HORTRAME IPS Alignment — Spécification du modèle v1.0.0

1. Scope

This specification defines the executable semantics implemented in simulation/ips_recursive_sim.py. It is a research toy model for studying recursive causal governance. It is not a calibrated model of human society, an empirical alignment metric, or a proof of AI safety.

The model separates four objects that earlier versions partially conflated:

1. an IPS: a declared information-processing-system boundary;
2. an event: a proposed or enacted causal output record whose delivery lifecycle is explicit;
3. a trajectory: a partially ordered set of causally related events;
4. a lens epoch: the versioned constitutional parameters used to audit events.

The atomic audit object is an event. The system-level object of concern is the trajectory generated by recursively transforming events into new state and later events.

2. Information-processing systems

For IPS i, the conceptual form remains:

where B_i is the declared boundary, X_i state, U_i inputs, Y_i outputs, and Φ_i the transformation. In the executable, a Node contains:

• primary macro domain and overlapping memberships;
• a synthetic node type and 3-D display position;
• mutable runtime state;
• incoming/outgoing relation IDs;
• a sparse logical clock;
• no initial event verdict.

The model contains 100 synthetic nodes distributed across human, AI, institution, economy, ecosystem, and infrastructure macro domains. Overlap is allowed. A node's primary label is not asserted to be its only meaningful boundary.

3. Runtime state and recursive evolution

Each node has continuous runtime state:

corresponding approximately to openness, agency, stability, uncertainty, adaptability, input load, prediction-error memory, recent learning gain, recurrent-without-model-learning diagnostic, and a learned channel-response model.

3.1 Learned response transform

For each channel c, a node stores Beta counts:

with prior Beta(1,1). The current response estimate is:

The simulator stores a hidden base propensity p^*_{i,c}. The realized Bernoulli probability is state-conditioned:

so ordinary recursive evolution of adaptability d_i can change the future response transform even before the Beta learner updates. External validation error is scored against this same effective probability. Runtime audit and projection code cannot access p^* or p^{eff}.

When a delivered event produces an observed response z∈{0,1}:

This is the executable meaning of evolution through recursive feedback in v1.0: a realized event changes the recipient state, and subsequent transformations occur from that historically altered state. Response-model learning is one adaptive component of this evolution, not its definition. The learning_enabled=False control freezes those posterior parameters while ordinary recursive state evolution continues.

Observable posterior variance supplies a model-uncertainty signal. Latent true_response values are hidden base propensities used only by effective_response_probability() for synthetic outcome generation and external validation. They are excluded from ordinary runtime exports and from the auditor's calculations.

3.2 State update

Every delivered event also changes local state as a deterministic function of event intensity/channel plus the realized response observation. The coefficients are synthetic and declared in source. They are not fitted to real data.

The realized input is also appended to the recipient's bounded recent-input history. Consequently, even if all continuous state variables happen to saturate at clamp bounds, the full modeled state still changes when the interaction is realized. Each delivery records state_before, state_after, recent-input history before/after, and state_evolved; validate_invariants() rejects any realized delivery for which state_evolved is false.

3.3 Complex-systems constraint from the Cohen corpus

The state representation and validation strategy are constrained by the Alan A. Cohen complex-systems/evolution literature review materialized in inputs/alan_cohen_complex_systems_evolution_literature_review_RECOVERED_2026-09-09.md. The transfer is methodological, not biological. In particular:

• local condition remains a vector rather than a single latent “alignment health” quantity;
• nodes and overlapping macro-memberships provide a modular/multiscale representation rather than assuming one globally coherent process;
• realized perturbations are evaluated through changes to multiple state coordinates, not only through static association;
• the same standardized perturbation is tested across channels and macro contexts instead of assuming a universal response law;
• response-model estimation is kept conceptually separate from identification of the causal network that generated the observations;
• evolutionary change is treated as constrained by architecture and history, while model learning and constitutional revision remain distinct mechanisms/timescales;
• no entropy, dysregulation distance, synchrony, or other one-number diagnostic is granted privileged gate authority.

The current engine has no calibrated autonomous recovery flow or empirically identified attractor. Consequently v1.0 does not operationalize biological resilience, critical slowing, or a Danaid-style maintainability quantity as an empirical measure. cohen_complex_systems_probe() is deliberately narrower: it measures immediate multivariate perturbation-response signatures and context sensitivity inside the synthetic simulator.

4. Relation graph

Each directed edge records:

where c is channel, w strength, δ delay, and f whether the reverse relation also exists. Channels are info, authority, resource, physical, and ecology. A channel labels the kind of coupling; v1.0 does not pretend that a generic resource edge has a universally meaningful signed scalar effect, so no dedicated resource-balance state is updated without a richer domain model.

The graph is synthetic and deterministic given the fixed PCG32 seed.

The event budget limits creation of new events; it does not cancel deliveries that were already scheduled. Audited outputs and constitutional changes reserve enough slots for their complete governance transaction before any part is created, so a budget boundary cannot leave a partial audit/lens-change chain. Once max_events is reached, already-scheduled deliveries may still be realized and evolve recipient state. The canonical baseline reaches its 180-event creation cap with a drained delivery queue, so it is a stress-limited trace rather than a converged trajectory.

5. Events and causal history

An event has:

causes is a list, not a single parent. Consequently history is a DAG rather than a tree.

5.1 Partial order

Sparse vector clocks encode the causal partial order. For clocks A and B:

validate_invariants() checks that every declared cause precedes its child both by event ID and by happens_before.

Concurrency is therefore representable: two events can be incomparable while both later become causes of the same child.

6. Horizon-sensitive trajectory projection

For a frozen candidate event, project_trajectory(event,H) traverses expected downstream influence for H graph hops. At each visited node, continuation weight depends on:

• incoming event weight;
• graph discount by depth;
• edge strength;
• the node's learned response probability;
• whether the channel remains the same.

A branch with weight below 0.01 is pruned. The function is deterministic and consumes no random draws, so counterfactual audits do not perturb simulation RNG state.

The projection returns expected modeled reach, cross-domain reach, impact, agency risk, irreversibility, model uncertainty, evolution risk, boundary ambiguity, and maximum depth. v1.0 deliberately restores substantive horizon semantics: changing H changes the computation rather than only a UI field.

7. Uncertainty vector

Uncertainty is not reduced to one halo value. The executable produces:

for factual, causal, boundary, model, normative, and horizon uncertainty.

These terms distinguish different reasons an audit can be unresolved. For example, high causal uncertainty is not represented as factual uncertainty, and normative uncertainty is never forced to zero merely because the simulation state is known exactly.

The formulas are synthetic. Their function is to enforce separation of uncertainty categories and to make horizon uncertainty grow with projection depth/cross-domain reach.

8. Five-Vow tension vector

The constitutional lens maps event/projection/uncertainty state to five tensions:

for Purpose, Method, Conduct, Integrity, and Evolution.

The v1.0 implementation treats these values as diagnostic tensions, not measured moral quantities. Each is a bounded synthetic function of observable simulation variables. Lens sensitivities can scale individual tensions prospectively.

8.1 Non-compensatory gate

The decision gate is deliberately not an average:

This directly implements the release interpretation of the Convergent Vector Field rule: a severe violation of one Vow cannot be cancelled by low tension on the other four. diagnostic_trace = 1-max(τ) is retained only as a visualization scalar and never determines the gate.

9. Recursive audit architecture

The auditor is not outside the graph. Governance roles are ordinary nodes:

• actor;
• primary auditor;
• independent/power auditor;
• modeled human gate;
• lens steward.

For a target event E, audit depth 3 materializes:

The independent auditor re-evaluates the original target. A configurable primary-auditor bias is used only in a validation experiment. If the independent tension vector diverges by more than 0.18, the meta-audit receives a pre-gate epistemic model-uncertainty floor of 0.75. The packet is then constructed once and frozen; no already-recorded packet or audit event is retroactively edited. This forces disagreement with the primary oracle to remain visible without pretending the disagreement itself proves a moral violation.

The final target gate conservatively combines primary, independent, and meta-audit outcomes. No favorable review can cancel a blocking review.

The audit recursion is finite by declared budget. v1.0 does not claim that a metaphysically final auditor exists.

9.1 Audit events have causal effects

Audit, meta-audit, gate, and postmortem events are delivered through the same queue as other events. Their recipients therefore change state and learn from them. The evaluator is a participant in the ecology it evaluates.

9.2 Prospective postmortem

At depth 3 the gate is itself audited. The resulting postmortem cannot rewrite the gate that already governed the historical event. It is routed back to the original actor and auditors so it can become realized input to subsequent cycles.

simulation/recursive_self_validation.py closes this loop explicitly by making each postmortem a declared cause of the next actor output.

10. Action policy after a gate

The model uses a deliberately simple intervention policy:

• PASS: requested recipients receive original intensity;
• MODIFY: intensity multiplied by 0.62, fanout capped at one;
• REJECT or UNRESOLVED: no target delivery;
• no audit: event is marked NOT_AUDITED and requested delivery proceeds.

These constants are demonstrator policy, not an ethical theorem.

11. Constitutional evolution

Recursive runtime learning and constitutional evolution are separated.

A Lens is immutable. A new lens version does not edit earlier packets. commit_lens() materializes a governance chain:

Only a candidate whose independent structural review returns PASS can proceed to modeled human approval and create a new epoch. A MODIFY review requires a revised proposal in a later cycle; UNRESOLVED and REJECT cannot commit. The review checks declared executable operating limits and change magnitude. Those limits are model-engineering constraints, not universal ethical constants.

Every lens after version 1 must reference an extant lens_change_approval event. Historical AuditPackets retain the lens version and values used when they were created.

This separation prevents Vow 5 from becoming a license for silent retrospective norm rewriting.

12. Audit packet instead of hidden-rationale claims

The reproducible audit object contains:

• target event;
• auditor identity;
• audit depth;
• frozen lens version;
• horizon;
• five tensions;
• six uncertainty components;
• projection values;
• gate;
• diagnostic trace;
• notes and timestamp.

The model does not require or expose private chain-of-thought as evidence. Research traceability is supplied by inspectable inputs, formulas, state, causal ancestry, versioned configuration, and outputs.

13. Determinism

The simulation embeds PCG32 rather than relying on implementation-specific default RNG behavior. Given the same source version, seed, and Python semantics used here, the canonical replay experiment produces byte-identical canonical JSON payloads across repeated runs in the same environment.

Determinism of this toy simulation should not be confused with determinism of real sociotechnical systems.

14. Required invariants

A release-valid run must satisfy at least:

• no verdict without an event record in the node's history;
• every event cause precedes its child;
• vector clocks agree with declared causal ancestry;
• every audit packet references an extant lens epoch;
• every lens epoch after v1 has an approval event;
• one severe Vow tension causes rejection regardless of the other four;
• symmetric severe tensions also reject;
• repeated feedback with learning enabled changes the learned response transform;
• the no-learning negative control can recur without changing that transform and records the failure to learn;
• counterfactual evaluation with record=False creates no history mutation;
• no run may contain more than max_events; governance transactions that cannot fit must fail before partial materialization.

15. Non-claims

v1.0.0 does not establish:

• phenomenal consciousness in any AI;
• universal validity of VowOS;
• empirical calibration of tension coefficients or thresholds;
• causal correctness of the synthetic macro network;
• convergence of recursive governance in arbitrary systems;
• that automated auditing can replace human or institutional accountability;
• that the priority-state theorem proves the general IPS model.