Permissionless financial infrastructure.

Not a lending product, a trading venue, an application, or a platform that curates what runs on it: a layer beneath applications that anyone can build on without permission, that operates by deterministic logic without trust in any operator, and that does not extract value from the people who use it.

*The elements, and the old institutions they record*
Who holds what?	Vault	Property and possession.
Who owes what to whom, and when?	Obligation	Contract and debt.
What makes a promise credible, and what happens if it fails?	Lien	The pledge and the security interest.
What is a thing worth?	SpotAuction, PositionAuction	The market and the fair.
Who can be trusted?	BOND	Reputation, the merchant's good name.

v2 is a minimal set of building blocks — custody (the vault), debts (obligations), security over collateral (liens), and exchange (batch-cleared spot auctions, and auctions for claims and positions) — and an open composition surface that anyone can build on.

Any debt or derivative instrument that does not need an oracle can be composed from these blocks. A loan is one obligation and one lien. An instalment loan, a mortgage, a note, an insurance policy, a future or an option is another arrangement of the same blocks — not a new contract with new trust assumptions.

Debt, security and custody are kept apart, as the law keeps them. A debt is a personal obligation: A owes B this amount of this asset by this date. Security is a property right in collateral that secures one or more debts, with rules for enforcing it. Custody is where the collateral actually is.

Equity is issued above the blocks, not composed from them: an issuer deploys its own contract, which issues shares under its own rules, and the blocks take those shares as assets — collateral to borrow against, an asset to sell or settle in. A variant of the vault respects each share's rule on who may hold it.

Primitives execute; orchestrators decide. The primitives are permissionless and policy-free: there is no allowlist of orchestrators, no per-token gating and no rate floor. Which assets, which terms and how they are discovered belong to the orchestrators above.

One exception, while it exists: a contract that moves balances in the vault for its users must be an authorised consumer of the vault. Whether that list stays is decided before mainnet.

Four layers.

0 — Primitives: the vault, Obligation, Lien, SpotAuction, PositionAuction; BOND as a service.
1 — Mechanisms: general-purpose orchestrators that originate, protect, package, service and settle instruments.
2 — Instruments: the products people hold — loans, bills, calls, protection, futures, funds.
3 — Applications: frontends, agents, structured strategies, integrations with other venues.

The base layer is layers 0 to 2 as published by the protocol's author. A product belongs to it only if it is composed of the primitives and base-layer mechanisms; uses no price feed, with any read of another protocol's on-chain state disclosed per obligation, by target; has no admin and no fees beyond the core's emergency functions, which cannot move user funds; follows the core's rules; and resolves every lien within bounds fixed at creation.

Anyone may build other instruments on the same primitives, including ones that read a price feed. A feed chosen for one instrument affects only the parties who chose it, and cannot reach any other obligation.

Mechanism, not judgement. The infrastructure does not judge its users. There is no KYC at the protocol layer and no exclusion mechanism; no admin function can reach user funds; there is no governance token and no DAO; composition needs no approval; and every event is public.

Legal rules live in the replaceable layers — orchestrators, gate contracts and the legal agreements that refer to the on-chain record — never in the core. When a law changes, a new orchestrator or gate is deployed for new arrangements; existing liens keep the terms they were made under.

Five commitments, written into the contracts.

No protocol fees.

The credit blocks and the spot auction have no fee parameter: there is no on-chain mechanism by which the protocol takes value from its users. The one transfer that is not user to user is the keeper's compensation for settling the spot auction — paid from the price improvement the auction creates, capped, and never from users' limit prices. Network transaction fees go to the network, not to Gavel.

Non-custodial.

User funds are held in vault contracts with no administrative function that can move user balances. A contract can act on a user's balance only after that user has approved it, and approvals can be revoked at any time. No contract is upgradeable: a replacement is deployed alongside the old one, which goes on serving its users.

Permissionless.

Anyone can use the contracts directly or through any frontend, build on them, run a keeper or read their events, without asking.

No price feed.

Prices and rates come from Gavel's own auctions. Where an instrument reads another protocol's on-chain state, each read is named when the obligation is created and published with it, so anyone can see what every instrument depends on.

Open composition.

The protocol's author publishes reference mechanisms; they are not the only ones, and alternatives are neither prevented nor taxed.

Three things the base layer declines, in every lien, whatever an orchestrator, a party or a jurisdiction asks: no reversing the past; no discretion that no one agreed to; no indefinite stays where a resolution was guaranteed.

Any rule constraining who may act, when, on what condition and with what result can be expressed by an orchestrator on the core; the core declines only to reverse the past, to allow discretion no party agreed to, and to suspend resolution without limit.

Where it stops. It does only what agreement can do. Facts it can't witness come from parties you choose to trust, judgement stays with courts and the agreements above it, and it enforces only against what was pledged. It pushes the need for force as far back as agreement allows, and is honest about where agreement ends.

What it is not. Not a central bank or currency issuer. Not a dispute-resolution system: no arbiter can reverse a transaction. Not a prediction platform. Not a governance DAO: its one token, BOND, is a public record of credit honoured and carries no governance, fee or revenue right. Not an identity platform: users are wallet addresses.

Status — the v1 contracts are Live (v1, audited); the v2 building blocks described here are specified and unaudited, and the core's first testnet deployment is pending.