Court governance answers one question: who turns the court's dials, and how far. Verified people vote. A square root tempers wealth, and service earns weight. A hard product boundary keeps every outside token away from the court's pricing, treasury, and verdicts.
The diagram shows the boundary. The court's own voters adjust bounded pricing inputs and court windows; the load-bearing rules sit outside every ballot.
The court token
Turns the court dials: juror compensation, resolved-case test share, set appeal panel growth, windows, treasury.
The court token
One person's square root
Court weight is the square root of linked tokens, counted once per World ID. Wealth still buys voice, but slowly: 100 times the tokens gives 10 times the weight. Splitting into new wallets does not help, because linked balances sum before the root and unverified wallets have no vote at all.
Personhood closes duplicate identities. The per-person cap contains groups of collaborators. Receipt-free ballots let any recruited voter take the money and privately vote the other way.
A service multiplier then rewards two things: fees paid and reputation-credited cases. Both decay on a 90-day half-life, both saturate against live medians, and the multiplier tops out at ×4. No person may exceed 0.5% of court weight. Tokens count only after 30 days linked, with the snapshot fixed when a proposal opens.
Counting fees instead of claimed case value makes self-dealing costly, since sham cases pay the full court fee every time. Credited cases score lower when the case was obvious, so careless votes add little. And because the thresholds track current medians, old activity cannot lock in voting power.
Reputation and case history stay private. A voter proves their allowed weight from private records, so voting never links an identity to past cases, verdicts, or payments.
The attack
Pricing the takeover
Suppose 50,000 verified people hold court tokens, a median voter weighs about 177, and you arrive with a war chest. Three ways to spend it.
The root and cap contain one rich person. Fake service burns fees into the system being attacked. The one strategy that scales, recruiting thousands of verified humans, runs into the receipt-free encrypted ballot: a buyer cannot verify a single delivered vote. The attack becomes a vast, expensive coalition with no way to confirm it bought anything.
The rails
What a captured vote still could not do
Every adjustable parameter stays inside a program-enforced range, and passed proposals wait through a public seven-day delay. No vote can move value across the product boundary, make court ballots provable, make court weight linear, remove personhood, reopen final rulings or completed escrow, or redirect juror penalties away from the reward pool. The constitution is the part with no dial.
Governance approves only the bounded inputs to a public formula: the starting juror-pay reference, complexity bands, reward-pool target, and operations budget and cap. Supply and demand can still raise the final juror rate as far as required. Changes ship as a new pricing-policy version and never alter the version an accepted case already selected.
A narrow, public migration path can replace a faulty rule, with notice and user choice. There is no emergency key that crosses the firewall or touches an active case.
| Variable | Value at launch | Why this value |
|---|---|---|
| Court base weight | √tokens per World ID | Voice grows slower than wealth; personhood makes the root unsplittable. |
| Court service multiplier | 1 + 1.5·F/(F+HF) + 1.5·R/(R+HR), ceiling ×4 | Counts fees and credited cases, not volume or empty votes. |
| Per-person cap | 0.5% of the court house | Change needs a crowd. |
| Token holding period | 30 days before counting; snapshot at proposal | No rented votes, no buying after the question is asked. |
| Quorum / public delay | 4% of active weight / 7 days | Allows participation, exit, and challenge. |
| Court parameter ranges | starting juror-pay reference and complexity bands; reward-pool target; public operations budget and cap; resolved-case tests 5–20% of the score window; set appeal panel growth ×1.5–×3; case-selected initial appeal window up to one year; later windows reduce by at least 15%, with an optional 24-hour minimum | Pricing changes through versioned policies, while the demand-responsive juror rate has no upper cap; no vote can alter the finite route, timing, pricing policy, or quote of an accepted case. |
| Ballots | Receipt-free encrypted ballots | Court votes must be unsellable. |
| Constitution | No dial exists | Independent pricing and treasury, personal sublinear weight, finality, and penalty routing to the reward pool are permanent. |
The tokens themselves
Where the token comes from, and what it never does
| Token | Genesis allocation | After genesis | Economic role |
|---|---|---|---|
| DemoThemis court | Fixed 1B: 50% streamed over eight years by decayed service score; 20% to first-year case sponsors and jurors; 20% treasury; 10% builders | No inflation; trades freely because voting weight, not transfer restrictions, supplies the defense | Appeal service fees pay panel work and delay once; only forfeited security bonds enter the reward pool. |
The fixed supply is earned for court service and never pays salaries. Each funded appeal consumes its tagged panel-work and delay fee once; only a forfeited security bond enters the reward pool, and a successful appeal gets that principal back from escrow.
Public vesting, treasury, service-distribution, and voter-concentration reports keep the electorate legible. Broad participation finishes what the root, the multiplier, and the cap start.