Part VII, Crisis & Resilience

Derived from Axiom 9 (resilience over elegance), the Charter's crisis doctrine (§I.6), and Criterion 8. This specifies model5's Crisis Defence Council. The governing principle: a crisis is the moment a system either saves itself or destroys itself, it must be able to act decisively and be structurally incapable of using the crisis to seize permanent power.

VII.1 The crisis dilemma

Two failures bracket every emergency:

• Too slow / too weak, the system cannot act, and the crisis does the damage.
• Too strong / unbounded, the system grabs emergency powers and never gives them back. Almost every modern democratic collapse ran through a "temporary" emergency.

This model resolves the dilemma by pre-commitment: the powers, limits, triggers, and exits are all defined in advance and in the open (doctrine), so a crisis activates a prepared, bounded response rather than improvised, unbounded authority. The Charter (§I.6) sets the hard rights limits; this Part sets the machinery within them.

VII.2 The Crisis Defence Council

• A standing, doctrine-bound body that can coordinate fast decisions in a verified genuine emergency.
• Doctrine-bound means it acts only within pre-agreed, published crisis doctrine, it executes a plan the people authorised in calm times; it does not invent new powers under pressure.
• Composition is pre-defined and legitimate (drawn from across branches, not a single office), so crisis authority never collapses into one person's hands.
• Its powers are bounded by the Charter at all times, Class A rights remain inviolable (§I.3), no constitutional change is possible (§I.6.4), and everything it does is logged and reviewable.

VII.3 The Threat Verification Matrix, no manufactured crises

The single most dangerous abuse is a fabricated or exaggerated emergency used to grab power. Therefore emergency powers cannot activate on anyone's mere say-so:

• A claimed threat must be independently verified against a published matrix, multiple independent sources, defined evidentiary thresholds per crisis type, and sign-off by bodies that do not benefit from the emergency.
• Separation of declarer and beneficiary: the verifier and the body that would gain power from the emergency must have structurally opposed interests and disjoint appointment routes, not merely separate letterheads — a faction that holds both bodies over time satisfies the letter while defeating the purpose.
• *Provenance limb (against the manufactured-genuine crisis). Verification checks not only that the threat is real but, as far as evidence allows, that the beneficiary did not engineer* it: where a body that would gain power had the means and motive to cause the qualifying event, there is a presumption against granting emergency powers pending independent attribution. A fully-published matrix is a specification an adversary can engineer to (a genuine Reichstag fire meets every threshold), so some evidentiary thresholds are kept confidential and independently audited rather than handed to the adversary as a recipe.
• Verification reasoning is logged to the transparency ledger (subject only to genuinely necessary, time-limited security redaction, itself independently reviewed).

VII.4 The Hardened Decision Council, fast action, hard limits

For decisions that genuinely cannot wait:

• A small, pre-defined decision body acts at speed, strictly within crisis doctrine and the Charter.
• Every act inherits the §I.6 limits: non-derogable rights protected, automatic sunset (default 30 days), no constitutional/electoral change, full logging, mandatory after-the-fact review.
• Decisions are reversible and explicitly time-boxed; nothing done under crisis powers is permanent without subsequent ordinary-process ratification.

VII.5 Continuity of governance, surviving the loss of people

The system must survive decapitation (leaders killed, incapacitated, or compromised), because a model that depends on specific individuals violates Axiom 8:

• Pre-defined, published succession for every critical office, several deep.
• Distributed authority, no single point whose loss halts governance.
• Geographic and institutional dispersal so a single attack cannot remove the leadership.
• Reconstitution by a deterministic automaton, not discretion. If many institutions are lost at once, rebuilding follows a pre-defined, no-discretion succession-and-reconstitution automaton — named, geographically dispersed lines several deep — that requires no one to declare themselves in charge. Because the threat-verifiers (§VII.3) may themselves be lost at the moment they are most needed, dispersed reserve verifiers are pre-appointed, so the check against a staged decapitation survives. Any reconstituted authority must (a) log its invocation to the replicated ledger, so a staged decapitation is later provable, and (b) face a mandatory confirmatory election or referendum within a hard, short window, so survivors cannot constitute themselves a self-legitimating junta. "Bounded and time-limited" is thus a mechanism, not an aspiration.

VII.6 Offline fallbacks and graceful degradation

The system must function when technology fails or is attacked (Axiom 9; §0.6.3 no single point of failure):

• Paper fallback for voting and identity that delivers the same outcome integrity and secret ballot — though honestly not the identical property set: a paper count gives risk-limiting-audit assurance, not per-voter cryptographic inclusion proofs, and standing up a national paper election at short notice mid-attack is a logistics operation, not a switch. So the fallback is pre-positioned and funded, not merely asserted: standing paper registers, pre-printed stock, and drilled staff are maintained so it is usable at speed (Axiom 9 forbids a design that only works in ideal conditions).
• Manual continuity for critical functions, degraded but functioning, never dark.
• Distributed/federated architecture so local systems keep working if the centre is hit.
• Graceful degradation is a design requirement for every system in Part VIII, tested by drills, not assumed.

VII.7 Crisis types and pre-agreed doctrine

Doctrine is written in advance for each foreseeable crisis class, so response is prepared, not panicked:

VII.8 Ending the crisis

Exits are as defined as entries, because the failure to end an emergency is itself the abuse:

• Automatic sunset ends powers by default; only an Assembly supermajority can actively renew (§I.6.3), and only up to the hard cumulative ceiling of §I.6.3a — beyond which renewal requires fresh independent re-verification, an escalating threshold, Sortition-Chamber concurrence, and ultimately a referendum. Inaction terminates the emergency.
• Mandatory post-crisis public inquiry, independent, with teeth, examines whether powers were justified and proportionate, and holds abusers accountable.
• Restoration of any paused rights/processes is automatic and verified.

VII.9 Failure modes and safeguards

Part VII ends. Next: Part VIII, The Digital & Technological Layer, the substrate that makes verifiability, identity, and resilience real.