Part VII — Crisis & Resilience

Derived from Axiom 9 (resilience over elegance), the Charter's crisis doctrine (§I.6), and Criterion 8. This specifies model5's Crisis Defence Council. The governing principle: a crisis is the moment a system either saves itself or destroys itself — it must be able to act decisively and be structurally incapable of using the crisis to seize permanent power.

VII.1 The crisis dilemma

Two failures bracket every emergency:

• Too slow / too weak — the system cannot act, and the crisis does the damage.
• Too strong / unbounded — the system grabs emergency powers and never gives them back. Almost every modern democratic collapse ran through a "temporary" emergency.

This model resolves the dilemma by pre-commitment: the powers, limits, triggers, and exits are all defined in advance and in the open (doctrine), so a crisis activates a prepared, bounded response rather than improvised, unbounded authority. The Charter (§I.6) sets the hard rights limits; this Part sets the machinery within them.

VII.2 The Crisis Defence Council

• A standing, doctrine-bound body that can coordinate fast decisions in a verified genuine emergency.
• Doctrine-bound means it acts only within pre-agreed, published crisis doctrine — it executes a plan the people authorised in calm times; it does not invent new powers under pressure.
• Composition is pre-defined and legitimate (drawn from across branches, not a single office), so crisis authority never collapses into one person's hands.
• Its powers are bounded by the Charter at all times — Class A rights remain inviolable (§I.3), no constitutional change is possible (§I.6.4), and everything it does is logged and reviewable.

VII.3 The Threat Verification Matrix — no manufactured crises

The single most dangerous abuse is a fabricated or exaggerated emergency used to grab power. Therefore emergency powers cannot activate on anyone's mere say-so:

• A claimed threat must be independently verified against a published matrix — multiple independent sources, defined evidentiary thresholds per crisis type, and sign-off by bodies that do not benefit from the emergency.
• Separation of declarer and beneficiary: the body that verifies the threat is institutionally distinct from the body that would gain power from the emergency.
• Verification reasoning is logged to the transparency ledger (subject only to genuinely necessary, time-limited security redaction, itself independently reviewed).

VII.4 The Hardened Decision Council — fast action, hard limits

For decisions that genuinely cannot wait:

• A small, pre-defined decision body acts at speed, strictly within crisis doctrine and the Charter.
• Every act inherits the §I.6 limits: non-derogable rights protected, automatic sunset (default 30 days), no constitutional/electoral change, full logging, mandatory after-the-fact review.
• Decisions are reversible and explicitly time-boxed; nothing done under crisis powers is permanent without subsequent ordinary-process ratification.

VII.5 Continuity of governance — surviving the loss of people

The system must survive decapitation (leaders killed, incapacitated, or compromised) — because a model that depends on specific individuals violates Axiom 8:

• Pre-defined, published succession for every critical office, several deep.
• Distributed authority — no single point whose loss halts governance.
• Geographic and institutional dispersal so a single attack cannot remove the leadership.
• Reconstitution procedures — how to lawfully rebuild institutions if many are lost at once, without that procedure itself becoming a coup route (it is bounded and time-limited).

VII.6 Offline fallbacks and graceful degradation

The system must function when technology fails or is attacked (Axiom 9; §0.6.3 no single point of failure):

• Paper fallback for voting and identity that delivers the same rights (already mandated, §II.1, §II.7) — an election can be run on paper if the digital layer is down or untrusted.
• Manual continuity for critical functions — degraded but functioning, never dark.
• Distributed/federated architecture so local systems keep working if the centre is hit.
• Graceful degradation is a design requirement for every system in Part VIII, tested by drills, not assumed.

VII.7 Crisis types and pre-agreed doctrine

Doctrine is written in advance for each foreseeable crisis class, so response is prepared, not panicked:

VII.8 Ending the crisis

Exits are as defined as entries — because the failure to end an emergency is itself the abuse:

• Automatic sunset ends powers by default; only an Assembly supermajority can actively renew (§I.6.3). Inaction terminates the emergency.
• Mandatory post-crisis public inquiry — independent, with teeth — examines whether powers were justified and proportionate, and holds abusers accountable.
• Restoration of any paused rights/processes is automatic and verified.

VII.9 Failure modes and safeguards

Part VII ends. Next: Part VIII — The Digital & Technological Layer, the substrate that makes verifiability, identity, and resilience real.