SOV NETWORK
← Back to home

SOV Network — Knowledge Bank

Civic education for the SOV Network: what it is, how to use it, and the protocols that make it work. This is the same Knowledge Bank shown inside the SOV app's Academy — published here so anyone can read it without installing anything.

Contents

What SOV is and why it exists

Why SOV is not in an app store, and has no company behind it

No single company should be able to switch off a network that belongs to its users. An app store is one gate, owned by one company: it decides who may install an app, and it can remove an app for everyone overnight. So SOV is delivered from places no single company controls: the SOV website and its mirrors, GitHub releases, IPFS and BitTorrent. Every release is signed, so you can check you hold the genuine file, and once SOV is installed the nodes find each other by themselves, with no website, store or server list needed. A store listing is not what makes an app safe; open code is. All of SOV is open source (Apache-2.0), and every node publishes the fingerprint of the exact code it runs, so anyone can check it. SOV also has no company, no chief executive and no owner, just like Bitcoin: nobody to pressure, buy, sue or shut down. Citizens run the nodes and decide the rules, one person, one vote. You do not have to trust a face; you can check the code.

How SOV keeps money safe without a blockchain or mining

Bitcoin is secure for two reasons: every node checks every rule itself, and mining decides the order of transactions and stops a cheater from inventing fake voters, because influence is measured in computing power. SOV keeps the first and replaces mining with something made for people. EVERY NODE CHECKS EVERY RULE: no money moves without its owner's own signature, every node verifies it, and the total is fixed at 50,000,000 SOV for ever, checked continuously by every node. A MAJORITY APPROVES EVERY SPEND: before money leaves an account, a majority of the validating nodes must grant that exact payment, and only one payment can ever get it. Proven on the live network: the same 600 SOV sent twice, through two different nodes, at the same moment, was paid once and refused once. ONE REAL PERSON, ONE ACCOUNT: joining takes a palm scan and a live face check on your own phone, so nobody can invent a crowd of fake accounts. That is why SOV needs no mining, no energy-hungry hardware and no race for computing power. Messages are end-to-end encrypted, and the nodes talk to each other over encrypted links.

Get started — from download to your first vote

1. GET THE APP. Download it from the SOV website's download page — for Android, Windows, macOS and Linux. It is not on Google Play or Apple's App Store: you download it directly, by web link, BitTorrent or IPFS, and the page gives a checksum so you can confirm the file is genuine. 2. ENROL. Open the app and follow the steps: a few short intro screens, allow the camera, then a quick liveness check (the app asks for one random movement — turn, move sideways, come closer or move back), then hold your LEFT palm flat in the frame (double-tap the frame to use your right palm instead). The photos never leave your phone. Then create your 6-digit PIN and write down your 12 backup words on paper — they are your key, and the surest way to restore your wallet. 3. YOUR WELCOME GRANT. When enrolment completes, the welcome grant is credited to your wallet automatically — there is nothing to claim. It is largest for the earliest citizens (1,000 SOV each for the first 10,000) and shrinks in tiers as the network grows. 4. FIRST SEND. On Home, tap Send SOV, enter the recipient's SOV ID and the amount, and confirm. The network fee is currently 0.1% of the amount, never more than 1 SOV. 5. FIRST MESSAGE. Open Messages → SOV Speak and tap the pencil button to start an encrypted conversation with a citizen's SOV ID. 6. FIRST VOTE. Open Governance → Votes to see open polls and cast your one vote; new proposals start from the Constitution tab. 7. RUN A NODE (optional). In the desktop app, on Home tap "SOV Network · View Dashboard →" to open Node Status, and switch Full Node ON; a node that stays up about three weeks starts earning the operator reward.

The world needed something new

Bitcoin proved that money does not need a bank. But Bitcoin never solved identity, communication, or justice. The SOV Network was built to go further — a single network where you own your identity, your money, your messages, and your voice in how the rules are written. Not controlled by any company. Not dependent on any government. Built to outlast them both.

Not a blockchain — a Sovereign Mesh

SOV is NOT a blockchain. There are no blocks, no chain of blocks, no mining race, and no global queue every payment must wait in. SOV is a SOVEREIGN MESH: self-contained nodes that gossip peer-to-peer, each holding the shared ledger, confirming transactions by witnessing them rather than by burning energy. It is called a "mesh" because the nodes form a web with no centre — any node can leave or join and the network carries on; and "sovereign" because YOU — not a company, not a chain — own your identity, your money, and your voice. Its one genuinely new idea is PROOF OF PERSONHOOD: one human, one wallet: your phone captures your palm and face, and the network refuses a second enrolment of the same person. That is what no blockchain has — the network knows you are a real, unique person without knowing who you are. So when you describe SOV, don't reach for "crypto" or "blockchain". Say what it actually is: a sovereign, proof-of-personhood mesh — self-contained nodes, one human one wallet, no central operator, and no app-store gatekeeper — the app is downloaded directly, not from Google Play or Apple's App Store.

Your identity is your key — nothing else

Every other network asks you to trust a company with your password, your phone number, or your email. SOV asks for none of those. Your palm proves you are you, and your 12 seed words hold your key — no corporation can reset or revoke either. When you enroll, the photos of your palm and face never leave your phone. Your phone derives a palm template and a face fingerprint, and those go to the network, which keeps them only in protected, scrambled form so it can refuse a second enrolment of the same person. Your SOV ID is yours permanently — no account to be banned, no service to be shut down.

Everything Bitcoin is — and everything it is not

Bitcoin is digital gold — scarce, decentralized, and unstoppable. SOV respects that design. But Bitcoin has no identity layer, no messaging, no governance, no justice system, and no built-in community. It cannot tell who is human and who is a bot. SOV solves all of that. One human, one wallet. The network knows you are real — and that changes everything.

The last network that can be built this way

Governments are moving fast to regulate digital identity and digital money. The window to build a truly free, sovereign network is closing. SOV was designed from the ground up to operate behind firewalls, survive hostile infrastructure, and resist seizure — because citizens in many countries cannot afford to wait for permission. Every citizen who joins today makes it harder to stop tomorrow.

Works behind firewalls and in blackouts

SOV Speak routes messages through relay nodes that operate on standard ports. Because it uses the same port as ordinary secure web traffic, it is harder to block than many apps. When a recipient is offline the message waits only in the sender's outbox on their own device — no node stores it, not even encrypted. The moment the recipient reconnects, the network announces their presence and the sender's device delivers it automatically. Message content is encrypted end to end, so a node passing it on cannot read it — not the operator, not the network, not anyone who seizes the machine — and no node keeps it. What a node does keep is the minimum needed to deliver: that a message passed between two SOV IDs, and when. That record is pruned on a schedule citizens vote on.

How SOV works

SOV is a peer-validated digital currency secured by biometric identity. Every citizen gets a wallet, a SOV ID, and a permanent place on the shared ledger. No bank account required. No minimum balance. No credit check. If you are human and you have a phone, you qualify.

Justice without courts

On the SOV Network, citizens have a real dispute process — no lawyers, no court fees, no waiting months for a ruling. If you have a dispute with another citizen, you file it with a bond (currently 10 SOV): returned if you win, paid to the jurors and the defendant if the case is dismissed. Citizens selected at random form the jury (three to start, up to seven); each juror has 48 hours to respond, then reviews the evidence and votes. A conviction currently needs two-thirds of the jurors (all of these numbers are set by citizen vote) and moves the disputed amount back from the wrongdoer as far as their balance covers it, and the verdict is recorded on every node. This is the first digital economy where justice is built into the protocol.

Your vote actually changes the rules

The Network Constitution is not a document written by a company and handed to you. It is a living set of protocols and values that citizens vote on. Every enrolled citizen votes equally — your balance does not change your weight. When a poll closes, the winning option takes effect for the whole network if at least 10% of enrolled citizens voted (that quorum is itself set by vote). The citizens own the rules.

Running the network

The SOV Network runs on nodes operated by enrolled citizens around the world, each node admitted by signed approval from other nodes. Nodes keep the shared ledger in sync, pass on encrypted messages (keeping none of them), and witness transactions. No single node can move your SOV: every payment, Vault, exchange listing, bond or platform fee is signed on your own device, and before anything moves a majority of the nodes each check that signature, the amount and your balance for themselves — the node you are connected to only carries your request. The more operators there are, the stronger, faster, and more resilient the network becomes. Any enrolled citizen can run a node — on a server, or on their own computer with the desktop app. This is infrastructure owned by the people who use it.

To run a node, see Running a node.

Run a node on macOS or Linux

The SOV desktop wallet is the same application on Windows, macOS and Linux, and on all three it is also a full node — the node is not a separate download. What differs between them is only how you get Tailscale, and Tailscale is needed ONLY if your connection cannot accept incoming traffic. START HERE, on any of the three: install the wallet, sign in, on Home tap "SOV Network · View Dashboard →" to open Node Status, leave "How citizens reach this node" on Automatic (the other choices are Tailscale Funnel and Static IP, for a machine with its own public address and open ports), and switch Full Node ON. On ordinary home broadband the app opens your router itself, or relays through the mesh if your network is awkward, and you configure nothing at all. When its status line reads "Serving citizens", you are serving, and uptime is what earns. A desktop node serves citizens, relays and keeps a copy of the ledger, but it does not vote on payments (the server nodes do that), so switching your computer off never holds up a payment for anyone. Most people never need anything below this paragraph. IF AUTO CANNOT GET THROUGH — mobile hotspot, CGNAT, student or office Wi-Fi, any network where you cannot forward a port — you use Tailscale Funnel, which gives your node a stable public address over an outbound-only connection, on Tailscale's free personal plan at the time of writing. You install Tailscale yourself and sign in to YOUR OWN Tailscale account. The SOV network never provisions it for you and never sees your tailnet. ON WINDOWS the wallet can install Tailscale for you: press Install Tailscale and accept the normal Windows prompt, then sign in through your browser once. ON macOS you install it yourself first — from tailscale.com/download, or with "brew install --cask tailscale" if you use Homebrew. Open Tailscale once and sign in. The wallet then finds it automatically, including the App Store version, whose command-line tool lives inside the application bundle rather than on your PATH. ON LINUX install it with your package manager — "sudo apt install tailscale" on Debian or Ubuntu, "sudo dnf install tailscale" on Fedora, "sudo pacman -S tailscale" on Arch — then "sudo tailscale up" and sign in. Linux needs ONE extra command that Windows and macOS do not: "sudo tailscale set --operator=$USER". Without it the wallet cannot talk to the Tailscale service, because that service is owned by root. Run it once and you are done; the wallet will tell you if you forgot. Then on any OS: set "How citizens reach this node" to Tailscale Funnel, switch Full Node ON, and the first time only, approve the Funnel link in your browser. Citizens reach you on the standard secure port with no port-forwarding anywhere. A note on Linux desktops: the wallet needs a few system libraries that some minimal installations leave out, and a keyring to store your keys in. The download page lists the exact packages. If the wallet will not start on a server or inside a container, that is expected — it is a desktop application, and a machine with no screen should run the node software directly instead.

Using SOV day to day

One human, one wallet

The SOV Network allows exactly one wallet per person, enforced by biometric identity. The network refuses a second enrolment of the same palm or face, so one person cannot join 100 times to multiply their vote or their grant. Every citizen has equal weight in governance. Every new citizen gets the same rights and one equal vote; the welcome grant is largest for the earliest citizens and shrinks in tiers as the network grows. The network is designed for people — not corporations, not algorithms.

SOV Value and the ⟡ symbol

The ⟡ symbol represents the SOV reference rate — the citizen-voted guide price of 1 SOV. Citizens propose a price, and the median of the current proposals becomes the rate. Early on it may rest on very few proposals, so treat it as a guide, not a quote. No exchange sets this number. No company owns it. Citizens decide the value of what they built.

A real economy — not a speculation game

SOV is not designed to be traded on exchanges and pumped by speculators. It is designed to be earned, spent, and saved by real citizens doing real things. Node operators earn for keeping the network online. Citizens earn by providing genuine goods and services to one another. The SOV economy rewards real participation, not speculation and not recruitment.

Sending and receiving SOV

Send SOV to any citizen using their SOV ID. Transactions confirm in seconds across the relay network. The only cost is a tiny network fee — currently 0.1% of the amount you send, capped at 1 SOV per transfer (both set by citizen vote). That fee is not taken by any company: it flows into the operator reward pool that pays the citizens hosting the network. No intermediaries, no waiting for business hours. Recent transactions sync to your device automatically every time you connect — so anything that arrived while you were offline is waiting for you. Your wallet is your own record; use the Backup & Restore feature to back up your history and keep it safe.

SOV Speak — messaging with receipts

SOV Speak lets you send messages, voice notes, photos, and files to any citizen on the network. Every message shows its status — Sending, Delivered or Offline, and Read if the recipient has read receipts on. You can open Send SOV straight from a conversation, with the recipient already filled in. No phone number required. No SIM card. Just your SOV ID.

Protecting your wallet

Your wallet is secured by your 12-word seed phrase, an optional 6-digit PIN, and guardian recovery. Write your seed phrase on paper and store it safely — it is the surest way to restore your wallet if your phone is lost or stolen; a backup file or your guardians can also restore it. No central authority can freeze your funds, reset your access, or demand your keys. This is what it means to truly own your money.

SOV Vault — leave SOV to your family

A Vault lets you set SOV aside for someone you choose, to be claimed on a date you set. You choose the amount, the release date and the beneficiary (their name is stored only in encrypted form), and you give them a CLAIM KEY. You can also add up to three FAMILY KEYS, each with a hint, as a fallback. The SOV stays in your wallet but is locked — you cannot spend it, and you can cancel the Vault at any time while it is locked, which unlocks it again. DIRECT CLAIM: once the release date has passed, the beneficiary enters the claim key and the SOV moves to their wallet. FALLBACK CLAIM: if the claim key is lost, a claimant presents a family key and a statement, and a council of up to nine randomly chosen citizens reviews it for seven days; it is approved when at least three have voted and at least two-thirds of the council approve, and the SOV then moves to the claimant. An abandoned Vault is not lost: if its owner shows no sign of life for 20 years, it moves to the operator pool — and it can be restored if the owner or a verified heir claims it. Logging in counts as a sign of life, and ordinary balances are never touched.

SOV Link lets any website or app accept your SOV ID as a login. It works in two phases. The FIRST time you visit a SOV-enabled site, you tap "Sign in with SOV", and the browser shows you a 6-digit pairing code. You open your SOV app, go to Profile → Security → Verify My SOV ID with External Site, type the code, confirm the site name, and choose a password just for that site. Your SOV app signs the link on the device — your seed phrase never enters the browser, never reaches the external site, and never leaves your phone. The site password you choose goes to a node once, when you link; the network keeps only a one-way check value of it. EVERY TIME after that, the site shows a normal username + password form. You type your SOV ID and the password you created for that site. The site can check the password on its own server, using a one-way check value it received when you linked, so day-to-day sign-ins are instant and keep working even when the SOV network is busy; it can also ask the network to confirm. Choose a different password for every site, so a breach at one site exposes nothing at another.

Many login systems use a QR code on the desktop that you scan with your phone. SOV Link deliberately does NOT do this. A photographed or screenshotted QR code is a fully valid login token — anyone who captures the picture could log in as you before you do. SOV Link uses a short 6-digit numeric pairing code instead. The code is one-use, expires a few minutes after it is shown, and is bound to the specific website domain you are trying to sign in to. Even if someone watches you type it, they cannot become you with it: the code only starts the pairing, and the sign-in is not authorised until your own device approves it with your own key. It also works for one site only, and once used it cannot be used again. This is a deliberate design choice — small operational friction (typing 6 digits) traded for a meaningful improvement in phishing resistance.

For a detailed end-to-end walkthrough showing what every actor does — a developer connecting a website, a citizen signing in for the first time, and that citizen returning a week later — read the SOV Link articles in this Academy, especially the exact-steps guide for site owners. Together they explain the two-phase model (a one-time link, then repeat logins the site can check on its own server), why SOV Link uses a short pairing code instead of a QR code, and what guarantees the protocol delivers versus what it does NOT do. Written so a non-technical reader can follow it straight through.

If you build the website side, start with the exact-steps article in this Academy. The site owner registers the platform in the SOV app and receives a small download: a ready-made PHP plugin with the platform's ID, its callback secret and the node list already filled in, plus a README. Your server needs two small pieces — one that starts a sign-in and shows the 6-digit pairing code, and one that receives the signed confirmation when the citizen approves it — and the plugin provides both. In short: the walkthrough tells you WHAT happens during a SOV Link sign-in; the plugin is the working code that makes it happen on your own site.

For platform builders — connect in 15 minutes

If you run a website or app and want one-human-one-account, SOV Login is the easiest way to add it. You do three things: connect your platform once on the network, add a "Sign in with SOV" button that shows the citizen a 6-digit pairing code (the citizen approves it inside their SOV app under Profile → Security → "Verify My SOV ID with External Site" — no seed phrase is ever typed into a browser and there is no login page hosted by anyone else), and accept the signed confirmation when the citizen returns. On your side you simply keep one account per SOV ID — the SOV identity layer is built so that each ID belongs to one person, so you get a bot-proof, one-person-one-account user base with no captchas, no SMS codes, and no KYC paperwork. The exact-steps article in this Academy shows the whole setup.

Connecting a new platform to the network

Before a website can offer "Sign in with SOV", it has to be connected to the network — and there is no admin office, no corporate sign-up, and no key handed out by a company. It is done by an enrolled SOV citizen who approves the request with their own identity and pays a yearly SOV fee (currently 10 SOV per 365 days, both set by citizen vote). That fee flows into the operator reward pool that pays the people running the network — the total SOV supply never changes. The network keeps no special administrative override: by design, only a real, biometrically verified human can add a platform. The owner registers the platform from their own wallet — Profile → Register a Platform — so the request is signed on their phone and no seed phrase is ever typed anywhere. The network returns the platform's ID and a callback secret, which the platform uses to check that sign-in confirmations are genuine, already packed into a ready-to-install plugin. From that moment the platform is live.

Add "Sign in with SOV" — the exact steps

This is the complete, do-it-today setup — no PDF needed. It is two short jobs: the OWNER registers the site from their wallet, then a developer drops one file in place.

PART 1 — THE OWNER (2 minutes, inside the SOV app):
1. Open Profile → tap "Register a Platform".
2. Type your website domain (e.g. myshop.com).
3. Type your Callback URL — the page on your site that will receive the signed login result (e.g. https://myshop.com/api/auth/sov-callback). If you are not sure, your developer will tell you; you can re-register later.
4. Tap "Register & Pay Fee". Your wallet signs it and the fee (currently 10 SOV, renewed every 365 days) goes to the node-operator pool. No servers, no command line.
5. The app then hands you a DOWNLOAD: a small .zip (sov-login-<yourdomain>.zip). Inside are just two files — "sov-login.php" (your ready-to-use plugin, with your platform ID, your callback secret and the node list already baked in) and "README.txt".

PART 2 — HAND IT TO YOUR DEVELOPER (or do it yourself):
Send them that .zip. It already contains your keys — there is nothing to configure. Tell them: "keep sov-login.php on the server, never put it in a public code repo — it holds our login secret." Then they do three things:
• Step 1: Upload sov-login.php into the web root, next to the login page.
• Step 2: On the "Sign in with SOV" button, add: require_once "sov-login.php"; SovLogin::initiate(); — that starts the sign-in and returns the 6-digit pairing code to show the visitor.
• Step 3: On the callback page (the URL from step 3 above), add: require_once "sov-login.php"; $data = SovLogin::handleCallback(); — the plugin verifies the network's signature for you, and $data["sovereign_id"] is the verified citizen. Start their session and you are done.

That is the whole integration. Because SOV already guarantees one human per identity, keeping one account per sovereign_id gives you a bot-proof, one-person-one-account user base with no passwords to store, no captcha, no SMS codes and no KYC paperwork. Repeat logins after the first are checked on your own server, so they are instant and keep working even if the network is busy.

CLI 1 of 5 — why SOV ships no SDK, and does not need one

Most networks hand developers a library, then ask you to trust it. SOV does something simpler: the desktop app IS the developer tool. SovNode.exe runs headless — the same binary a citizen double-clicks will, given "--cli", act as a scriptable wallet that speaks JSON. There is nothing extra to install, no API key to request, no package to audit, and no company in the middle. Run "SovNode.exe --cli --help" and you have the entire surface. On macOS and Linux the desktop app's own executable takes the same --cli flag. Why this matters: an SDK is a dependency, and a dependency is a party who can change the rules, break your build, or be pressured. The CLI is just your own wallet, operated by a script instead of a finger. It signs with the key already sealed in your operating system's credential store, talks to the same relays your app talks to, and obeys exactly the same protocol rules. Nothing about automation makes you a second-class citizen on the network — a script and a human are indistinguishable to the protocol, because both are the same signed identity.

CLI 2 of 5 — the complete command surface

Everything begins with "SovNode.exe --cli". MONEY: "balance" shows what you hold; "send --to <sov-id> --amount 10 [--memo \"text\"]" transfers; "history [--limit 50]" lists past transactions; "contacts" lists saved citizens. MESSAGES: "msg --to <id> \"hello\"" sends; "msg --list [--with <id>] [--limit 20]" reads; "msg --listen [--seconds <n>]" stays online and prints messages as they arrive. WALLET: "status" shows your identity, relay and balance; "restore --seed-file <path>" restores an existing wallet from its 12 words, headless. NODE: "node status|on|off" starts or stops the bundled full node on this machine. EXCHANGE: "exchange orders" browses the book; "exchange mine" shows yours; "exchange create --amount 100 --memo \"...\" [--price 950 --currency NGN]" lists SOV for sale; "exchange chat --order <id>" and "exchange chat-send --order <id> --to <sid> \"...\"" negotiate directly on the listing; "exchange threads --order <id>" is the seller's negotiation inbox; "exchange create" also takes --payment "<how fiat is paid>" and --days <n>; "exchange fill" takes --agreed <fiat per SOV> to fill at negotiated terms; "exchange fill --order <id>", "exchange confirm --order <id>", "exchange cancel --order <id>" complete or withdraw. SECURITY: "spendlock status|enable|disable --pin <code>", "hwlock status|enable|disable [--hello]", "automation status|set|allow|deny|off|cancel". GLOBAL FLAGS: "--json" makes any command emit machine-readable output — this is what turns the CLI into an API; "--pin <code>" supplies the PIN so a script never stalls waiting for input; "--node <wss://...>" pins a specific relay. Every command returns a meaningful exit code, so shell scripts can branch on success or failure without parsing text.

CLI 3 of 5 — the four security tiers (read this before automating money)

Automation that can spend money deserves more care than automation that reads it, and SOV gives you four escalating tiers. TIER 0 — PIN GATE: the PIN stops a casual passer-by, nothing more. Anyone who can run the executable as you can move your SOV. Never run the CLI on a shared, hosted, or borrowed machine. TIER 1 — SPEND-LOCK ("spendlock enable --pin <code>"): the private key is no longer stored in the clear at all; only a PIN-encrypted blob is kept, hardened with Argon2id, which is memory-hard and therefore brutally slow to brute-force even though a PIN is short. The decrypted key lives in memory for a bounded session only — the same idea as Bitcoin Core's walletpassphrase timeout, so automation unlocks once instead of re-prompting per transfer. TIER 2 — HARDWARE-LOCK ("hwlock enable [--hello]"): the seed is sealed by your machine's key store — the TPM on Windows (or Windows' non-exportable software key store if there is no TPM), the Secure Enclave on Mac; hardware-lock is not available on Linux — with a key that cannot be exported. Copying the file to another computer gains an attacker nothing, because only that machine's key store can unseal it. Add "--hello" and every unseal additionally demands your fingerprint or face. TIER 3 — NETWORK-ENFORCED CAPS ("automation set --per-tx 5 --daily 20 --allow id1,id2"): the previous tiers protect the key; this one protects you from your own script. Limits are enforced by the network, not by your code: before any of your SOV moves, every node that has to agree checks them — for payments, Vaults, exchange listings, bonds and fees alike — so a runaway loop or a compromised script cannot raise them, pick a lenient node, or route money through another feature. The daily total is counted from the shared ledger, so spreading payments across nodes does not stretch it. With an allowlist set, your wallet can ONLY pay the accounts on it: Vaults, exchange listings and fees are refused until you remove the allowlist (removing it, like raising a cap, takes effect only after a 48-hour cooling-off delay, so a stolen key cannot loosen your limits at once; tightening them is instant). IMPORTANT: your seed phrase always restores the wallet, so a dead TPM or a forgotten PIN is never lost funds — hardware sealing is at-rest hardening, never the root of custody.

CLI 4 of 5 — building an agent that runs your wallet

Because every command speaks JSON, a working agent is remarkably short. The loop is: poll "msg --list --json" for new messages, decide what to do, then act with "msg --to" or "send --to". That is genuinely the whole architecture — a reference implementation lives in the project at tools/cli_automation/, where a single decision function sits between reading and acting. Swap that one function for a call to an AI model and your wallet answers its own messages in your voice; leave it as simple rules and it is a predictable bot. Useful shapes: an auto-responder that replies while you sleep; a payment watcher that notices incoming SOV and confirms delivery; an OTC desk that quotes prices in the exchange chat and fills orders at terms you set; a monitor that reports your balance to your own dashboard. THE RULES THAT KEEP THIS SAFE: put a hard spend cap in the code AND in the network ("automation set"), so a bug cannot drain you. Keep an allow-list of recipients — never let the agent pay an address it learned from a message it just received, which is exactly how a prompt-injection attack would try to rob you. Never commit your PIN to source or paste it in a screenshot. Use "msg --listen" to receive messages as they arrive, or poll "msg --list --json"; either way, build for eventual consistency. And understand that you are responsible for everything your automation signs, because to the network it is you.

CLI 5 of 5 — what the CLI deliberately cannot do

A tool is defined as much by its refusals as its features. THE CLI CANNOT ENROLL YOU. There is no headless account creation, and this is deliberate rather than unfinished: enrollment requires a live palm-and-face scan proving a real, unique human is present. If a script could enroll, one person could mint thousands of identities and one-human-one-wallet — the single idea SOV is built on — would collapse overnight. So the CLI only ever operates an identity that already exists, created by a human with a camera. THE CLI CANNOT READ OTHER PEOPLE'S MESSAGES. Message bodies stay end-to-end encrypted; the CLI decrypts only your side, using your key. THE CLI CANNOT FORGE A RELEASE, appoint itself an operator, or vote twice — every action carries your signature and is checked by the network exactly as the app's actions are. WHAT THIS MEANS FOR YOU: the CLI is a key-holder's tool, not a skeleton key. It makes an existing citizen faster; it cannot manufacture citizens. That boundary is why automation can be handed this much power safely — the scarce thing on SOV was never compute or code, it is verified personhood, and no amount of scripting creates more of it.

For developers: automate your wallet with the CLI (no SDK needed)

SOV ships no developer SDK — and does not need one. The desktop app, SovNode.exe, doubles as a headless command-line wallet that runs on your ALREADY-SIGNED wallet and speaks JSON, so any program (or an AI assistant) can do everything you do by hand. Run "SovNode.exe --cli --help" to see it: check balance ("--cli balance --json"), send SOV ("--cli send --to <sov-id> --amount 10"), read and send messages ("--cli msg --list --json" / "--cli msg --to <id> 'hello'"), pull history, and even drive the P2P Exchange ("--cli exchange orders|create|fill|confirm"). Every command takes "--json" for scripting and "--pin <code>" so it never has to stop and ask. That is a complete automation surface: a short script can WATCH your inbox for new messages, AUTO-REPLY (or hand each message to an AI that answers on your behalf), forward, report your balance, or auto-pay a trusted contact within limits you set. THE LIMITS ARE THE SECURITY MODEL, not a footnote. (1) Private PC only — the CLI signs as YOU using the key sealed in your operating system's credential store, so anyone who can run the exe on your machine can move your SOV; never on a shared or hosted box. (2) A signed or restored wallet is required (the CLI can restore an existing wallet from its 12 words with "restore --seed-file") — there is deliberately no headless enrollment, because enrollment needs a live palm-and-face scan (proof of personhood) that cannot be scripted; the CLI only operates an identity that already exists. (3) Keep your PIN out of source and out of screenshots. (4) It can listen for messages as they arrive ("msg --listen") or poll, and message bodies stay end-to-end encrypted — the CLI decrypts only for your side. (5) You are responsible for anything your automation sends, which is why auto-transfer should always sit behind an allow-list and a hard spend cap. Used this way, a citizen can point a personal AI at their own wallet — replying to SOV Speak messages, watching for payments, running an OTC exchange desk — entirely from their own machine, with no company, server, or API key in the middle. A ready-to-run reference agent lives in the project at tools/cli_automation/.

Protocols — how the network works

Protocol: Why SOV has no usernames

SOV deliberately has no usernames, no @handles and no display names you can choose. That is a privacy decision, not a missing feature. The moment citizens can type their own name, some of them will type their REAL name — and a network that promised no personal data would be quietly leaking it, permanently and publicly. So the protocol never offers the field at all. Instead every citizen gets a nickname the network derives from their SOV ID: the same ID always produces the same nickname, on every device, because it is computed from the ID itself rather than looked up anywhere. It carries no personal information, because there is none to carry - the ID is all it is made from. Your SOV ID remains the only network identity; the nickname exists purely so humans can recognise a contact at a glance instead of reading a 20-character string. Nobody can buy, squat or transfer one, because nobody chooses one — including you. Two citizens can occasionally get the same nickname, so always confirm a contact by their SOV ID.

Protocol: The Sealed-Launch Invariant (§905)

The released code has NO special admin key — every privileged action must be authorised by a real biometrically enrolled citizen, approving it with their own on-device key and paying any fee from their own wallet. There is no admin token, no super-user key, no founder override, and no hidden "administrator" flag anywhere. Connecting a platform, creating a poll, filing a petition, opening a dispute, publishing an Academy article — all follow the same rule: the citizen approves the action on their own device (the private key never leaves it), over a connection the network has already proved belongs to that enrolled citizen, so no privileged action is possible without their key; the network then takes any required fee and performs it. A transfer additionally carries its own signature over its amount and its recipient; whether a transfer with a bad signature is refused or only logged is itself set by citizen vote (it is currently logged while the format is proven). This is why no founder, operator or state can act for a citizen: the only way to act for a citizen is to BE that citizen, holding their key. Spreading node operation across many independent operators is the work still in progress.

Protocol: Petitions — the off-cadence governance path

A petition lets any enrolled citizen propose switching a network protocol on or off without waiting for a formal poll cycle. Fellow citizens SIGN it (one signature per citizen, enforced at the database layer). If signatures cross the supermajority threshold (default 67% of enrolled citizens) the change activates immediately — no poll needed. If they cross the lower threshold (default 33%) a normal governance poll is created automatically for the rest of the network to vote on. If neither threshold is met before expiry, the petition is rejected by silence. Petitions are the escape hatch alongside paced polls: a clear supermajority skips debate; a significant minority escalates to a vote; weak support simply lapses. Numeric values — fee rates, jury sizes, retention windows — change only through a poll: a petition carries a direction and not a number, so even a 67% petition on a numeric value changes nothing. Both petition thresholds are themselves citizen-tunable by poll.

Protocol: How citizens govern every value (4-part contract)

Every value citizens can vote on follows a mandatory four-part contract, so that a value the citizens govern is never left as a number baked into the code: (1) the parameter is declared with its range, (2) seeded with a sensible default on first boot, (3) read from the governance table at runtime (never a baked-in number), and (4) given a pre-built poll in the app Constitution tab (most values have one already; the rest are being added). There are dozens of such parameters today — poll durations, fee rates, jury sizes, retention windows, and more — and the registry grows as new features land via the same contract. A critical rule: governance values are always read as strings and compared exactly (a binary protocol gate checks == "1"), because a number cast silently breaks the gate. If citizens should be able to vote on it, it must pass through all four parts — no exceptions. This is the §905 invariant made concrete: the way a feature is written determines whether citizens can adjust it.

Protocol: Network fees — small, capped, and paid to the people who run it

SOV charges small, citizen-voted fees on a few actions, and none of it goes to a founder or gets burned into nothing — every fee flows into the operator reward pool that funds the citizens hosting the network. THE TRANSFER FEE is currently 0.1% of the amount you send, and it is CAPPED — currently at 1 SOV — so no single transfer, however large, ever costs more than that ceiling. THE EXCHANGE FEE is currently 1% of a completed trade. THE PLATFORM FEE is paid once a year by a business that wants to accept "Sign in with SOV" — ordinary citizens NEVER pay to log in anywhere. All three fee rates and the transfer cap are governance parameters: citizens can vote the rates up, down or to zero, and voting the transfer cap to 0 removes the cap. This is the SOV economy in one sentence — the cut a bank would keep is instead a citizen-set, capped contribution that circulates straight back to the people doing the work.

Protocol: Operator income — earning by keeping the network alive

Citizens who run relay nodes earn SOV for the real work of keeping the network running: staying online and serving (a per-transaction reward also exists, currently set to 0 by vote). A node must be CONTINUOUSLY up for a qualifying period (a current default of about three weeks) before it earns — sleeping or shutting the machine down breaks the streak, so payouts reward genuine uptime, not machines that are mostly off. Payment is a fixed reward per relay per 30 days (currently 20 SOV, set by vote), with a deliberately steep anti-monopoly curve: your first relay earns the full reward, a second and third earn a quarter each, and a fourth or beyond earns nothing but recognition — so running a farm of nodes gives you no advantage, keeping the network spread across many independent operators. Crucially, operators are paid FROM THE FEES that flow in first, and only then, capped, from the genesis reserve — so as the network grows and fees rise, it funds its own operators and the reserve becomes a long-term runway rather than a pot that drains. You can watch every fee flow into the pool and every payout leave it on the live SOV Economy screen — the ledger is public.

Protocol: How a new node is let in

Anyone may run a node, but no node lets itself in. When a new node first meets the network it announces itself, and the peers that hear it check three things against their own copy of the ledger: that the operator gave a SOV ID at all, that the ID belongs to a genuinely enrolled citizen, and that the node runs exactly the software the rest of the network runs. A node offering no operator ID is refused outright, and so is one running different code. A citizen may run more than three nodes, but the fourth and later earn nothing. That is not bureaucracy — a network that accepts anonymous nodes can be flooded by one person running thousands of them, and every vote and every payout after that is meaningless. The question is not put to the whole network. Asking every node would get slower each time the network grew, and it would also be weaker than it sounds: if any single node's approval were enough, one dishonest node could wave in anything it liked. Instead a small sample of peers is asked (currently 5), and a set number of them (currently 3, never more than the peers available) must sign approval; other nodes accept the newcomer only with a certificate of those signatures from nodes they already know. The cost of admitting a node stays the same whether the network has ten nodes or ten thousand. Checking costs the network nothing. Every node already holds the full enrollment ledger, so "is this a real citizen?" is answered on the spot, from local data, without asking anyone. How many peers are sampled and how many must agree are both citizen-governed values, so the network can tighten or loosen its own front door by vote as it grows.

Protocol: One human, one identity — the face lock

SOV guarantees one account per living person, and it is built to enforce that across BOTH hands. You enrol with one palm, and for accessibility you may enroll with either hand — but a single person could otherwise try to register their left palm as one identity and their right as another, because two palms of the same person look unrelated to a palm scanner. The face lock closes that gap. During the liveness check the app already looks at your face; from that it computes a private mathematical fingerprint (never a photo — a numeric fingerprint the network keeps in protected form, so every later enrolment can be checked against it) and the network checks it against everyone already enrolled. If your face already has an identity, a second enrollment is refused — you are told to recover your existing wallet instead, with your 12 words, your .sovbak backup file or your guardians (recovery by re-scanning your palm is switched off in the current app). The check runs on the network, not on the phone. Identical twins are the one natural limit every face system shares. This is the check that keeps one-human-one-vote and one-human-one-wallet true, no matter which hand you scan.

Protocol: The Exchange — turning your SOV into real value

SOV gets its exchange value the honest way: person to person, with no company setting the price. On the Exchange a citizen who wants cash LISTS some of their SOV for sale and states how they take payment (bank transfer, mobile money, whatever they choose). The moment they list, that SOV is locked in escrow on the network — it cannot be spent or double-sold. A buyer browses the open listings, opens a private negotiation chat with the seller RIGHT ON THE LISTING — you do not have to commit first, you can ask "what price per SOV?" before anything — and the two agree a number. Offers ride inside the chat as tappable cards: the seller sends an offer, the buyer taps Accept, and a "Fill at agreed terms" button appears. The buyer pays the agreed money OFF the platform (SOV never touches a bank), and when the seller confirms the money arrived, the network releases the escrowed SOV to the buyer, minus a small citizen-voted exchange fee that goes to the operator pool. Every fee and every operator payout is public on the SOV Economy screen, and open listings are public on the Exchange. The negotiation chat is end-to-end encrypted and never stored on any node, and a single listing is currently capped at 10,000 SOV (set by vote). Because citizens set their own prices with no middleman, free price discovery is exactly how SOV earns a real, market-set value.

Protocol: One truth on every node — how the mesh heals itself

SOV has no central server, yet every node — whether it is a data-centre relay or a laptop at home — must show you the SAME balances, the same votes, the same records — messages are never on a node; they live on citizens' devices. It stays that way through a quiet background process called anti-entropy. Every node keeps a tiny fingerprint of its own copy of the shared state and gossips that fingerprint to its neighbours about once a minute. If two neighbours' fingerprints differ, the one that is behind simply asks the other for the missing pieces and folds them in — balances by highest version — never raised past the fixed supply — and records like guardians, trades, group memberships and platform registrations by "keep everything, never lose a fact". So if your node was switched off for a week, or a home node was unreachable during a storm, the instant it comes back it catches up automatically — no operator action, no re-sync button, no central authority to ask. It also watches its own links: if a connection to a peer goes silently dead, the node notices the silence, drops the dead link and reconnects — which is why the network keeps converging even as nodes come and go. This is what lets any number of independent nodes converge on one truth: not because a company keeps them in line, but because the protocol reconciles itself, forever, with nobody watching.