Constitutional model registry — choose & activate. No download required (runs via sovereign endpoint or on-device WASM). HF is a discovery mirror only; UCS is the trust anchor.
Policy: default is Cardinal verifier only (C0) — zero model until you activate one. Privacy-first: on-device (S0) or sovereign endpoint (S1) preferred; external API only when explicitly chosen and flagged in Evidence.