Aegis Charter

Version 1.0 · Adopted 2026-05-18, Year 2 of the Root, Fluen, Fidelis 4 · canonical source

This charter describes what Aegis is, what it is not, who consents to its protection, and what holds it accountable. It is binding on every Aegis instance hosted under the Soteria Covenant Trust and is the reference for any third-party evaluation of the protocol.

1. Purpose

Aegis is the Soteria Covenant Trust's theft-recovery infrastructure for property already on a trust schedule and for personal devices belonging to individual members who voluntarily register them.

It is not surveillance infrastructure. It is not a parental control tool. It is not law-enforcement tooling. It is not for tracking other people. It is not for tracking other people's devices. It is not for tracking unconsented hardware. The protocol enforces this at every layer.

2. Consent — the first invariant

Every device protected by Aegis is owner-registered. The owner-of-record walks through a registration flow, generates a per-device Ed25519 keypair on the engine, receives the private key once, and installs that key on the device themselves.

There is no method by which a third party can attach Aegis protection to a device they do not own. There is no fleet-enrollment tool. There is no MDM push. There is no silent install. For trust-owned devices there is an additional gate: the property must already exist in Blueprint, custodied by a Trustee at Membership tier ≥ 2.

3. The audit trail — the second invariant

Every Aegis act produces three independent records:

A SHA-256 hash-chain ledger entry on LUKS-encrypted RAID. Any tampering breaks the chain at the next verification.
An Ed25519 signature binding the act to the keypair that performed it (the device's key for beacons; the operator's session for state changes).
An OpenTimestamps anchor on the Bitcoin blockchain, providing third-party time-witness.

Every recovery act Aegis ever performs is independently verifiable after the fact, by anyone shown the ledger, without needing to trust Aegis or Soteria.

4. Governance

Tier	Role	Aegis capability
0	Beneficiary	Register personal devices; flag own; view own trail
1	Junior Trustee	+ Review own trust's protected fleet
2	Administrator	+ Register trust devices against custodied Blueprint properties
3	Senior Trustee	+ Cross-trust device review
4	Steward	+ Emergency override (ledgered as a steward act)

5. Scope limits

No remote screen / webcam / microphone / screenshot / keystroke capture. The agent reads only hostname, public IP, geo-IP, visible WiFi SSIDs, interface MAC addresses, and boot fingerprints.
No covert capability on non-consenting devices. Installation requires the device owner running an installer with root privileges.
No mass tracking. The MAC sightings registry uses a privacy-preserving bloom-filter protocol so cooperating routers never reveal non-flagged-stolen MACs to the registry, and the registry never reveals the flagged set to routers.
No third-party data sharing. Beacon data lives on owner-controlled infrastructure. It is not shared with advertisers, data brokers, or law enforcement absent valid legal process.

6. Pre-OS workstreams (UEFI / initramfs / BLE)

The v0.3 roadmap extends beacon coverage to layers above the OS — initramfs (pre-LUKS), UEFI firmware (pre-bootloader), and BLE radio broadcast for proximity detection. These are powerful capabilities; they require restating the consent invariant:

Every pre-OS beacon component is installed by the owner with root / Secure-Boot-enrolled-MOK privileges.
No pre-OS component is silent toward the owner: a UEFI beacon shows up in BIOS boot order; an initramfs hook shows up in lsinitramfs; a BLE broadcaster has a per-device control surface in the dashboard.
All pre-OS components are AGPL-licensed and reproducibly buildable. Owners can verify the binary on disk matches the published source.
Misuse-by-installer is mitigated by the same governance that gates everything else: a Trustee cannot install pre-OS beacons on a device not custodied by them; a Steward override on a non-trust device is not permitted.

7. Open-source commitment

Aegis is released under the GNU Affero General Public License version 3.0 (AGPL-3.0). The AGPL's network-clause requires that anyone hosting an Aegis instance as a service for others must publish their fork's source code. This is a deliberate choice: theft-recovery infrastructure, of all things, should be auditable end-to-end.

8. Standing offer

Suspected misuse of an Aegis instance — unconsented protection, missing audit trail, steward override outside its emergency role — should be reported to [email protected]. Reports are reviewed by the Trustee body. Substantiated misuse triggers an audit of the affected instance's ledger and, where applicable, a public disclosure.

Full charter text including misuse mitigations, cryptographic posture, and amendment procedure: CHARTER.md