# Principles & Ethos

ChainRender is built on a small set of non-negotiable principles. They aren't marketing — they're the actual rules
the system is engineered against, and they explain nearly every design decision. If you're evaluating ChainRender,
these are the commitments you're relying on.

## The core value

> **Marketing must never exceed what the code enforces.**

This is the deepest rule. Every claim ChainRender makes corresponds to something the contracts actually guarantee.
Where a guarantee has a boundary, the system discloses it rather than papering over it. The trust grade exists
*because* of this rule — it makes the exact trust cost legible instead of hiding behind a reassuring badge. When you
read "trustless" here, it means the code enforces it; when there's a caveat (like read-path metadata), you're told.

## The floor principle

> **On-chain is the floor; the client (GPU, fetch, animation) is an enhancement that fails closed.**

Every app has a complete, verifiable, fully on-chain rendering that needs nothing but the chain. Enhancements
improve it but can never be required. This is what lets ChainRender be both trustless and rich. See
**[The Floor](../concepts/the-floor.md)**.

## Engineering principles

These govern how ChainRender itself is built — and they're worth knowing, because they're why you can rely on it:

- **Ownerless & immutable.** Every registry and renderer is deployed with no owner, admin, or upgrade key. A
  contract with an admin is a contract whose admin you must trust. Ownerlessness is what lets you verify the system
  *once* and rely on it *forever*.
- **No hardcoded constants.** Values derive from tokens, descriptors, and registry reads — never baked lists. A new
  resolver, theme, or name appears without a code change. This keeps the system honest and extensible.
- **Roll-your-own over frameworks.** Core primitives are built directly rather than pulled from heavy dependencies,
  so the trust surface is auditable and minimal — you're not trusting a supply chain you can't see.
- **Real fixes, never stopgaps.** Problems are fixed at the root, not masked. A symptom-patch that leaves the cause
  is rejected in favor of the correct, permanent fix — even when it's more work.
- **Dogfood the platform.** ChainRender's own tooling (the explorer, the flagship) is built *on* ChainRender's
  public capabilities. If we wouldn't use our own system, why should you?
- **Fail closed, always.** On any error — a reverting resolver, a failed proof, a missing asset — the system
  degrades to an honest fallback, never a fabrication. Safety is structural, not a runtime check you might forget.

## Safety by construction, not by warning

ChainRender doesn't warn you about unsafe apps — it makes them **unregistrable**. The enforcer refuses arbitrary
code, dishonest capability envelopes, value smuggling, and arbitrary calls *at registration*. What remains is a
system where every live app is structurally incapable of those attacks. A warning can be ignored; a gate cannot be
passed. See **[The Capability Enforcer](../concepts/enforcer.md)**.

## Why these principles, together

Each principle removes a place where you'd otherwise have to trust someone: the frontend host (fully on-chain), the
contract admin (ownerless), the dependency supply chain (roll-your-own), the operator's honesty (marketing ≤ code),
the client's environment (the floor). Together they add up to a system you can verify once and rely on without
trusting any continuing party. That's the whole point.

## Related
- **[Design Rationale](./design-rationale.md)** — the reasoning behind specific choices.
- **[The Floor](../concepts/the-floor.md)** · **[The Trust Grade](../concepts/trust-grade.md)** ·
  **[The Capability Enforcer](../concepts/enforcer.md)**