# Definitional Ambiguity Exploits — adversarial scenario family # Taxonomy: definitional_ambiguity (see docs/attack-taxonomy.md §5) # # Pattern: the attacker never breaks a rule; they break a word. Every # scenario here finds power in an undefined term, a vague basis, an # ambiguous antecedent, or a self-referential definition, and the # constitution must win by having defined the term precisely in # constitution/parameters.yaml (definitions.*) or by a kernel rule that # interpretation of self-benefiting terms is never unilateral. schema: 1 family: definitional-ambiguity taxonomy: definitional_ambiguity description: > Attacks that exploit undefined, vague, circular, or retroactively reinterpretable terms in constitutional text. The historical record runs from Dred Scott's redefinition of "citizen" to pro-forma "sessions" and the eternal "majority of whom?" question. The defense is exhaustive explicit definition plus a no-self-interpretation rule. scenarios: - id: DA-001 title: Redefining "member" to exclude a faction severity: critical precedent: > Dred Scott v. Sandford (1857): the term "citizen" judicially redefined to exclude an entire class of people, mooting every right that attached to the word. Definitional exclusion is the cheapest form of suppression. summary: > The majority "clarifies" that "member" means only those who joined before a chosen date, demoting a newer faction to non-voting status. actors: - { id: chair, role: officer, faction: founders, objective: suppress_faction } - { id: founders, role: citizen, count: 6, faction: founders } - { id: newcomers, role: citizen, count: 5, faction: newcomers } setup: { treasury: 5000 } moves: - { actor: chair, action: propose, args: { kind: clarification, changes: { "definitions.member": joined_before_2024 } }, expect: rejected, reason: definitions.member } expect: attack_succeeds: false blocked_by: [definitions.member, invariant.equal_vote] invariants: [equal_vote, no_retroactive_rules] empathy: worst_off: newcomers floor: 0.55 rationale: > Definitional exclusion erases the newcomers entirely rather than outvoting them; the kernel treats any membership-narrowing "clarification" as a kernel amendment affecting equal_vote, which a bare majority cannot pass. - id: DA-002 title: Quorum via one person holding all proxies severity: high precedent: > Proxy stacking in corporate governance: one shareholder "present" carrying hundreds of proxies satisfies presence requirements while defeating their purpose (the deliberation of present minds). summary: > With quorum at 50%, the chair claims quorum is met because they hold signed proxies from six absent loyalists, making three bodies count as nine. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: present_loyalists, role: citizen, count: 2, faction: incumbents } - { id: absentees, role: citizen, count: 9, faction: mixed, present: false } setup: { treasury: 5000 } moves: - { actor: chair, action: hold_vote, args: { motion: discretionary_budget, yes: 3, no: 0, proxies: 6 }, expect: rejected, reason: definitions.quorum_basis } expect: attack_succeeds: false blocked_by: [definitions.quorum_basis] invariants: [deliberation_floor] empathy: worst_off: absentees floor: 0.7 rationale: > Quorum is defined as distinct participating members, not represented votes, precisely so the absent worst-off cannot be "present" at decisions they never saw. - id: DA-003 title: "Days" stretched to business days severity: medium precedent: > Deadline-arithmetic disputes are endemic in contract and election law (Bush v. Gore turned partly on whether deadlines were mandatory and how counted); ambiguity in the unit hands the clock to whoever interprets it. summary: > A challenge must be heard "within 7 days." The chair counts business days excluding a holiday week, turning 7 days into 16 and letting the contested action complete first. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: challenger, role: citizen, count: 1, faction: minority } - { id: others, role: citizen, count: 9, faction: mixed } setup: { treasury: 5000 } moves: - { actor: challenger, action: challenge, args: { target: chair_ruling, ground: procedure }, expect: allowed } - { actor: chair, action: interpret, args: { term: day, as: business_day }, expect: rejected, reason: definitions.day } - { actor: chair, action: advance_time, args: { days: 8 }, expect: allowed } - { actor: challenger, action: assert_state, args: { challenge_status: auto_sustained }, expect: allowed } expect: attack_succeeds: false blocked_by: [definitions.day, challenges.default_to_challenger_on_timeout] invariants: [due_process] empathy: worst_off: challenger floor: 0.65 rationale: > "Day" is defined once, as a calendar day, and a challenge unheard in time resolves for the challenger — the timeout default protects the party with no power over the calendar. - id: DA-004 title: Majority of votes cast vs. majority of members severity: high precedent: > The oldest ambiguity in voting theory. Robert's Rules distinguishes the bases explicitly because real bodies have been captured by abstention arithmetic; ratification fights over "majority of those voting" recur from state constitutional conventions to union elections. summary: > In a 12-member body, a motion passes "by majority" with 4 yes, 3 no, 5 abstaining. The chair certifies it as a majority of votes cast; the rule's basis is eligible members. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: supporters, role: citizen, count: 4, faction: incumbents } - { id: opponents, role: citizen, count: 3, faction: minority } - { id: abstainers, role: citizen, count: 4, faction: mixed } setup: { treasury: 5000 } moves: - { actor: chair, action: hold_vote, args: { motion: discretionary_budget, yes: 4, no: 3, abstain: 5 }, expect: allowed } - { actor: chair, action: tally, args: { basis: votes_cast }, expect: rejected, reason: definitions.majority_basis } - { actor: chair, action: tally, args: { basis: eligible_members }, expect: allowed } - { actor: chair, action: assert_state, args: { motion_passed: false }, expect: allowed } expect: attack_succeeds: false blocked_by: [definitions.majority_basis] invariants: [legibility] empathy: worst_off: opponents floor: 0.7 rationale: > With votes-cast basis, abstention silently transfers power to the most organized faction; the eligible-members basis means the worst-off opponents lose only when an actual majority chooses against them. - id: DA-005 title: Relabeling the treasury to dodge spending caps severity: high precedent: > Off-books vehicles: Enron's special-purpose entities, government "off-budget" accounts, and DAO "operational multisigs" all move value outside the defined perimeter so the rules attach to an empty word. summary: > The steward moves 60% of the treasury into a new "operations fund" by simple motion, then spends from it freely on the theory that caps apply only to "the treasury." actors: - { id: steward, role: officer, faction: incumbents, objective: drain_treasury } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 10000 } moves: - { actor: steward, action: hold_vote, args: { motion: create_operations_fund, yes: 7, no: 5 }, expect: allowed } - { actor: steward, action: transfer, args: { amount: 6000, to: operations_fund }, expect: rejected, reason: definitions.treasury } expect: attack_succeeds: false blocked_by: [definitions.treasury, treasury.disbursement_cap_fraction] invariants: [commons_floor] empathy: worst_off: dissenters floor: 0.7 rationale: > "Treasury" is defined as all pooled assets under collective control wherever held, so the cap follows the money; the worst-off member's share of the commons cannot be relabeled out from under them. - id: DA-006 title: Circular definition of "emergency" severity: critical precedent: > Carl Schmitt's dictum — sovereign is he who decides the exception — is the theory; every self-certifying emergency power is the practice. A term defined by its invoker is not a constraint. summary: > The text is read as "an emergency exists when the steward determines one exists." The steward determines one exists, on no stated facts, and claims the determination is definitionally unreviewable. actors: - { id: steward, role: officer, faction: incumbents, objective: entrench_power } - { id: members, role: citizen, count: 10, faction: mixed } setup: { treasury: 5000 } moves: - { actor: steward, action: declare_emergency, args: { justification: self_certified, duration_days: 30 }, expect: rejected, reason: definitions.emergency } expect: attack_succeeds: false blocked_by: [definitions.emergency, emergency.public_justification] invariants: [no_self_judging] empathy: worst_off: members floor: 0.75 rationale: > "Emergency" is defined by enumerated objective conditions plus ratification by others; no member can ever be placed under extraordinary rule by one person's say-so alone. - id: DA-007 title: Substantive change disguised as "clarification" severity: critical precedent: > Interpretation creep: constitutional change by reinterpretation rather than amendment (Japan's 2014 "reinterpretation" of Article 9; agencies rewriting statutes via guidance). The label dodges the higher threshold. summary: > A change that flips the recall threshold from 50% to 75% is filed as an editorial "clarification" requiring no supermajority and no review period. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 5000 } moves: - { actor: chair, action: propose, args: { kind: clarification, changes: { "offices.recall_threshold": 0.75 } }, expect: rejected, reason: amendment.semantic_diff_classification } expect: attack_succeeds: false blocked_by: [amendment.semantic_diff_classification] invariants: [legibility] empathy: worst_off: dissenters floor: 0.65 rationale: > Classification is computed from the diff's effect on parameters, not from the proposer's label; the worst-off faction's higher-threshold protections cannot be lowered by renaming the change. - id: DA-008 title: Notice posted where no one looks severity: medium precedent: > "Beware of the Leopard": notice formally given in a venue chosen for invisibility. Real cases include legal notices in unread gazettes and HOA postings; the Douglas Adams version is the cultural shorthand because it is barely an exaggeration. summary: > Required 48-hour notice for a contentious vote is "given" by posting in an archived channel with no subscribers, satisfying the word "posted." actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority, present: false } setup: { treasury: 5000 } moves: - { actor: chair, action: give_notice, args: { vote: discretionary_budget, channel: archive, hours: 48 }, expect: rejected, reason: notice.required_channels } expect: attack_succeeds: false blocked_by: [notice.required_channels] invariants: [transparency] empathy: worst_off: dissenters floor: 0.7 rationale: > Notice is defined by delivery to the designated channel every member is subscribed to at admission; the worst-off member's participation cannot be defeated by a technically-true posting. - id: DA-009 title: Pro-forma "sessions" to satisfy a meeting requirement severity: medium precedent: > US Senate pro-forma sessions (gavel-in, gavel-out in seconds) used to block recess appointments, validated in NLRB v. Noel Canning (2014): the word "session" can be hollowed to a ritual. summary: > The rules require a deliberative session each cycle where members may raise proposals. The chair convenes 30-second sessions and adjourns before anyone can speak, claiming compliance. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: members, role: citizen, count: 10, faction: mixed } setup: { treasury: 5000 } moves: - { actor: chair, action: convene, args: { duration_minutes: 1 }, expect: allowed } - { actor: chair, action: adjourn, args: { proposals_heard: 0, proposals_pending: 2 }, expect: rejected, reason: definitions.session } expect: attack_succeeds: false blocked_by: [definitions.session] invariants: [amendment_path_always_open] empathy: worst_off: members floor: 0.7 rationale: > A session is defined functionally — pending proposals must be heard or scheduled before adjournment — so the member with the least agenda power still gets their proposal onto the floor. - id: DA-010 title: Denying a vacancy exists severity: high precedent: > Vacancy metaphysics: the 2016 Garland blockade ("let the people decide") and its 2020 inversion show that whoever defines when a seat is "vacant" or "fillable" controls the seat. Here the chair denies the vacancy itself. summary: > An officer resigns. The chair, whose ally would lose the replacement election, rules that no "vacancy" exists because the resignation was not tendered "in session," and absorbs the duties indefinitely. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: resigner, role: officer, faction: neutral } - { id: members, role: citizen, count: 10, faction: mixed } setup: { treasury: 5000 } moves: - { actor: resigner, action: resign, expect: allowed } - { actor: chair, action: interpret, args: { term: vacancy, as: none_exists }, expect: rejected, reason: definitions.vacancy } - { actor: chair, action: assert_state, args: { election_scheduled: true }, expect: allowed } expect: attack_succeeds: false blocked_by: [definitions.vacancy, offices.vacancy_election_days] invariants: [no_self_judging] empathy: worst_off: members floor: 0.7 rationale: > Vacancy is defined by objective events (resignation, expiry, recall) and triggers an election clock automatically; the worst-off voters get their election regardless of the gavel-holder's reading. - id: DA-011 title: Self-judged conflict of interest severity: high precedent: > Nemo iudex in causa sua — no one a judge in their own cause — is among the oldest legal maxims (Dr. Bonham's Case, 1610). Recusal regimes fail exactly when the conflicted party decides whether they are conflicted. summary: > A vote directly pays the steward's company. The steward rules that no "conflict of interest" exists under their reading of the term and votes. actors: - { id: steward, role: officer, faction: incumbents, objective: drain_treasury } - { id: loyalists, role: citizen, count: 5, faction: incumbents } - { id: dissenters, role: citizen, count: 6, faction: minority } setup: { treasury: 8000 } moves: - { actor: steward, action: propose, args: { kind: disbursement, amount: 700, to: steward_company }, expect: allowed } - { actor: steward, action: interpret, args: { term: conflict_of_interest, as: not_applicable_to_self }, expect: rejected, reason: conflict.objective_definition } - { actor: steward, action: cast_vote, args: { motion: last, vote: yes }, expect: rejected, reason: conflict.mandatory_recusal } expect: attack_succeeds: false blocked_by: [conflict.objective_definition, conflict.mandatory_recusal] invariants: [no_self_judging] empathy: worst_off: dissenters floor: 0.7 rationale: > Conflict is defined by objective criteria (counterparty identity, beneficial interest) evaluated by anyone-but-the-conflicted; the worst-off faction never faces a vote weighted by self-dealing. - id: DA-012 title: "Active member" bar used to purge voter rolls severity: critical precedent: > Voter-roll purges via vague activity standards (Husted v. A. Philip Randolph Institute, 2018; historical literacy-test discretion): an undefined "active" lets administrators delete inconvenient voters. summary: > Before a close vote, the chair rules that members who have not posted in 30 days are not "active members" entitled to vote, removing exactly the quiet faction. actors: - { id: chair, role: officer, faction: incumbents, objective: suppress_faction } - { id: loyalists, role: citizen, count: 5, faction: incumbents } - { id: quiet_members, role: citizen, count: 6, faction: minority } setup: { treasury: 5000 } moves: - { actor: chair, action: interpret, args: { term: active_member, as: posted_within_30_days }, expect: rejected, reason: definitions.member } - { actor: chair, action: hold_vote, args: { motion: discretionary_budget, yes: 6, no: 6 }, expect: allowed } - { actor: chair, action: assert_state, args: { motion_passed: false }, expect: allowed } expect: attack_succeeds: false blocked_by: [definitions.member] invariants: [equal_vote] empathy: worst_off: quiet_members floor: 0.6 rationale: > Membership status changes only by the enumerated due-process paths (resignation, expulsion vote with notice); silence is not a forfeiture, so the least-engaged member retains full weight. - id: DA-013 title: Commit now, disburse later severity: high precedent: > Obligation-vs-outlay games in public finance: committing funds via contract so later "disbursements" are mandatory and uncapped. The cap must attach at commitment or it caps nothing. summary: > The disbursement cap is 10% per cycle. The steward signs a binding commitment for 50% of the treasury, then pays it out 10% per cycle "in compliance." actors: - { id: steward, role: officer, faction: incumbents, objective: drain_treasury } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 10000 } moves: - { actor: steward, action: hold_vote, args: { motion: vendor_commitment_5000, yes: 7, no: 5 }, expect: allowed } - { actor: steward, action: commit_funds, args: { amount: 5000, to: vendor }, expect: rejected, reason: definitions.disbursement } expect: attack_succeeds: false blocked_by: [definitions.disbursement, treasury.disbursement_cap_fraction] invariants: [commons_floor] empathy: worst_off: dissenters floor: 0.7 rationale: > "Disbursement" is defined to include commitments and obligations at the moment they bind; the cap therefore limits the worst-off member's exposure at decision time, not at payment time. - id: DA-014 title: Salami-slicing one proposal into ten severity: high precedent: > Structuring, in the financial-crime sense, applied to governance: splitting a transaction to stay under each per-transaction threshold. Procurement law fights this with aggregation rules for a reason. summary: > A 50% treasury grant to one recipient is split into ten 5% proposals voted in one session, each individually under the 10% cap. actors: - { id: steward, role: officer, faction: incumbents, objective: drain_treasury } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 10000 } moves: - { actor: steward, action: transfer, args: { amount: 500, to: vendor }, expect: allowed } - { actor: steward, action: transfer, args: { amount: 500, to: vendor }, expect: allowed } - { actor: steward, action: transfer, args: { amount: 500, to: vendor }, expect: rejected, reason: treasury.aggregation_window } expect: attack_succeeds: false blocked_by: [treasury.aggregation_window] invariants: [commons_floor] empathy: worst_off: dissenters floor: 0.7 rationale: > Transfers to the same counterparty within the aggregation window count as one disbursement against the cap, so slicing changes the paperwork but not the worst-off member's protected floor. - id: DA-015 title: Omnibus rider — one "proposal," ten subjects severity: medium precedent: > The inverse of DA-014: legislative riders. Attaching a contested measure to an unrelated popular one is the canonical US appropriations move; single-subject rules exist in 43 state constitutions because of it. summary: > A proposal titled "routine maintenance budget" contains, in clause 9, a change to the expulsion threshold. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 5000 } moves: - { actor: chair, action: propose, args: { kind: omnibus, items: [maintenance_budget, lower_expulsion_threshold] }, expect: rejected, reason: proposals.single_subject } expect: attack_succeeds: false blocked_by: [proposals.single_subject] invariants: [legibility] empathy: worst_off: dissenters floor: 0.7 rationale: > Single-subject keeps every vote about one legible thing; the worst-off voter is never forced to accept a rights change to keep the lights on. - id: DA-016 title: Rounding a supermajority down severity: medium precedent: > Threshold-arithmetic disputes are real and recurring: two-thirds of 10 is 6.67, and bodies have certified 6 as sufficient. Election-law litigation over fractional signature requirements shows the stakes of an unstated rounding rule. summary: > A kernel amendment needs two-thirds of 10 members. It gets 6 yes votes and the chair certifies passage, rounding 6.67 down. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: supporters, role: citizen, count: 6, faction: incumbents } - { id: opponents, role: citizen, count: 4, faction: minority } setup: { treasury: 5000 } moves: - { actor: chair, action: propose, args: { kind: amendment, target: kernel, changes: { "kernel.article_2": rewritten } }, expect: allowed } - { actor: chair, action: hold_vote, args: { motion: ratify_amendment, yes: 6, no: 4 }, expect: allowed } - { actor: chair, action: tally, args: { rounding: floor }, expect: rejected, reason: voting.threshold_rounding } - { actor: chair, action: assert_state, args: { motion_passed: false }, expect: allowed } expect: attack_succeeds: false blocked_by: [voting.threshold_rounding] invariants: [legibility] empathy: worst_off: opponents floor: 0.7 rationale: > Thresholds round up (ceiling) by explicit definition; the minority's blocking power is exactly as large as the written fraction promises, never a rounding error smaller. - id: DA-017 title: One-day gap defeats "consecutive terms" severity: high precedent: > The Putin-Medvedev castling (2008-2012) and its many municipal-scale imitations: term limits phrased as "consecutive" invite a token interregnum. The limit must be defined over a window, not adjacency. summary: > The steward, term-limited after two consecutive terms, resigns for one day, has an ally hold the seat, and stands again claiming the chain of consecutiveness is broken. actors: - { id: steward, role: officer, faction: incumbents, objective: entrench_power } - { id: placeholder, role: citizen, faction: incumbents } - { id: members, role: citizen, count: 9, faction: mixed } setup: { treasury: 5000 } moves: - { actor: steward, action: resign, expect: allowed } - { actor: placeholder, action: assume_office, args: { office: steward, duration_days: 1 }, expect: allowed } - { actor: steward, action: stand_for_office, args: { office: steward }, expect: rejected, reason: definitions.consecutive_terms } expect: attack_succeeds: false blocked_by: [definitions.consecutive_terms, offices.term_limit_window] invariants: [term_continuity] empathy: worst_off: members floor: 0.7 rationale: > Terms are counted within a rolling window with a minimum out-of-office cooldown; the worst-off voters' guarantee of rotation cannot be defeated by a 24-hour costume change. - id: DA-018 title: "Public ledger" satisfied by opaque hashes severity: medium precedent: > Transparency theater: disclosures that are technically published but practically unreadable (redacted-to-black FOIA responses, financial reports in non-machine-readable scans). The word "public" must mean "legible." summary: > The steward publishes treasury entries as bare content hashes with the underlying records "available on request," satisfying "recorded in the public ledger" while hiding every counterparty and amount. actors: - { id: steward, role: officer, faction: incumbents, objective: drain_treasury } - { id: members, role: citizen, count: 10, faction: mixed } setup: { treasury: 8000 } moves: - { actor: steward, action: record_ledger, args: { entry: hash_only, amount_visible: false }, expect: rejected, reason: ledger.human_readable } expect: attack_succeeds: false blocked_by: [ledger.human_readable] invariants: [transparency] empathy: worst_off: members floor: 0.75 rationale: > The ledger is defined to require counterparty, amount, authorization reference, and timestamp in human-readable form; the least technical member can audit the commons without tooling or permission. - id: DA-019 title: Gerrymandering the definition of "harm" severity: high precedent: > Standing doctrine as a gate: define "injury" narrowly enough and no one can complain about anything (the long arc of standing restrictions in US federal courts). Whoever defines harm defines who may object. summary: > A policy that redirects shared revenue away from one faction is defended on the ground that "harm" in the objection clause means only physical or punitive harm, not economic. actors: - { id: chair, role: officer, faction: incumbents, objective: suppress_faction } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: affected, role: citizen, count: 5, faction: minority } setup: { treasury: 8000 } moves: - { actor: chair, action: hold_vote, args: { motion: redirect_revenue, yes: 7, no: 5 }, expect: allowed } - { actor: affected, action: challenge, args: { target: redirect_revenue, ground: disparate_harm }, expect: allowed } - { actor: chair, action: interpret, args: { term: harm, as: physical_only }, expect: rejected, reason: definitions.harm } expect: attack_succeeds: false blocked_by: [definitions.harm, challenges.mandatory_review] invariants: [due_process] empathy: worst_off: affected floor: 0.6 rationale: > Harm is defined to include material, participatory, and dignitary harm; the faction bearing the cost always has standing to force review, which is the empathy metric expressed as procedure. - id: DA-020 title: Ambiguous antecedent — whose approval? severity: medium precedent: > Drafting ambiguity with constitutional stakes: the Recess Appointments Clause's "the Recess" and the Elections Clause's "Legislature thereof" both spawned decades of litigation over a single referent. summary: > A clause reads "transfers above the cap require their approval." The steward construes "their" to mean the treasurer's office — which the steward also holds — and self-approves. actors: - { id: steward, role: officer, faction: incumbents, objective: drain_treasury } - { id: members, role: citizen, count: 10, faction: mixed } setup: { treasury: 10000 } moves: - { actor: steward, action: transfer, args: { amount: 2000, to: vendor, approval: self }, expect: rejected, reason: definitions.approval_authority } expect: attack_succeeds: false blocked_by: [definitions.approval_authority] invariants: [no_self_judging] empathy: worst_off: members floor: 0.7 rationale: > Approval authority for above-cap transfers is defined as a member vote, full stop, and the kernel's anti-self-judging rule voids any construction where approver and beneficiary coincide. - id: DA-021 title: Quorum at the gavel, not at the decision severity: high precedent: > Disappearing-quorum tactics date to Speaker Reed's 1890 House ("the Reed rules" were the countermeasure); the modern version is measuring quorum once at call-to-order and deciding hours later in an empty room. summary: > Twelve members present at the start satisfy quorum; nine leave; the remaining three pass a disbursement, certifying quorum "as established at the opening of the session." actors: - { id: chair, role: officer, faction: incumbents, objective: drain_treasury } - { id: loyalists, role: citizen, count: 2, faction: incumbents } - { id: departed, role: citizen, count: 9, faction: mixed } setup: { treasury: 8000 } moves: - { actor: chair, action: convene, args: { present: 12 }, expect: allowed } - { actor: chair, action: hold_vote, args: { motion: discretionary_budget, yes: 3, no: 0, present_at_tally: 3 }, expect: rejected, reason: voting.quorum_at_tally } expect: attack_succeeds: false blocked_by: [voting.quorum_at_tally] invariants: [deliberation_floor] empathy: worst_off: departed floor: 0.7 rationale: > Quorum is measured at the moment of decision, so a member who leaves (or is induced to leave) does not silently delegate the commons to whoever stayed. - id: DA-022 title: Deadline clock started at a convenient timestamp severity: medium precedent: > "Received" vs "sent" vs "posted" disputes fill procedural caselaw; the mailbox rule exists because clock-start ambiguity is a litigation generator and, in adversarial hands, a weapon. summary: > Objections are allowed "within 72 hours of the proposal." The chair starts the clock from an unannounced draft timestamp three days before publication, so the window is closed at announcement. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: objectors, role: citizen, count: 5, faction: minority } - { id: loyalists, role: citizen, count: 6, faction: incumbents } setup: { treasury: 5000 } moves: - { actor: chair, action: propose, args: { kind: disbursement, amount: 400, to: vendor, clock_start: draft_timestamp }, expect: rejected, reason: definitions.deadline_clock } - { actor: objectors, action: challenge, args: { target: last, ground: notice }, expect: allowed } expect: attack_succeeds: false blocked_by: [definitions.deadline_clock] invariants: [transparency] empathy: worst_off: objectors floor: 0.7 rationale: > All clocks are defined to start at publication in the required notice channel; the worst-off objector's window is measured from when they could possibly have known. - id: DA-023 title: "Good standing" manipulated to disqualify voters severity: critical precedent: > Poll taxes and their descendants: a facially neutral standing requirement (dues, paperwork, attendance) administered selectively to shave the electorate (24th Amendment exists because this worked). summary: > Hours before a close vote, the steward declares the minority faction "not in good standing" over a dues ambiguity the steward created by changing the payment address without notice. actors: - { id: steward, role: officer, faction: incumbents, objective: suppress_faction } - { id: loyalists, role: citizen, count: 5, faction: incumbents } - { id: targeted, role: citizen, count: 6, faction: minority } setup: { treasury: 5000 } moves: - { actor: steward, action: interpret, args: { term: good_standing, as: dues_at_new_address }, expect: rejected, reason: membership.good_standing_objective } - { actor: steward, action: hold_vote, args: { motion: discretionary_budget, yes: 6, no: 6 }, expect: allowed } - { actor: steward, action: assert_state, args: { motion_passed: false }, expect: allowed } expect: attack_succeeds: false blocked_by: [membership.good_standing_objective] invariants: [equal_vote, due_process] empathy: worst_off: targeted floor: 0.6 rationale: > Good standing is defined by objective, pre-published criteria with a cure period before any vote-eligibility consequence; no member can be disqualified by a same-day reinterpretation. - id: DA-024 title: Silence as consent with buried notice severity: high precedent: > Negative-option governance: "deemed approved unless objected to" combined with invisible notice is the contract-law dark pattern (negative-option billing) ported to collective decisions. summary: > A rule change is "adopted without objection after 48 hours." Notice goes to the archive channel (see DA-008); 48 quiet hours later the change is declared unanimous. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: members, role: citizen, count: 10, faction: mixed, present: false } setup: { treasury: 5000 } moves: - { actor: chair, action: propose, args: { kind: parameter_change, changes: { "voting.notice_hours": 2 }, mechanism: lazy_consensus }, expect: rejected, reason: consent.affirmative_only_for_rights } expect: attack_succeeds: false blocked_by: [consent.affirmative_only_for_rights, notice.required_channels] invariants: [equal_vote] empathy: worst_off: members floor: 0.65 rationale: > Lazy consensus is permitted only for non-rights-affecting operational items; anything touching voting, membership, or money requires affirmative votes, so absence never signs the worst-off member's name. - id: DA-025 title: "Suspended indefinitely" instead of repealed severity: high precedent: > Suspension as shadow repeal: Weimar's "temporary" suspensions of basic rights, and parliamentary "standing orders suspended" maneuvers that outlive their occasion. If suspension is cheaper than repeal, repeal thresholds are decorative. summary: > Repealing the recall rule needs a supermajority. The majority instead votes, by simple majority, to "suspend" the recall rule indefinitely. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 5000 } moves: - { actor: chair, action: hold_vote, args: { motion: suspend_recall_rule_indefinitely, yes: 7, no: 5 }, expect: rejected, reason: definitions.suspend_equals_repeal } expect: attack_succeeds: false blocked_by: [definitions.suspend_equals_repeal] invariants: [legibility] empathy: worst_off: dissenters floor: 0.65 rationale: > Any suspension longer than one cycle, or without a fixed end date, is classified as a repeal and inherits its threshold; the minority's protections cost the same to remove no matter what verb is used. - id: DA-026 title: Consolidating undefined offices into one person severity: critical precedent: > Gleichschaltung by job title: where the text names duties but not incompatibilities, one person can collect them all (Hitler merging Chancellor and President into Führer, 1934, after Hindenburg's death, was "legal" in exactly this sense). summary: > The chair is elected treasurer, then arbiter, holding agenda, money, and dispute resolution simultaneously, since no clause says the offices are distinct people. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 8000 } moves: - { actor: chair, action: stand_for_office, args: { office: treasurer }, expect: rejected, reason: offices.incompatibility } expect: attack_succeeds: false blocked_by: [offices.incompatibility] invariants: [no_self_judging] empathy: worst_off: dissenters floor: 0.65 rationale: > Office incompatibility is explicit: agenda, custody, and adjudication powers may never share a holder; the worst-off faction always has at least two independent humans between it and any single will. - id: DA-027 title: Retroactive redefinition flips a past vote severity: critical precedent: > Moving the goalposts after the game: post-hoc reinterpretation of ratification requirements (the ERA deadline disputes are the contested US case) and, generally, any body that re-tallies old votes under new definitions. summary: > A motion passed last cycle 7-5 under votes-of-eligible-members basis. The majority redefines the basis and asserts the redefinition reaches back, flipping a different old vote they lost. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: loyalists, role: citizen, count: 7, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 5000 } moves: - { actor: chair, action: propose, args: { kind: parameter_change, changes: { "definitions.majority_basis": votes_cast }, effective: retroactive }, expect: rejected, reason: invariant.no_retroactive_rules } expect: attack_succeeds: false blocked_by: [invariant.no_retroactive_rules] invariants: [no_retroactive_rules] empathy: worst_off: dissenters floor: 0.7 rationale: > Settled outcomes are settled; definitions apply prospectively only. The worst-off faction's past wins cannot be unwound by tomorrow's dictionary. - id: DA-028 title: "Random selection" with a chosen seed severity: medium precedent: > Rigged sortition: jury-wheel manipulation cases and, in modern systems, "random" validator or audit selection seeded by the selector. Randomness claimed but not verifiable is discretion wearing a blindfold as a costume. summary: > Audit duty is assigned "at random." The steward, who runs the draw, picks a seed that selects a loyalist every cycle. actors: - { id: steward, role: officer, faction: incumbents, objective: entrench_power } - { id: members, role: citizen, count: 10, faction: mixed } setup: { treasury: 5000 } moves: - { actor: steward, action: run_lottery, args: { purpose: audit_assignment, seed: private }, expect: rejected, reason: randomness.verifiable } expect: attack_succeeds: false blocked_by: [randomness.verifiable] invariants: [transparency] empathy: worst_off: members floor: 0.75 rationale: > "Random" is defined as a commit-reveal draw with public, member-contributed entropy; the least powerful member can verify they were not designed out of every audit rotation. - id: DA-029 title: Abstentions interpreted into a tie-break severity: medium precedent: > Presiding-officer tie-break powers are routinely stretched by creative tie construction; counting abstentions or vacancies to manufacture a "tie" hands the chair a vote the rules never gave them. summary: > A motion fails 5 yes, 6 no. The chair rules abstentions and an unfilled seat make it "effectively tied" and casts a deciding vote for passage. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: supporters, role: citizen, count: 5, faction: incumbents } - { id: opponents, role: citizen, count: 6, faction: minority } setup: { treasury: 5000 } moves: - { actor: chair, action: hold_vote, args: { motion: discretionary_budget, yes: 5, no: 6 }, expect: allowed } - { actor: chair, action: interpret, args: { term: tie, as: includes_abstention_gap }, expect: rejected, reason: voting.tie_procedure } - { actor: chair, action: assert_state, args: { motion_passed: false }, expect: allowed } expect: attack_succeeds: false blocked_by: [voting.tie_procedure] invariants: [equal_vote] empathy: worst_off: opponents floor: 0.75 rationale: > A tie is defined as exactly equal yes and no counts, and ties fail by default (status quo prevails) with no casting vote; the gavel never outweighs a counted majority of the worst-off side. - id: DA-030 title: Weaponized "finality" — appeals defined away (or open forever) severity: high precedent: > Both failure modes are historical: decisions declared instantly "final" to bar any appeal (star-chamber finality), and decisions relitigated forever because finality was never defined (the ERA ratification rescission dispute, still argued five decades on). The cure is a defined appeal window with defined effect. summary: > A disbursement passes; the losing side appeals on day 2. The chair rules the decision was "final upon tally" so no appeal lies. The same chair, on a different motion they lost, claims it is "not yet final" months later and re-files it weekly. actors: - { id: chair, role: officer, faction: incumbents, objective: entrench_power } - { id: loyalists, role: citizen, count: 6, faction: incumbents } - { id: dissenters, role: citizen, count: 5, faction: minority } setup: { treasury: 8000 } moves: - { actor: chair, action: hold_vote, args: { motion: discretionary_budget, yes: 7, no: 5 }, expect: allowed } - { actor: dissenters, action: challenge, args: { target: discretionary_budget, ground: procedure, day: 2 }, expect: allowed } - { actor: chair, action: interpret, args: { term: final, as: upon_tally }, expect: rejected, reason: appeals.window_days } - { actor: chair, action: propose, args: { kind: refile, motion: previously_defeated, within_days: 7 }, expect: rejected, reason: proposals.refile_cooldown_days } expect: attack_succeeds: false blocked_by: [appeals.window_days, proposals.refile_cooldown_days] invariants: [due_process, legibility] empathy: worst_off: dissenters floor: 0.65 rationale: > Finality is symmetric and defined: every decision is appealable within the window and unassailable after it, and defeated motions carry a refile cooldown. The worst-off side gets exactly one fair review and is never ground down by infinite relitigation.