Product Constitution
Version: 1.0
Date: 2026-07-11
Status: Non-negotiable
Authority: This file + XEL LOCKED-MODEL (where character endowments apply)
Plane: XEL-152
Any design, PR, deploy, or ticket that violates these principles is out of scope until rewritten.
One-liner
Section titled “One-liner”Open Yield provides intelligence and automation. It never takes custody. Contracts hold capital; agents instruct within owner policy; owners can always exit.
Core principles (cannot violate)
Section titled “Core principles (cannot violate)”| Rank | Principle | One-sentence rule | Severity if broken |
|---|---|---|---|
| 1 | No custody of user funds | Team/protocol/server never hold or control principal. Users and agents interact with smart contracts (and venue protocols under policy). | Critical — product-killing |
| 2 | Users can always withdraw | Owner can withdraw principal anytime without team approval (subject only to onchain rules: fan-credit liability, conditioned tranches). | Critical |
| 3 | No hidden admin powers | No secret keys that freeze, drain, or rewrite user positions. Upgrades only via explicit, transparent, owner-consent paths. | Critical |
| 4 | Transparent onchain fees | Performance/routing fees are calculable onchain, disclosed in API/UI (gross vs net). Never offchain skim of principal. | High |
| 5 | Fee only when users earn | Protocol earns primarily as % of harvested yield (~5% default skim), not on deposits, tips, top-ups, or withdrawals. | High |
| 6 | Permissionless harvest | Anyone may trigger harvest/heartbeat (with bounty rules). Positions must not depend on the team to “maintain” yield. | High |
| 7 | Agent-native, owner-sovereign | Optimized for autonomous agents/characters, but owner root always overrides. Agents cannot withdraw principal or widen their own envelope. | High |
| 8 | Open execution layer | Core contracts, adapters interfaces, and orchestrator logic are open/verifiable. “Open Yield” is not a closed black-box optimizer. | High |
| 9 | Discovery ≠ execution truth | DefiLlama (and similar) may rank opportunities; venue adapter reads decide executable APY and amounts. | High |
| 10 | Honest numbers only | No invented APY, runway, or fees. Missing data → null / N/A / hide — never demo constants as live. | High |
XEL character overlay (when Open Yield powers a Living Character)
Section titled “XEL character overlay (when Open Yield powers a Living Character)”These add to the above; they do not replace them:
| Rule | Detail |
|---|---|
| Stake OFF by default | Owner opt-in Auto Yield; no auto-stake on mint |
| One automatic unstake only | Survival/storage shortfall — minimum amount only |
| Auto Pay | Post-fee, post-survival residual yield only — not liquid principal by default |
| Home chains Phase 1 | Sui + Solana execution homes; Base/Ethereum = bridge-in / discovery only |
Decision guide
Section titled “Decision guide”| Decision area | Follow | Pass test |
|---|---|---|
| Smart contracts | No custody + always withdraw + no hidden admin | Owner withdraw works without team; no admin drain |
| Fee model | Transparent + earn-when-user-earns | Fee only inside harvest/waterfall; shown as feeBps + net APY |
| Agent permissions | Agent-native + owner-sovereign | Agent harvests/plans; cannot withdraw principal or change fee/venues |
| Cross-chain | No custody | Bridge via protocol rails (e.g. Mayan); credit only after delivery; no team intermediate wallet as owner of funds |
| Discovery / AI routing | Discovery ≠ truth + honest numbers | Propose/rank offchain; execute only allowlisted adapters with live read_apy |
| Upgrades | No hidden admin | Immutable core where possible; otherwise timelock + owner consent / package migration |
| Product copy | Honest numbers | Never “guaranteed APY” or fee-free yield if skim applies |
What we learn from peers (and how we differ)
Section titled “What we learn from peers (and how we differ)”| Protocol | Lesson we take | How Open Yield differs |
|---|---|---|
| Superform | Immutable core, modular routing, non-custodial cross-chain mental model | Agent-native + Auto Pay; Phase 1 homes Sui + Solana |
| Yearn | Permissionless harvest; performance fees accepted | Simpler agent one-call surface; fee ~5% of yield (not 2%+20% stack by default) |
| Beefy | Multi-chain auto-compound UX | Intelligent routing + character/agent policy, not vault farm list only |
| Giza / closed agent optimizers | Agentic yield is real demand | Stay open — orchestrator anyone can run; no closed custody platform |
| OpenRouter (analogy) | One high-level call that routes | Same UX metaphor for capital, not LLMs |
We do not copy: custodial “send us USDC and we stake,” closed agent backends that hold keys to principal, or fee-on-deposit models.
Fee constitution (detail)
Section titled “Fee constitution (detail)”Full fee model: docs/09-fee-model.md
gross_yield → protocol_skim (~5% default, onchain bps) → survival bills (storage, etc.) → residual → compound and/or Auto Pay| Allowed | Forbidden |
|---|---|
| % of harvested yield (~5% MVP default) | % of deposit / tip / top-up |
| Optional x402 pay-per-call on data/API only | OpenRouter-style % tax on “credits” as core yield model |
| Disclosed routing fee on routed storage renewal | Hidden bridge markup as “fee” without disclosure |
| Keeper bounty from policy | Second Auto Pay % that double-charges residual |
| Pass-through venue/bridge gas costs | Withdrawal fee on principal (Beefy-style) |
| Management fee on idle principal as primary revenue |
Anti-patterns (instant reject)
Section titled “Anti-patterns (instant reject)”- User sends funds to a team/ops wallet “to be staked.”
- Admin key that can seize, freeze, or redirect principal.
- Agent can
withdrawprincipal or transfer aNFT. - Auto-stake every character on create.
- Fee charged at deposit or withdraw of principal.
- Harvest only callable by team.
- UI shows demo APY as live.
- DefiLlama APY used as sole input to size a live supply tx.
- Bridge credit before destination delivery confirmed.
- “Upgrade” that changes fee or withdraw rules without transparent process.
Governance posture (MVP)
Section titled “Governance posture (MVP)”- Prefer immutable fee + withdraw + harvest invariants on the execution path used by characters.
- Venue allowlists and adapter sets may evolve under owner policy and transparent protocol config — not silent admin.
- Token/governance for fee share is not required for MVP; do not block shipping on a token.
How to use this document
Section titled “How to use this document”- Every Open Yield PR description must name which principles it upholds.
- Code review: fail any PR that weakens rank 1–3.
- Plane tickets XEL-153…168 must not contradict this constitution; Codex/review comments that cite custody/fee/harvest take priority over convenience.
- Marketing: never claim non-custodial if any path holds user keys to principal without export/exit.
Related
Section titled “Related”| Doc | Role |
|---|---|
docs/01-implementation.md | How we build |
docs/02-agent-api.md | API surface |
docs/03-sui-move.md | Move / XEL treasury map |
docs/04-xel-integration.md | Plug into Living Characters |
docs/LOCKED-MODEL-XEL.md | Character economy authority |
Constitution end. If a principle must change, it requires an explicit product decision recorded here with date and owner — not a silent code change.