The civic argument, concrete
A donation-funded, openly licensed model, governed at every boundary. The value lives in the governance layer many organisations validate, not the pretraining run.
The commons proposes. Every boundary disposes.
The commons only has to be trustworthy enough to be worth considering, not trustworthy enough to enforce. Nothing it publishes governs anyone until that organisation re-authors and signs it locally. That is the whole reason it is safe.
The two invariants
Invariant 1
A per-boundary contribution/adoption instance inside each organisation's trust boundary, and a commons-side curation instance that never reaches into any organisation's verdict path. No instance both curates upstream and enforces downstream.
This is Rule 1, separation of powers, applied to the commons itself.
Invariant 2
Nothing published reaches any organisation's enforcement until that organisation re-authors, validates, signs, and version-binds it locally. Pull, don't push.
Two sides, one guard between them
Each tagged COMMONS · gates nothing. It proposes; it never reaches a verdict path.
Re-authored, validated, signed and version-bound by you before anything governs a single action.
Policy exclusion · never
Identifiable patient records, classified material, never enter the open-model pipeline by any route, including federation. They still get local governance.
Admin approval · may
The approval queue is the revocation window, held, not flowing, until an admin releases it on a screen that states permanence.
You choose the authoring model
Semantic experimentTwo organisations governing structurally identical weights can end up with different libraries. Divergence is the product, not a defect, a hedge against monoculture and a sovereignty lever. (Premise-dependent: it rests on the same semantic experiment the meaning appliance awaits.)
The five per-boundary layers
Per-vertical templates, exclusion presets, DP bands, new verticals are template packs, not re-architecture.
Consent options, approval queue with a mandatory permanence screen, exclusion manager, provenance viewer.
A one-directional bridge with a directionality guard.
Commons-side, curates upstream contributions and their provenance.
Posture reporting only, never verdict contents, never raw data.
The lifecycle
Protection lives upstream of irreversibility.
Attest the protocol; don't vault the data.
Attested federated training proves the DP discipline was honoured and no ungoverned copy was taken.
The residual, stated plainly
DP bounds leakage, it does not eliminate it; federation reduces exposure, it does not zero it; a contribution cannot be deleted from a trained model. The permanence screen exists because this is true.
The honest boundary
Irreversibility is disclosed, not engineered away: once released under differential privacy into training, a contribution is permanent, hence the mandatory permanence screen, and an exclusion tier for classes that must never enter the pipeline. Residual-leakage bounds and federation limits are disclosed to every contributor. Federation-attestation components are Validating.
Rules 1 and 6 are the commons' load-bearing rules. The eight rules →