Part XVI, Adversarial Analysis

This is the robustness test the design sets itself (§0.6). Every adversary is named, each attack is mapped to the safeguards that answer it, and then combined red-team scenarios are run, because real attacks come sequenced and simultaneous, not one at a time. The Part closes with an honest statement of residual risk, because a design that claims zero weaknesses has stopped being credible (§0.6.5). The analysis covers the whole model, Parts 0–XIX — including the operating model (the AI Router and the citizen levers, §XIX) and the transition (§XV), the components that carry the most attack surface and that an earlier draft of this Part had not yet tested.

XVI.1 Method

1. Name the adversaries in advance (§XVI.2), you cannot defend against threats you refuse to name.
2. Map attack → mechanism → safeguard(s) (§XVI.3), each safeguard tracing to an earlier Part.
3. Red-team combined scenarios (§XVI.4), sequenced, multi-vector attacks, the realistic case.
4. State the meta-defence (§XVI.5), defence-in-depth: no single safeguard is load-bearing.
5. State residual risk honestly (§XVI.6).

XVI.2 The adversary catalogue

Every governing system is attacked by some subset of these. This model is designed against all of them at once:

1. Elite capture, the wealthy/powerful bend the system to themselves.
2. Corporate capture, industry captures its regulators and policy.
3. Foreign interference, a hostile state subverts elections, decisions, or infrastructure.
4. Populist subversion, a demagogue uses legitimate routes to dismantle the checks (the modern pattern: Hungary, Venezuela, etc.).
5. Administrative / expert self-dealing, the insiders entrench and enrich themselves.
6. Partisan capture, one faction seizes the machinery of state.
7. Cyber-attack, technical subversion of the digital layer.
8. Disinformation / information warfare, distort the mandate with lies and synthetic media.
9. Tyranny of experts, technocratic drift; rule by an unaccountable clever few.
10. Tyranny of the majority, 51% oppress a minority.
11. Corruption, money buys outcomes.
12. Fiscal looting, present majorities loot the future via debt and hidden liabilities, or money is printed for political gain.
13. Security-state capture / coup, the instruments of force (military, police, intelligence) are turned against the constitution.
14. Territorial destabilisation, secession crises or national grievances are exploited to fracture the Union.
15. Demos manipulation, rig who belongs/votes (citizenship-stripping, ethno-nationalist redefinition) instead of rigging the count.
16. Emergency abuse, a crisis becomes permanent power.
17. The guardian regress, who guards the guardians; the watchers are captured.
18. Gradual erosion, death by a thousand cuts; the slow, lawful hollowing-out that kills modern democracies.
19. Enforcement defiance, a captured power simply ignores the rules ("make me").
20. Router / classifier capture, mislabel value questions as "technical" at machine scale to wall them off from the people (the operating layer, §XIX.3).
21. Guardian collusion / convergence, the checking bodies quietly align through shared personnel, worldview, and information, so "independent" checks become correlated.
22. Lever weaponisation, abuse the citizen levers (veto / initiative / Pause) to paralyse competent execution, or game identity issuance to move every threshold.
23. Legitimacy collapse & technical failure (named in §0.6.2), loss of consent, or failure of the digital substrate, answered by the consent, resilience, and verifiability machinery throughout.

This catalogue is a strict superset of the §0.6.2 adversary set: every §0.6.2 adversary (including "legitimacy collapse" and "technical failure") maps to an entry here, restoring the traceability §0.7 requires.

XVI.3 Attack → safeguard map

XVI.4 Red-team scenarios (combined, sequenced attacks)

Real adversaries combine vectors. Each scenario is run to its conclusion.

Scenario A, The charismatic strongman

A populist wins a large Assembly majority and sets out to dismantle the checks.

• Rewrite the Charter → blocked: two-thirds + referendum + 12-month cooling-off + Citizens' Assembly review (§I.9.1); the super-entrenched core is changeable only by the extraordinary cross-generational route (§I.9.3), far beyond a strongman's reach.
• Pack or cow the Court → blocked: independent, term-limited appointment; removable only for cause; overruled only by the people (§IX.4).
• Ram through harmful law → the Sortition Chamber forces reconsideration (§IX.2); the Court strikes rights breaches (§I.8).
• Manufacture an emergency to suspend elections → blocked by threat verification, no-constitutional-change-in-crisis, auto-sunset, no-election-cancellation ceiling (§VII.3, §I.6).
• Defund the watchdog / capture the media → integrity funding is constitutionally guaranteed (§VI.2); press independence and anti-monopoly are protected (§IX.7).
• Order the police/army to enforce a power-grab → they are sworn to the Charter, not to him, and are bound to refuse unlawful orders (§XIV.4, XII.5).
• Outcome: the strongman can govern within the mandate but cannot dismantle the system. The legitimate route to autocracy is closed by construction.

Scenario B, The hostile foreign power

Disinformation + cyber-attack + a funded candidate to swing an election. → foreign/anonymous money banned, donations transparent, spending capped (§III.7); deepfakes met with rapid independent rebuttal and foreign-op disclosure, provenance helps but is not relied on (§III.8), and, decisively, a fabricated clip cannot alter an end-to-end-verifiable, paper-backed count (§VIII.3); offline fallback covers a downed digital layer (§VII.6). Outcome: each vector independently defended; success requires defeating all at once, and the one that matters most, the count, is the hardest of all to fake.

Scenario C, The captured domain

A corporation and a clique of experts capture a domain. → capturing appointments requires defeating four independent stages at once (§IV.4); self-dealing is caught by procurement forensics, anomaly detection, beneficial-ownership transparency, and the spend ledger (§VI.5, X.7); concealment fails against the transparency ledger, open algorithms, and citizen-jury audit (§VI); acting beyond remit is void (§IV.6). Outcome: capture is detectable, reversible, and personally costly, expected value negative.

Scenario D, The manufactured emergency

An office-holder declares a crisis to seize power. → cannot self-certify: the threat must clear the Threat Verification Matrix with declarer ≠ beneficiary (§VII.3); powers auto-sunset; no constitutional/electoral change is possible in emergency; a mandatory inquiry with accountability follows (§VII.8, §I.6). Outcome: the emergency route to permanent power is closed.

Scenario E, Death by a thousand cuts

No coup, patient, lawful erosion: defund the watchdog, weaken a transparency rule, pack a board over years. → integrity funding is constitutionally uncuttable (§VI.2); checks are Charter-level, beyond ordinary legislation, and amendment needs the full §I.9 gauntlet; staggered terms + multi-stage appointment + citizen-jury oversight resist slow packing; the un-bypassable scrutiny guarantee (§IX.2) blocks the "ram it through without scrutiny" tactic that is the clearest early marker of backsliding; and continuous rubric scoring plus explicit backsliding indicators (§VI.7, XVII) make decline measurable and public, erosion shows on a dashboard, triggering Review·Pause·Correct and press/public attention before it is fatal. Outcome: the slow attack that kills other systems is here entrenched against, citizen-watched, and measured in public, though, honestly, never fully solvable against a patient faction and a passive public (§XVI.6).

Scenario F, The coup / security-state seizure

A faction (in or out of office) attempts to seize power through the instruments of force, or a captured executive turns the security state on opponents.

• Command the military/police against the constitution → forces are sworn to the Charter and the people, not to any leader (§XII.5, XIV.4); an unconstitutional order is unlawful and must be refused; refusal is protected duty, obedience is the offence.
• Use the intelligence services domestically → barred; intrusive powers need prior judicial warrants; no mass surveillance (barred by law and warrant; unlinkable identity removes one linkage vector, §XII.4, §VIII.2); cleared oversight with real access; internal whistleblower channels (§XII.4).
• Just ignore the Court → distributed loyalty means the instruments of enforcement won't act for him; the integrity body, press, and citizen juries raise the alarm; illegitimate power forfeits the duty of obedience and the informed citizenry is the final backstop (§XIV.4).
• Outcome: a coup requires the simultaneous, active disloyalty of forces trained and sworn to refuse it, the design removes the obedient instrument every coup needs.

Scenario G, Fracture the Union

A hostile actor (foreign or domestic) inflames national grievance to break the UK apart, or a captured centre provokes secession by overreach. → the territorial settlement is codified, consented, and equalised, with grievance-reducing fiscal solidarity (§XI.3-7); a lawful, dignified self-determination route (§XI.5) converts existential crisis into a known, deliberative procedure that cannot be triggered by transient anger; each nation runs the full model, so none is governed without consent (§XI.4). Outcome: the Union holds by consent and process, not by either coercion or panic.

Scenario H, Capturing the boundary machine (the operating layer)

A faction tunes the AI Router so contested value questions are quietly classified "technical" and routed to friendly expert boards, at scale, on the long tail no one appeals. → the Router is rule-based where it can be (the scale limb) and a flagging aid on the contestable limbs, barred from being a learned/opaque model (§VIII.5); for a top-materiality tier a screened panel of the Sortition Chamber must affirm by blind re-classification before it binds (near-threshold and constitutional-magnitude calls default upward), the rest batch/sampled on an affirm-or-lapse window; a stakes-weighted escalation metric anchored to that panel's re-classification rate catches a wrong level, not only a downward drift; and the Router's author, deployer, and evaluator are institutionally separate from the affirming panel. Outcome: the classifier cannot be silently biased — a born-captured Router shows as a wrong level against the blind baseline, and no single actor holds the roles. Honest residual: the judgement limbs are irreducibly judgement (that is why a human panel decides), so the safeguard is the panel's independence and adversarial briefing, not a pretence that the whole test is a mechanical rule.

Scenario I, Rigging the lot

Bias the sortition draw, or its strata, to seat friendly citizens across the appointment panels, the Sortition Chamber, the oversight juries, and the constitutional-convention procedure at once (a common-mode failure). → every draw uses a public, tamper-evident randomness beacon and is reproducible by any citizen from the published roll and open algorithm (§VI.3a); the strata are set by an entrenched adversarial process, not the body being seated; and the distinct bodies use independently administered draws. Outcome: a rigged draw is publicly detectable (it does not reproduce), and no single selection mechanism feeds every check. Residual: opt-out bias in who serves, corrected statistically and measured.

Scenario J, The guardians converge

Not a conspiracy but a drift: the Court, the Integrity bodies, the expert boards, and the Router's governance come to share a professional-class worldview and personnel, so the "independent" checks stop checking each other. → the meta-defence (§XVI.5) is a statistical argument that holds only if the defences are uncorrelated, so the design bounds the correlation directly: mandatory viewpoint/background diversity across guardian bodies, not only within (§IV.3); inter-guardian revolving-door bans and lifetime caps so the same people do not recirculate through every role (§VI.1, §IV.7); forbidden shared secretariats/briefers among bodies meant to check each other; and a standing concordance audit treating agreement-where-you-expect-friction as a red flag. Outcome: convergence is made visible and structurally resisted. Honest residual: a society-wide elite consensus is the hardest case, answered ultimately by the elected chamber, the lot, and an engaged public — never fully by structure.

Scenario K, Weaponising the people's levers

A well-funded interest, a populist movement, or a foreign operation floods the veto / initiative / Pause machinery to paralyse sound technical delivery, or games identity issuance to move thresholds. → the escalation and Pause triggers carry a vexatious filter, repeat-challenge cooling-off, and a "no re-trigger without materially new grounds" rule (§V.4.4); reversible decisions proceed pending the vote and the rate-limiter blocks grind-down re-vetoes (§XIX.9); the whole-electorate approval-quorum floors defeat a mobilised minority (§XIX.5); and multi-party issuance plus a publicly-reconciled roll stop the issuer moving the denominator (§VIII.2). Outcome: the levers stay usable by the public but cannot be turned into a denial-of-service on government. Residual: the responsiveness-vs-obstruction balance is a live tuning problem, tracked as a backsliding indicator.

XVI.5 The meta-defence, defence-in-depth

The model never relies on a single safeguard. Every adversary meets multiple, independent defences from different branches (constitutional, judicial, integrity, democratic, fiscal, security, technological, civic). To capture the system, an attacker must defeat the Charter's entrenchment and the Court and the Integrity bodies and the citizen juries and the sortition chamber and the free press and the independent fiscal/monetary authorities and forces sworn to the constitution and the transparency that makes the attack visible and the engaged citizenry, simultaneously and undetected. The design makes that combination infeasible, which is the operational meaning of robustness in this model.

The correlation caveat (why this is an honest argument, not a slogan). Defence-in-depth is a statistical claim that only holds if the defences are genuinely independent. Where they could become correlated — shared personnel, a shared information source, a single sortition-selection mechanism, one AI classifier feeding every route — the argument weakens, so the design attacks the correlation directly (Scenarios I, J): verifiable independent draws (§VI.3a), cross-body diversity and inter-guardian revolving-door limits (§IV.3, §VI.1), a Router affirmed by a screened, separately-briefed panel of the Sortition Chamber (§XIX.3), and a dissent-integrity audit. Robustness here means many uncorrelated defences, and the model now defends that "uncorrelated" explicitly rather than assuming it.

XVI.6 Residual risk, stated honestly

No system is perfectly secure, and claiming otherwise is itself a failure (§0.6.5). The honest residuals:

1. The ultimate backstop is an engaged, informed citizenry. No paper safeguard survives a large, sustained, popular movement to end the system, nor should it (Axiom 1). Mitigation: civic education, transparency, and measured outcomes that keep consent informed (Parts II, VI, XIV), not a lock against the people themselves.
2. Appointment remains a residual surface. It is now harder to capture, a sortition citizen-panel sits inside the process (its membership unknowable in advance) and completed appointments are audited retrospectively (§IV.4, §VI.3), but sustained, coordinated, long-horizon capture is still the hardest residual. The backsliding evidence is clear that no mechanism closes it entirely; mitigation is rotation, transparency, and continuous scoring.
3. Remote voting is deliberately limited because the coercion/malware problem is unsolved (§VIII.3), a real constraint on convenience, accepted to protect integrity.
4. Transition is hard, slow, and expensive (Part XV) and can fail at the ballot, a legitimate, if disappointing, outcome.
5. Complexity is a cost (Criterion 11), mitigated by the plain-English duty and civic education but real.
6. The militant-democracy balance carries two-sided risk (§XIV.3), erring toward freedom risks tolerating a genuine threat; the design accepts this lesser risk and leans on structure rather than bans.
7. The boundary machine and the lot are defended, not perfect. The Router is rule-based, citizen-affirmed, and drift-monitored, and the lot is verifiable — but a rule set can carry a subtle value tilt, and participation/opt-out bias in who serves is real. Both are made visible and challengeable, not eliminated (Scenarios H, I).
8. Guardian convergence is bounded, not abolished. Cross-body diversity, inter-guardian revolving-door limits, and a concordance audit resist elite drift, but a society-wide consensus is answered ultimately by the elected chamber, the lot, and an engaged public — not by structure alone (Scenario J).
9. The people's levers trade responsiveness against obstruction. Anti-abuse controls keep them usable without enabling denial-of-service, but the exact tuning is a live, measured balance (Scenario K).

These residuals are carried forward into the scorecard (Part XVII), openly.

Part XVI ends. Next: Part XVII, the honest self-scorecard against the §0.4 rubric, now covering the whole model.