From an interim constitution to a committee workbench: why we built Cella

How Cardano got a Constitution

The Chang hard fork on September 1, 2024, switched on the first governance actions under an interim constitution and seated an Interim Constitutional Committee (ICC). That interim text calls itself "an interim minimum viable constitution" that "is intended to be temporary": a floor of guardrails so that CIP-1694 (Cardano Improvement Proposal 1694, the governance design) could run while the community wrote the permanent document.

The permanent document was written in public, through a worldwide series of community workshops that fed a draft and elected the delegates who would finish it. Awen hosted one of them.

The Chicago workshop, September 14, 2024

Two weeks after Chang, we opened the doors at Second Shift in Chicago's Logan Square for the Cardano Constitutional Workshop. Twenty-two people registered. The brief from Intersect was to use the interim Constitution as the starting point and argue about what the final one should say, so the day ran on five questions from the consultation:

• What should the Constitution require of Delegated Representatives (DReps) as a code of conduct?
• Should it say more about the Cardano budget process?
• Should on-chain governance participation be limited to ada holders?
• What size and term length should the Constitutional Committee have?
• What should it say about one ada holder voting on the same action as both a DRep and a Stake Pool Operator (SPO)?

Question four turned out to be the one we would live inside. The room spent its longest stretch on how many committee seats there should be and how long a term should run, with no idea that a year later some of us would be sitting in one.

The day closed the way every workshop did, with a ranked-choice election of one voting delegate and one traveling alternate to carry Chicago's positions to the convention. Thirteen ballots were cast. Ken Ladd was elected delegate and I was elected the traveling alternate, with Maggie Schmidt as backup.

Second Shift, Chicago, September 14, 2024: the room at the end of the day; getting started that morning (photo by Adam Rusch); and the Intersect workshop card.

Buenos Aires, December 2024

From December 4 to 6, 2024, sixty-three elected delegates from 51 countries met simultaneously in Buenos Aires and Nairobi for the Cardano Constitutional Convention. I flew to Buenos Aires as Chicago's alternate and spent the week in the rooms where the final text was argued line by line. Sixty delegates voted to send the draft on chain.

The Plomin hard fork on January 29, 2025, enabled the remaining action types, including "Update Constitution", and the ratification vote opened the next day. It needed 75 percent of DRep stake and the ICC's finding that the text was constitutional. It got both, and the Constitution took effect on February 23, 2025.

It has already been amended once. A revised Constitution was ratified on January 19, 2026, with 79 percent of DRep stake and took effect on January 24, 2026. It added defined terms, removed budget info actions from the constitutional process, made treasury withdrawals carry their own budget justification, and required off-chain documents to use immutable links. Dry changes, and each one changed what a committee has to check.

Buenos Aires, December 3 to 6, 2024, left to right: the University of Buenos Aires Law School on day one (photo by Ken Ladd); at the delegate wall on arrival; the opening keynote; the delegate hall during the session linked to Nairobi; the United States delegates after the 95 percent vote to approve the text (photo by Ken Ladd); and the signing ceremony on the final day.

The signing, December 6, 2024

Each delegation was called to the stage to sign the approved text. Ken Ladd signed for Chicago and I countersigned as the alternate. Forty-three seconds, ten years in the making.

Where Cardano Curia sits: one seat of seven

The Constitution defines the CC as the body "charged with ensuring that applicable governance actions take effect on the Cardano Blockchain only if in alignment with the principles and provisions" of the Constitution. DReps and SPOs decide whether an action is a good idea. The committee decides whether it is allowed.

The committee has seven seats and a two-thirds threshold, so five Yes votes ratify. Four of the seven seats are consortia: groups of people who hold one seat's credential together through a multi-signature script and cast one vote between them. Cardano Curia is one of those four. It is not the committee, and it is not a committee of the committee. It is one seat, held by five people. The Curia seat was first elected in the December 2025 snap election, called to restore the committee's quorum, and re-elected in July 2026 to a term that runs to epoch 799, roughly September 2028.

Inside that one seat, five people have to agree on a single vote. For each action we at Curia read the payload and the proposer's metadata, find the articles that apply, argue it out, record each position, and write one rationale the body can stand behind. Since its first vote on December 23, 2025, the Curia seat has cast 68 on-chain votes: 64 Yes, 2 No and 2 Abstain. Those are one seat's votes among seven: over the same period the seven current seats cast 377 votes between them as of November 13, 2026, and Curia's 68 are one slice of that. Curia's long-form rationales at cardanocuria.com follow one shape: a summary, the finding checked against named articles, a precedent discussion, a counterargument discussion that keeps dissent on the record, and a conclusion. Two of the ten published there carry a four-to-one internal split in the document itself. My own view, not the consortium's: that split is the point. A rationale with the dissent left in is worth more to the next reviewer than a clean one.

Where Curia's own process fell short

For the Curia seat's first months the path from "an action appeared" to "our vote is on chain" ran through a block explorer, the Constitution as a PDF, a shared document, a group chat, and the command line. Each piece worked. None of them knew about the others. The explorer showed the action but not the articles it touched. The document held our positions but could not prove who had signed them. The chat held the argument and lost it a week later.

The vote itself was the hardest part. For a script-held seat it means pinning the rationale to the InterPlanetary File System (IPFS), hashing it, building a transaction that spends the committee's hot credential, collecting enough signatures, and submitting before the epoch boundary. One of our members wrote that procedure down as a shell script in five phases. It works, and it asks one person to hold every piece in their head the night before a deadline. In my view a committee that misses a deadline has abstained without choosing to, and that is the failure a seat can least afford.

We do not know how the other six seats handle this, and we are not going to guess. That is what the survey at the end of this article is for.

Cella: the workbench that came out of it

Cella began as code inside Cardano Curia's own WordPress site: actions synced from Koios, the Constitution beside them, a login for members. By June 2026 it was clear the tool mattered more than the site, and that any of the other seats would need to run it without our stack. So Awen rebuilt it as a single Go program with its own SQLite file: no WordPress, no database server, no API (application programming interface) key. It is open source under Apache-2.0 at github.com/Awen-online/cella.

The name is the Latin word for the inner chamber of a temple, the room behind the columns where the work actually happened. That is the job: one private room where a seat does its reading, its arguing and its signing, and one public document that comes out the other side.

Here is what a review looks like inside it, in the order it happens.

Step one: read what the action actually does

The dashboard leads with the clock. Every open action is sorted by how soon it expires, with the seat's own quorum progress beside it, because an action that expires unvoted is an abstention the committee never chose. Each row carries the action type, the proposer's title, and a link to the explorer for anyone who wants the raw transaction.

Open an action and the first panel is not the proposer's pitch. It is the on-chain payload, decoded: for a treasury withdrawal, every recipient with the exact amount and share; for a parameter change, every parameter it would set; for a hard fork, the protocol version it moves to; for a committee update, every seat it adds or removes, which is how our own seat's new term showed up in July. The proposer's abstract, motivation and rationale come after, and if the metadata they anchored does not hash to what was committed on chain, Cella says so. Reading the payload first is the habit that catches a proposal whose text and transaction disagree.

Step two: judge it against the text, not a memory of the text

Under the payload sits "constitutional alignment": the articles and appendices Cella thinks apply, each one a link into the Constitution itself. The Constitution ships inside the binary in all three versions, interim, first ratified and current, with a permalink for every article and section, a sticky table of contents and in-page search. Clicking from an action lands on the exact article, in the version that was in force. Cella is careful to call this a starting point for reading, not a boundary on it: the seat judges against the whole document, including articles the tool did not think to name.

The optional model review reads the in-force Constitution text into its prompt before it looks at the action, so its answer cites articles rather than vibes. You bring the model: a hosted one, or a local one running on the same laptop, so no action ever has to leave the machine. The review is labeled as one input among several. In our seat it has been most useful as a checklist of articles to go read, and least useful as an opinion.

Step three: deliberate as a seat, with signatures

Members sign in with a Cardano wallet. The browser signs a challenge the server issued, the server verifies the signature, and no key ever leaves the wallet. From there, a member records a position on an action, and signs that too, over a plain-language message the wallet shows them. A recorded vote used to be only as trustworthy as the cookie that stored it; now it is attributable. Members raise flags to each other (needs discussion, ready, blocked) and keep private notes that nobody else sees. Quorum is read from the committee's hot credential on chain, never from Cella's own roster, so the tool cannot be configured into believing it has more votes than it does.

Step four: publish a rationale the chain will accept

The rationale form follows the shape our seat settled on over ten published reviews: a one-sentence summary, the full statement citing the articles judged against, precedent, the strongest counterargument stated fairly, and a conclusion. The chamber's positions fill the document's internal vote block automatically, so a four-to-one split shows up in the published record as a four-to-one split. When the required fields are complete, Cella emits a real CIP-136 JSON-LD document and prints its anchor hash, the same value cardano-cli produces. Until they are complete, it refuses to hand over the file, because a hash over an unfinished rationale looks submittable and is not.

cardano-cli hash anchor-data --file-text rationale.jsonld
# matches the blake2b-256 shown on the Cella rationale page

How it is built, and what it refuses to do

• One binary, one file. Go, with SQLite through a pure-Go driver, so there is nothing to install beside it. cella ingest pulls the chain, cella serve runs the chamber, cella review runs the model.
• The chain is the source of truth. Actions, votes, the roster, the threshold and the quorum all come from Koios and the hot credential's datum, not from a config file someone could edit.
• Mainnet, preprod or preview by a flag, and an unrecognized network is a startup error, never a silent mainnet.
• Signed sessions, CSRF tokens, strict headers. A vote is one click, so the boring web security is not optional.
• Cella never holds a signing key. Positions are signed in the wallet; the committee vote will be signed in the wallet. The server assembles, it never signs.

Honest about the gaps, and how to try it

Cella does not submit the vote. It can decode a vote transaction so a member reads what they are about to sign, and it can reassemble a witnessed transaction, tested byte for byte against Cardano Curia's real mainnet vote. Collecting signatures in the app, building the script-spending transaction, and pinning the rationale to IPFS are still ahead of us, and its quorum logic assumes a script-held seat, so a single-key member gets less from it today. Cella will never hold a signing key.

There is no downloadable release yet. With Go installed, you can build it and point it at preprod, the pre-production testnet where governance is live:

git clone https://github.com/Awen-online/cella
cd cella
go build -o cella .
./cella ingest -n preprod -limit 25
./cella serve -n preprod -demo

Then open http://localhost:8080. Demo mode turns off wallet sign-in; use it only on your own machine.

Questions or contributions: open an issue on GitHub, or get in touch.