A mission that survives only while its founder is unusually principled is not yet protected. This framework places constraints around the power to spend, appoint, deploy, interpret, amend, conceal, and excuse. It applies those constraints to Entif itself, including its founder. A nonprofit label cannot do this work for us. [P00, P09-P10, P15, P23-P25; C01, C09-C10, C15, C23-C25.]
This is a proposed institutional design, not bylaws or a representation that a legally constituted board exists. The Ledger controls its substantive commitments. The first-draft Charter and Commentary supply the proposed constitutional text and its interpretation. Counsel must determine how the mechanisms below can be implemented in the selected jurisdiction without silently changing their intended outcomes. Concrete numbers, offices, thresholds, and time periods in this document are proposed drafting defaults, not historical founder decisions, adopted requirements, or statements of law.
1. Authority must have a name, a boundary, and an end
Entif shall distinguish constitutional authority, board governance, executive management, financial authority, technical execution authority, and independent review. Holding one does not automatically confer another. An administrator who can change a setting does not thereby acquire the right to change the governing rule. A donor who funds an activity does not acquire authority over its findings. A reviewer who identifies a defect does not automatically acquire permission to deploy a repair. [P09-P11, P14-P15; GC001, GC007, GC013, GC034.]
Once adopted, the Charter shall constrain subordinate instruments. D16 shall define the shared conformance requirements. Specialized standards shall state how those requirements apply in their domains. The adoption/version registry under #26 shall identify the effective version, approving authority, scope, and known implementation gaps. Publication, repetition, a repository merge, or a confident announcement shall not substitute for adoption.
Every material delegation shall identify the granting authority, recipient role, purpose, permitted acts, prohibited acts, resource limits, affected systems or interests, duration, revocation path, reporting duties, and evidence required for completion. Subdelegation requires an express grant and may not exceed the original authority. Delegation transfers work; it does not erase the accountable owner’s duty to supervise and remedy foreseeable failures. [GC013, GC020, GC032-GC034.]
2. Founding transition and the proposed board
The proposed steady-state board has five voting directors, including at least three independent directors. Independence means more than a different job title: no material employment, financial, family, vendor, donor, or other relationship that would reasonably compromise judgment on the matter under review. A director may be independent generally and conflicted for a specific decision. Both assessments must be recorded. The founder may hold a seat, but no permanent personal veto, hereditary seat, or exemption from removal is created by this framework. [P10, P15; GC003, GC013, GC038.]
The board should collectively cover nonprofit governance, finance, technical safety, research ethics, and the interests of materially affected people. This is a competence matrix, not a requirement that every director be an expert in every field. Missing expertise must be obtained from accountable advisers with adequate access and a mandate to disagree. An AI system may assist the board, but this draft does not claim it can legally serve as a director, signatory, or fiduciary. Counsel must settle legal eligibility. Moral standing and lawful governance office remain separate questions. [P11; GC025, GC037.]
The independent chair should not also be the chief executive. The board appoints a secretary responsible for records and a treasurer responsible for financial oversight; combining administrative functions is permissible only where the applicable legal rules and a documented conflict review allow it. The preparer of a material financial record should not be its sole approver or reconciler. The board may appoint an executive director for operations within an approved budget and delegation schedule.
Before lawful constitution of the board, the founder acts only as the owner of the preparation program to the extent otherwise authorized. Drafting documents, obtaining advice, and preparing applications do not imply institutional adoption. Binding commitments, filings, appointments, and transfers require the actual authority appropriate to that stage, established through #25, #30, and #32. The transition record must identify what the founder can presently do, what remains unassigned, and what is prohibited until the relevant authority exists.
A small founding team must not invent independence by asking another instance of the same model to certify its work. When genuine independent review is not yet available, record that gap, restrict the activity to the permitted preparatory or low-consequence scope, and seek a qualified reviewer before crossing the higher-consequence gate. Lack of a reviewer is a limit on the proposed activity, not permission to relabel self-review. [GC003, GC009, GC025, GC035, GC041.]
3. Appointment, terms, succession, and removal
Proposed director terms are three years, staggered after the initial board, with a limit of two consecutive full terms followed by a one-year interval. Initial shorter terms may establish the stagger. A documented exception should require independent review and a reserved decision; it cannot be used repeatedly to make a nominal term limit meaningless. These are governance proposals subject to counsel’s review and the eventual governing instruments.
Appointments should follow a recorded competence and independence assessment, disclosure of relevant relationships, consent to serve, and acceptance of the Charter, Code, confidentiality duties, and conflict process. Recruitment should seek credible disagreement and relevant experience rather than loyalty to a founder’s preferred research conclusion. A nomination record must explain how the candidate improves board capacity and independence.
The board must maintain a succession plan for the chair, executive, treasurer, secretary, and critical administrative custodians. It should identify interim authority, key records, access-transfer procedures, and the acts that an interim holder may not take. No succession plan may rely on a password known only to a departing founder or on an undocumented personal account. #39 owns the account and recovery record; #26 owns changes in authority.
Removal must distinguish misconduct, incapacity to perform an assigned function, persistent nonparticipation, and a legitimate change in organizational need. A person must receive the relevant allegations or basis, a fair opportunity to respond, and a decision by unconflicted authority. Good-faith dissent, adverse research findings, or reporting a violation are not grounds for removal. An urgent temporary restriction may protect people or records, but must not predetermine the final finding. The affected director does not vote on their own removal. Counsel must confirm the lawful voting and notice mechanics. [P14, P16-P17; GC005, GC024, GC048-GC050.]
4. Three classes of institutional decision
Ordinary decisions concern reversible operations within an adopted policy, approved budget, and valid delegation. The proposed board quorum is three directors. Ordinary board decisions require a majority of unconflicted directors participating, with at least two affirmative votes. The executive may make ordinary delegated decisions without requesting a board vote each time, provided the action remains within scope and produces the required records.
Reserved decisions include appointment or removal of the executive; material related-party transactions; commitments outside approved budget limits; exclusive vendor dependence affecting critical governance; significant debt or asset disposition; high-consequence deployment; material changes to delegated powers; acceptance of restrictive funding that could influence the mission; and settlement of a material governance violation. The proposed threshold is three affirmative unconflicted directors, including at least two independent directors. The reasons, dissent, conflicts, evidence, and conditions must be recorded. [GC008, GC013-GC015, GC021-GC023, GC034, GC038-GC039, GC052.]
Constitutional decisions include amendments to the Charter; alteration of protected floors or mission-lock mechanisms; changes to constitutional amendment or reserved-power rules; merger, dissolution, or transfer of substantially all mission-bearing assets; and arrangements that would hand another actor practical control of the constitutional plane. The proposed threshold is four affirmative directors from the five-seat board, including three independent directors, following independent review and two deliberations separated by at least thirty days. Urgency cannot reduce this threshold through an emergency declaration.
Vacancies, recusal, or temporary absence shall not lower the stated affirmative-vote minimum for reserved or constitutional decisions. If too few eligible directors remain, the matter is held while a lawful, unconflicted appointment or review mechanism is arranged. The draft does not create substitute voting directors by administrative designation. Counsel must supply an implementable vacancy and deadlock mechanism that preserves, rather than bypasses, the independence outcome.
A tie is not approval. Rejected or deferred proposals retain their evidence and reasons. Repackaging a rejected proposal as several smaller transactions to evade a threshold is prohibited. Aggregate related commitments over a rolling period when assessing materiality. The control register must state the applicable aggregation rule. [GC007-GC008, GC022, GC032, GC049.]
5. Mission lock and protected floors
The mission lock protects the public-benefit purpose and the Charter’s commitments to human dignity, evidence integrity, consent, privacy, non-extraction, contestability, and proportionate care under moral uncertainty. It is not a promise that capture is physically or legally impossible. Its effectiveness must be tested through control evidence, adversarial scenarios, funding and authority concentration reviews, and actual responses to challenge. [P00-P04, P07-P10, P13-P15, P23-P25; H08.]
No budget, product objective, donor condition, contract, technical default, or executive instruction may silently displace a protected floor. Where two protected interests conflict, the decision record must identify each interest, affected parties, urgency, evidence and uncertainty, feasible alternatives, likely error costs, least-invasive effective action, duration, reviewer, and restoration path. D16 supplies the common record semantics; D08, D11, D12, and D13 supply the specialized tests. An economic benefit alone is not sufficient justification for sacrificing a protected interest. [GC014-GC016, GC042-GC044.]
The legal instruments should preserve mission-bearing assets and public-benefit use through appropriate purpose, amendment, transfer, and dissolution provisions. Counsel must distinguish a legally enforceable restriction from a policy preference or a contractual undertaking. Where law will not support the proposed mechanism, present the conflict, alternatives, and residual risk to the proper constitutional authority. Do not insert conventional boilerplate and call the intended outcome implemented. [#9, #25; P10, P15; GC023, GC035.]
6. Funding, vendors, and other routes to capture
Funding decisions must examine influence as well as amount. Conditions that grant a donor authority to suppress findings, select only favorable evaluators, decide appeals concerning the donor, or weaken protected floors are incompatible with this framework. A legitimate restriction on use of a grant is not automatically capture; the distinction depends on what discretion is transferred and whose interests are subordinated. The acceptance record must identify restrictions, reporting rights, publication terms, conflicts, termination rights, and alternative funding options. [P10, P12-P15, P20; GC026, GC038.]
Proposed review triggers are a single source providing more than twenty-five percent of the next twelve months’ expected funding, or the largest three sources providing more than sixty percent. Crossing a trigger requires a concentration and exit-risk review, not automatic rejection. The analysis must include in-kind compute, platform credits, data access, and infrastructure dependence, not only cash. For a small new institution, a concentration may be unavoidable; the recorded response should specify duration, safeguards, diversification steps, and reassessment rather than make a false claim of independence.
Critical vendor review must assess substitution time, exportability of data and evidence, termination effects, pricing and service dependence, control over identity or access, confidentiality, and ability to investigate the vendor’s own failures independently. A provider must not become the only available source of evidence about whether its service misled or harmed users. Public standards and multi-provider capability may reduce dependence, but compatibility alone does not prove an exit path works. Test it. [GC009, GC025, GC039.]
The finance and funding owners under #33, #34, and #41 supply the facts; the board decides material conflicts. Neither fundraising success nor a donor’s public reputation establishes ethical compatibility. No reviewer should lose funding merely because their supported conclusion blocks a preferred activity. [GC003, GC026, GC029, GC038.]
7. Conflicts, recusal, and independent scrutiny
Directors, officers, staff, contractors, agents, and advisers must disclose relevant conflicts before participating and update disclosures when circumstances change. The conflict record should include the interest, affected decision, assessment authority, recusal or mitigation, alternative decision-maker, and review date. Public disclosure may use categories or aggregates where personal details are not necessary; the unconflicted reviewer must still receive enough information to assess the conflict. [C15; GC003, GC009, GC027, GC038.]
A conflicted person may provide requested factual information but must not control the evidence packet, reviewer selection, deliberation, vote, or appeal concerning that conflict. The minutes record their participation and absence from the decision. The board’s conflict policy under #25 and currentness register under #37 operationalize this rule. Financial related-party transactions also require #33’s documented financial controls.
Independent review is required for constitutional change, material related-party decisions, unresolved consequential appeals, credible allegations against controlling officers or directors, high-risk research or deployment, and material claims of verified conformance where internal interests are insufficiently separated. The review mandate must state access, competence, resources, conflicts, reporting rights, dissent protection, and removal rules. Reviewers can report insufficient access as a finding. Management cannot certify success by narrowing the question after seeing the evidence. [GC003, GC009, GC025, GC029, GC035.]
A review may be external, or internally separated where the risk and conflict assessment justify it. Automation can assist evidence collection and routine checks. It cannot be described as independent human judgment. Reviewer provenance must identify the actual role and method. The board must budget proportionate capacity for this work rather than require reviewers to investigate a complex system without the tools to inspect it. [GC025-GC026, GC041.]
8. Stakeholders, notice, and recourse
Before a consequential decision, identify who receives benefits, who bears costs, whose options shrink, and who lacks a contractual voice. Consultation must include materially affected groups where feasible, using representatives, subject-matter advocates, accessible feedback, or independent assessment when direct participation is impracticable. Absence from a meeting must not be interpreted as consent or assigned a weight of zero. Representation is not a guarantee that every preference prevails; it makes the tradeoff visible. [P07, P14, P20, P23; GC012, GC037.]
A materially affected party should receive an intelligible statement of the decision, actual state, basis, governing authority, available remedy, and route to challenge. Temporary withholding for privacy, security, or an active investigation requires a reason, scope, reviewer, and review time. It must not become a permanent invisible decision because nobody remembered to lift the hold. D07 and D08 define the evidence and consent details. [GC012, GC027, GC040-GC041.]
Proposed recourse defaults are acknowledgment within five business days, triage within ten, and a substantive disposition or explained status update within thirty. Imminent serious harm is escalated immediately. A missed target triggers a status notice and escalation rather than a fictional closure. These service targets require adoption and resourcing; a statutory or contractual shorter deadline controls when applicable.
The original decision owner may correct an obvious error promptly. An unresolved consequential, repeated, or conflicted challenge must reach a separated human or external reviewer. The appeal record identifies the evidence considered, reviewer type, reasoning, corrective act, remaining harm, and systemic follow-up. Reversal is not full restoration when downstream records, lost access, or other consequences remain. [GC041, GC048.]
9. Protected reporting and non-retaliation
Good-faith reports of safety, ethical, legal, governance, or evidence-integrity concerns may bypass implicated management. The proposed escalation path is the independent chair, then an unconflicted director or designated external reviewer if the chair is implicated. Contact routes and accessibility must be established before Entif claims that a protected channel exists. A placeholder email address is not a reporting system. [GC024, GC050.]
Retaliation is a separate alleged violation. Access restrictions, funding removal, performance action, exclusion from research, or threats must be evaluated for whether they punish protected reporting or dissent. Necessary protective measures remain permissible when supported by separate evidence and unconflicted review. Knowingly fabricated accusations are not immunized, but an unproven concern is not automatically bad faith.
Protect the reporter’s identity to the extent appropriate, preserve relevant evidence, communicate a usable status, and record disposition. Do not promise absolute confidentiality when lawful obligations or effective investigation may require disclosure. Explain the actual limits before requesting sensitive information. [P16-P17; GC010, GC024, GC027, GC050.]
10. Emergency authority that cannot appoint itself permanent
Emergency authority is limited to a credible imminent threat of material harm where ordinary process is too slow. Proposed activation may be authorized by the executive or designated incident lead within a pre-adopted containment delegation. It permits only necessary isolation, suspension of a risky action, preservation of evidence, and reversible protective steps within that scope. It does not authorize constitutional amendment, permanent identity alteration, unrelated surveillance, destruction of audit evidence, or transfers of mission-bearing assets. [GC018-GC019, GC033, GC045.]
The activating officer must record the threat, evidence, alternatives, actions, affected interests, start time, expiry, and immediate notification to the independent chair. Proposed expiry is twenty-four hours. Any extension requires two unconflicted directors, including an independent director, a fresh reason, and a new explicit expiry no longer than seventy-two hours. The full board reviews continued restrictions through the appropriate reserved process. Repeated renewals are themselves a governance finding, not an administrative convenience.
An independent or separated review should begin within five business days after stabilization. It examines necessity, scope, privacy impact, evidence preservation, collateral harm, restoration, and any misuse of emergency powers. The resulting findings may invalidate the standing delegation. Where notice was withheld, provide the affected party an explanation and recourse as soon as the specific reason for withholding ends. [P14, P25; GC018, GC036, GC048.]
11. Enforcement and systemic repair
Violations must be classified by consequence, intent where supported, preventability, repetition, concealment, and the actor’s authority. A minor correctable deviation may require correction and coaching. Material or repeated failure may require restricted authority, additional review, remediation deadlines, or suspension. Serious misconduct, retaliation, concealment, or reckless disregard may require removal, contract action, public correction, or referral to competent authorities where warranted. These are proposed consequence categories; lawful employment, contract, and procedural requirements remain applicable. [GC005, GC034, GC050.]
The decision-maker must distinguish error from misconduct and duty from culpability. An organization may owe restoration even when no individual acted maliciously. Conversely, a favorable aggregate result does not excuse deliberate deception or a protected-floor violation. The response must be consistent across seniority: a founder or major donor does not receive a different definition of the same breach. [P04, P15, P23-P25; GC005, GC015-GC017.]
Material recurring failures require an accountable remediation owner, preserved evidence, root-cause analysis, feasible search for similarly affected cases, a changed mechanism, regression testing, and recurrence monitoring. Closure identifies the repaired outcome, residual harm, remaining risk, and who verified the change. D16 provides the common conformance record. #36 receives a board-level summary without duplicating the underlying incident system. [GC011, GC017, GC035-GC036, GC048.]
12. Transparency, records, and coordinated standards
Entif should publish the current public Charter, Code, governance framework, material governance changes, useful aggregate assurance results, and significant unresolved limitations. Protected source evidence, personal records, security-sensitive implementation, and confidential legal material remain appropriately restricted. Every material withholding category should have a rationale and accountable reviewer. Transparency is not indiscriminate disclosure, and confidentiality is not exemption from scrutiny. [GC010, GC027, GC049.]
Decision records must identify the version and authority used, evidence, conflicts, participants, votes where applicable, dissent, conditions, expiry, and follow-up. Corrections preserve the prior record. #26 tracks authority and version changes; #35 tracks recurring filing obligations; #37 tracks policy currentness; #39 tracks account and recovery authority. The board packet consumes these records instead of creating rival spreadsheets with different answers.
External standards and cross-jurisdiction obligations retain their own meanings. Entif should maintain mappings that identify equivalence, narrowing, extension, conflict, and gaps. Routing work through a vendor or another jurisdiction must not evade a substantive obligation. The board must obtain qualified legal review where the applicable rules conflict or are unclear. This document asserts no current treaty membership, regulator approval, or international incident-response role. [GC004, GC022-GC023, GC051.]
For incidents exceeding Entif’s containment capacity, the incident owner must use legitimate, pre-approved coordination channels where available, share the minimum necessary evidence, preserve chain of custody, and record jurisdictional and authority limits. Cross-border urgency does not confer authority to act on someone else’s systems. Capability gaps belong in preparedness planning and the board’s risk register. [GC006, GC046.]
13. Review, amendment, and proof of operation
The proposed review cadence is quarterly board oversight, annual review of the governance framework, and immediate targeted review after material changes in capability, reach, dependency, funding concentration, or a serious governance failure. #36 owns the recurring packet; D16 defines the control tests. The board should ask whether safeguards detect failure, whether appeals work, whether reviewers can obtain evidence, and whether the same exception keeps returning under a new name. [GC031-GC036, GC042-GC043, GC051-GC052.]
Before a high-consequence expansion, the proposing authority bears the burden of showing sufficient governance, not merely the absence of visible complaints. Its submission must identify actual capability and exposure, relevant control results, independent findings, residual risks, affected stakeholder interests, and a tested containment and recourse path. Unresolved critical findings block the expansion unless a lawful, explicitly authorized emergency path applies to a narrower protective action. [P23-P25; GC008, GC025, GC035, GC042, GC052.]
Acceptance of this design requires an explicit adopting act identifying the text, version, lawful authority, effective date, transition provisions, and implementation gaps. Constitutional changes use the constitutional process; ordinary administrative revisions may not disguise a change in reserved powers. Material amendments require affected-document and control reconciliation, preserved dissent, and a migration plan. The registry records adoption independently of whether the machinery is implemented or verified.
14. First-draft decisions and acceptance tests
Proposed choices requiring review are the five-seat board and independence test; term limits and stagger; the ordinary, reserved, and constitutional thresholds; thirty-day constitutional deliberation interval; funding-concentration review triggers; recourse targets; and emergency expiry and renewal periods. The source record supports the duties and structural objectives, not these exact numbers. Counsel must test legal feasibility; the founder and future lawful governing body must decide adoption. No named person is appointed by this text.
An independent reader should be able to trace a hypothetical donation with restrictive conditions, a conflicted director vote, an urgent system isolation, an appeal against the executive, and a proposed Charter amendment through a named authority and a complete record. Test at least one case where recusal removes the quorum, one where the founder is the subject of a complaint, one where a reviewer lacks evidence, and one where the same emergency permission is repeatedly renewed. A design that can describe only its happy path has not met this framework’s purpose.
The applicable GC slice is GC001, GC003-GC009, GC011, GC013-GC015, GC018, GC022-GC027, GC032-GC039, GC042-GC043, GC046, and GC050-GC052. Specialized references to adjacent controls explain intersections, not a competing catalog. D16 retains the common definitions. #25 must map legally embodied mechanisms; #26 records authority; #32 records actual organizational action. Until those acts and their evidence exist, this remains a candidate institutional design.