Charter

Ratified v1 · 2026-04-28.

A commercial entity built on top of an open protocol family has obligations the protocol layer cannot enforce on its own. These are the ones OrangeCheck accepts publicly. The full text is committed to git so the diff is auditable; this page is the canonical published version.

The charter binds the whole company. Every product that ships under the OrangeCheck name — ochk.app, vault.ochk.io, and every sibling protocol site (attest, lock, vote, stamp, agent, pledge) — operates under these eight commitments. There is one charter, in one place, at ochk.io/docs. Product subdomains link here.

The eight commitments

01 · No token. Ever.

OrangeCheck does not and will not issue a token, points balance, airdrop, or any unit of account other than sats and USD. The economic loop closes on Bitcoin. Anyone proposing otherwise is not OrangeCheck.

02 · No custody you didn't choose.

OrangeCheck does not hold customer Bitcoin private keys and does not operate a custodial wallet you cannot move out of. On the protocol siblings, no custody — period. Bonded reputation is attestation-of-unspent: sats stay in the customer's own wallet, enforcement is by exposure, never by slashing.

ochk.app is the one place this commitment has a stated exception, and it is a stage rather than a design. While it is in testing, OrangeCheck holds what a user accrues there and is the party that moves it, because it is operating every role in the system until independent operators take them. The design is federation custody — an M-of-N guardian set, OC holding no share — with a one-click move to your own keys that keeps the same address and the same history. Neither is in force yet: no federation is bound, which is machine-readable at /api/federations and stated in the present tense at ochk.app/custody. We say that here rather than in a footnote, because a charter that overstates is worth less than one that names its own exception.

03 · The protocol stays open.

The wire format, scope grammar, audit-bundle structure, and Bitcoin-anchoring rules are defined by the open oc-*-protocol specs (oc-attest-protocol, oc-lock-protocol, oc-vote-protocol, oc-stamp-protocol, oc-agent-protocol, oc-pledge-protocol). Every change OrangeCheck makes lands as a public commit in that spec's repository, and each spec keeps a changelog. No private extensions, no closed conformance vectors.

04 · The protocol sites stay free.

attest.ochk.io, lock.ochk.io, vote.ochk.io, stamp.ochk.io, agent.ochk.io, pledge.ochk.io — every sibling protocol site remains free, self-hostable, no-account public goods forever. The consumer commercial products (ochk.app, vault.ochk.io) are optional layers, never the only path to using the protocols. If we ever change this, the spec stewardship governance ratifies first.

05 · Audit verifies without us.

Every audit bundle and every receipt OrangeCheck issues, billable or not, is verifiable offline, against Bitcoin headers, by anyone, forever. If OrangeCheck disappeared tomorrow, every receipt continues to verify. We sell operations, not lock-in. The protocol is the API.

06 · No agent-replacing-humans positioning.

OrangeCheck sells authority infrastructure. We do not market agents as labor displacement. The pitch is that compliance teams can sign off on agents taking real authority — which is human work being elevated, not erased.

07 · Sat-denominated economics, first-class.

Sat-paid customers are not a footnote. Every USD price is published with its sat equivalent on the same row. We do not require a fiat onramp and do not treat sat-paid customers as a niche segment. Payments to OrangeCheck are made on-chain: Lightning has been off across the family since 2026-09-02. On ochk.app specifically, every billable event has its price, OC's platform fee and what the user earns published in sats — USD shown alongside, never as the canonical unit.

08 · Spec stewardship is public.

Material changes to the spec stewardship structure are announced publicly and discussed in the oc-protocol governance forum before being adopted. OrangeCheck has one seat at that table; it is not the chair. Material changes to this charter itself follow the same path: a published proposal, a public review window, and a versioned re-ratification.

How this applies per product

• ochk.app — consumer commercial product (its API is me.ochk.io). OrangeCheck-held while in testing; federation custody, then your own keys, is the destination (commitment 02). Three kinds of billable event: one-time, per action and per session. Integrators set what each event pays the user; OC's fee is a fixed 20% of the price. Commitments 02 (custody you can move out of), 05 (every receipt verifies offline), and 07 (sats first-class) bind this product specifically.
• vault.ochk.io — consumer commercial product. Bitcoin-bound encrypted secrets storage built on OC Lock Flow 4. OC holds ciphertext only — no entry name, type, or payload is ever readable server-side, and there is no recovery backdoor by construction. Commitments 02 (no custody — the vault key never leaves the user's device, OC cannot decrypt), 03/04 (oc-lock-protocol is open and free forever), 05 (every entry exports as a portable artifact any holder of the key can decrypt offline via @orangecheck/lock-crypto), and 07 (paid in sats on-chain, into a watch-only wallet, no fiat) bind this product specifically.
• Protocol siblings — every oc-*-protocol spec repo + the matching *.ochk.io reference site. Commitments 03 (open spec), 04 (free forever), and 05 (offline-verifiable) bind these specifically.

If we ever break one of these

The protocol layer continues to work without us. Every receipt we ever issued continues to verify. The spec repos stay public under the MIT license their LICENSE files state, and the npm packages remain published. Customers can fork the managed components and run them themselves on day one. This is the whole point of the design.

Spec stewardship and family governance live at github.com/orangecheck. Every change to a spec, and to this page, is a public commit there.

Signatures

These commitments are made by the OrangeCheck founding team. Names will be appended here as public commitments are formalized.