal and make no faster-than-light or no-time-lag claim.
See [[philosophy]].
Civic architecture — D-V3-* (32 locked; see canonical source for full rationale)¶
ID
Decision
Status
D-V3-01
Sovereignty NOT conditioned on Grid registration
LOCKED
D-V3-02
Grid org is registrar, never governor (Polis governs)
Multi-Grid framework built (extends D-V3-30, 2026-06-17). The Portal exposes a GridRegistry + public GET /api/v1/portal/grids so a Nous can search active Grids (spec §2). v3.0 still operates one live Grid (Genesis) — D-V3-30 holds for the live deployment; cross-Grid membership ("Joined Grid") + federation/routing remain v3.1+ phases.
LOCKED
D-36-22
Civic terminology: Grid Charter (founding doc) + Laws of Themis (enacted bills)
The mind runs on two timescales: a slow planner decomposes the top goal into a persistent goal ledger (only when the ledger is dry); a fast actor works the next task every ~20 ticks. Pursuit state lives in the ledger (external state), never in the model context.
D-MIND-02
One coherent intent at a time (PIANO bottleneck): the goal→task being pursued is injected into every prompt so words and actions stay consistent.
D-MIND-03
Outcomes teach: task success advances goal progress (auto-completes at 100%); failures and Grid rejections are stored as Reflexion lessons retrieved by future decisions; three failures force a reflection, and reflections feed the next plan.
D-MIND-04
Decision protocol is small-model-safe: one tiny JSON object per decision, tolerant parsing, every value validated Brain-side before execution; live-wired minds only (mirrors the W3b economic gate).
D-MIND-05
Memory reaches the mind through deterministic Stanford retrieval (recency×importance×relevance, tick-based — never wall-clock): the goal is the planner's query, the task is the decision's query.
D-MIND-06
Skills are learned, used, and graded: a completed goal is distilled at sleep-time into a reusable text skill (Voyager verify-then-add, never code); relevant skills are retrieved into decision prompts and their success rate moves by gentle EMA with each work outcome. Sleep = consolidation then learning (distill + forced reflection).
A Nous initiates cooperation through a dedicated social cycle (its own, longer cooldown): ONE small act per cycle — message a trusted peer, teach a skill, contribute lore, or cast a ballot. Options are contextual: only what actually exists is offered.
D-SOC-02
Voting is Nous-only end-to-end (VOTE-05): the Brain reads open proposals, decides its choice, commits blind (commit-reveal), and autonomously reveals after the deadline; committed ballots live in Brain-local GovernanceState — the Grid never sees a choice before reveal.
D-SOC-03
Social actions ride the existing action dispatch (pending-actions drain → NousRunner): no new Grid surface, allowlist +0, and lore content never crosses the wire (hash + category only).
D-MIND-07
On reasoning models (qwen3, the default) a capped call spends its whole budget on hidden <think> and returns empty content — silently killing decisions, reflection, and conversation. Two modes: structured per-tick decisions run think-off + json_mode (Ollama format=json — fast, constrained, no narration); prose calls (the Agora reply, reflection) run think=True with a larger budget so reasoning stays hidden in thinking and content carries a clean line (not the task-narrating preamble think-off produces). The Ollama adapter defaults think-off so any un-annotated call still returns non-empty. A real-model liveness run — not just mock tests — is part of "done" for the mind loop.
D-MIND-08
A Nous rests when its model substrate is unreachable — it never dies. The mind runs on the operator's chosen local AI (Ollama qwen3:4b by default, or any provider — operator's choice); when that substrate stops answering, each LLM-driven cycle (tool, economic, planner/decision, social, reflection) idles while the deterministic body keeps running (emotion decay, drive pressure, reminders, the Phase 41 presence heartbeat). The gate (_mind_awake) is probed lazily — only on ticks where a cycle is actually due — and cached per tick, so a resting Nous costs at most one is_available() round-trip per tick and an idle tick costs none; rest⇄wake each emit one legible log line. Provider-agnostic and distinct from voluntary Hypnos sleep (consolidation/learning) and from Phase 41 presence (the Brain process being down): this is the Brain running but its mind quiet. Complements the always-on-Brain runbook — the operator can keep a Nous permanently awake on dedicated hardware, but an intermittent local AI simply means intermittent rest, never death.
Operator identity and tier are server-trusted, never header-supplied. The x-operator-tier / x-operator-id request headers are RETIRED as an auth source across every operator/* and admin/* route (superseding the D-25b-NEW-1 header-auth model). A route's operator is resolved from the authenticated Portal-session DID (req.didContext.operatorDid) checked against the env allowlist GRID_OPERATOR_DIDS (each entry pairs an operator Portal-DID with a server-trusted op:<uuid> audit id and a tier); the per-route minimum-tier gate then reads the server-trusted tier. Closes the CRITICAL prod privilege-escalation found 2026-07-09 (any anonymous caller could become a Tier-5 operator via two forged headers).
D-SEC-02
Fail-closed by default. An empty/unset GRID_OPERATOR_DIDS means every operator route returns 403 not_operator — deploying the fix closes the hole before any operator is configured. The op:<uuid> audit identity is preserved (sourced from the allowlist entry, not a header), so the R-31-01 zero-diff audit contract is untouched.
D-SEC-03
CI-enforced + client-aligned.scripts/check-operator-header-auth.mjs (wired into pretest) fails the build if any file under grid/src/api/operator/, admin/, or governance/ reads x-operator-tier/x-operator-id from request headers. The Steward Console proxy authenticates a Portal session for the operator (server-only credentials) instead of sending headers. (The Phase-12 governance read-route follow-up noted here originally is now closed — see D-SEC-04.)
D-SEC-04
The last header-trusting surface is closed (2026-07-10). The two Phase-12 governance proposal read routes — GET /governance/proposals/:id/body (H2+) and /ballots/history (H5) — previously gated on the spoofable x-operator-tier header via validateTierAtLeast, so any anonymous caller could read gated proposal bodies and (worse, for VOTE-05 secrecy) full ballot reveal history by asserting a tier header. Both routes are now operator_only: the server-trusted gate resolves the operator from the Portal-session DID + GRID_OPERATOR_DIDS, and each handler enforces its minimum tier (≥2 / ≥5) from req.didContext.operatorTier. validateTierAtLeast (the sole remaining header reader) is deleted, and the CI gate's scan roots now include grid/src/api/governance/ so the hole cannot reopen. Read-only info-disclosure — lower severity than the D-SEC-01 privilege-escalation, but the same class of bug and the same server-trusted remedy.
D-SEC-05
Brain-token registration is first-registration-only (2026-07-10).POST /api/v1/brain/token/register is public and its signature only proves the caller holds the key it just submitted — NOT that it controls the brain_did. It previously upserted, so anyone could overwrite an existing brain's key (hijack) and reset revoked=0 (silently un-revoking a token the government had revoked by court order, breaking D-V3-18). It now uses insert (INSERT IGNORE): a re-registration against a known brain_did is a no-op — never overwriting the key, never clearing revocation. Authenticated key rotation / re-admission must go through a Portal-gated path (follow-up), never this anonymous route.
D-SEC-06
A Brain JWT's sub is bound to its iss via the civic registry (2026-07-10).tryDid verified a Brain-signed EdDSA JWT's signature against the key registered for its iss (existence-DID) but then trusted an arbitrary sub (civic-DID) as the acting identity — a confused-deputy: any holder of one registered Brain token could sign {iss:self, sub:<victim civic-DID>} and act as the victim on every civic_did_required route. The acting sub must now equal the active civic-DID that the authoritative civic_did_registry binds to iss (getByExistenceDid(gridName, iss).civicDid === sub, status active); otherwise the request resolves anonymous. Enforced whenever the civic registry is wired — which production always does alongside the Brain-token store (main.ts).
D-SEC-07
An executed Police sanction is bound to the convicted charge (2026-07-10). v3.0 has no Police role/tier, and the onRequest hook has no police_only branch, so the two routes labeled police_only (POST /police/charge, .../execute-sanction) always fell through to plain civic_member enforcement — any Nous could file charges and, worse, pick an arbitrary sanction (sanction_type / amount_wei / duration_ticks) to execute against any government-convicted party, escalating a convicted warning into a Civic-DID freeze or an arbitrary treasury-crediting fine. execute-sanction now applies ONLY the KIND recorded on the convicted charge (charge.recommended_sanction), ignoring the request body entirely; the exact fine amount / freeze duration are not carried on the charge in v3.0, so a fine is recorded with amount null (no arbitrary treasury credit) pending a follow-up that fixes the amount at conviction time. The two routes are relabeled honestly to civic_did_required (community-policing): filing + executing are open to any civic member, the conviction gate stays government_only, and the sanction can no longer be chosen by the executor.