Manifesto
Sovereignty is a property, not a slogan
Six commitments that shape what gets built, what gets refused, and what gets admitted. They are here so you can hold the project to them.
1 · If we vanish, your instance keeps running
This is the one claim everything else has to survive. It rules out the usual architecture, where a "self-hosted" product still phones home for licensing, identity, or discovery. Every centralized service we operate is therefore optional and off by default — and an instance that uses none of them is not a degraded instance, it is a complete one.
| Service | Required? | If it vanishes |
|---|---|---|
| Your instance | Yes — it is the product | Your instance is the thing |
| Matrix homeserver | Yes, bundled per instance | Runs on your hardware |
| PostgreSQL, IPFS | Yes, bundled per instance | Runs on your hardware |
| sovrgnnet.cc identity | No — off by default | Local accounts unaffected |
| Instance directory | No — not built, will be opt-in | Invite links keep working |
| Cloudflare | No — one of four access options | Use your own domain, TLS, or LAN only |
2 · Software nobody can install isn't sovereign, it's a demo
Running your own instance must not require a domain name, an account with anybody, or knowing what Docker is. That constraint was earned the hard way and it disqualifies a lot of otherwise reasonable design.
The installer generates every password, provisions the database, and ends by telling you which URL to open. It asks exactly one question that matters: whether this is for your house or for friends on the internet. Both answers work, and neither one costs money.
3 · Protocols, not products
Every message is a Matrix event on a homeserver you run. Every file is content-addressed on an IPFS node you run. We invented neither format, which means neither one can be taken away from you by us.
Nothing about this codebase's language, framework, or database is normative. What matters is the protocol, which is versioned separately from the application and comes with a conformance suite so a second implementation can prove itself without asking our permission.
pnpm conformance https://any-instance.example4 · Leaving must be cheap
A platform you cannot leave is a platform you do not own. Backups carry a manifest and a per-component checksum, verified before a restore touches anything, so moving an instance to another machine takes its identity, rooms, and history with it.
The measure of this principle is not how good the export button is. It is whether anyone has ever actually walked away with their data intact — so the restore path is tested, not just written down.
5 · A small thing that works beats a large thing that doesn't
Text chat that reliably sends and receives came before everything else. Voice, video, mobile clients, and federation are all wanted and none of them were allowed to delay a working core. Features land when they work end to end, not when they demo.
6 · State the gaps before someone discovers them
Also missing today: voice and video, mobile apps, federation between instances (possible, off by default, untested), an instance directory, and session revocation — sessions are stateless and last a year. There has been no independent security audit. The threat model and the roadmap say so in more detail. A project that hides its gaps is asking you to trust marketing instead of evidence.
Hold us to it
These principles are testable, which is the only reason to write them down. If a release breaks one of them, that is a bug worth filing — open an issue and say which principle and how.