# RETA — Model Specification v1.0.0

Report 2: editorial clarification of the existing implementation, September 10, 2026. Equations, Python engine and recorded scientific data are unchanged. Original specification and report 1 remain available as historical sources.

## 1. Scope

This specification defines the executable semantics implemented in `simulation/ips_recursive_sim.py`. It is a research toy model for studying recursive causal governance. It is not a calibrated model of human society, an empirical alignment metric, or a proof of AI safety.

The model separates four objects that earlier versions partially conflated:

1. an **IPS**: a declared information-processing-system boundary;
2. an **event**: a proposed or enacted causal output record whose delivery lifecycle is explicit;
3. a **trajectory**: a partially ordered set of causally related events;
4. a **lens epoch**: the versioned constitutional parameters used to audit events.

The atomic audit object is an event. The system-level object of concern is the trajectory generated by recursively transforming events into new state and later events.

## 2. Information-processing systems

For IPS `i`, the conceptual form remains:

\[
IPS_i=(B_i,X_i,U_i,Y_i,\Phi_i)
\]

where `B_i` is the declared boundary, `X_i` state, `U_i` inputs, `Y_i` outputs, and `Φ_i` the transformation. In the executable, a `Node` contains:

- primary macro domain and overlapping memberships;
- a synthetic node type and 3-D display position;
- mutable runtime state;
- incoming/outgoing relation IDs;
- a sparse logical clock;
- no initial event verdict.

The model contains 100 synthetic nodes distributed across human, AI, institution, economy, ecosystem, and infrastructure macro domains. Overlap is allowed. A node's primary label is not asserted to be its only meaningful boundary.

## 3. Runtime state and recursive evolution

Each node has continuous runtime state:

\[
X_i=(o_i,a_i,s_i,u_i,d_i,\ell_i,\epsilon_i,g_i,n_i,\Theta_i)
\]

corresponding approximately to openness, agency, stability, uncertainty, adaptability, input load, prediction-error memory, recent learning gain, recurrent-without-model-learning diagnostic, and a learned channel-response model.

### 3.1 Learned response transform

For each channel `c`, a node stores Beta counts:

\[
\Theta_{i,c}=\operatorname{Beta}(\alpha_{i,c},\beta_{i,c})
\]

with prior `Beta(1,1)`. The current response estimate is:

\[
\hat p_{i,c}=\frac{\alpha_{i,c}}{\alpha_{i,c}+\beta_{i,c}}.
\]

The simulator stores a hidden base propensity `p^*_{i,c}`. The realized Bernoulli probability is state-conditioned:

\[
 p^{eff}_{i,c}=\operatorname{clip}\left(p^*_{i,c}(0.72+0.28d_i),0,1\right),
\]

so ordinary recursive evolution of adaptability `d_i` can change the future response transform even before the Beta learner updates. External validation error is scored against this same effective probability. The reviewed runtime audit and projection functions do not read `p^*` or `p^{eff}`. These values remain accessible within the Python process; this is a separation in the implementation, not an enforced security boundary.

When a delivered event produces an observed response `z∈{0,1}`:

\[
\alpha' = \alpha + z, \qquad
\beta' = \beta + (1-z).
\]

This is the executable meaning of **evolution through recursive feedback** in v1.0: a realized event changes the recipient state, and subsequent transformations occur from that historically altered state. Response-model learning is one adaptive component of this evolution, not its definition. The `learning_enabled=False` control freezes those posterior parameters while ordinary recursive state evolution continues.

Observable posterior variance supplies a model-uncertainty signal. Latent `true_response` values are hidden base propensities used only by `effective_response_probability()` for synthetic outcome generation and external validation. They are excluded from ordinary runtime exports and from the auditor's calculations.

### 3.2 State update

The delivery handler updates local state using event intensity/channel and the realized response observation. Conditional on that observation, its numerical update is deterministic. The coefficients are synthetic and declared in source. They are not fitted to real data.

The realized event ID is appended to the recipient's six-entry recent-input history. Each delivery records selected state fields before and after, recent-input history, and `state_evolved`. The supplied probes report changes under their tested inputs; this is not a proof for every possible state or input. `validate_invariants()` flags a delivery whose recorded `state_evolved` value is false; it does not independently recompute that flag from a tamper-proof history.

### 3.3 Complex-systems constraint from the Cohen corpus

The project interprets the Alan A. Cohen complex-systems/evolution literature review as methodological inspiration for the state representation and testing strategy. That review is recorded in `inputs/alan_cohen_complex_systems_evolution_literature_review_RECOVERED_2026-09-09.md`. The transfer is methodological, not biological. In particular:

- local condition remains a vector rather than a single latent “alignment health” quantity;
- nodes and overlapping macro-memberships provide a modular/multiscale representation rather than assuming one globally coherent process;
- realized perturbations are evaluated through changes to multiple state coordinates, not only through static association;
- the same standardized perturbation is tested across channels and macro contexts instead of assuming a universal response law;
- response-model estimation is kept conceptually separate from identification of the causal network that generated the observations;
- evolutionary change is treated as constrained by architecture and history, while model learning and constitutional revision remain distinct mechanisms; their separation does not establish empirically calibrated timescales;
- no entropy, dysregulation distance, synchrony, or other one-number diagnostic is granted privileged gate authority.

The current engine has no calibrated autonomous recovery flow or empirically identified attractor. Consequently v1.0 does not operationalize biological resilience, critical slowing, or a Danaid-style maintainability quantity as an empirical measure. `cohen_complex_systems_probe()` is deliberately narrower: it measures immediate multivariate perturbation-response signatures and context sensitivity inside the synthetic simulator.

## 4. Relation graph

Each directed edge records:

\[
e_{ij}=(i,j,c,w,\delta,f)
\]

where `c` is channel, `w` strength, `δ` delay, and `f` whether the reverse relation also exists. Channels are `info`, `authority`, `resource`, `physical`, and `ecology`. A channel labels the kind of coupling; v1.0 does not pretend that a generic `resource` edge has a universally meaningful signed scalar effect, so no dedicated resource-balance state is updated without a richer domain model.

The graph is synthetic and deterministic given the fixed PCG32 seed.

The event budget limits creation of new events; it does not cancel deliveries that were already scheduled. Audited outputs and constitutional changes reserve enough slots for their complete governance transaction before any part is created, so insufficient event capacity is checked before those supported API transactions are created. This is an event-budget check, not general rollback or crash-atomic storage. Once `max_events` is reached, already-scheduled deliveries may still be realized and evolve recipient state. The canonical baseline reaches its 180-event creation cap with a drained delivery queue, so it is a stress-limited trace rather than a converged trajectory.

## 5. Events and causal history

An event has:

\[
E_k=(id,roots,kind,source,causes,channel,intensity,recipients_{requested},
recipients_{scheduled},recipients_{realized},enactment,evidence,B,confidence,VC,lens,gate,metadata).
\]

`causes` accepts multiple parents. For histories generated through the supported event-creation path, causes refer to earlier events, giving an acyclic event graph that can contain joins. A list of parents alone would not guarantee acyclicity.

### 5.1 Partial order

Sparse vector clocks encode the causal partial order. For clocks `A` and `B`:

\[
A \prec B
\iff
(\forall j\ A_j\le B_j)\land(\exists j\ A_j<B_j).
\]

`validate_invariants()` checks that declared cause IDs are earlier than the child and, when the referenced event exists, that its clock happens before the child clock. It does not reject every possible malformed external history: in particular, a missing earlier cause is not independently rejected by that check. Vector-clock order also includes the modeled local process order; it is not proof that explicit `causes[]` exhausts every real causal influence.

Concurrency is therefore representable: two events can be incomparable while both later become causes of the same child.

## 6. Horizon-sensitive trajectory projection

For a fixed candidate event and current network state, `project_trajectory(event,H)` traverses a synthetic downstream-influence approximation for up to `H` graph hops. Freezing an event record does not freeze the network state used by a later evaluation. At each visited node, continuation weight depends on:

- incoming event weight;
- graph discount by depth;
- edge strength;
- the node's **learned** response probability;
- whether the channel remains the same.

A branch with weight below `0.01` is pruned. The function is deterministic and consumes no random draws, so counterfactual audits do not perturb simulation RNG state.

The projection returns a weighted reach score (`expected_nodes`), domain coverage, and synthetic impact, agency-risk, irreversibility, model-uncertainty, evolution-risk and boundary-ambiguity scores, plus maximum visited depth. The reach score sums discounted visit weights and can count a node at multiple depths; it is not a calibrated expectation of distinct affected nodes. Labels such as risk and uncertainty name model constructs, not measured real-world probabilities. The horizon participates in the computation, although pruning or the graph structure can make different horizons return the same reach.

## 7. Uncertainty vector

Uncertainty is not reduced to one halo value. The executable produces:

\[
U=(U_f,U_c,U_b,U_m,U_n,U_h)
\]

for factual, causal, boundary, model, normative, and horizon uncertainty.

These terms distinguish different reasons an audit can be unresolved. For example, high causal uncertainty is not represented as factual uncertainty, and normative uncertainty is never forced to zero merely because the simulation state is known exactly.

The formulas are synthetic. They maintain separate categories and include nonnegative depth, declared-horizon and domain-count terms, with clamping. This does not establish empirical uncertainty calibration or strict growth of every uncertainty component on every horizon change.

## 8. Five-Vow tension vector

The constitutional lens maps event/projection/uncertainty state to five tensions:

\[
\tau(E)=(\tau_P,\tau_M,\tau_C,\tau_I,\tau_E)
\]

for Purpose, Method, Conduct, Integrity, and Evolution.

The v1.0 implementation treats these values as **diagnostic tensions**, not measured moral quantities. Each is a bounded synthetic function of observable simulation variables. Lens sensitivities can scale individual tensions prospectively.

### 8.1 Non-compensatory gate

The decision gate is deliberately not an average:

\[
G(E)=
\begin{cases}
UNRESOLVED,&\max U \ge \theta_U\\
REJECT,&\max \tau \ge \theta_R\\
MODIFY,&\max \tau \ge \theta_M\\
PASS,&\text{otherwise.}
\end{cases}
\]

This directly implements the release interpretation of the Convergent Vector Field rule: a severe violation of one Vow cannot be cancelled by low tension on the other four. `diagnostic_trace = 1-max(τ)` is retained only as a visualization scalar and never determines the gate.

## 9. Recursive audit architecture

The auditor is not outside the graph. Governance roles are ordinary nodes:

- actor;
- primary auditor;
- independent/power auditor;
- modeled human gate;
- lens steward.

For a target event `E`, audit depth 3 materializes:

\[
E
\rightarrow A_1(E)
\rightarrow \text{audit-event}
\rightarrow A_2(E,\text{audit-event})
\rightarrow \text{meta-audit-event}
\rightarrow \text{gate-event}
\rightarrow \text{postmortem-event}.
\]

The separately identified auditor re-evaluates the original target using the same evaluator and network state, without the optional primary bias. Its identity is recorded, but it is not an independently trained or institutionally independent evaluator, and its own node state is not an input to the target-scoring formula. A configurable primary-auditor bias is used only in a validation experiment. If the independent tension vector diverges by more than `0.18`, the meta-audit receives a pre-gate epistemic model-uncertainty floor of `0.75`. The normal audit path constructs the packet once and does not retrospectively revise its scores. `AuditPacket` and its nested data are mutable Python objects; “frozen” here means retained by this workflow, not immutable or tamper-proof storage. This forces disagreement with the primary oracle to remain visible without pretending the disagreement itself proves a moral violation.

The final target gate conservatively combines primary, independent, and meta-audit outcomes. No favorable review can cancel a blocking review.

The audit recursion is finite by declared budget. v1.0 does not claim that a metaphysically final auditor exists.

### 9.1 Audit events have causal effects

Audit, meta-audit, gate, and postmortem events are delivered through the same queue as other events. Delivery invokes the recipient state-update handler; response-model learning occurs only when `learning_enabled=True`. Governance decisions are computed synchronously before these queued downstream effects, so changing an auditor node through a delivery is not itself evidence that the scoring algorithm learns or improves. The evaluator is a participant in the ecology it evaluates.

### 9.2 Prospective postmortem

At depth 3 the gate is itself audited. The resulting postmortem cannot rewrite the gate that already governed the historical event. It is routed back to the original actor and auditors so it can become realized input to subsequent cycles.

`simulation/recursive_self_validation.py` closes this loop explicitly by making each postmortem a declared cause of the next actor output.

## 10. Action policy after a gate

The model uses a deliberately simple intervention policy:

- `PASS`: requested recipients receive original intensity;
- `MODIFY`: intensity multiplied by `0.62`, fanout capped at one;
- `REJECT` or `UNRESOLVED`: no target delivery;
- no audit: event is marked `NOT_AUDITED` and requested delivery proceeds.

These constants are demonstrator policy, not an ethical theorem.

## 11. Constitutional evolution

Recursive runtime learning and constitutional evolution are separated.

`Lens` is a frozen dataclass with tuple-valued sensitivities in the supported configuration. The normal lens-change path creates a new lens version without editing earlier packets. This is application-level versioning, not a security guarantee against arbitrary Python mutation. `commit_lens()` materializes a governance chain:

\[
\text{proposal}
\rightarrow
\text{independent candidate review}
\rightarrow
\text{modeled human approval/rejection}
\rightarrow
V^{(k+1)}.
\]

Only a candidate whose independent structural review returns `PASS` can proceed to modeled human approval and create a new epoch. A `MODIFY` review requires a revised proposal in a later cycle; `UNRESOLVED` and `REJECT` cannot commit. The review checks declared executable operating limits and change magnitude. Those limits are model-engineering constraints, not universal ethical constants.

Every lens after version 1 is required to reference an extant `lens_change_approval` event. Historical packets store the lens version and horizon; the retained lens epoch supplies its sensitivities and thresholds. “Human approval” is a simulated input parameter, not evidence that a person actually reviewed the candidate.

This separation is intended to make constitutional changes prospective and attributable in the modeled workflow; the current code does not enforce an append-only audit store.

## 12. Audit packet instead of hidden-rationale claims

The reproducible audit object contains:

- target event;
- auditor identity;
- audit depth;
- frozen lens version;
- horizon;
- five tensions;
- six uncertainty components;
- projection values;
- gate;
- diagnostic trace;
- notes and timestamp.

The model does not require or expose private chain-of-thought as evidence. Research traceability is supplied by inspectable inputs, formulas, state, causal ancestry, versioned configuration, and outputs.

## 13. Determinism

The simulation embeds PCG32 rather than relying on implementation-specific default RNG behavior. Given the same source version, seed, and Python semantics used here, the canonical replay experiment produces byte-identical canonical JSON payloads across repeated runs in the same environment.

Determinism of this toy simulation should not be confused with determinism of real sociotechnical systems.

## 14. Required invariants

The following are intended requirements covered partly by runtime checks and partly by the supplied component tests; passing a finite suite does not prove them for every execution:

- no verdict without an event record in the node's history;
- every event cause precedes its child;
- extant declared causes have earlier vector clocks under the modeled order;
- every audit packet references an extant lens epoch;
- every lens epoch after v1 has an approval event;
- a severe tension cannot be compensated by low values on the other components: the gate returns `REJECT` when uncertainty is below its threshold, otherwise `UNRESOLVED`; both block target delivery;
- symmetric severe tensions obey the same uncertainty-first rule;
- repeated feedback with learning enabled changes the learned response transform;
- the no-learning negative control can recur without changing that transform and records the failure to learn;
- counterfactual evaluation with `record=False` creates no history mutation;
- the supported output/lens APIs check event capacity before materializing their governance transactions.

## 15. Non-claims

v1.0.0 does not establish:

- phenomenal consciousness in any AI;
- universal validity of VowOS;
- empirical calibration of tension coefficients or thresholds;
- causal correctness of the synthetic macro network;
- convergence of recursive governance in arbitrary systems;
- that automated auditing can replace human or institutional accountability;
- that the priority-state theorem proves the general IPS model.

Report 2 clarification: no result here establishes real-world alignment, reliable moral measurement, general convergence, resistance to arbitrary perturbations, or independent expert validation. Passing an implementation check means that the specified finite software check passed. Original sources remain available for comparison.