From 28d25ae9dcf3c7dd8e2cac494a39c7f2e933318f Mon Sep 17 00:00:00 2001 From: heimdall Date: Sat, 7 Nov 2026 13:15:18 +0000 Subject: [PATCH] Estate-rule sim docs: record the operator's ruling, one account per person (SPEC 5d) Docs only. Ledger, consolidation, recount requirements; deciding body and appeal marked open. Co-Authored-By: Claude Sonnet 5.5 --- .../2026-11-05-estate-rule-sim/REPORT.md | 2 +- docs/research/2026-11-05-estate-rule-sim/SPEC.md | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/docs/research/2026-11-05-estate-rule-sim/REPORT.md b/docs/research/2026-11-05-estate-rule-sim/REPORT.md index a5f9440..a2c97a5 100644 --- a/docs/research/2026-11-05-estate-rule-sim/REPORT.md +++ b/docs/research/2026-11-05-estate-rule-sim/REPORT.md @@ -50,7 +50,7 @@ Static weight analysis, not a motion simulation: it measures weight share, not P - **The half-influence cap binds only when other estates are silent.** Fraction of (cell, seed) in which council share x >= .5 over 162 cells (b x unit x roll x amount x weights) x 40 seeds: all four live 0.000; Patrons + Minds live 0.044 (all of it the degenerate case where no other patron clears the unit, so there is nothing to cut against: unenforceable); Patrons alone live 0.222 (0.148 of cells bind in every seed, 0.089 of cell-seeds unenforceable). It binds more at small rolls (Patrons alone: 0.669 at roll 4 and b = 2 down to 0.000 at roll 400) and with a smaller log base. The Patrons-alone scenario is the renormalization case of prior section 10 (drop non-voting estates); how likely it is in practice is not a sim output. - **Splitting wins, by orders of magnitude.** The same 1,000,000 EUR over k identities multiplies weight by 1.9 (k = 2), 8.3 (k = 10), 66.7 (k = 100), 500 (k = 1000), and 16,667 at k = amount/unit = 100,000 (each fake identity buying exactly the unit). The multiplier is (amount/unit) / (1 + log_b(amount/unit)); for b = 10, unit = 10 it is 250 at 10,000 EUR, 2,000 at 100,000 EUR. With k = 10 fake identities the buyer's Patrons-alone share is 0.901, with k = 2 it is 0.676. This refutes the log as a purchase bound unless identities are scarce. - **The half-influence cap is per identity and splitting evades it.** In the Patrons-alone case the single identity trips the cap in 85% of seeds; at k = 2 no identity does (each holds 0.34) while the joint share is 0.676, in every seed. A cap on a person's influence needs an identity oracle the harness does not have. -- **SPEC names no sybil defence** (the charter's frozen roll, A6, bounds joins after notice, not pre-notice buying of identities), so none is implemented as policy. Three candidates are quantified in results.md and none is chosen: a per-person weight cap does not help (it caps the honest single purchase and the fakes are each below it; 100,000x at cap 1); a raised unit floor reduces the multiplier (250 at 1,000 EUR, 5 at 100,000 EUR, 1.0 only at 1,000,000 EUR, where no purchase under the buyer's amount buys any weight), so it neutralises splitting only by pricing out everyone smaller; a per-identity cost neutralises only at about half the budget (bisection values 49.3%, 49.8%, 49.95% of 10,000, 100,000, 1,000,000 EUR; the threshold is c = amount/2, where a second identity is left with nothing to buy), so it would also tax the honest buyer's single identity at that rate. The choice between pricing identities, verifying people or bounding total weight per verified person is a design fork left for the operator. Nothing here rules it. +- **SPEC names no sybil defence** (the charter's frozen roll, A6, bounds joins after notice, not pre-notice buying of identities), so none is implemented as policy. Three candidates are quantified in results.md and none is chosen: a per-person weight cap does not help (it caps the honest single purchase and the fakes are each below it; 100,000x at cap 1); a raised unit floor reduces the multiplier (250 at 1,000 EUR, 5 at 100,000 EUR, 1.0 only at 1,000,000 EUR, where no purchase under the buyer's amount buys any weight), so it neutralises splitting only by pricing out everyone smaller; a per-identity cost neutralises only at about half the budget (bisection values 49.3%, 49.8%, 49.95% of 10,000, 100,000, 1,000,000 EUR; the threshold is c = amount/2, where a second identity is left with nothing to buy), so it would also tax the honest buyer's single identity at that rate. The choice between pricing identities, verifying people or bounding total weight per verified person is a design fork left for the operator. Nothing here rules it. Ruled 2026-11-07 by the operator: one account per person, with consolidation and recount after a finding (SPEC 5d; its open questions are marked there). Limits specific to E6: the roll, the Pareto scale, b and unit are assumptions; the buyer joins as an additional patron and buys once (no repeated purchase or liquidation); decisiveness is estate-level only, not council-level (prior section 10 shows weight share is not decisiveness); the best split is a grid maximum, a lower bound; hours play no part in a purchase scenario because estate weights are fixed and the buyer sits in Patrons, so an hours buyer (a Member who is paid or who farms hours) is untested and the conversion of hours into weight is just a per-estate parameter whose gaming is not modeled. diff --git a/docs/research/2026-11-05-estate-rule-sim/SPEC.md b/docs/research/2026-11-05-estate-rule-sim/SPEC.md index 4978cd7..ff46f24 100644 --- a/docs/research/2026-11-05-estate-rule-sim/SPEC.md +++ b/docs/research/2026-11-05-estate-rule-sim/SPEC.md @@ -111,6 +111,22 @@ Serves the purchased-stake brief (operator relayed: Patron vote power is logarit **Falsifiers fixed in advance.** (1) Working hypothesis "logarithmic weight bounds buyout power": refuted if a one-million-euro buyer's within-estate share s exceeds 1/2 at the harness's own roll, or if splitting multiplies weight by more than 2 at any k. (2) The half-influence cap is "binding" in a (cell, seed) iff x >= .5; the rate over the sweep is reported per live-estate scenario. (3) The cap is "evaded" by splitting iff the joint share is >= .5 while no single identity's share is. +## 5d. Sybil policy (ruling, 2026-11-07; not simulated) + +Ruled by the operator (Meta, #operator, 2026-11-07), option D of the sybil pick on the purchased-stake arm: + +> One account per person. If we determine a person to have broken the policy, their identities are consolidated and decisions they influenced are subject to a recount. + +This is a rule enforced after the fact, not a weight formula, so section 5c's weight analysis does not model it and nothing in `estatesim.py` implements it. It names what the estate vote must keep. Each item is a requirement on the real system, not a design: + +1. **Durable per-decision vote ledger.** Every cast ballot is kept as a row: decision id, voter identity, estate, weight at the time of the vote, timestamp, and the ballot itself. Append-only. Weight is stored as it was computed then (rule version included), never recomputed from current state, or a recount cannot reproduce the original tally. +2. **Identity consolidation operation.** Merges the identities found to belong to one person into one account. It writes an audit receipt: who decided, the evidence cited, the identities merged, the surviving account, the time. It does not edit the ledger; it adds a mapping from old identity to person that a recount reads. Reversible by a later receipt that supersedes the first. +3. **Deterministic recount.** For each decision the consolidated person influenced (any ledger row from any merged identity), re-tally from the ledger under the mapping: the person's rows count as one voter with weight set by the same rule applied to the person (the log of the combined purchase, not the sum of split weights), estates and thresholds as at the decision. The same ledger, mapping and rule version always give the same tally, and the output states which decisions flip. No clock, no randomness, no read of live state. +4. **Who determines a violation, and appeal: OPEN QUESTION.** The ruling does not say who finds that a person broke the policy, on what evidence, or how the accused can contest it. Needed before the operation in item 2 can run: the deciding body (an estate, the council, a named steward), the standard of evidence, notice to the accused, an appeal path with a different decider, and whether a consolidation takes effect before or after appeal. Not decided here; to be put to the operator. +5. **Not covered by the ruling: the window before detection.** Decisions stand until a recount flips them; whether a flipped decision is reversed, re-voted or only annotated is also open. + +Section 5c's numbers show why enforcement after the fact is the only lever on offer: weight is per identity, so a split buyer holds 0.676 of Patrons weight at k = 2 and 0.901 at k = 10, with no identity over the half cap. + ## 6. Strategic and adaptive agents A fraction ρ = .25 of ballot holders and of absent undelegated roll members are strategic. Each is myopic about the motion at hand and best-responds to everyone else's current ballots over three rounds in random order: