Risk classification cannot be static: from a Memory System to a Commitment System

Target under attack: the static map riskClass: Slot -> Risk

A prior safe-convergence design rests on riskClass being a property of the SLOT. This note attacks that assumption adversarially and argues it is false.

1. Theorem: riskClass cannot be static

Theorem. No static riskClass(slot) is correct in all contexts.

Proof (counterexample). Let "correct risk" denote the real reversibility of acting on a wrong value. Take the slot address:

• C1 (profile edit, no live order): a wrong address is undoable, so the correct risk is REVERSIBLE.
• C2 (moments before warehouse dispatch of a live order): a wrong address ships the package irretrievably, so the correct risk is IRREVERSIBLE.
• A static label returns one value for both contexts: labeling it REVERSIBLE under-classifies C2 (an unsafe silent reuse of an irreversible commit); labeling it IRREVERSIBLE over-classifies C1 (it would confirm every profile edit, which is unusable).
• No static label is correct in both. QED.

Risk is therefore NOT a slot property: it is a function of the action consuming the value, the world-context, and the time relative to the reversibility window. A slot's risk class is at best a conservative prior or lower bound, never the true risk. Slot-risk is not action-risk.

2. The three-layer risk hierarchy

There is an ordering: slot-risk (a schema prior) is weaker than action-risk (known once the action is selected), which is weaker than outcome-risk (the reversibility window — the latest and truest). The true risk resolves only at the latest layer. A static slot-risk both under-estimates (an address becomes irreversible at dispatch) and over-estimates (a delete is reversible within a trash-retention window); the under-estimating direction is the dangerous one because it permits a silent commit. Freezing risk on the slot substitutes a prior for a posterior — precisely the flaw that punches through the prior design.

3. Risk is compositionally unbounded, so it lives only at the commit site

Modeling risk as a function of action and context still assumes one can enumerate which actions a value feeds. In an open-ended agent a value is recombined into unforeseen actions (a field treated as "reversible" is later pasted into a transfer memo that trips fraud detection and triggers an irreversible account freeze). A value's risk depends on the unbounded set of downstream actions it might feed, including unforeseen ones. Therefore risk cannot be pre-attached to any slot or value — it can only be evaluated at each COMMIT action's site, on its inputs, at commit time.

Strongest form: risk is a property of the ACT OF COMMITTING, computed at the commit site, never a property of data. This is why it cannot be static on the slot, and it directly implies the commitment reframe below.

4. The design upgrade — and an adversarial attack on it

Upgrade: evaluate risk as a function of action, context, and time, combined with provenance and source, computed conservatively at the decision point (lifting the zero-false-confident discipline to risk estimation itself: unprovable reversibility is treated as irreversible).

Adversarial attack on the upgrade: the reversibility window is (a) partially UNDECIDABLE (has the counterparty acted on the contract? has a transfer settled? this is unknowable in advance), (b) NON-MONOTONE (a settled transfer may reopen a recall window), and (c) EXTERNALLY dependent (an instant rail versus a next-day rail — reversibility depends on the external system). The risk estimator cannot always be correct; the only safe collapse is to require authorization whenever reversibility is unprovable. This is clean, but it bounds convergence by how much reversibility the system can prove.

5. Memory System to Commitment System (actually three layers)

Experience is not authorization. Memory converges inputs; crossing an irreversibility boundary is not a memory operation but an AUTHORIZATION operation, and authorization is a stateful object with scope, expiry, and revocability. So the system is three layers:

• Memory — converges the provably-reversible interior (fact reuse) toward zero residual interaction.
• Risk-estimation — computes the reversibility window at the commit site; conservative (unprovable means irreversible).
• Authorization — scoped, expiring grants for crossing an irreversibility boundary; experience never substitutes for it.

The system's real convergence target is the outcome commitment — the target outcome plus the set of irreversibility boundaries (commitment points) on the path. This coincides with the runtime notion of a completion signal, or where the system can no longer act autonomously: the commitment boundary IS that line.

6. Verdict and upgraded thesis

• riskClass CANNOT be static. It must be a function of action, context, and time, computed at the commit site, conservatively.
• The Memory-to-Commitment reframe is correct, but adversarially it is THREE layers (Memory, Risk, Authorization), and its safety collapses onto a partially-undecidable core: reversibility-window prediction.
• Theoretical closure: convergence is fundamentally bounded by the decidability of reversibility. Experience converges the provably-reversible interior toward zero; the irreversible (and the unprovably-reversible) is gated by commit-site runtime risk plus fresh scoped authorization; the convergence ceiling equals how much reversibility the system can prove.

This upgrades the design from a Memory System to a Commitment System: a runtime that accumulates experience but never treats experience as authorization, recomputes risk at every irreversibility boundary at the commit site, and requires fresh scoped authorization to cross it. That is the core of a sovereign execution runtime, not a local memory plus autocomplete.