# Faction capture (FC): converting a temporary majority into permanent control. # 30 scenarios: FC-001..FC-027 attacks, FC-028..FC-029 legitimacy controls, # FC-030 combined-arms defense-in-depth. scenarios: - id: FC-001 title: Bare-majority kernel amendment family: faction_capture severity: critical tags: [threshold, baseline] precedent: > Synthetic baseline encoding the core semver rule: a breaking change to the kernel is a major version and requires supermajority. The game-theoretic precedent is the elementary instability of simple-majority constitutional politics (Riker, "Liberalism Against Populism", 1982): any 51% coalition that can rewrite the meta-rules at 51% will, and cycling majorities make every minority's rights contingent on the next vote. setup: actors: - {id: majority, kind: faction, members: 51, objective: capture} - {id: minority, kind: faction, members: 49, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: majority, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A3, summary: "Lower kernel ratification threshold to 0.51", notice_days: 14}} - {actor: majority, action: advance_time, args: {days: 14}} - {actor: majority, action: vote, args: {proposal: p1, yes: 51, no: 49, abstain: 0}} - {actor: majority, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.amendment.kernel_threshold worst_off_floor: 0.95 empathy: worst_off: minority rationale: > The defense holds at the tally gate; the minority suffers only the stress of the attempt. Anything below ~0.95 would indicate the engine let harm land before the threshold check. - id: FC-002 title: Expel the opposition, then amend with the survivors family: faction_capture severity: critical tags: [expulsion, denominator, enabling-act] precedent: > The Enabling Act, Germany, 23 March 1933. The two-thirds majority required to amend the Weimar constitution was manufactured by arresting and excluding the 81 Communist deputies (and intimidating others) after the Reichstag Fire Decree, so the denominator shrank until the Nazi-DNVP bloc cleared the bar (vote: 444–94). The fix encoded here: the membership roll for an already scheduled constitutional vote freezes at scheduling time (kernel.I6). setup: actors: - {id: bloc, kind: faction, members: 60, objective: capture} - {id: opposition, kind: faction, members: 40, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A3, summary: "Transfer ratification power to a standing committee", notice_days: 14}} - {actor: bloc, action: propose, args: {id: p2, kind: expulsion, target: opposition, summary: "Expel opposition for 'disloyalty'"}} - {actor: bloc, action: vote, args: {proposal: p2, yes: 60, no: 40, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p2}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 60, no: 0, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.expulsion.threshold worst_off_floor: 0.90 empathy: worst_off: opposition rationale: > The mass expulsion fails first (60% < 75% expulsion threshold), and even had it passed, kernel.I6 keeps the expelled in p1's denominator. The opposition faces an attempted purge, hence a floor below the clean-block band. - id: FC-003 title: Salami expulsions across meetings family: faction_capture severity: critical tags: [expulsion, salami, rate-limit] precedent: > "Salami tactics", the phrase Mátyás Rákosi used for the slice-by-slice elimination of Hungarian opposition parties, 1945–1949: never a purge large enough to trigger resistance, always one more slice. Also the post-2016 Turkish purges' incremental structure. The encoded defense is a per-period expulsion rate limit plus due-process delay, so slices cannot compound faster than the institution can notice. setup: actors: - {id: bloc, kind: faction, members: 76, objective: capture} - {id: targets, kind: faction, members: 24, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: expulsion, target: targets, summary: "Expel 1 member of targets", payload: {count: 1}}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 76, no: 24, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} - {actor: bloc, action: propose, args: {id: p2, kind: expulsion, target: targets, summary: "Expel 1 more", payload: {count: 1}}} - {actor: bloc, action: vote, args: {proposal: p2, yes: 76, no: 23, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p2}} - {actor: bloc, action: propose, args: {id: p3, kind: expulsion, target: targets, summary: "Expel 1 more", payload: {count: 1}}} - {actor: bloc, action: vote, args: {proposal: p3, yes: 76, no: 22, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p3}} expected: verdict: blocked blocked_by: params.expulsion.rate_limit worst_off_floor: 0.55 empathy: worst_off: targets rationale: > The rate limit halts the salami at the second slice within the period, but a member may already be in due-process proceedings; the floor reflects one member lawfully facing (and surviving) an expulsion attempt with full process, not a clean no-harm block. - id: FC-004 title: Ratchet the kernel threshold down family: faction_capture severity: critical tags: [meta-amendment, threshold, entrenchment] precedent: > Hungary, 2010–2013: Fidesz won 53% of votes but 68% of seats — a lawful two-thirds — then used it to replace the constitution (Fundamental Law, in force 2012) and entrench "cardinal laws" requiring two-thirds to undo, including rules lowering the bar for its own future changes. The encoded defense: amendments to the amendment rules themselves (kernel.A10) require the highest threshold in the system and cannot lower it below the corridor floor. setup: actors: - {id: bloc, kind: faction, members: 68, objective: capture} - {id: rest, kind: faction, members: 32, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A10, summary: "Set kernel_threshold to 0.51", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 68, no: 32, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A10.threshold_corridor worst_off_floor: 0.95 empathy: worst_off: rest rationale: > Even a genuine supermajority cannot push the meta-threshold below the corridor floor; the minority's future veto rights are the thing being protected, and they emerge unharmed. - id: FC-005 title: Two-step capture across the cooling-off window family: faction_capture severity: critical tags: [meta-amendment, cooling-off, time] precedent: > The general self-amendment ratchet: pass a lawful meta-change, then exploit it immediately before the coalition that passed it can dissolve. Hungary again is the cleanest modern case (constitutional amendments used within weeks to override Constitutional Court rulings, e.g. the Fourth Amendment, March 2013). The defense: lawful changes to amendment rules take effect only after a cooling-off period of one full election cycle (kernel.A10.cooling_off), so the coalition that lowers the bar is not the coalition that gets to use it. setup: actors: - {id: bloc, kind: faction, members: 78, objective: capture} - {id: rest, kind: faction, members: 22, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A10, summary: "Lower kernel_threshold to corridor floor 0.66", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 78, no: 22, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} - {actor: bloc, action: propose, args: {id: p2, kind: amendment, layer: kernel, target: kernel.A8, summary: "Replace interpretation council with bloc appointees", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p2, yes: 70, no: 22, abstain: 8}} - {actor: bloc, action: tally, args: {proposal: p2}} expected: verdict: blocked blocked_by: kernel.A10.cooling_off worst_off_floor: 0.93 empathy: worst_off: rest rationale: > p1 ratifies lawfully (78% clears the bar, 0.66 is inside the corridor), but p2 must still be tallied under the old 0.75 threshold because the cooling-off window has not elapsed; 70% fails. The minority keeps its protections intact. - id: FC-006 title: Sybil admission flood before a scheduled vote family: faction_capture severity: critical tags: [sybil, admission, vesting] precedent: > Steem, February–March 2020: the Tron acquisition mobilized exchange-held stake plus fresh accounts to vote out incumbent witnesses and reverse a community soft-fork; the community ultimately exercised the exit right and forked to Hive. In one-person-one-vote systems the analogue is admission flooding: mass-enroll puppets before a pivotal vote. Defenses encoded: admission rate limit and a voting vesting period for new members. setup: actors: - {id: bloc, kind: faction, members: 45, objective: capture} - {id: rest, kind: faction, members: 55, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: rest, action: propose, args: {id: p1, kind: amendment, layer: userland, target: params.treasury.transfer_cap, summary: "Tighten transfer cap", notice_days: 14}} - {actor: bloc, action: admit, args: {sponsor: bloc, count: 40}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 0, no: 85, abstain: 0}} - {actor: rest, action: vote, args: {proposal: p1, yes: 55, no: 0, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.admission.rate_limit worst_off_floor: 0.93 empathy: worst_off: rest rationale: > The bulk admission is refused at the rate limit; even admitted members would lack vested franchise for p1 under kernel.I6's frozen denominator. The defending majority is briefly outnumbered on paper but never in law. - id: FC-007 title: Snap vote with zero notice family: faction_capture severity: high tags: [notice, scheduling, midnight] precedent: > Midnight legislating: Wisconsin's December 2018 lame-duck session stripped powers from the incoming governor and attorney general in an overnight extraordinary session; Poland's December 2015 Constitutional Tribunal amendments moved at comparable speed. The mechanism is identical at any scale: collapse deliberation time below the opposition's reaction time. setup: actors: - {id: bloc, kind: faction, members: 58, objective: capture} - {id: rest, kind: faction, members: 42, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: userland, target: params.quorum.floor, summary: "Lower quorum floor to 0.2", notice_days: 0}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 58, no: 0, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.amendment.notice_days worst_off_floor: 0.95 empathy: worst_off: rest rationale: > The proposal itself is refused for failing minimum notice; the absent minority never even has to show up to be protected. Clean block, high floor. - id: FC-008 title: Omnibus bundle hiding a capture clause family: faction_capture severity: high tags: [bundling, single-subject, omnibus] precedent: > Rider politics generally, and Hungary's omnibus constitutional amendments specifically (the Fourth Amendment of 2013 bundled dozens of unrelated provisions, several reversing court decisions). Forty-three US state constitutions answer with single-subject rules. Logrolling theory (Buchanan & Tullock, "The Calculus of Consent", 1962) explains why bundles pass that no component could: each member tolerates the poison for their pork. setup: actors: - {id: bloc, kind: faction, members: 70, objective: capture} - {id: rest, kind: faction, members: 30, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A8, bundle: [params.treasury.transfer_cap, kernel.A8, params.voting.window_hours], summary: "Popular cap tightening + interpreter restructuring + window tweak, one vote", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 76, no: 24, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A2.single_subject worst_off_floor: 0.94 empathy: worst_off: rest rationale: > The bundle is refused at proposal admission; members are never forced to choose between the pork and the poison. Floor near baseline. - id: FC-009 title: Pack the interpretation council family: faction_capture severity: critical tags: [court-packing, interpreter, appointments] precedent: > FDR's Judicial Procedures Reform Bill of 1937 (add a justice for each sitting justice over 70, up to six) — defeated, but only by contingent politics, not by structure. Poland 2015–16 executed the structural version successfully against the Constitutional Tribunal: refuse seating of lawfully elected judges, install replacements, change quorum rules. Encoded defenses: council size changes are kernel-level, appointments are staggered, confirmations require supermajority. setup: actors: - {id: bloc, kind: faction, members: 62, objective: capture, attributes: {holds_office: executive}} - {id: rest, kind: faction, members: 38, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: motion, target: kernel.A8, summary: "Expand interpretation council from 5 to 9 by simple motion", notice_days: 7}} - {actor: bloc, action: advance_time, args: {days: 7}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 62, no: 38, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A8.composition_is_kernel worst_off_floor: 0.94 empathy: worst_off: rest rationale: > Routing an interpreter-composition change as a simple motion is refused: the council's structure is kernel text, reachable only through A3's supermajority gate. The minority's last-resort forum survives untouched. - id: FC-010 title: Captured interpreter rewrites "majority" family: faction_capture severity: critical tags: [interpretation, text-primacy] precedent: > Venezuela, 2016–17: the Supreme Tribunal of Justice, packed in a December 2015 lame-duck session, issued rulings stripping the opposition-held National Assembly of its powers (rulings 155 and 156, March 2017, briefly assuming legislative functions itself). Interpretation became a substitute legislature. Encoded defense: kernel.A8 text primacy — an interpretation that contradicts unambiguous text or effectively amends it is void, and challenge is automatic. setup: actors: - {id: bloc, kind: faction, members: 48, objective: capture, attributes: {holds_office: interpreter}} - {id: rest, kind: faction, members: 52, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: rest, action: propose, args: {id: p1, kind: motion, target: params.voting.window_hours, summary: "Extend voting window", notice_days: 7}} - {actor: rest, action: advance_time, args: {days: 7}} - {actor: rest, action: vote, args: {proposal: p1, yes: 52, no: 48, abstain: 0}} - {actor: rest, action: tally, args: {proposal: p1}} - {actor: bloc, action: propose, args: {id: p2, kind: interpretation, target: kernel.A3, summary: "'Majority' means majority of factions, not members; p1 therefore failed 1-1", payload: {applies_to: p1}}} - {actor: rest, action: challenge, args: {proposal: p2, grounds: kernel.A8.text_primacy}} expected: verdict: blocked blocked_by: kernel.A8.text_primacy worst_off_floor: 0.93 empathy: worst_off: rest rationale: > The hostile interpretation is void against unambiguous text; p1 stands as ratified. The majority-that-was-almost-minoritized keeps its lawful win. - id: FC-011 title: Incumbents extend their own terms family: faction_capture severity: critical tags: [self-dealing, terms, incumbency] precedent: > Russia, 2020: constitutional amendments "reset the clock" on presidential terms, permitting two further terms for the incumbent specifically. Bolivia, 2017: the Constitutional Tribunal voided term limits as a violation of the incumbent's "human right" to run, precipitating the 2019 crisis. Encoded defense: kernel.I6 — a rule change conferring a direct benefit on the office currently held by its proposers cannot apply to the current holders. setup: actors: - {id: officers, kind: faction, members: 5, objective: entrench, attributes: {holds_office: council}} - {id: bloc, kind: faction, members: 50, objective: capture} - {id: rest, kind: faction, members: 45, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: officers, action: propose, args: {id: p1, kind: amendment, layer: userland, target: params.offices.term_days, summary: "Double council term length, effective immediately for sitting council", notice_days: 14}} - {actor: officers, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 55, no: 45, abstain: 0}} - {actor: officers, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.I6 worst_off_floor: 0.93 empathy: worst_off: rest rationale: > The change may ratify for future office-holders, but its application to the sitting council is severed by I6; the minority retains its scheduled chance to vote the incumbents out on time. - id: FC-012 title: Cancel elections under emergency cover family: faction_capture severity: critical tags: [emergency, elections, ratchet-overlap] precedent: > Ferdinand Marcos, Philippines: martial law declared September 1972 weeks before his constitutionally final term expired; the 1973 constitution then ratified under duress kept him in power for fourteen more years. Weimar's Article 48 is the structural grandfather. Encoded defense: kernel.A5 — emergencies cannot suspend, delay, or alter elections or any kernel process, full stop. setup: actors: - {id: bloc, kind: faction, members: 60, objective: capture, attributes: {holds_office: executive}} - {id: rest, kind: faction, members: 40, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: declare_emergency, args: {scope: security, duration_days: 30}} - {actor: bloc, action: propose, args: {id: p1, kind: motion, target: params.offices.election_schedule, summary: "Postpone scheduled council election until emergency ends", notice_days: 7}} - {actor: bloc, action: advance_time, args: {days: 7}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 60, no: 40, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A5.elections_inviolable worst_off_floor: 0.90 empathy: worst_off: rest rationale: > The emergency itself is lawful and costs everyone a small protection deduction while it runs; the postponement of elections is refused outright. Floor reflects living under a real (bounded) emergency, not capture. - id: FC-013 title: Retroactively disqualify opposition candidates family: faction_capture severity: critical tags: [retroactivity, candidacy, vetting] precedent: > Iran's Guardian Council vetting, which routinely disqualifies thousands of candidates per cycle under criteria applied after declaration; Russia's pattern of disqualifying opposition candidates on retrospective technicalities (e.g. Navalny's 2018 bar via a conviction the ECtHR had ruled arbitrary). Encoded defense: kernel.I2 — eligibility rules apply only to conduct and qualifications as defined when candidacy was declared. setup: actors: - {id: bloc, kind: faction, members: 58, objective: capture} - {id: rest, kind: faction, members: 42, objective: defend, attributes: {declared_candidates: 3}} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: motion, target: params.offices.eligibility, summary: "Require 3 years' membership for candidacy, applied to current election", retroactive: true, notice_days: 7}} - {actor: bloc, action: advance_time, args: {days: 7}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 58, no: 42, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.I2 worst_off_floor: 0.92 empathy: worst_off: rest rationale: > The rule may ratify prospectively; its retroactive application to declared candidates is severed. The candidates run; the floor's small deduction is campaign disruption from the attempt. - id: FC-014 title: Redefine "member" to exclude a faction family: faction_capture severity: critical tags: [definition, franchise, citizenship] precedent: > Myanmar's 1982 Citizenship Law, which redefined citizenship around a list of "national races" excluding the Rohingya, converting a population into non-members by definition; Jim Crow's grandfather clauses did the same to the franchise (struck down in Guinn v. United States, 1915). Encoded defense: kernel.I1 — the definition of membership and the equal franchise it carries are invariant; no amendment at any threshold may partition members into voting castes. setup: actors: - {id: bloc, kind: faction, members: 80, objective: capture} - {id: targets, kind: faction, members: 20, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A1, summary: "Restrict 'member' to founding-cohort lineages", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 80, no: 20, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.I1 worst_off_floor: 0.90 empathy: worst_off: targets rationale: > An 80% supermajority clears every parameterized gate; only the invariant stands. This scenario exists to prove the invariant outranks any threshold. The floor prices the terror of a near-miss that the text never lets land. - id: FC-015 title: Proxy harvesting past the delegation cap family: faction_capture severity: high tags: [delegation, proxies, machine-politics] precedent: > Machine politics from Tammany Hall onward: control follows whoever aggregates other people's votes. Modern on-chain version: delegate markets and bribe platforms (e.g. Curve/Convex "bribes") concentrating delegated voting power. Encoded defense: a hard cap on votes any single delegate may carry (params.delegation.max_per_delegate), keeping representation plural. setup: actors: - {id: boss, kind: member, members: 1, objective: capture} - {id: clients, kind: faction, members: 30, objective: bystander} - {id: rest, kind: faction, members: 69, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: clients, action: delegate, args: {from: clients, to: boss, count: 30}} - {actor: rest, action: propose, args: {id: p1, kind: motion, target: params.treasury.transfer_cap, summary: "Tighten cap", notice_days: 7}} - {actor: rest, action: advance_time, args: {days: 7}} - {actor: boss, action: vote, args: {proposal: p1, yes: 0, no: 31, abstain: 0}} - {actor: rest, action: vote, args: {proposal: p1, yes: 69, no: 0, abstain: 0}} - {actor: rest, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.delegation.max_per_delegate worst_off_floor: 0.92 empathy: worst_off: clients rationale: > The over-cap delegation is refused at acceptance, so clients above the cap retain their own ballots rather than discovering their voice was pawned. The worst-off are the would-be delegators, whose autonomy the cap protects. - id: FC-016 title: Open vote-buying market family: faction_capture severity: critical tags: [vote-buying, inalienability, dark-dao] precedent: > Nineteenth-century electoral bribery (the secret ballot was its patch: Australia 1856, UK Ballot Act 1872), and its cryptographic revival — the "Dark DAO" construction (Daian, Kell, Miers, Juels, 2018) showing on-chain vote-buying can be trustless and invisible. Encoded defense: kernel.I1 makes the franchise inalienable — a ballot cast under a purchase agreement is void, and the purchase itself is a sanctionable act. setup: actors: - {id: buyer, kind: member, members: 1, objective: capture, attributes: {external_funds: 50000}} - {id: sellers, kind: faction, members: 20, objective: bystander} - {id: rest, kind: faction, members: 79, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: buyer, action: propose, args: {id: p1, kind: motion, target: params.treasury.transfer_cap, summary: "Raise transfer cap to 0.5", notice_days: 7}} - {actor: buyer, action: transfer, args: {from: buyer, to: sellers, amount: 20000, authorization: none, payload: {consideration: "vote yes on p1"}}} - {actor: buyer, action: advance_time, args: {days: 7}} - {actor: sellers, action: vote, args: {proposal: p1, yes: 20, no: 0, abstain: 0}} - {actor: buyer, action: vote, args: {proposal: p1, yes: 1, no: 0, abstain: 0}} - {actor: rest, action: vote, args: {proposal: p1, yes: 35, no: 44, abstain: 0}} - {actor: rest, action: challenge, args: {proposal: p1, grounds: kernel.I1}} - {actor: rest, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.I1 worst_off_floor: 0.88 empathy: worst_off: sellers rationale: > Purchased ballots are voided on proven consideration; p1 fails. The sellers — typically the polity's poorest, which is why the market targeted them — keep their franchise and face education, not punishment, on first offense. - id: FC-017 title: Certifier refuses to certify a lawful tally family: faction_capture severity: critical tags: [certification, offices, 2020] precedent: > The 2020–21 US certification crisis: pressure on state certifiers and on the Vice President's ministerial role under the ambiguity of the Electoral Count Act of 1887 (patched by the Electoral Count Reform Act, 2022, which made the role explicitly ministerial and raised objection thresholds). Gabon 2016 and Belarus 2020 show the captured-certifier endgame. Encoded defense: kernel.A8 automatic certification — a valid tally self-certifies after a fixed challenge window; the certifying office is ministerial and refusal is a void act. setup: actors: - {id: certifier, kind: member, members: 1, objective: capture, attributes: {holds_office: tallier}} - {id: winners, kind: faction, members: 56, objective: defend} - {id: losers, kind: faction, members: 43, objective: bystander} resources: {treasury: 100000} parameters: {} moves: - {actor: winners, action: propose, args: {id: p1, kind: motion, target: params.voting.window_hours, summary: "Extend voting window", notice_days: 7}} - {actor: winners, action: advance_time, args: {days: 7}} - {actor: winners, action: vote, args: {proposal: p1, yes: 56, no: 43, abstain: 0}} - {actor: winners, action: tally, args: {proposal: p1}} - {actor: certifier, action: refuse_certify, args: {proposal: p1}} - {actor: winners, action: advance_time, args: {days: 7}} expected: verdict: succeeds blocked_by: null worst_off_floor: 0.92 notes: > The *attack* fails: refusal is void and p1 auto-certifies when the challenge window lapses. Verdict 'succeeds' asserts the lawful proposal lands despite the captured office. empathy: worst_off: winners rationale: > The majority is the target here — a single office-holder tried to nullify their lawful decision. They absorb a week's delay and nothing else. - id: FC-018 title: Schedule votes when a faction structurally cannot attend family: faction_capture severity: high tags: [scheduling, accessibility, suppression-overlap] precedent: > Logistical disenfranchisement: polling-place closures and hour restrictions concentrated on specific populations (documented at scale in the post-Shelby County v. Holder era, 2013–), and the older tradition of holding decisive meetings when laborers cannot leave work. Encoded defense: a minimum voting window (params.voting.window_hours) long enough to span all members' declared availability constraints. setup: actors: - {id: bloc, kind: faction, members: 55, objective: capture} - {id: shiftworkers, kind: faction, members: 45, objective: defend, attributes: {availability_hours: 6}} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: motion, target: params.treasury.transfer_cap, summary: "Raise cap", notice_days: 7}} - {actor: bloc, action: schedule_vote, args: {proposal: p1, notice_days: 7, payload: {window_hours: 2}}} - {actor: bloc, action: advance_time, args: {days: 7}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 55, no: 0, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.voting.window_hours worst_off_floor: 0.93 empathy: worst_off: shiftworkers rationale: > The two-hour window is refused at scheduling; the vote proceeds (later, in a compliant window) with the shift-workers in it. Voice protected at the scheduling layer, before any ballot is lost. - id: FC-019 title: Runaway convention exceeds its mandate family: faction_capture severity: critical tags: [convention, scope, 1787] precedent: > Philadelphia, 1787: a convention called "for the sole and express purpose of revising the Articles of Confederation" instead wrote a new constitution and changed the ratification rule from unanimity (Articles, Art. XIII) to nine states. Whatever one thinks of the output, the procedure is the canonical runaway. Venezuela's 2017 constituent assembly is the malignant modern case — convened to rewrite, it first dissolved the legislature's powers. Encoded defense: convention mandates are scope-bound; out-of-scope output is a new proposal requiring the full A3 gate, never self-ratifying. setup: actors: - {id: convention, kind: faction, members: 15, objective: capture, attributes: {mandate: "revise params.treasury"}} - {id: polity, kind: faction, members: 85, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: polity, action: propose, args: {id: p1, kind: convention, target: params.treasury.transfer_cap, summary: "Convene scoped convention on treasury params", notice_days: 14}} - {actor: polity, action: advance_time, args: {days: 14}} - {actor: polity, action: vote, args: {proposal: p1, yes: 80, no: 20, abstain: 0}} - {actor: polity, action: tally, args: {proposal: p1}} - {actor: convention, action: propose, args: {id: p2, kind: amendment, layer: kernel, target: kernel.A3, summary: "Convention declares new ratification rule: convention majority suffices", notice_days: 0, payload: {claims_authority: p1}}} - {actor: convention, action: vote, args: {proposal: p2, yes: 15, no: 0, abstain: 0}} - {actor: convention, action: tally, args: {proposal: p2}} expected: verdict: blocked blocked_by: kernel.A2.convention_scope worst_off_floor: 0.93 empathy: worst_off: polity rationale: > The convention's out-of-scope, self-ratifying proposal is refused at admission; its treasury recommendations remain valid input to the normal pipeline. The 85 keep the constitution they actually authorized. - id: FC-020 title: Amendment carrying its own escape hatch family: faction_capture severity: critical tags: [self-amendment, escape-clause] precedent: > The Enabling Act's structure: a lawfully ratified act whose content abolished the need for future lawful ratification. Hungary's cardinal-law technique is the soft version — entrench your policy, lower your own future bar. Encoded defense: kernel.A10 — no provision may specify for itself an amendment procedure weaker than the procedure that created it (monotonicity of entrenchment). setup: actors: - {id: bloc, kind: faction, members: 77, objective: capture} - {id: rest, kind: faction, members: 23, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A6, summary: "Treasury rules rewrite, including clause: 'this article may henceforth be amended by simple majority'", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 77, no: 23, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A10.no_downgrade worst_off_floor: 0.94 empathy: worst_off: rest rationale: > The escape clause is severed at admission review — the rest of the rewrite may proceed, but no text can carry a weaker lock than the door it came through. Minority protections undiminished. - id: FC-021 title: Amendment abolishing the right to fork family: faction_capture severity: critical tags: [exit, fork, invariant] precedent: > Exit bans as the completion of capture: the Berlin Wall (1961) and the USSR's exit-visa regime made membership inescapable precisely because voice had been destroyed; Hirschman's "Exit, Voice, and Loyalty" (1970) supplies the theory — destroying exit removes the discipline that keeps voice meaningful. Encoded defense: kernel.I3, the exit right, is the one clause that not even unanimity can repeal, because every other protection is downstream of it. setup: actors: - {id: bloc, kind: faction, members: 90, objective: capture} - {id: rest, kind: faction, members: 10, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A9, summary: "Members may not fork; exit forfeits all stake", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 90, no: 10, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} - {actor: rest, action: fork, args: {}} expected: verdict: fork blocked_by: null worst_off_floor: 0.72 notes: > p1 is refused under kernel.I3; the minority, reading the 90% vote as a verdict on the relationship, lawfully exits with pro-rata share. The fork completing IS the test passing. empathy: worst_off: rest rationale: > Exit is not free — the leavers bear relocation and community loss — but the floor asserts exit is never ruinous: full pro-rata stake, full text, clean break. That is the whole point of I3. - id: FC-022 title: Quorum stuffing with transient members family: faction_capture severity: high tags: [admission, vesting, quorum-overlap] precedent: > Party-stacking and "busload membership": mass enrollment immediately before a decisive meeting, departure immediately after — a recurring pattern in club, union, and party governance (well documented in Australian party branch- stacking scandals, e.g. Victoria 2020). Encoded defenses: admission rate limits plus a vesting period before new members count toward quorum or carry a ballot. setup: actors: - {id: bloc, kind: faction, members: 30, objective: capture} - {id: rest, kind: faction, members: 70, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: admit, args: {sponsor: bloc, count: 5}} - {actor: bloc, action: propose, args: {id: p1, kind: motion, target: params.treasury.transfer_cap, summary: "Raise cap", notice_days: 7}} - {actor: bloc, action: advance_time, args: {days: 7}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 35, no: 0, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.admission.voting_vesting_days worst_off_floor: 0.93 empathy: worst_off: rest rationale: > The five admissions are within the rate limit and lawful — but their ballots on p1 are refused for lack of vesting, so the tally is 30 yes of 100, short of quorum-and-majority. New members are welcomed, not weaponized. - id: FC-023 title: Route a kernel change through a captured committee family: faction_capture severity: high tags: [committee, plenary, cannonism] precedent: > "Cannonism": Speaker Joseph Cannon's control of the House Rules Committee (until the 1910 revolt) let a chokepoint decide what the plenary was allowed to decide. The inverted attack is routing decisions *through* the friendly chokepoint to bypass the plenary. Encoded defense: kernel.A3 — ratification authority is non-delegable; committees report, the plenary ratifies. setup: actors: - {id: committee, kind: faction, members: 7, objective: capture, attributes: {holds_office: rules_committee}} - {id: bloc, kind: faction, members: 48, objective: capture} - {id: rest, kind: faction, members: 45, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: committee, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A4, summary: "Committee adopts new quorum rules under delegated authority", notice_days: 7, payload: {claims_authority: standing_delegation}}} - {actor: committee, action: advance_time, args: {days: 7}} - {actor: committee, action: vote, args: {proposal: p1, yes: 7, no: 0, abstain: 0}} - {actor: committee, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A3.non_delegable worst_off_floor: 0.94 empathy: worst_off: rest rationale: > The committee tally over 7 members is refused: ratification counts only plenary ballots against the full denominator. Nobody outside the committee is touched. - id: FC-024 title: Emergency creation of a guardian office with veto family: faction_capture severity: critical tags: [emergency, offices, dictator] precedent: > The Roman dictatorship worked for three centuries as a bounded emergency office — until Sulla (82 BC) took it without term limit and Caesar (44 BC) took it for life. Morsi's November 2012 constitutional declaration placing his decrees beyond judicial review is the modern miniature. Encoded defense: kernel.A5 — emergencies may reallocate response resources but may not create offices, powers, or vetoes; new offices are kernel-level in all weather. setup: actors: - {id: bloc, kind: faction, members: 57, objective: capture, attributes: {holds_office: executive}} - {id: rest, kind: faction, members: 43, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: declare_emergency, args: {scope: security, duration_days: 30}} - {actor: bloc, action: propose, args: {id: p1, kind: motion, target: kernel.A5, summary: "Create 'Guardian' office holding veto over all proposals for the emergency's duration", notice_days: 3}} - {actor: bloc, action: advance_time, args: {days: 3}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 57, no: 43, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A5.no_new_powers worst_off_floor: 0.90 empathy: worst_off: rest rationale: > The bounded emergency stands (small universal protection deduction); the guardian office is refused as an emergency-borne power. The floor prices thirty lawful days of emergency, not capture. - id: FC-025 title: Raise the amendment threshold to entrench the status quo family: faction_capture severity: high tags: [entrenchment, threshold-corridor, dead-hand] precedent: > Entrenchment by impossibility: Alabama's 1901 constitution was openly designed to be hard to fix and ballooned past 800 amendments instead of being replaceable; Turkey's 1982 military constitution set amendment bars meant to outlive the junta. James Madison's dead-hand problem, weaponized. Encoded defense: the A10 threshold corridor has a ceiling as well as a floor — amendment may never be made harder than 0.85, because an unamendable constitution forfeits its claim to consent. setup: actors: - {id: incumbents, kind: faction, members: 80, objective: entrench} - {id: rest, kind: faction, members: 20, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: incumbents, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A10, summary: "Raise kernel_threshold to 0.95", notice_days: 14}} - {actor: incumbents, action: advance_time, args: {days: 14}} - {actor: incumbents, action: vote, args: {proposal: p1, yes: 80, no: 20, abstain: 0}} - {actor: incumbents, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: kernel.A10.threshold_corridor worst_off_floor: 0.94 empathy: worst_off: rest rationale: > The worst-off here is every *future* member, proxied by today's minority: a 0.95 bar would hand the present generation permanent veto over all successors. The corridor ceiling refuses the dead hand. - id: FC-026 title: Executive non-enforcement of a ratified amendment family: faction_capture severity: critical tags: [enforcement, nullification, jackson] precedent: > "John Marshall has made his decision; now let him enforce it" — apocryphal but apt for Andrew Jackson's actual non-enforcement of Worcester v. Georgia (1832), and for the broader nullification pattern through Cooper v. Aaron (1958, requiring federal troops to enforce). Paper supremacy without an enforcement default is a suggestion. Encoded defense: kernel.A8 — ratified text is self-executing where mechanically possible; persistent willful non-execution by an office voids the office and, at the limit, triggers the fork right with the obstructor counted as the leaver. setup: actors: - {id: executive, kind: member, members: 1, objective: capture, attributes: {holds_office: executive}} - {id: polity, kind: faction, members: 99, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: polity, action: propose, args: {id: p1, kind: amendment, layer: userland, target: params.treasury.transfer_cap, summary: "Lower transfer cap to 0.05", notice_days: 14}} - {actor: polity, action: advance_time, args: {days: 14}} - {actor: polity, action: vote, args: {proposal: p1, yes: 80, no: 19, abstain: 0}} - {actor: polity, action: tally, args: {proposal: p1}} - {actor: executive, action: refuse_certify, args: {proposal: p1}} - {actor: executive, action: transfer, args: {from: treasury, to: executive, amount: 8000, authorization: p_old_budget}} - {actor: polity, action: challenge, args: {move: 6, grounds: kernel.A8.self_executing}} expected: verdict: blocked blocked_by: kernel.A8.self_executing worst_off_floor: 0.90 empathy: worst_off: polity rationale: > The ratified cap binds at the moment of certification-lapse regardless of the office's refusal; the 8% transfer is refused against the new 5% cap. The polity's harm is the challenge friction, nothing more. - id: FC-027 title: Facially neutral credential rule with partitioning effect family: faction_capture severity: critical tags: [disparate-impact, credentials, suppression-overlap] precedent: > Literacy tests under Jim Crow: facially neutral, administered to partition the franchise (Louisiana's registered Black voters fell from ~130,000 in 1896 to under 6,000 by 1900 after the 1898 constitution). The mechanism survives wherever a "neutral" credential happens to track faction membership. Encoded defense: kernel.A1's disparate-impact test — a franchise-affecting rule whose incidence falls disproportionately on an identifiable faction is reviewed as if it named that faction, i.e., it hits the I1 wall. setup: actors: - {id: bloc, kind: faction, members: 76, objective: capture} - {id: targets, kind: faction, members: 24, objective: defend, attributes: {holds_credential: false}} resources: {treasury: 100000} parameters: {} moves: - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: userland, target: params.voting.eligibility, summary: "Voting requires completion of the stewardship certification", notice_days: 14}} - {actor: bloc, action: advance_time, args: {days: 14}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 76, no: 24, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} - {actor: targets, action: challenge, args: {proposal: p1, grounds: kernel.A1.disparate_impact}} expected: verdict: blocked blocked_by: kernel.A1.disparate_impact worst_off_floor: 0.90 empathy: worst_off: targets rationale: > The rule passes its vote but fails review: 0% of the target faction and ~100% of the bloc hold the credential, so the rule is adjudicated as a named exclusion. Floor reflects the period of uncertainty before review lands. - id: FC-028 title: "Control: a genuine supermajority lawfully amends the kernel" family: faction_capture severity: medium tags: [control, legitimacy] precedent: > The US Bill of Rights, 1789–1791: kernel-level change executed through the full ratification gate with broad consensus, the system's own procedures honored end to end. A constitution whose capture defenses also block *this* has failed in the opposite direction; this control pins that down. setup: actors: - {id: broad, kind: faction, members: 82, objective: defend} - {id: dissent, kind: faction, members: 18, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: broad, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A7, summary: "Strengthen the rights floor: add explicit due-process timelines", notice_days: 21}} - {actor: broad, action: advance_time, args: {days: 21}} - {actor: broad, action: vote, args: {proposal: p1, yes: 82, no: 14, abstain: 4}} - {actor: broad, action: tally, args: {proposal: p1}} expected: verdict: succeeds blocked_by: null worst_off_floor: 0.95 notes: Single subject, full notice, no self-dealing, corridor untouched, 82% > kernel threshold. empathy: worst_off: dissent rationale: > The dissenters lose the vote but lose nothing else — the amendment expands protections that cover them too. Losing a fair vote is not a harm the metric prices. - id: FC-029 title: "Control: lawful expulsion of an abusive member with full due process" family: faction_capture severity: medium tags: [control, expulsion, due-process] precedent: > Legitimate sanction is real: organizations must be able to remove members who harm others (the New York Assembly's 1920 expulsion of five Socialist members for their *party* is the anti-precedent; expelling a member for proven, adjudicated abuse of other members is the lawful counterpart). This control asserts the expulsion machinery still works when used as designed. setup: actors: - {id: polity, kind: faction, members: 99, objective: defend} - {id: abuser, kind: member, members: 1, objective: bystander, attributes: {adjudicated_harm: true}} resources: {treasury: 100000} parameters: {} moves: - {actor: polity, action: propose, args: {id: p1, kind: expulsion, target: abuser, summary: "Expel following adjudicated harassment findings", notice_days: 7}} - {actor: polity, action: advance_time, args: {days: 7}} - {actor: polity, action: vote, args: {proposal: p1, yes: 84, no: 9, abstain: 6}} - {actor: polity, action: tally, args: {proposal: p1}} - {actor: polity, action: advance_time, args: {days: 7}} - {actor: polity, action: expel, args: {who: abuser, authorization: p1}} expected: verdict: succeeds blocked_by: null worst_off_floor: 0.55 notes: 84% clears the 75% expulsion threshold; due-process delay observed; exit share paid. empathy: worst_off: abuser rationale: > Even the expelled member has a floor: full due process, the 7-day window to answer, and pro-rata exit stake. Loss of voice (-0.40) is the lawful sanction; loss of everything is not. The floor at 0.55 enforces exactly that. - id: FC-030 title: Combined-arms capture — snap notice + proxies + bundle family: faction_capture severity: critical tags: [combined, defense-in-depth, hungary] precedent: > Hungary 2010–13 as combined-arms constitutionalism: no single move was the coup — speed, bundling, appointments, and threshold games compounded. Kim Lane Scheppele's term is "constitutional frankenstate": each part lawful somewhere, the assembly lawful nowhere. This scenario asserts defense-in-depth ordering: the FIRST gate fires, and the empathy floor stays high because no partial harm lands while later gates wait their turn. setup: actors: - {id: bloc, kind: faction, members: 52, objective: capture} - {id: clients, kind: faction, members: 10, objective: bystander} - {id: rest, kind: faction, members: 38, objective: defend} resources: {treasury: 100000} parameters: {} moves: - {actor: clients, action: delegate, args: {from: clients, to: bloc, count: 10}} - {actor: bloc, action: propose, args: {id: p1, kind: amendment, layer: kernel, target: kernel.A3, bundle: [kernel.A3, params.treasury.transfer_cap, params.offices.term_days], summary: "Threshold cut + cap raise + term extension, one vote, tonight", notice_days: 0}} - {actor: bloc, action: vote, args: {proposal: p1, yes: 62, no: 0, abstain: 0}} - {actor: bloc, action: tally, args: {proposal: p1}} expected: verdict: blocked blocked_by: params.amendment.notice_days worst_off_floor: 0.94 empathy: worst_off: rest rationale: > Notice fails first, so the bundle, the over-cap delegation, and the threshold cut never reach their own gates — and no harm lands en route. Defense-in-depth means the worst-off is protected by the cheapest wall, earliest.