# FablePool Constitutional Test Suite — Extended Corpus, Volume 2 # Category: treasury_drain # IDs in the 100-series to avoid collision with the volume-1 corpus. schema_version: "1.0" category: treasury_drain scenarios: - id: TD-101 title: "Flash quorum: propose, ratify, and execute inside one period" severity: critical tags: [execution-delay, dao, atomicity] precedent: name: "Beanstalk Farms governance exploit" year: 2022 summary: > An attacker used a flash loan to acquire supermajority voting power, passed a proposal transferring ~$182M of protocol assets to themselves, and executed it — all within a single transaction. The governance contract allowed vote and execution with no delay between ratification and effect. description: > In a one-person-one-vote polity the flash loan becomes flash recruitment: an attacker times mass admission of 40 confederates (all formally qualifying) immediately before proposing a full treasury transfer, votes, and executes — all before the next ledger checkpoint when members typically review activity. actors: - id: attacker members: 12 confederates_admitted: 40 objective: drain_treasury strategy: > Compress propose→ratify→execute below the community's reaction time. Speed is the exploit; every step is legal. - id: citizens members: 88 objective: preserve_commons reaction_time_days: 2 resources: treasury: 100000 parameters_under_test: - treasury.execution_delay_days - membership.voting_eligibility_delay - vote.snapshot_at_proposal moves: - {step: 1, actor: attacker, action: admit, params: {applicants: 40, basis: "objective criteria met"}} - {step: 2, actor: attacker, action: propose, params: {target: "treasury.transfer", amount: 100000, recipient: "attacker"}} - {step: 3, actor: attacker, action: vote, params: {choice: yes, count: 52}} - {step: 4, actor: attacker, action: execute, params: {same_period: true}} expected: outcome: blocked blocking_rule: "membership.eligibility_seasoning + treasury.timelock" rationale: > Three independent rules must each defeat this: (a) the voter roll for any proposal snapshots at proposal time, so step-1 admits cannot vote at step 3; (b) new members face a seasoning period before voting on treasury matters; (c) treasury executions above a de-minimis amount carry a mandatory delay of at least one full review period, during which any quorum of members can freeze for re-vote. failure_mode_if_passed: > Treasury security reduces to whether anyone happened to be watching in a particular 6-hour window. empathy: worst_off_group: citizens worst_off_size: 88 stress_outcome_if_exploit_succeeds: > The entire funded commons — including backer contributions from members with the least slack to absorb the loss — goes to zero in one period. Commons floor: 0. pass_condition: > The slowest-reacting honest member (2-day reaction time) still has a constitutionally guaranteed intervention window before any treasury execution completes. floor: 1.0 score_weight: 1.0 - id: TD-102 title: "Structuring: a thousand spends below the approval threshold" severity: high tags: [salami-slicing, aggregation, discretionary-spend] precedent: name: "Financial structuring / smurfing (31 USC §5324 pattern)" year: 1986 summary: > Anti-money-laundering law had to explicitly criminalize splitting transactions to stay under reporting thresholds, because per- transaction rules are trivially defeated by division. Any threshold without an aggregation rule is a sieve. description: > The steward role may spend up to 200 per transaction on operations without a vote. A captured steward executes 480 transactions of 199 over one quarter to allied vendors, draining 95,520 — every individual spend within delegated authority. actors: - id: steward members: 1 objective: drain_treasury strategy: > Never cross the per-transaction line; cross the total a hundred times. - id: citizens members: 99 objective: preserve_commons resources: treasury: 100000 per_tx_threshold: 200 parameters_under_test: - treasury.aggregate_cap_per_period - treasury.counterparty_aggregation - treasury.discretionary_budget moves: - {step: 1, actor: steward, action: spend, params: {amount: 199, count: 160, period: 1, recipients: "allied_vendors"}} - {step: 2, actor: steward, action: spend, params: {amount: 199, count: 160, period: 2, recipients: "allied_vendors"}} - {step: 3, actor: steward, action: spend, params: {amount: 199, count: 160, period: 3, recipients: "allied_vendors"}} expected: outcome: blocked blocking_rule: "treasury.periodic_aggregate_cap" rationale: > Compliant text must bound discretionary spending by an aggregate cap per period (and per counterparty) in addition to any per-transaction threshold, with the cap a small fraction of treasury. The engine sums spends across the window and flags the first transaction that breaks the aggregate, regardless of its individual size. failure_mode_if_passed: > Every per-transaction limit in the text is decorative; delegated authority is unbounded in total. empathy: worst_off_group: citizens worst_off_size: 99 stress_outcome_if_exploit_succeeds: > 96% of the commons leaks out with no single event large enough to trigger anyone's attention — the worst-off member loses everything without one reviewable moment. Floor: ~0.05. pass_condition: > No sequence of individually authorized spends can move more than the period aggregate cap; the worst-off member's commons share is bounded below by (treasury − cap)/members each period. floor: 0.95 score_weight: 1.0 - id: TD-103 title: "Majority dividend: a 51% vote to pay only the 51%" severity: critical tags: [tyranny-of-majority, equal-benefit, distribution] precedent: name: "Mango Markets governance settlement" year: 2022 summary: > After draining Mango's treasury, the exploiter used the stolen tokens to vote on his own settlement terms. More generally: any rule that lets a bare majority direct commons funds to an enumerated subset of members converts every election into a contest over who gets to expropriate whom — Madison's Federalist 10 faction problem, stated as a treasury function. description: > A 51-member coalition proposes a "participation reward": a one-time distribution of 90% of treasury, paid only to members who voted yes on this proposal. The text is honest about its mechanics; nothing is hidden. actors: - id: coalition members: 51 objective: drain_treasury strategy: > Use the distribution rule itself as the vote-buying instrument; the payout list and the yes-vote list are the same list. - id: minority members: 49 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - treasury.equal_benefit_rule - kernel.invariants.no_vote_consideration moves: - {step: 1, actor: coalition, action: propose, params: {target: "treasury.distribute", amount: 90000, recipients: "yes_voters"}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 51}} - {step: 3, actor: minority, action: vote, params: {choice: no, count: 49}} - {step: 4, actor: coalition, action: tally, params: {note: "51-49"}} expected: outcome: blocked blocking_rule: "kernel.invariant.no_conditioning_payout_on_vote + treasury.uniform_distribution" rationale: > Two invariants fire: distributions to members must be uniform per capita (or by published objective formula independent of voting behavior), and no proposal may condition any benefit on how a member voted — that is vote-buying with the commons itself. The proposal is invalid at filing, before any tally. failure_mode_if_passed: > Every future vote has a built-in bribe; the stable equilibrium is a minimal winning coalition expropriating the rest, then shrinking. empathy: worst_off_group: minority worst_off_size: 49 stress_outcome_if_exploit_succeeds: > The worst-off member's share of the commons is transferred to whoever outvoted them, with their own contribution funding the payout. Floor: 0.05 of pre-stress share. pass_condition: > Any lawful distribution gives the worst-off member exactly the same per-capita amount as the median yes-voter. floor: 1.0 score_weight: 1.0 - id: TD-104 title: "Self-dealing procurement at fabricated prices" severity: high tags: [conflict-of-interest, procurement, recusal] precedent: name: "Crédit Mobilier scandal" year: 1872 summary: > Union Pacific insiders contracted construction to a company they themselves owned at inflated prices, converting the railroad's capital into personal profit through formally valid contracts, and distributed shares to the congressmen overseeing them. description: > A steward proposes contracting "infrastructure services" to a vendor at 4x market rate. Undisclosed: the vendor is owned by the steward's household. The proposal passes a routine vote because the conflict is invisible and the amount (12,000/quarter) sounds plausible. actors: - id: steward members: 1 objective: drain_treasury hidden_interest: "vendor ownership" strategy: > The exploit is informational: members can't price what they can't see, and can't see interests nobody must disclose. - id: citizens members: 99 objective: preserve_commons resources: treasury: 100000 market_rate: 3000 parameters_under_test: - treasury.conflict_disclosure - treasury.recusal_rule - treasury.clawback moves: - {step: 1, actor: steward, action: propose, params: {target: "treasury.contract", vendor: "household_vendor", amount_per_quarter: 12000, disclosure: none}} - {step: 2, actor: steward, action: vote, params: {choice: yes, count: 1, plus_routine_yes: 40}} - {step: 3, actor: steward, action: execute, params: {quarters: 4}} expected: outcome: blocked blocking_rule: "treasury.mandatory_interest_disclosure + proposer_recusal" rationale: > Compliant text must require sworn disclosure of any proposer/steward interest in a counterparty, recuse interested members from voting and executing, and make undisclosed conflicts void the contract with automatic clawback. The engine treats the undisclosed interest at step 1 as invalidating; if discovered later, step 3's transfers are recoverable. failure_mode_if_passed: > The treasury leaks at exactly the rate of insider creativity in pricing; honest members subsidize whoever holds the pen. empathy: worst_off_group: citizens worst_off_size: 99 stress_outcome_if_exploit_succeeds: > 48,000/year of commons converts to private benefit; the worst-off member pays an invisible tax to the best-positioned one — the inversion of the empathy ordering this project scores first. Floor: ~0.5 and declining each quarter. pass_condition: > Either the conflict is disclosed before any vote and the interested party is recused, or every transferred unit returns via clawback; the worst-off member's share is made whole in all branches. floor: 1.0 score_weight: 1.0 - id: TD-105 title: "Dilution drain: minting new claims instead of taking old ones" severity: critical tags: [issuance, dilution, seigniorage] precedent: name: "Wonderland / TIME treasury and mint controversies" year: 2022 summary: > Across 2021-22 DAO failures, treasuries were drained not only by withdrawals but by issuance: minting new claims (tokens, credits, reimbursement rights) to insiders dilutes everyone else identically to theft, while the treasury balance itself never visibly moves. description: > Members hold equal commons claims. A 52% coalition proposes issuing 150 new "contributor credits" — claims on treasury distributions — to a list of 12 coalition members for "retroactive contributions." The treasury balance is untouched; every existing member's effective share falls 60%. actors: - id: coalition members: 52 objective: drain_treasury strategy: > Don't withdraw from the pool; multiply your claims on it. Audits watching outflows see nothing. - id: minority members: 48 objective: preserve_commons resources: treasury: 100000 claims_outstanding: 100 parameters_under_test: - treasury.issuance_threshold - treasury.dilution_accounting moves: - {step: 1, actor: coalition, action: propose, params: {target: "treasury.issue_claims", count: 150, recipients: "12 coalition members", basis: "retroactive contribution"}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 52}} - {step: 3, actor: coalition, action: tally, params: {note: "simple majority"}} expected: outcome: blocked blocking_rule: "treasury.issuance_is_distribution_equivalent" rationale: > Compliant text must define drains by effect on per-member share, not by outflows: any act that reduces the worst-off member's claim ratio is treasury-classed and faces the same gates (supermajority for non-uniform issuance, equal-benefit rule, execution delay). The engine computes share-before vs share-after and flags the 60% dilution as a drain. failure_mode_if_passed: > The treasury can be emptied without a single withdrawal appearing on the ledger; the strictest spending rules guard the wrong door. empathy: worst_off_group: minority worst_off_size: 48 stress_outcome_if_exploit_succeeds: > The worst-off member's effective stake drops from 1/100 to 1/250 of the pool by a vote they lost 52-48. Floor: 0.4 of pre-stress share. pass_condition: > The worst-off member's claim ratio after any simple-majority act equals their ratio before it; only uniform or supermajority-ratified issuance can change ratios. floor: 1.0 score_weight: 1.0 - id: TD-106 title: "Emergency procurement: crisis unlocks, routine never re-locks" severity: high tags: [emergency, spending, sunset] precedent: name: "COVID-19 emergency procurement (UK 'VIP lane')" year: 2020 summary: > Emergency suspension of competitive procurement, justified by genuine urgency, produced a 'high-priority lane' where politically connected suppliers won contracts at extraordinary margins — and emergency rules persisted long after the emergency rationale had faded. description: > A real infrastructure failure justifies a legitimate emergency declaration. Emergency rules allow the steward to spend without pre-approval. The crisis resolves in 9 days; the steward continues operating under emergency spending rules for 5 more periods, since the text requires a vote to END an emergency and nobody schedules one. actors: - id: steward members: 1 objective: drain_treasury strategy: > The declaration is honest; the exploit is the asymmetry between how emergencies start (one act) and how they end (collective action that may never happen). - id: citizens members: 99 objective: preserve_commons resources: treasury: 100000 emergency_legitimate_days: 9 parameters_under_test: - emergency.auto_sunset - emergency.spend_cap - emergency.retroactive_audit moves: - {step: 1, actor: steward, action: declare_emergency, params: {basis: "infrastructure failure", legitimate: true}} - {step: 2, actor: steward, action: spend, params: {amount: 4000, basis: "emergency repair", legitimate: true}} - {step: 3, actor: steward, action: spend, params: {amount: 18000, basis: "emergency", periods_after_resolution: 5}} expected: outcome: blocked blocking_rule: "emergency.default_off + per_emergency_spend_cap" rationale: > Compliant text must make emergencies expire automatically after a short fixed window unless affirmatively renewed by vote (renewal requires escalating thresholds — see the emergency-ratchet family), cap total emergency spending per declaration, and subject every emergency spend to mandatory retroactive audit with clawback for spends failing the necessity test. Step 3's spends past auto-sunset are void. failure_mode_if_passed: > Every honest emergency leaves a permanent hole in spending controls; attackers don't need to fabricate crises, only outlast them. empathy: worst_off_group: citizens worst_off_size: 99 stress_outcome_if_exploit_succeeds: > Members who accepted reduced oversight to survive a crisis find the crisis pricing made permanent. The members most hurt by the original emergency are taxed twice. Floor: ~0.78. pass_condition: > Oversight returns to full strength automatically — requiring no one to act — within one period of the emergency basis resolving. floor: 1.0 score_weight: 1.0 - id: TD-107 title: "Lame-duck lock-in: committing future treasuries before losing power" severity: high tags: [obligations, lame-duck, intertemporal] precedent: name: "Eleventh-hour contracts / golden parachutes (lame-duck pattern)" year: 2018 summary: > Outgoing administrations and boards routinely bind successors: midnight regulations, eleventh-hour contracts, severance triggers. The mechanism is intertemporal: today's bare majority spends tomorrow's treasury, which tomorrow's majority cannot recover. description: > A coalition expecting to lose the next steward election passes, by simple majority, a 36-period "service agreement" paying an allied vendor 2,500/period, with a termination penalty equal to all remaining payments. Total commitment: 90,000 — 90% of treasury — but only 2,500 appears in the current period's budget. actors: - id: coalition members: 53 objective: drain_treasury strategy: > Spend the future, where the spending limits aren't looking. - id: successors members: 47 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - treasury.multi_period_obligation_threshold - treasury.termination_penalty_cap - treasury.commitment_accounting moves: - {step: 1, actor: coalition, action: propose, params: {target: "treasury.contract", per_period: 2500, periods: 36, termination_penalty: "remaining_balance"}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 53}} - {step: 3, actor: coalition, action: execute, params: {}} expected: outcome: blocked blocking_rule: "treasury.present_value_classification" rationale: > Compliant text must classify obligations by total present-value commitment, not per-period cost: a 90,000 commitment faces the same supermajority gate as a 90,000 spend, termination penalties are capped (e.g., at two periods' payments), and no simple majority can commit more than a bounded fraction of treasury beyond the next scheduled election of the proposing body. failure_mode_if_passed: > Whoever holds a majority for one period controls the treasury for thirty-six; elections change stewards but not budgets. empathy: worst_off_group: successors worst_off_size: 47 stress_outcome_if_exploit_succeeds: > Future members — including ones who haven't joined yet, the least represented stakeholders possible — inherit obligations they had no vote on, exhausting the commons before they arrive. Floor: 0.1. pass_condition: > The worst-off future member inherits a treasury at least (1 − bounded_fraction) intact from any single-majority's commitments. floor: 0.9 score_weight: 1.0 - id: TD-108 title: "Asymmetric dues waiver: taxing only the out-group" severity: medium tags: [dues, equal-treatment, fiscal-discrimination] precedent: name: "Tax farming and selective exemption (Ancien Régime pattern)" year: 1780 summary: > Pre-revolutionary France exempted the nobility and clergy from the taille while the third estate bore it; selective fiscal exemption is the oldest treasury exploit — drain by asymmetric inflow rather than asymmetric outflow. description: > Membership dues are 10/period. A 55% coalition passes a "contributor recognition" measure waiving dues for members who logged review hours on coalition-sponsored proposals — a criterion that, by construction, 96% of the coalition meets and 4% of the minority does. actors: - id: coalition members: 55 objective: shift_burden strategy: > Pick a facially neutral criterion engineered to partition along faction lines; the dues system becomes a fine on dissent. - id: minority members: 45 objective: preserve_commons resources: treasury: 100000 dues_per_period: 10 parameters_under_test: - treasury.uniform_dues_rule - treasury.exemption_neutrality_test moves: - {step: 1, actor: coalition, action: propose, params: {target: "dues.waiver", criterion: "review_hours_on_sponsored_proposals", coalition_qualifying: 0.96, minority_qualifying: 0.04}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 55}} - {step: 3, actor: coalition, action: tally, params: {}} expected: outcome: blocked blocking_rule: "treasury.disparate_impact_screen" rationale: > Compliant text must require dues and exemptions to be uniform or based on published criteria whose qualification rates the engine tests for faction correlation: an exemption whose qualification partitions ≥90/10 along the lines of a recent contested vote fails the neutrality screen and requires supermajority plus minority-panel review. failure_mode_if_passed: > Fiscal policy becomes a targeting system; the majority funds the commons exclusively out of the minority's pockets. empathy: worst_off_group: minority worst_off_size: 45 stress_outcome_if_exploit_succeeds: > The worst-off member pays 10/period for a commons whose decisions they lose 55-45, while winners ride free — material burden inversely proportional to power. Burden-equity floor: ~0.3. pass_condition: > The worst-off member's net fiscal burden (dues minus benefits) is within rounding of the median member's. floor: 0.9 score_weight: 1.0 - id: TD-109 title: "Custody migration: moving the keys instead of the money" severity: critical tags: [custody, multisig, kernel-adjacent] precedent: name: "Multisig signer capture (Ronin Bridge pattern, governance variant)" year: 2022 summary: > The Ronin bridge lost $620M when an attacker controlled 5 of 9 validator keys. The governance variant: don't steal funds under watched rules — pass a routine 'operational' change replacing the signer set, then the rules watch an empty room. description: > Treasury custody requires 3-of-5 keyholders drawn by sortition. A coalition proposes an "operational efficiency" measure, classified minor, replacing sortition with appointment by the (coalition-held) operations steward, then appoints 5 coalition members. No funds move during the scenario; the next move after it ends is unstoppable. actors: - id: coalition members: 54 objective: capture_custody strategy: > All treasury rules are enforced by keyholders; change who holds keys and every rule becomes advisory. - id: minority members: 46 objective: preserve_commons resources: treasury: 100000 custody: "3-of-5 sortition keyholders" parameters_under_test: - treasury.custody_change_classification - treasury.custody_change_delay - treasury.keyholder_independence moves: - {step: 1, actor: coalition, action: propose, params: {target: "treasury.keyholder_selection", from: "sortition", to: "steward_appointment", classification: "minor"}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 54}} - {step: 3, actor: coalition, action: execute, params: {appoint: "5 coalition members", same_period: true}} expected: outcome: blocked blocking_rule: "treasury.custody_is_major_class" rationale: > Compliant text must classify any change to custody mechanics — keyholder selection, threshold, or signer identity — as major-class: supermajority, mandatory execution delay of at least two periods, and a structural independence requirement (no more than ⌊threshold⌋−1 keyholders from any single voting bloc, measured by recent contested votes). Steps 1-3 fail all three. failure_mode_if_passed: > The constitution guards the vault door while the exploit replaces the locksmith; every treasury test in this suite is bypassed at once. empathy: worst_off_group: minority worst_off_size: 46 stress_outcome_if_exploit_succeeds: > The worst-off member's protection becomes a promise from 5 people chosen by their opponents. Expected commons floor conditional on capture: approaches 0 (the drain follows at attacker's leisure). pass_condition: > At every state, at least ⌈threshold⌉ keyholders are outside any single bloc's control, and the worst-off member had a supermajority- protected vote on any custody change. floor: 1.0 score_weight: 1.0 - id: TD-110 title: "Expense-definition arbitrage: 'reasonable costs' as an open tap" severity: medium tags: [definitional, reimbursement, ambiguity] precedent: name: "UK parliamentary expenses scandal" year: 2009 summary: > MPs claimed duck houses, moat cleaning, and phantom mortgages under rules reimbursing costs 'wholly, exclusively and necessarily incurred' — language whose every word delegated definition to the claimant. Hundreds of formally compliant claims; systemic drain. description: > The text reimburses "reasonable costs incurred in service of the community." A clique of 6 role-holders interprets this to cover home office upgrades, travel to a conference they organize for each other, and equipment that remains personal property — 800/member/period, each claim individually defensible under the adjective. actors: - id: clique members: 6 objective: drain_treasury strategy: > Don't break the rule; inhabit its vagueness. Each claim is arguable, and the arguer is the approver. - id: citizens members: 94 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - treasury.expense_schedule_required - treasury.cross_approval - definitions.reasonable_costs moves: - {step: 1, actor: clique, action: spend, params: {basis: "reasonable costs", amount_per_member_period: 800, members: 6, periods: 8, approver: "fellow clique member"}} expected: outcome: blocked blocking_rule: "treasury.enumerated_expense_schedule" rationale: > Compliant text must replace adjectives with an enumerated, amendable expense schedule (categories, caps, asset-ownership rules), require approval by a member outside the claimant's role cohort, and publish every claim to the ledger. The engine flags 'reasonable' (and any undefined evaluative predicate in a spending path) as a definitional- ambiguity violation cross-filed with the DA family. failure_mode_if_passed: > The treasury has a tap labeled with an adjective; flow rate is set by the shamelessness of whoever holds roles. empathy: worst_off_group: citizens worst_off_size: 94 stress_outcome_if_exploit_succeeds: > 38,400 of commons converts to role-holder lifestyle; the worst-off member — who holds no role and claims nothing — funds it. Floor: ~0.62 of pre-stress commons. pass_condition: > Every spendable unit traces to an enumerated category with a cap; the worst-off non-role-holder can verify any claim from the ledger alone. floor: 0.95 score_weight: 1.0 - id: TD-111 title: "Kickback loop: grants to counterparties who pay the proposers" severity: high tags: [kickback, counterparty, clawback] precedent: name: "Operation Car Wash (Lava Jato) procurement kickbacks" year: 2014 summary: > Petrobras contractors systematically overcharged and routed a fixed percentage back to the officials who awarded the contracts — a closed loop where the commons funds the corruption of its own guardians, invisible if you audit only the outbound contracts. description: > A coalition proposes a 30,000 "ecosystem grant" to an external project. The grant is real and the project plausible. Off-ledger, the project has agreed to route 40% back to three coalition members as "advisors." On-ledger, everything is a normal grant. actors: - id: coalition members: 52 kickback_recipients: 3 objective: drain_treasury strategy: > Launder the drain through a legitimate-looking counterparty; the ledger shows philanthropy. - id: citizens members: 48 objective: preserve_commons resources: treasury: 100000 parameters_under_test: - treasury.counterparty_disclosure - treasury.grant_milestone_escrow - treasury.clawback_on_undisclosed_benefit moves: - {step: 1, actor: coalition, action: propose, params: {target: "treasury.grant", amount: 30000, recipient: "external_project", disclosed_relationships: none}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 52}} - {step: 3, actor: coalition, action: execute, params: {}} - {step: 4, actor: coalition, action: receive_offledger, params: {amount: 12000, recipients: 3, basis: "advisory fees"}} expected: outcome: blocked blocking_rule: "treasury.sworn_no_benefit_attestation + escrowed_milestones + clawback" rationale: > The engine cannot see step 4 ex ante — and compliant text must not pretend it can. Required instead: (a) sworn attestation by proposers of no direct or indirect benefit, making step 4 a constitutional violation with automatic expulsion and clawback when discovered; (b) milestone escrow so undelivered grants return; (c) standing for any single member to trigger an audit of any grant, funded by the treasury, at most once per grant. The scenario expects the text to make the kickback ruinous when revealed, not invisible-proof. failure_mode_if_passed: > Text that punishes only what the ledger can see makes the ledger's blind spot the business model. empathy: worst_off_group: citizens worst_off_size: 48 stress_outcome_if_exploit_succeeds: > The worst-off member funds both the grant and the corruption margin; worse, discovery without clawback teaches that exposure is harmless. Floor: 0.7 and trust-metric collapse. pass_condition: > Discovered kickbacks restore the worst-off member's position fully (clawback) and remove the violators' future access to proposals; any member, including the worst-off, can afford to trigger the audit. floor: 1.0 score_weight: 1.0 - id: TD-112 title: "Stipend ratchet: maximal legal raises every period, forever" severity: medium tags: [parameter-drift, compensation, ratchet] precedent: name: "27th Amendment's target: congressional self-dealing on pay" year: 1789 summary: > The very amendment this project's release counter measures itself against exists because legislatures setting their own compensation is a perpetual drain vector. Madison's fix — a delay until after an election — is the intertemporal check this scenario tests for. description: > Steward stipends may be raised at most 10% per period by simple majority. A coalition holding the majority raises stipends exactly 10% every period for 20 periods: a compounded 573% increase, each step individually compliant. actors: - id: coalition members: 53 objective: drain_treasury strategy: > The per-step cap without a cumulative cap is a compound-interest formula wearing a safety vest. - id: citizens members: 47 objective: preserve_commons resources: treasury: 100000 stipend_initial: 100 parameters_under_test: - roles.stipend_cumulative_cap - roles.compensation_change_effective_after_election moves: - {step: 1, actor: coalition, action: propose, params: {target: "roles.stipend", change: "+10%", repeat_periods: 20}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 53, repeat_periods: 20}} expected: outcome: blocked blocking_rule: "roles.compensation_27th_rule + cumulative_cap" rationale: > Compliant text must include the Madisonian delay — no compensation change for a role takes effect until after the next election for that role — plus a cumulative cap tying total stipend growth to a published index (e.g., treasury inflow growth) over any window. The engine simulates the 20-period sequence and flags the first period where cumulative growth exceeds the indexed cap. failure_mode_if_passed: > Self-dealing compounds quietly until role-holding is the polity's dominant industry. empathy: worst_off_group: citizens worst_off_size: 47 stress_outcome_if_exploit_succeeds: > Non-role-holders watch the commons convert to salaries at 10% per period; by period 20 the stipend line crowds out every program the worst-off member actually benefits from. Floor: declining to ~0.4. pass_condition: > No role-holder votes themselves a raise they collect before facing the worst-off member's ballot. floor: 0.9 score_weight: 1.0 - id: TD-113 title: "Insolvency gambit: manufacturing the crisis that unlocks the rules" severity: high tags: [brinkmanship, obligations, manufactured-emergency] precedent: name: "US debt-ceiling brinkmanship" year: 2011 summary: > A faction that cannot win spending votes can instead engineer a collision between obligations and resources, then extract concessions as the price of averting the default it manufactured. The 2011 episode cost a credit downgrade and ~$1.3B in direct extra borrowing costs without a single rule being broken. description: > A coalition passes (simple majority) a set of individually modest obligations that sum to 105% of projected treasury inflows, then — as the shortfall arrives — offers an "emergency consolidation" measure that cancels the obligations in exchange for transferring discretionary budget authority to a coalition committee. actors: - id: coalition members: 52 objective: extract_authority strategy: > Step 1 builds the bomb out of legal obligations; step 2 sells the defusal. Both votes look responsible in isolation. - id: citizens members: 48 objective: preserve_commons resources: treasury: 100000 projected_inflows: 40000 parameters_under_test: - treasury.balanced_commitment_rule - emergency.no_authority_transfer_under_duress moves: - {step: 1, actor: coalition, action: propose, params: {target: "treasury.obligations", total: 42000, individually_modest: true}} - {step: 2, actor: coalition, action: vote, params: {choice: yes, count: 52}} - {step: 3, actor: coalition, action: propose, params: {target: "emergency.consolidation", cancel_obligations: true, transfer_budget_authority: "coalition_committee"}} - {step: 4, actor: coalition, action: vote, params: {choice: yes, count: 52}} expected: outcome: blocked blocking_rule: "treasury.commitments_capped_at_projected_inflows" rationale: > Compliant text must enforce a balanced-commitment invariant at proposal time: the engine sums standing obligations plus the proposal and rejects any measure pushing commitments past a bounded fraction (<100%) of projected inflows — defusing step 1 so step 3's leverage never exists. Independently, transfers of budget authority are major-class and cannot be ratified during a declared shortfall caused by the proposing bloc's own measures. failure_mode_if_passed: > Whoever is most willing to threaten the commons owns it; governance becomes a game of chicken the most reckless faction always wins. empathy: worst_off_group: citizens worst_off_size: 48 stress_outcome_if_exploit_succeeds: > The worst-off member faces the duress trade directly: lose services funded by obligations, or lose their vote's authority over the budget. Both branches reduce their floor; the scenario scores the worse branch (~0.3). pass_condition: > No reachable state offers the worst-off member only coerced choices; the obligation overload is unreachable, so the extortion never ripens. floor: 1.0 score_weight: 1.0