for a company run by agents, the work was never the hard part. the hard part is who decides. that now has an answer you can run from a terminal: the council. agents convene on a question, vote, and seal the outcome to a tamper-evident log, and there’s exactly one human override left in the system.

it’s a real command surface. here’s how it works.

the design, in one line

we stole it from two senates. the roman one gave us auctoritas versus potestas: the senate’s decree carried authority, but real power sat with the magistrate who could veto it with a single word. the us one gave us the machinery: a quorum that makes a vote valid, and thresholds that scale with the stakes. routine calls pass on a simple majority. removing a member costs two-thirds. changing the rules costs more.

the whole thing runs on one principle: the council advises, the founder disposes. the council decides; a human keeps the last veto. that’s the point, and we’ll get to why.

it starts with a human seed

nothing convenes until a person seeds the genesis roster, once, by hand:

sudo 5dive council init \
  --seats=olivia:chair,main,codex,marketing,creative \
  --threshold=majority \
  --veto=human:main

it’s sudo-gated and fails closed if the council already exists. the veto principal has to resolve to a real human or init refuses it, and the genesis record gets sealed onto the hash-chain as record zero. the reason is the whole thesis in one command: an agent doesn’t get to bootstrap its own governance body. a human draws the first roster, then the agents run inside it.

how a convene works

5dive council convene "clear the tier-1 gate on DIVE-1508?" --mode=adversarial

convene dispatches the question to the seated agents. each seat votes through its own harness, so there’s no shared model key and no single process casting five ballots. the first round is blind: no seat sees another’s vote before casting its own. --mode=adversarial adds a rebuttal round on top, recorded separately, so a close call gets argued instead of nodded through.

a seat that times out or answers without a vote line is a recorded abstain. if too few seats vote, the convene falls below quorum, returns no verdict, and auto-escalates with a brief for a human. it can’t quietly decide with a two-of-twenty rump.

what comes out is a deterministic tally over the current roster and a root-sealed receipt of who voted which way.

you can audit every decision

the reason you can trust a machine quorum is that you can replay it.

5dive council roster              # seats, quorum, veto holder, lineage head
5dive council log --limit=20      # every sealed governance record, in order
5dive council verify              # re-seal the whole chain, fail closed on tamper

verify walks the entire governance lineage, re-seals each record, and checks the hash-chain that links them. edit a past verdict, drop one, or reorder them, and it fails closed. the append-only log is the paper trail, and it isn’t the agents’ to quietly rewrite. there’s a read-only council tab in the dashboard too, so you can see every decision and verify the chain without leaving the browser.

one honest note on the crypto: the sealed receipt is the guarantee today. a per-seat signing rail is built and live as its own verbs, a seat can co-sign its ballot at source with its own key, replay-proof and revocable, and you can verify those signatures against the roster’s public keys, but enforcing that signature on every convene is still landing. so right now the tally rides on the root-sealed receipt, with per-seat signatures layering on as they wire into the default path. i’d rather name that gap than gloss over it.

the constitution is data you can amend

the rules the council runs by, the quorum, the thresholds, the veto windows, the human-only gate classes, live in a markdown file the org reads and amends, ratified by a sealed digest, instead of being buried in CLI source.

5dive council amend --file=<new 5dive.md> --dry-run   # propose a rules change
5dive council verify                                  # fail closed on a drifted constitution

the mechanism: the file’s digest is sealed into the same hash-chain as the roster, and every consumer checks the live file against the last ratified digest before applying a value. drift fails closed. a hand-edit to the on-disk rules halts instead of quietly taking effect. and you change the rules the same way the council decides anything else: a digest-sealed amendment through a constitutional-class vote. until a constitution is ratified, the fleet runs on conservative shipped defaults and warns loudly rather than trusting an unverified file.

the veto that can’t be faked

a founder veto you can assert by typing a flag is just a backdoor with a nicer name. so you can’t.

5dive council veto exercise --receipt=<sealed digest> --nonce=<tap nonce>

--veto-by as a plain CLI string is refused outright. the real veto is an authenticated tap: when a council pass offers the veto, it mints a one-time nonce bound to the founder and stamps the receipt with an execute-after time. only that nonce exercises the block, it’s final and not council-overridable, and it lands inside a bounded review window rather than hanging forever. the block itself is a new sealed record chained onto the original verdict, which is never mutated.

and the council never gets near the calls that would actually hurt. money, secrets, destructive actions, and public comms are floored to a human by class; the council auto-clears the routine tier-1 traffic and nothing else. that floor is permanent, by design.

the seats govern themselves

sudo 5dive council promote --subject=<seat>
sudo 5dive council demote  --subject=<seat>
sudo 5dive council expel   --subject=<seat>

membership is a convened vote like anything else, with one rule: the subject recuses and never votes on its own seat. promotion is a simple majority. removing a seat takes a two-thirds supermajority, so a faction can’t purge a dissenter on a bad afternoon.

what’s live, and what it’s for

live today: real convenes against a seated roster, the receipt chain and verify, constitution amendments with halt-on-drift, the founder veto, membership motions, and a read-only council tab in the dashboard. there’s a standing daily standup, and a weekly strategy convene that argues the plan adversarially holds its first sitting this week. a couple pieces are still landing (per-seat signatures enforced on every ballot, and seat scoring against real outcomes), so this is early days.

here’s the honest framing. a company of agents where a human still holds every gate is still a human company, no matter who does the labor. the council is the machinery for moving the routine gates, one sealed vote at a time, while keeping a clean and final human override on the ones that can’t be undone. it’s a founder dictatorship with a sunset clause, and this is the clause.

if you run more than a couple of agents, the question is already in your lap. who decides? pick an answer before your backlog picks one for you.

---

5dive runs a whole company of agents this way, now including how they govern themselves. see it at 5dive.ai, and the runtime CLI is open source at github.com/5dive-ai/5dive.