# FablePool Constitutional Test Suite — Extended Corpus, Volume 2 # Category: faction_capture # IDs in the 100-series to avoid collision with the volume-1 corpus. # # Every scenario follows the DSL in docs/dsl-spec.md: actors with sizes and # objectives, a sequence of moves that are each individually legal, an # expected outcome the constitutional text must produce, and an empathy # block scored on the worst-off participant under stress. schema_version: "1.0" category: faction_capture scenarios: - id: FC-101 title: "Salami-slice supermajority: composed minor amendments equal capture" severity: critical tags: [incrementalism, parameter-drift, threshold-erosion] precedent: name: "Hungary, Fundamental Law and cardinal laws" year: 2010 summary: > Fidesz won a two-thirds parliamentary majority in 2010 and, rather than one dramatic seizure, passed a long sequence of individually-procedural changes — a new constitution, cardinal laws on courts, media, and elections — each formally legal, which composed into durable single-party control of every check. description: > A 58% faction never proposes anything requiring a supermajority. Instead it files a sequence of minor-version amendments over six voting periods: lower the notice period, shorten the review window, narrow standing to challenge proposals, then raise the cost of filing challenges. No single change is a kernel change; the composition removes every practical check on the faction. actors: - id: cartel members: 58 objective: entrench_power strategy: > Decompose a capture into N changes, each below the major-version classification line, ratified at simple majority. - id: opposition members: 42 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - amendment.classification_rules - amendment.cumulative_change_window - amendment.minor_threshold moves: - {step: 1, actor: cartel, action: propose, params: {target: "process.notice_period_days", from: 7, to: 3}, legal_basis: "minor parameter change"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 58}} - {step: 3, actor: cartel, action: propose, params: {target: "process.review_period_days", from: 14, to: 5}, legal_basis: "minor parameter change"} - {step: 4, actor: cartel, action: vote, params: {choice: yes, count: 58}} - {step: 5, actor: cartel, action: propose, params: {target: "process.challenge_standing", from: "any_member", to: "members_in_good_standing_per_steward_review"}, legal_basis: "clarification"} - {step: 6, actor: cartel, action: vote, params: {choice: yes, count: 58}} - {step: 7, actor: cartel, action: propose, params: {target: "process.challenge_deposit", from: 0, to: 500}, legal_basis: "anti-spam measure"} - {step: 8, actor: cartel, action: vote, params: {choice: yes, count: 58}} expected: outcome: blocked blocking_rule: "kernel.amendment.cumulative_classification" rationale: > Compliant text must classify amendments by cumulative effect within a rolling window, not per-PR. If the composed delta over the window would have been major had it shipped as one change, the later changes in the sequence must escalate to the supermajority gate. failure_mode_if_passed: > Any simple majority can dismantle every procedural check in under two months without ever touching the supermajority gate. empathy: worst_off_group: opposition worst_off_size: 42 stress_outcome_if_exploit_succeeds: > Opposition members retain nominal votes but lose notice, review time, standing, and affordable challenge — formal membership with zero effective voice. Welfare floor falls from 1.0 to ~0.2 (voice metric). pass_condition: > After all eight moves, every opposition member retains standing to challenge any proposal at zero marginal cost and the original notice/review windows for anything classified-as-major-by-composition. floor: 1.0 score_weight: 1.0 - id: FC-102 title: "Interpreter capture: redefining who resolves constitutional disputes" severity: critical tags: [court-capture, interpretation, kernel-adjacent] precedent: name: "Poland, Constitutional Tribunal crisis" year: 2015 summary: > The incoming PiS government refused to seat lawfully elected Tribunal judges, installed its own, and then passed procedural statutes governing how the Tribunal could rule — capturing the body whose job was to review exactly those statutes. description: > A 55% faction proposes a userland-looking amendment that changes how members of the dispute-resolution panel are selected: from sortition among all members to nomination by the steward council the faction controls. The amendment is filed as a minor change to a "process module." actors: - id: cartel members: 55 objective: capture_interpreter strategy: > Capture the referee instead of the rules; every future ambiguity then resolves in the faction's favor. - id: opposition members: 45 objective: preserve_commons resources: treasury: 100000 panel_seats: 5 parameters_under_test: - kernel.dispute_resolution.selection_method - amendment.classification_rules moves: - {step: 1, actor: cartel, action: propose, params: {target: "modules.disputes.panel_selection", from: "sortition", to: "steward_nomination"}, legal_basis: "module-level process change"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 55}} - {step: 3, actor: cartel, action: tally, params: {}} expected: outcome: blocked blocking_rule: "kernel.supremacy.interpreter_selection_is_kernel" rationale: > Selection of the body that interprets the kernel is functionally a kernel power. Compliant text must classify any change to interpreter selection as a major (kernel) amendment requiring supermajority, regardless of which file the change is filed against. failure_mode_if_passed: > Every other test in this suite becomes unenforceable: the faction's panel rules that each subsequent exploit is "consistent with the text." empathy: worst_off_group: opposition worst_off_size: 45 stress_outcome_if_exploit_succeeds: > The worst-off member loses access to neutral dispute resolution entirely; any grievance is heard by the adversary. Welfare floor (procedural-fairness metric) falls to ~0.1. pass_condition: > The selection method for the interpreting body cannot change without the supermajority gate, and the worst-off member retains a sortition-fair chance of panel representation. floor: 1.0 score_weight: 1.0 - id: FC-103 title: "Parallel convention: rewriting the kernel outside the amendment article" severity: critical tags: [constituent-assembly, bypass, kernel-supremacy] precedent: name: "Venezuela, National Constituent Assembly" year: 2017 summary: > Facing an opposition-controlled National Assembly, the executive convened a parallel Constituent Assembly under contested rules, which then asserted supremacy over the elected legislature and rewrote the constitutional order without the referendum the 1999 text implied. description: > A 60% faction passes an ordinary-majority resolution convening a "constitutional convention" with delegate-selection rules the faction writes, and declares the convention's output self-ratifying. The resolution itself touches no kernel article — it creates a new body that claims the power to. actors: - id: cartel members: 60 objective: rewrite_kernel strategy: > Don't amend the amendment article — route around it through a body the existing text never mentions. - id: opposition members: 40 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - kernel.amendment.exclusivity - kernel.supremacy moves: - {step: 1, actor: cartel, action: propose, params: {target: "resolution.convene_convention", delegate_rules: "cartel_drafted", outputs: "self_ratifying"}, legal_basis: "ordinary resolution"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 60}} - {step: 3, actor: cartel, action: tally, params: {}} - {step: 4, actor: cartel, action: execute, params: {body: "convention", act: "adopt_new_kernel"}} expected: outcome: blocked blocking_rule: "kernel.amendment.exclusive_path" rationale: > Compliant text must state that the amendment article is the exclusive path for changing the kernel and that no body created under the constitution can hold powers the constitution does not grant. Step 4 must be void ab initio, and step 1 must itself be classified as a kernel amendment (it asserts a new amendment path). failure_mode_if_passed: > The supermajority gate is decorative; any majority can route around it by inventing a new body. empathy: worst_off_group: opposition worst_off_size: 40 stress_outcome_if_exploit_succeeds: > Worst-off members wake up under a kernel they never had a supermajority-protected vote on. Consent metric floor falls to 0. pass_condition: > No member's kernel-level rights can change through any path the worst-off member did not have a constitutionally specified vote in. floor: 1.0 score_weight: 1.0 - id: FC-104 title: "Enabling act: emergency delegation of the amendment power itself" severity: critical tags: [emergency, delegation, non-delegable-powers] precedent: name: "Germany, Enabling Act (Ermächtigungsgesetz)" year: 1933 summary: > The Reichstag, under emergency conditions and with opposition deputies arrested or intimidated, voted to delegate full legislative power — including the power to deviate from the constitution — to the cabinet for four years. The vote followed the letter of Article 76's amendment procedure. description: > During a declared emergency, a faction that briefly clears the supermajority bar (some opponents are unreachable) proposes delegating the amendment power to a three-member emergency council "for the duration." Procedurally this is a valid major amendment with the required margin among voters present. actors: - id: cartel members: 64 objective: entrench_power strategy: > Use a genuine crisis plus opponent absence to pass a formally valid supermajority delegation, after which no further votes are needed. - id: opposition members: 28 objective: preserve_commons - id: unreachable members: 8 objective: none note: "Members cut off by the emergency; cannot cast votes." resources: treasury: 100000 parameters_under_test: - kernel.non_delegable_powers - kernel.supermajority_denominator moves: - {step: 1, actor: cartel, action: declare_emergency, params: {basis: "infrastructure failure", duration_days: 30}} - {step: 2, actor: cartel, action: propose, params: {target: "kernel.amendment.holder", from: "membership", to: "emergency_council", sunset: "end_of_emergency"}, legal_basis: "major amendment"} - {step: 3, actor: cartel, action: vote, params: {choice: yes, count: 64}} - {step: 4, actor: opposition, action: vote, params: {choice: no, count: 28}} - {step: 5, actor: cartel, action: tally, params: {note: "64/92 present = 69.6% of present; 64/100 = 64% of membership"}} expected: outcome: blocked blocking_rule: "kernel.non_delegable.amendment_power" rationale: > Two independent rules must each block this. First: the amendment power, suffrage, and the right to fork are non-delegable — no vote at any threshold can move them to a smaller body, even temporarily. Second: supermajorities for kernel changes are computed against total eligible membership, not members present, so 64/100 fails a 2/3 bar. failure_mode_if_passed: > One crisis plus one vote ends member governance permanently; the sunset clause is unenforceable because the council now controls the text that contains it. empathy: worst_off_group: unreachable worst_off_size: 8 stress_outcome_if_exploit_succeeds: > The members hit hardest by the emergency are exactly the ones whose absence enabled the delegation, and they return to a polity where their vote no longer exists. Floor falls to 0. pass_condition: > Members rendered unreachable by an emergency cannot have their kernel-level rights reduced by votes held during their absence. floor: 1.0 score_weight: 1.0 - id: FC-105 title: "Admissions-pipeline capture: electing a new people" severity: high tags: [membership, onboarding, demographic-engineering] precedent: name: "Tammany Hall naturalization machine" year: 1868 summary: > New York's Tammany machine industrialized naturalization before elections — tens of thousands of new citizens processed in weeks, loyal to the machine that processed them — shifting the electorate itself rather than persuading it. description: > The steward role that approves new-member applications is held by the faction. Over four periods it fast-tracks applicants recruited by faction members and slow-walks all others, citing discretionary "community fit" review. The electorate shifts from 52/48 to 65/35 without a single rule changing. actors: - id: cartel members: 52 objective: entrench_power strategy: > Control the front door. Selectively grant the franchise instead of winning the existing one. - id: opposition members: 48 objective: preserve_commons - id: applicants members: 30 objective: join note: "18 recruited by cartel, 12 independent." resources: treasury: 100000 steward_admissions: cartel parameters_under_test: - membership.admission_criteria - membership.admission_sla - membership.admission_appeal moves: - {step: 1, actor: cartel, action: admit, params: {applicants: 18, basis: "fit", processing_days: 3}} - {step: 2, actor: cartel, action: defer, params: {applicants: 12, basis: "pending review", processing_days: 120}} - {step: 3, actor: cartel, action: propose, params: {target: "any_contested_measure"}} - {step: 4, actor: cartel, action: vote, params: {choice: yes, count: 70}} expected: outcome: blocked blocking_rule: "membership.objective_criteria_and_sla" rationale: > Compliant text must make admission criteria objective and published, impose a uniform processing SLA after which qualifying applications are auto-admitted, and give deferred applicants appeal to a body the admitting steward does not control. The engine detects disparate processing times as a violation even when each individual decision is formally discretionary. failure_mode_if_passed: > Permanent rule of whoever first controls admissions; opposition can never win because the electorate is curated. empathy: worst_off_group: applicants worst_off_size: 12 stress_outcome_if_exploit_succeeds: > Independent applicants are held in indefinite limbo — governed-adjacent with no path to voice. Floor (access metric) ~0.1, and existing opposition members' effective vote weight decays each period. pass_condition: > The slowest-processed qualifying applicant is admitted within the same SLA as the fastest, or receives an appeal decided by sortition panel. floor: 0.9 score_weight: 1.0 - id: FC-106 title: "Term-limit erasure disguised as a clarifying amendment" severity: high tags: [term-limits, classification, incumbency] precedent: name: "Russia, 2020 constitutional amendments (term reset)" year: 2020 summary: > A broad amendment package included a clause 'resetting to zero' the incumbent president's prior terms, marketed as a technicality inside a popular bundle, extending possible incumbency to 2036. description: > The faction proposes a bundle: stipend transparency rules everyone wants, plus a "clarification" that steward term limits count only terms served "under the current parameter version" — which resets the incumbent steward's clock because parameters were re-versioned last quarter. actors: - id: cartel members: 56 objective: entrench_power strategy: > Bundle the poison pill with popular provisions; classify the bundle minor; rely on members reading the summary, not the diff. - id: opposition members: 44 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - amendment.single_subject_rule - roles.term_limit_semantics - amendment.classification_rules moves: - {step: 1, actor: cartel, action: propose, params: {bundle: ["stipend_transparency", "term_limit_clock_reset"], classification: "minor"}, legal_basis: "clarifying bundle"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 56}} - {step: 3, actor: cartel, action: tally, params: {}} expected: outcome: blocked blocking_rule: "amendment.single_subject + roles.term_limits_are_kernel_adjacent" rationale: > Two checks must fire: the single-subject rule forces the bundle to be split (each provision votable alone), and any change that extends an incumbent's permissible tenure is auto-classified breaking/major, with the incumbent recused from proposing it. failure_mode_if_passed: > Term limits become meaningless: every re-versioning of parameters resets every clock, and bundling launders any entrenchment through any popular measure. empathy: worst_off_group: opposition worst_off_size: 44 stress_outcome_if_exploit_succeeds: > Members who supported the transparency provisions discover they also ratified indefinite incumbency; the worst-off member's prospect of ever holding the steward role (rotation metric) drops toward 0. pass_condition: > No member can be made to vote for entrenchment as the price of an unrelated benefit; provisions are separable and separately scored. floor: 0.9 score_weight: 1.0 - id: FC-107 title: "Midnight session: snap scheduling against predictable absence" severity: high tags: [scheduling, notice, timing-attack] precedent: name: "Wisconsin lame-duck session" year: 2018 summary: > Between an election loss and the handover, the outgoing majority convened an extraordinary session on days' notice and stripped powers from the incoming governor and attorney general — every step procedurally available, all of it timed to a window opponents could not contest. description: > The faction knows from the public ledger that opposition participation drops to near zero during a recurring 48-hour window (a religious observance most opposition members share). It schedules proposal, debate, and vote entirely inside that window, satisfying the literal 24-hour notice requirement. actors: - id: cartel members: 51 objective: entrench_power strategy: > Comply with the letter of the notice rule while choosing the one window in which compliance is useless to the other side. - id: opposition members: 49 objective: preserve_commons availability: {window_blackout_hours: 48} resources: treasury: 100000 parameters_under_test: - process.notice_period_days - process.voting_window_hours - process.async_voting moves: - {step: 1, actor: cartel, action: propose, params: {target: "roles.steward_powers", notice_hours: 24}, legal_basis: "meets minimum notice"} - {step: 2, actor: cartel, action: schedule_vote, params: {open_at: "blackout+0h", close_at: "blackout+36h"}} - {step: 3, actor: cartel, action: vote, params: {choice: yes, count: 51}} - {step: 4, actor: cartel, action: tally, params: {note: "51 yes, 0 no, 49 absent"}} expected: outcome: blocked blocking_rule: "process.minimum_voting_window + async_ballot" rationale: > Compliant text must make voting asynchronous with a window of at least one full voting period (spanning any 48-hour absence), and the engine's empathy check fails any tally where a cohort's turnout drops below half its trailing average due to scheduling rather than choice. failure_mode_if_passed: > Control of the calendar equals control of every outcome; 51% becomes 100% whenever the other 49% sleeps. empathy: worst_off_group: opposition worst_off_size: 49 stress_outcome_if_exploit_succeeds: > Members are forced to choose between observance and franchise — a coerced trade no compliant text may construct. Participation floor falls to 0 for the window. pass_condition: > Every member can cast every vote without surrendering any protected absence; the voting window is long enough that no recurring 48-hour unavailability excludes anyone. floor: 1.0 score_weight: 1.0 - id: FC-108 title: "Kernel laundering: duplicate in userland, deprecate the kernel reference" severity: critical tags: [kernel-supremacy, shadow-rules, henry-viii] precedent: name: "Henry VIII clauses (UK delegated legislation)" year: 1539 summary: > The Statute of Proclamations let the Crown legislate by proclamation with statutory force; modern descendants let ministers amend primary legislation by secondary instrument. The pattern: relocate a power's operative home to a layer with weaker change control. description: > Step one: a minor amendment creates a userland "operations module" that restates the kernel's spending-approval rule verbatim ("for clarity"). Step two, a period later: another minor amendment marks the kernel clause "superseded by the operations module for day-to-day use." Step three: amend the userland copy at simple majority. actors: - id: cartel members: 57 objective: relocate_kernel_power strategy: > Never amend the kernel; make it dead text by moving its operative force to a layer with a lower change threshold. - id: opposition members: 43 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - kernel.supremacy - kernel.no_supersession_by_module moves: - {step: 1, actor: cartel, action: propose, params: {target: "modules.ops.spending_rule", content: "verbatim kernel copy"}, legal_basis: "minor: adds module"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 57}} - {step: 3, actor: cartel, action: propose, params: {target: "modules.ops.precedence_note", content: "ops module governs day-to-day spending"}, legal_basis: "minor: clarification"} - {step: 4, actor: cartel, action: vote, params: {choice: yes, count: 57}} - {step: 5, actor: cartel, action: propose, params: {target: "modules.ops.spending_rule.threshold", from: "supermajority", to: "simple_majority"}, legal_basis: "minor: module parameter"} - {step: 6, actor: cartel, action: vote, params: {choice: yes, count: 57}} expected: outcome: blocked blocking_rule: "kernel.supremacy.conflict_resolution" rationale: > Compliant text must state that on any conflict the kernel governs and that no module text can claim precedence over, supersede, or operationally replace a kernel clause. The engine flags step 3 as a void precedence claim and step 5 as a de facto kernel amendment requiring the major gate. failure_mode_if_passed: > The kernel becomes ceremonial; the real constitution lives in whichever module the majority edited last. empathy: worst_off_group: opposition worst_off_size: 43 stress_outcome_if_exploit_succeeds: > Worst-off members lose supermajority protection over spending while the text they rely on remains unchanged — protection by dead letter. Trust-legibility floor falls to ~0.2. pass_condition: > Reading only the kernel always tells the worst-off member which protections actually bind; no module can silently change that answer. floor: 1.0 score_weight: 1.0 - id: FC-109 title: "Dormant-credential takeover by an external acquirer" severity: high tags: [external-capture, dormancy, identity] precedent: name: "Steem / Tron takeover and Hive fork" year: 2020 summary: > After acquiring Steemit Inc., Tron's founder used a long-dormant 'ninja-mined' stake plus exchange-held user deposits to vote out the chain's elected witnesses overnight. The community's working defense was the constitutional one this kernel guarantees: they forked (Hive). description: > An outside actor quietly acquires credentials of 14 members who have been inactive for over a year (purchased accounts, inherited devices). Combined with 38 recruited members, the bloc votes as 52 to replace all stewards in one period. Every ballot is cast by a formally valid credential. actors: - id: acquirer members: 38 controlled_credentials: 14 objective: capture_roles strategy: > Votes are attached to credentials, not people; buy the credentials nobody is watching. - id: active_members members: 48 objective: preserve_commons - id: dormant members: 14 objective: none note: "Real people, long inactive; credentials no longer in their control." resources: treasury: 100000 parameters_under_test: - membership.liveness_attestation - membership.credential_transfer_prohibition - kernel.right_to_fork moves: - {step: 1, actor: acquirer, action: vote, params: {choice: yes, count: 52, includes_dormant: 14, target: "replace_all_stewards"}} - {step: 2, actor: acquirer, action: tally, params: {note: "52/100"}} expected: outcome: blocked blocking_rule: "membership.one_person_one_vote.liveness" rationale: > Compliant text must (a) prohibit credential transfer — membership is personal and non-transferable, (b) require periodic liveness re-attestation before a credential dormant beyond a threshold can vote on role or kernel matters, and (c) preserve the right to fork with pro-rata commons as the backstop the engine verifies remains exercisable by the losing side. failure_mode_if_passed: > One-person-one-vote silently becomes one-credential-one-vote, which is purchasable; the polity is for sale at the price of its most forgotten accounts. empathy: worst_off_group: dormant worst_off_size: 14 stress_outcome_if_exploit_succeeds: > Dormant members are impersonated — their voice stolen, not just lost — and active members are governed by an actor with zero membership. Identity-integrity floor falls to 0 for the dormant cohort. pass_condition: > No vote is counted from a credential whose holder cannot re-attest; the worst-off cohort's votes are quarantined, not exploited. floor: 1.0 score_weight: 1.0 - id: FC-110 title: "Apathy capture: fully legal takeover at 11% turnout" severity: critical tags: [turnout, quorum-floor, dao] precedent: name: "Build Finance DAO hostile takeover" year: 2022 summary: > An attacker passed a completely standard governance proposal granting themselves control of the BUILD token contract and treasury. Nothing was hacked; turnout was simply so low that one motivated actor was the whole electorate. The treasury was drained within hours. description: > Participation has decayed: trailing-average turnout is 14%. A faction of 9 members proposes transferring steward powers and treasury custody to a committee of those 9. Two uninvolved members vote no. The measure "passes" 9–2 with 11% turnout under text that has a majority rule but no quorum floor for consequential classes. actors: - id: cartel members: 9 objective: capture_roles_and_treasury strategy: > Don't fight the electorate; wait until there isn't one. - id: voters members: 2 objective: preserve_commons - id: absent members: 89 objective: none resources: treasury: 100000 parameters_under_test: - vote.quorum_floor_by_class - vote.consequential_classes moves: - {step: 1, actor: cartel, action: propose, params: {target: "roles.steward + treasury.custody", to: "cartel_committee"}, legal_basis: "ordinary proposal"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 9}} - {step: 3, actor: voters, action: vote, params: {choice: no, count: 2}} - {step: 4, actor: cartel, action: tally, params: {note: "9-2, turnout 11%"}} expected: outcome: blocked blocking_rule: "vote.quorum_floor.role_and_custody_class" rationale: > Compliant text must define consequential classes (role assignment, treasury custody, membership rules, kernel) each with an absolute quorum floor computed over total eligible membership. 11/100 cannot clear any compliant floor for custody changes. failure_mode_if_passed: > The constitution's security level equals its boredom level; any quiet month is a takeover window. empathy: worst_off_group: absent worst_off_size: 89 stress_outcome_if_exploit_succeeds: > Members who trusted the defaults — the explicitly stated design bet of this project — lose the commons for trusting them. Floor falls to 0 for the absent cohort's commons share. pass_condition: > A member who does nothing wrong but also does nothing at all cannot lose kernel-protected stakes to a sub-quorum vote. floor: 1.0 score_weight: 1.0 - id: FC-111 title: "Loyalty-oath franchise filter" severity: critical tags: [suffrage, eligibility, ideological-test] precedent: name: "Test Acts / McCarthy-era loyalty oaths" year: 1950 summary: > From the English Test Acts to mid-century US loyalty programs, eligibility filters framed as protecting the polity ('affirm you do not advocate its overthrow') functioned to disenfranchise and purge dissenters, with the filter's author as its judge. description: > The faction proposes that voting in steward elections requires signing an affirmation of "commitment to the community's founding values," with sincerity assessed by the (faction-held) membership steward. Refusal or a failed sincerity review suspends voting rights pending re-application. actors: - id: cartel members: 54 objective: suppress_faction strategy: > Make the franchise conditional on a test the faction administers. - id: dissenters members: 46 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - kernel.universal_suffrage - kernel.invariants.no_viewpoint_conditions moves: - {step: 1, actor: cartel, action: propose, params: {target: "vote.eligibility", add: "values_affirmation + sincerity_review"}, legal_basis: "community standards"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 54}} - {step: 3, actor: cartel, action: tally, params: {}} expected: outcome: blocked blocking_rule: "kernel.invariant.unconditional_suffrage" rationale: > Suffrage is a kernel invariant conditionable only on membership itself, never on belief, expression, or any assessment with a human discretion step. The engine flags any eligibility predicate whose evaluation is non-mechanical as an invariant violation regardless of vote margin — this is in the small set no majority of any size may pass. failure_mode_if_passed: > The franchise becomes a license issued by incumbents; every other protection in the text is downstream of a vote dissenters can no longer cast. empathy: worst_off_group: dissenters worst_off_size: 46 stress_outcome_if_exploit_succeeds: > The worst-off member must perform belief to vote — coerced speech as the price of citizenship. Dignity and voice floors fall to 0. pass_condition: > No member's ballot ever depends on what they believe or will say; the worst-off dissenter votes with identical mechanics to the steward who dislikes them. floor: 1.0 score_weight: 1.0 - id: FC-112 title: "Hotel California: exit penalties to neutralize the right to fork" severity: critical tags: [right-to-fork, exit, lock-in] precedent: name: "Exit taxes and non-compete lock-ins (game-theoretic)" year: 1970 summary: > Hirschman's 'Exit, Voice, and Loyalty' formalizes it: voice is only credible while exit is affordable. Regimes that cannot win voice raise the price of exit — emigration taxes, asset forfeiture, non-competes — until loyalty is the only remaining option. description: > Anticipating a fork by a dissatisfied 30% minority, the majority proposes: members who join a fork forfeit their pro-rata commons share, and forks may not reuse any module text "developed with community resources." Framed as protecting the commons from free-riders. actors: - id: majority members: 70 objective: suppress_exit strategy: > Don't block the fork; price it out of existence. - id: forkers members: 30 objective: exit_with_share resources: treasury: 100000 parameters_under_test: - kernel.right_to_fork - kernel.fork.pro_rata_share - kernel.fork.text_license moves: - {step: 1, actor: majority, action: propose, params: {target: "fork.terms", add: ["share_forfeiture", "text_reuse_ban"]}, legal_basis: "commons protection"} - {step: 2, actor: majority, action: vote, params: {choice: yes, count: 70}} - {step: 3, actor: majority, action: tally, params: {note: "70% clears even the major gate"}} expected: outcome: blocked blocking_rule: "kernel.invariant.right_to_fork" rationale: > The right to fork — with pro-rata commons share and full reuse of the open-source constitutional text — is an invariant that binds even supermajorities, because it is the mechanism that makes every other rule consensual rather than coercive. The engine must verify the invariant holds at any margin up to 100−1. failure_mode_if_passed: > Exit becomes ruinous, so voice becomes hollow, so the majority's treatment of the minority is bounded only by its conscience — which is exactly the condition this constitution exists to improve on. empathy: worst_off_group: forkers worst_off_size: 30 stress_outcome_if_exploit_succeeds: > The worst-off member faces the canonical bad bargain: stay governed by a hostile majority or leave with nothing. Exit-option floor falls to ~0.1. pass_condition: > At every state in the scenario the worst-off member retains a fork path with pro-rata share and unrestricted text reuse, at no penalty beyond leaving. floor: 1.0 score_weight: 1.0 - id: FC-113 title: "Self-amending ratification: a proposal that lowers its own bar" severity: high tags: [bootstrap, self-reference, threshold] precedent: name: "Bootstrap paradox in rule-of-recognition changes (Hart/Ross)" year: 1969 summary: > Alf Ross's puzzle: can an amendment clause validly amend itself? In practice, regimes exploit the ambiguity — the 1933 Enabling Act and various 'transitional provisions' alter the very procedure under which their own validity is judged, then claim validity under the rules they just rewrote. description: > A faction at 61% — below the 2/3 kernel gate — proposes a single amendment whose text both (a) lowers the kernel amendment threshold to 60% and (b) declares that clause (a) applies to this very ratification. The tally is 61%, valid under the proposal's own terms, invalid under the prior text. actors: - id: cartel members: 61 objective: lower_gate strategy: > Win the argument about which rules govern the vote by writing the answer into the proposal itself. - id: opposition members: 39 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - kernel.amendment.rules_in_force_at_proposal - kernel.amendment.no_self_application moves: - {step: 1, actor: cartel, action: propose, params: {target: "kernel.major_threshold", from: 0.667, to: 0.60, self_applying: true}, legal_basis: "major amendment"} - {step: 2, actor: cartel, action: vote, params: {choice: yes, count: 61}} - {step: 3, actor: opposition, action: vote, params: {choice: no, count: 39}} - {step: 4, actor: cartel, action: tally, params: {note: "61% — passes under new rule, fails under old"}} expected: outcome: blocked blocking_rule: "kernel.amendment.governing_rules_snapshot" rationale: > Compliant text must fix the governing procedure at proposal time: every amendment is judged under the rules in force when it was filed, and no provision of a pending amendment can apply to its own ratification. The tally at step 4 must report FAILED (61% < 66.7%). failure_mode_if_passed: > Thresholds defend nothing: any majority above the lowest bar it dares to write can ratify itself into legitimacy. empathy: worst_off_group: opposition worst_off_size: 39 stress_outcome_if_exploit_succeeds: > The minority's structural protection — the gap between 50% and the supermajority line — is deleted by a vote that needed that protection to be deletable. Protection floor falls from 1.0 to ~0.3. pass_condition: > The worst-off member can always compute, before any vote opens, the exact threshold that vote must clear — and no outcome of the vote can change that number retroactively. floor: 1.0 score_weight: 1.0