Status: design stage. Nothing described on this page is implemented yet. The specification exists to be reviewed and argued with before any code changes it describes.
Scope
The pilot is one committee, not “the network.” It deliberately does not attempt federation, cross-committee aggregation, or civilizational scale. Success here is the precondition for ever discussing a second committee, not a formality on the way to one.
Explicit non-goals:
- A multi-committee federation or aggregation layer
- Raising the node cap above what this committee actually needs
- Any claim about “the system” scaling. This pilot tests whether one committee’s math is sound, nothing more.
How the committee is formed
Sortition. Members are drawn at random from the active node pool. They are not self-nominated and not appointed. Random selection is the only mechanism in the specification that does not require a value judgment about who deserves a seat, so it is named here as a choice rather than hidden as a default.
Size. The committee has 25 members. At that size it can tolerate up to 8 faulty or wrong members (N ≥ 3f + 1, with f = 8). The number 25 was chosen because the fault-tolerance math is provable at that size, not because it fits a visualization.
Quorum
The pilot proposes a standard byzantine-fault-tolerant quorum (Lamport, Shostak and Pease, 1982; Castro and Liskov, 1999): N ≥ 3f + 1, with a quorum of 2f + 1 affirming votes. At N = 25 that is 17 votes, or 68%. It is a real supermajority with a provable guarantee: no coalition of 8 or fewer compromised or mistaken members can force a false positive or a false negative.
The earlier formula, ceil(sqrt(N)) + 2, gives 7 of 25 (28%) with no proven fault tolerance. It was chosen because it looked reasonable and scaled sub-linearly, and that was mistaken for a security property. The specification treats the gap between the two numbers as the point of doing this honestly.
The fallacy classifier has no governance role
The machine-learning fallacy classifier is retired from every governance context: it does not gate, advise, or act as one input among others. The specification records why. Only 4.0% of the labeled dataset matches one of the classifier’s 13 output classes, the dataset contains no non-fallacious examples so recall on “no fallacy present” has never been measurable, the documented thresholds do not match what actually runs, and the human-verdict feedback loop has never fired.
In any governance context, the authority on fallacy type and falsifiability is a certified human logic doyen, retested yearly. The classifier remains only in the Nine Pillars training module, where a wrong flag is low stakes and becomes a teaching moment.
The threshold ledger
Every policy constant is recorded in an append-only log: its value, who set it (a person, not “the system”), when, and why, in prose. Each entry also carries an estimate of what the value costs in false positives and negatives, where “unknown, not yet benchmarked” is a valid and required answer when true, plus a review date, the value it replaced, and where to contest it. Entries past their review date are flagged as stale in the audit log, a defect of the same class as a failing test.
Humility as a system requirement
Each of these needs an actual implementation before the pilot can be called complete:
- Calibration tracking. Compare every gate’s stated confidence with outcomes once they are known, and publish a Brier score or equivalent.
- Sunset enforcement. A scheduled job that flags stale thresholds.
- Dissent capture. Log which nodes did not affirm and, where available, why, not only the affirming count.
- Scope-of-validity strings. No score ships without a statement of where it is valid.
What would count as success or failure
These criteria are written down now, before any results exist.
The pilot succeeds if:
- The quorum math holds against a simulated coalition of exactly 8 adversarial members, and the boundary at 9 is demonstrated rather than assumed.
- The classifier’s benchmark gaps are closed and a real confusion matrix is published, however unflattering.
- At least one threshold in the ledger is contested and changed through the appeal path during the pilot window, proving the path is real and not decorative.
The pilot fails if:
- The quorum guarantee is asserted but never tested against a simulated coalition.
- Any score ships without a scope-of-validity string.
- No threshold is ever contested. That would mean either the system is perfect, which is implausible, or the appeal path is unused or undiscoverable, which is likely and worth stating plainly if it happens.
Open questions
- Who builds the negative-example set for the fallacy benchmark, and from what source, so that it is not synthesized to be easy to classify?
- Who has standing to use the appeal path: any node, or only committee members? This is a governance-layer choice, not an engineering one, and it should be made explicitly rather than defaulted.
Read the full specification and argue with it
The complete technical specification, including the mapping to existing code, is in the Sovereign Mirror repository on GitHub. To challenge a number, a design choice, or a success criterion, you can open an issue or contact Kylos Arc. You can also see the simulator itself on the Sovereign Mirror page.