The open tools

Permissionless means the function is open to anyone — you need only a wallet and gas. No allow-list, no sign-up, no approval. These are the public cranks: cranking one moves the machines along for everybody, and whoever pays the gas gets nothing special for it.

Self-serve means the function is gated to you — your wallet acts on your own position (your stake, your markers, your seat). Nobody can do it for you, and you need no one's permission to do it for yourself.

The one limit true of nearly everything here: you can crank these machines, but you cannot withdraw from them, cannot redirect them, and cannot touch the corpus. The endowment corpus is one-way by design. The shared retirement registry is the real one: 0xfd780B0aE569e15e514B819ecFDF46f804953a4B.

Members place kernel-weighted markers on jars; at each harvest the drips split by the live weights. Moving your marker reroutes your weight immediately.

Page: /vote/ · Governance manager (V5): 0xE8023a58a10fA4c248e4Ff8ae4EbB7BCA3DD40C0

• moveMarkers(...) — self-serve: moves YOUR kernel weight onto the jars you choose.

Can never: move anyone else's weight, take custody of money, or change where a jar ultimately sends funds. (V5 is in a 14-day soak ending ~2026-11-02 — keys held during proving; see §8.)

Address: 0x93cfDF9bb276719a92569A81854f4FFf26731A7e

• openJar(card) — permissionless: flips the on-chain "votable" flag for any registered card.

Can never: create or route funds, or force the website to feature a card. Tools open, UI curated.

Address: 0x9D914FE8387e82391cF4f29a400F34A7701CB341

• registerJar(...) — permissionless: registers a new beneficiary card on-chain.

Can never: force the website to display your card, or take anyone's money. Registering a card does not fund it — only members voting their kernels onto it routes yield.

Page: /join/ · SeatClaim 0x1b1e8d1934D2DDcf0AeB224EC04DBbc37AC19E86 · Gate 0xC37226904B09a345f29cf0bfD528291Cdf776ccd

An inviter spends a scarce invite and a distinct second member adds a free co-vouch; the gate completes the seat atomically. Two humans with wallets are the authority — no founder in the loop for seating.

Can never: let one wallet self-seat (a distinct second member is required), or take custody of funds. A kernel is a non-transferable voting voice — it can't be bought, sold, or transferred. Founding-seat cap 100, immutable.

Permissionless cranks anyone may call (the keeper does this daily, but it's open to all):

• scrape() — on a feeder/booster: folds loose USDC/token into its born-locked LP.
• harvest() — on an engine: sweeps accrued LP fees and disposes of them the one fixed way — registry-retire to 0xfd780B0a…, or Juicebox-burn for ART (proof = the ArtBurned event).

Can never: pull liquidity (LP cards are born-locked), withdraw/rescue (engines have admin=0x0, no withdraw door), or redirect the cause token anywhere but its fixed sink. These are LP machines, not deposit endpoints — don't bare-send expecting a receipt. MEV posture: 1% fee tier × two legs + an immutable ≤3%/hop cap means net extractable shrinks to ~≤1% minus gas, with the residue accruing to the machine's own locked LP.

Retired / burned to date (flywheel 2026-10-05): ART 345.97 (burned) · PR24 40.70 · PR25 14.81 · MGRO 0.0683 · CHAR 0.00493 · MSV 0.000185 · CBI 0.00013 · JLT-B23 first retirement landed · rest seeded. Retirement is not destruction and not certification — retired tokens are held forever at the registry as a public record of support.

Stake CEN; any CEN sent into the contract by anyone splits pro-rata among whoever has staked. Address: 0x64d5078E4cDBD13AEb140dcf8d4cDA0FdC98Afd8 (verified; CEN() returns the real CEN, owner() reverts = no owner).

• stake(amount) / unstake(amount) / claim() / exit() — self-serve: your stake in, your principal out any time, your rewards out. Unstake is always open — no lock, no pause.
• sync() — permissionless crank: folds any CEN that landed in the contract into the pro-rata accumulator.

Funding rewards is permissionless: anyone or anything funds the pot simply by transferring CEN to the address.

Can never: there is no owner, admin, pause, lock, withdraw, rescue, setter, or feeder key — confirmed in source, ABI, and a runtime-bytecode selector scan. The only value-out paths pay only the caller their own stake/earned amount. It pays no promised return. This is the one honestly keyless surface here.

Page: /staffing/. A staff member resigns their own chair, signed by their own wallet: earned pay to date is claimed out to them, the seat vacates, no questions owed. A vacant chair keeps earning while empty — a month empty is a month's pay as the next hire's sign-on bonus.

Can never: let one person claim another's chair pay, or touch the corpus (pay is vault yield only). Hiring and firing are founder-signed / seat-voted orders, not self-serve.

The off-chain message bus by which partners and their agents reach the CEN coordinator and each other. Read your files with GET /bus/files/<filename> using your token; send with POST /bus/send. File names are prefixed with your lane so you can see yours.

Can never: move money, touch any contract, or seat/vote/grant anything. The bus carries words, not funds — chain actions still run through the on-chain tools above. Tokens and server paths are issued privately, never printed in docs.

The surfaces where a key of ours still exists, each with its money-safety reason. None of these keys can touch, dilute, or strand a member's funds or the corpus — they are operational conveniences, co-signed powers, and presses, not withdraw doors. We never call a keyed thing "trustless."

• V5 governance keys (held, in soak): adoptMember and the keyed seat/jar/roster powers on the V5 manager stay live through a 14-day soak ending ~2026-11-02, so a migration defect can be fixed without a redeploy. V5 holds no funds — nothing is at risk. Sinks are tunable during the soak. Arc: keyed → vote-governed → renounced, on the founder's later word.
• grantKernel (staff power): a staff chair can mint a free voting kernel to a seated member, only co-signed by a second distinct staff chair, capped at 3 grants / 30 days per chair. It mints voice, never money.
• Keeper convenience: a keeper wallet runs the cranks on a schedule — but every function it calls is the same permissionless crank anyone can call. No special power; it cannot withdraw or redirect.
• Peg-maker / liquidity-manager keys: deepen pools and manage one-sided peg pools along fixed paths; not withdraw doors over member deposits — the Aave corpus is one-way regardless.
• Game-item mint keys (adjacent ecosystem): some game tokens keep their minter keyed forever to mint items as gameplay happens; game-layer presses, not CEN endowment money — listed for completeness.

The one question we answer about every keyed thing — "Can any key of ours touch, block, dilute, or strand someone's funds or the corpus?" — is NO for all of the above. Already keyless or sealed, and honestly callable so: the born-locked LP cards, the admin=0x0 engines, and CENStakingSimple.

• Experimental — nothing guaranteed. Nothing here is a promise of value, income, or safety beyond what the chain enforces.
• No income promises. Not an investment, not a security. Purchases are content and support. CBI-token buyers receive no yield.
• Retirement is not destruction and not certification. Retired tokens are held forever at the registry as a public record of support.
• We never custody other people's funds. A hard law. Other people's money moves only by code they control; members' no-withdraw deposits are contributions chosen knowingly.
• Tools open, UI curated. The on-chain tools are permissionless and open to everyone; what the website lists is editorial. "This page is curated. The chain is open."
• Live-price law. Any public value figure is read live from the on-chain market, never hand-set or projected.
• "Trustless" is never used for anything still keyed. The honest arc is keyed → vote-governed → renounced.