Skip to content
Sovereign Circuit Doctrine
Doctrine SCDOC/1.0 Intent, not contract 31 Aug 2026
Sovereign Circuit · Doctrine

Nine commitments, and what breaks each one.

The protocol page says how a grade is bound to a price. The rubric page says how a grade is derived. Neither says why any of it should exist, or what this program refuses to do when refusing costs money. That is what this page is for. Each commitment below is stated with the thing that would falsify it, because a principle with no failure condition is a slogan.

Version
SCDOC/1.0
Commitments
9
Enforced in code
3 of 9
Refusals
7
Read the commitments → See one enforced Board
1 · Where this came from

A coffee machine in a hospital corridor.

Before any of this had a protocol, it had a working example. A family company owned equipment — coffee machines, vending, the ordinary infrastructure a building needs — and placed it inside hospitals. The hospital did not buy the machines. It did not maintain them, depreciate them, or hold a spare in a basement. If a machine failed, it was swapped out immediately for the same unit or a better one, and the person who needed coffee at three in the morning got coffee at three in the morning.

That model is worth copying exactly, and almost nobody applies it to computers. The reason it works is not the machines. It is that ownership sits with whoever is able to maintain it, and the operator's obligation is defined by continuity of service rather than by delivery of a box. Nobody in that hospital was ever handed a manual and told good luck.

The transposition

Sovereign Circuit places hardware the same way: the unit is matched to a specific requirement, it arrives with the software already correct, it lives inside a security envelope the recipient does not have to build, and when it fails it is replaced with the same specification or better — not credited, not queued, not diagnosed over email.

The difference is what happens at the end. A coffee machine that stops earning is scrapped. A three-year-old business laptop is a perfectly good machine for a nine-year-old learning to code, and destroying it is a choice someone made, not a fact about the hardware.

2 · The number that starts the argument

Sixty-two million tonnes, and a quarter of the emissions.

The Global E-waste Monitor 2024 puts the world's electronic waste at 62 million tonnes in 2022, rising toward 82 million by 2030, with documented formal collection and recycling at 22.3% — meaning more than three quarters of it is not accounted for (Global E-waste Monitor 2024).

The other half of the number matters more, because it is about the machines that are still working. Research summarised by Computerworld found that extending the corporate life of a laptop by a single year cuts its associated emissions by roughly 25%, for the straightforward reason that most of a computer's carbon cost is incurred before it is ever switched on (Computerworld).

What usually happens

A fleet refresh retires four hundred working machines. They go to a broker, get graded with an adjective, get wiped to an unverifiable standard, and are sold on price. The ones that do not clear get shredded, and the shredding is reported as responsible disposal.

What this program does

The same four hundred machines are graded against counts and instrument readings, wiped to a stated NIST SP 800-88r2 category with a certificate identifier, matched to specific requirements, and placed — business-capable units into businesses, the rest into households and schools with the strongest software configuration on them, not the weakest.

One more reason to be careful about the language: a Windows 11 requirement for TPM 2.0 is what pushes an enormous number of otherwise healthy machines into the retirement bucket (CRN). That is a software policy, not a hardware failure. It is exactly the category of machine this program exists to catch, and it is why tpm_version is a graded field rather than a footnote.

3 · The commitments

Each one with the thing that would prove it false.

Three of these are enforced in code today and are marked as such. The rest are intent, and saying so is the point — a commitment that claims mechanical enforcement it does not have is worse than an honest promise.

  1. 01

    Nothing that works gets destroyed to make a number look clean.

    intent

    A working machine is not waste because a spreadsheet says it is depreciated. Every unit that enters this program gets graded before anyone decides what happens to it, and the grade is derived from what the machine actually does — not from its age, not from whether it runs the current operating system, not from whether it is convenient.

    Falsified if: a unit is shredded, and its observation sheet shows a machine that powered on, held a charge, and passed its storage reads.

  2. 02

    The specification matches the requirement exactly.

    intent

    Placement is not clearance. A unit goes where its actual specification meets an actual stated requirement, and the match is written down before the unit ships. Nobody receives a machine because it happened to be the next one on the shelf, and nobody is told that eight gigabytes is fine for a workload that needs thirty-two.

    Falsified if: a placement record exists with no requirement document, or with a requirement written after the unit was allocated.

  3. 03

    A failure is replaced with the same specification or better, immediately.

    intent

    This is the hospital model and it is the whole operational promise. When a placed unit fails, the obligation is not a repair ticket. It is a working machine of equal or greater specification, in place, with the configuration already correct. The failed unit comes back to be diagnosed on our time, not the recipient's.

    Falsified if: a replacement is ever a downgrade, or a recipient is asked to wait on a diagnosis before receiving a working machine.

    This is a service obligation, described in service terms. It is deliberately not called insurance, an appraisal, a valuation, or a warranty product, and it will not be described in those terms unless counsel says the specific words are accurate — because the difference between a service contract and an insurance product is a regulated distinction and not a matter of tone (IRMI).
  4. 04

    Both sides agree what it is worth, and neither can move after seeing the other.

    enforced in code

    Value is set by dual attestation: both parties seal a figure, both reveal, and the settlement is a function of the two sealed figures and a policy fixed before either was revealed. Agreement inside the tolerance band settles at the midpoint. Disagreement outside it escalates to a published index rather than to whoever argues longest.

    Enforced by: attestation.py, with the settlement arithmetic pinned by eight published test vectors. Protocol →

  5. 05

    What it is gets fixed before what it costs.

    enforced in code

    A price window cannot open until a grade is published, and the price commitment is bound to that grade. This closes the gap that makes commit-and-reveal schemes decorative in practice: you cannot seal a price and then negotiate the grade toward it.

    Enforced by: eight live guards in station.py, which you can attack yourself. Test station →

  6. 06

    Condition is described in counts and readings, never adjectives.

    enforced in code

    Sixty-six fields, every one a count against a defined threshold or a reading taken off the machine. The grade is an output. That does not make grading objective — someone still decides whether a mark is a scratch — but it makes each remaining judgement call contestable one line at a time, answerable with a ruler instead of an argument.

    Enforced by: grading.py, hashed to a rubric_hash that is inside every commitment. Rubric →

  7. 07

    Hardware that is not secure enough for a business is not therefore junk.

    intent

    A machine that no longer clears a business security bar is often an excellent machine for a household, a student, or a nine-year-old learning to write code. It cascades with the strongest software configuration available — hardened, updated, supported — not a stripped one. The security envelope around it is ours to provide, not the family's to assemble.

    Falsified if: a household placement ever ships with a weaker configuration than a business placement of the same unit would have received.

    Stated plainly, because this is the part most likely to be misread: this is not a channel for offloading hardware nobody wants. A unit that should not be running is not placed anywhere. The rubric has a tier for exactly that (R — recovery only), and a tier that is never placed into a household or with a child (L).
  8. 08

    The hardware stays inside the security envelope, including the things nobody thinks of as computers.

    intent

    A placed unit sits behind the same segmentation, the same air-gapped build environment and the same monitoring the rest of the program uses. That envelope extends to the IoT on the same premises — the cameras, sensors, thermostats and controllers that are treated as appliances and are in practice unpatched infrastructure with network access. Putting a hardened laptop on a network with an unmanaged camera on it is not security.

    Falsified if: a placement is made onto a network with no segmentation plan for its non-computer devices.

  9. 09

    Published prices are a floor, and capability only ever raises them.

    intent

    The Sentinel figures published on the board are a floor and are never undercut, for anyone, under any volume. When capability is added, the price goes up — it does not get absorbed to win a deal. Discounts exist for participation, not for negotiation: contributing units, hosting a lab, or running a pilot earns a stated reduction that anyone doing the same thing gets.

    Falsified if: any placement settles below the published floor, or any capability is added without a corresponding price change.

4 · The habit underneath all nine

Publish the weakness before someone finds it.

Every page on this board carries a section stating what is unresolved, and the chips at the top of each page say what is not calibrated. This is not modesty. It is the only way a claim about evidence can be checked, and a program about evidence that hides its own gaps has already failed at the thing it sells.

Three things found by testing this program's own code, all published rather than quietly fixed:

  • One guard has never fired and cannot. The escalation check in publish_grade is unreachable under the current rubric — about 35,400 searched sheet pairs produced zero crossings, and a deliberately sabotaged rubric produced 25, proving the search was capable of finding one. The guard stays; it is labelled dormant and is never described as protection that happens in practice. The finding →
  • The public grader was three fields out of date. Its list of machine-read fields — the ones that void a round when they conflict — was maintained by hand and had fallen behind the rubric source, so a disagreement on ecc_memory, storage_type or wipe_certificate_id was being treated as an ordinary divergence. It is now generated from source and the page fails loudly if it ever drifts again.
  • An evidence collector reported a false failure. A check in the network evidence script flagged a healthy configuration as a failure because of how one command formats its output. It was found by writing tests for the verifier rather than by trusting it, and a verifier that cries wolf is worse than none.
The standard being applied

A claim is publishable when someone else could check it and find it false. Everything on this board either meets that bar or is labelled as not meeting it yet. There is a large amount in the second category, and the largest item is that no real unit has been graded by two people.

5 · Refusals

Things this program will not do, including when it pays.

  • Will not grade with an adjective. Not for a customer who prefers it, not to match an existing broker workflow. If a counterparty needs Grade B, they get the derived code and the sheet it came from, and can map it themselves.
  • Will not price a unit whose machine reads conflicted. The round voids and the unit is re-read. Averaging two disagreeing SMART counts produces a number about a machine that does not exist.
  • Will not settle a material divergence in software. When a judgement call moves the grade, a person looks at it. The software's job is to notice, not to decide.
  • Will not call the figure an appraisal or a valuation. Not on this site, not in a proposal, not once. It is a settlement between two committed parties under a stated policy. Those are different things and the difference is legal, not stylistic.
  • Will not describe the replacement obligation as insurance. Until counsel reviews the specific wording, it is a service obligation and is described only in service terms.
  • Will not place a unit below its tier. Recovery-only units are not placed. Tier L units are never placed with a household or a child. There is no volume pressure that changes this.
  • Will not claim a security property it has not tested. The evidence packs exist so that "air-gapped" and "wiped to purge" are statements with artifacts behind them. Where an artifact does not exist yet, the claim is not made.
This page is a statement of intent and operating doctrine. It is not a contract, an offer, an appraisal, a valuation, insurance, or legal advice. Three of the nine commitments are enforced by published code; the other six are undertakings with no mechanical enforcement yet, and are marked accordingly.