§27. Risk Analysis & Failure Modes

Jason St George. "§27. Risk Analysis & Failure Modes" in Next Generation Stores of Value: Privacy, Proofs, Compute. Version v1.4. /v/1.4/read/part-vi/27-risk-analysis/

§27. Risk analysis & failure modes

The risks to this emerging triad are not merely technical; they are structural, political, and economic, each capable of undermining the credibility that makes these systems valuable. The same telemetry that defines the adoption curve also serves as an early-warning system: if those metrics drift, the thesis degrades.

Technical risk: proof systems, hardware, and protocol bugs. Proof systems can break or be attacked; hardware profiles can be compromised; protocols can have consensus or bridge flaws. These map directly to:

• Proof system failures. A SNARK/STARK is broken or a major exploit appears. Mitigation: multi-ZK support; tagging proofs with system/parameter IDs; migration paths; ability to risk-flag, apply collateral haircuts, and impose prospective ineligibility on Work Credits tied to compromised systems.

• Hardware capture. A major fab or TEE platform is found to have a backdoor. Mitigation: Layer-0 profiles, lot sampling, open hardware alternatives, ability to deprecate profiles and redistribute workloads.

• Protocol bugs. Consensus bugs, bridge flaws, privacy leaks. Mitigation: reference implementations, staged rollouts, aggressive testing, incident response and rollback procedures at Layer 6.

Technical failures are unavoidable; the question is how contained and observable they are. In telemetry, these show up as spikes in failure rates, incident reports, profile deprecations, and temporary VerifyPrice/Settle deviations.

Verification cost creep. Verification cost creep remains the most immediate systemic hazard: if verifying proofs ceases to be much cheaper than producing them, the entire asymmetry collapses and PoUW or zkML schemes regress into centralized trust or brittle heuristics. In terms of VerifyPrice, this shows up as rising p95_t(W), rising p95_c(W), and a verification ratio r(W) that drifts upward over time. It can be mitigated only by rigorous measurement (publishing open VerifyPrice dashboards that expose verifier latency, cost, and failure rates) and by prioritizing constructions with tight, transparent asymptotics such as MatMul-PoUW.

Centralization and chokepoints. Centralization risks follow closely behind. When specialized hardware, opaque broker networks, or closed-access prover routers dominate, neutrality erodes and the system devolves into the same gatekeeping it was meant to escape. In telemetry, this looks like:

• concentrated facility IDs in FERs;
• a small set of hardware profiles dominating receipt volume;
• broker/router addresses capturing a rising share of flow;
• increasing entry latency for new provers, miners, LPs, or mirrors.

Open admission for provers and miners, auditable broker logic, and anti-Sybil defenses that don’t re-introduce permissioning are essential; live decentralization metrics (validator/miner weight concentration, router/mirror house share, regional VerifyReach(N,R)) should be continuously monitored.

Economic risks: fee death-spirals and incentive misalignment. If demand falls, fees can collapse, security budgets shrink, and the network becomes easier to attack (a classic fee death-spiral). If rewards are tied only to volume, not to SLOs, operators may cut corners on security or decentralization: an incentive misalignment.

• In telemetry and receipts, a death-spiral looks like: sustained low fee revenue from real workloads, rising share of security budget funded by pure issuance, and declining usage of canonical workloads.

• Incentive misalignment shows up as: SLO breaches (VerifyPrice and VerifySettle routinely outside targets) with no corresponding slashing or reputational penalty; growing mismatch between Work Credit issuance and actual workload utilization.

Mitigations include conservative base issuance, fee designs that do not rely on perpetual mania, Work Credits that encode long-term demand for triad capacity, and reward mechanisms explicitly keyed to SLO performance (VerifyPrice, VerifySettle, decentralization), not just throughput.

Regulatory choke points and fractured demand. Regulatory choke points threaten to fracture demand. If privacy or proof tokens cannot be settled into BTC or fiat, even via non-custodial rails, the market fragments and liquidity thins. In VerifySettle(C) this appears as falling success(C), deteriorating refund_safe(C), and widening tails in p95_t(C) whenever there is regulatory noise. The antidote is auditable, user-friendly adaptor-signature swap UX paired with transparent settlement analytics and demonstrably compliant provenance for regulated contexts. Mitigation is architecture, not lobbying: lawful privacy corridors, receipts, and analytics (disclosure without doxxing) let large treasuries use privacy rails while remaining auditable.

Repression toolkit and macro-financial engineering. It will be mandatory for a repression toolkit to anticipate interest-rate caps/YCC on the curve; mandated holdings for banks/pensions/insurers; administered deposit rates; macro-prudential rules that prefer sovereign collateral; capital movement frictions. Historically, this mix delivered negative real rates for long stretches and capital losses when caps broke. In telemetry, you will see this as pressure on on/off-ramps, attempts to preference certain collateral types, and policy shocks to corridors.

Design the network so that no coupon can be capped and no single chokepoint can gate settlement or proving markets; measure resilience with admission latency, house-share, swap telemetry, and the fraction of settlement and proving volume that remains non-custodial and cross-jurisdictional.

Political risk: bans, sanctions, and narrative war. Some of the sharpest risks are explicitly political:

• Bans & sanctions. Jurisdictions may declare privacy assets illegal, sanction contracts, or criminalize the use of certain clients. Mitigation: jurisdictional diversity (labs, foundations, hardware profiles, LPs); client modes that degrade gracefully (offline, mesh, sat-links); legal defense resources; and a clear separation between core protocol and specific front-ends so that UI bans do not equal protocol death.

• Info-ops and framing. Media and governments can frame the stack as “criminal tech” or “national security threat.” Mitigation: lawful-privacy narratives grounded in receipts and compliance primitives; visible legitimate use cases (payroll, provenance, AI verification, critical-infrastructure audit trails); and an insistence on evidence (“show the receipts”) rather than slogans on both sides.

• Regulatory choke points at the edge. App stores, banks, and ISPs can be pressured to block access even when the protocol is neutral. Mitigation: the Layer-1/2 work described earlier (alternate transports, side-loading, content-addressed and offline distribution) so that no single storefront, bank, or carrier can become a kill switch.

Political risk cannot be “engineered away.” It must be distributed and prepared for: diversified jurisdictions, many independent implementations, multiple access paths, and a culture that expects (and drills) for attempted bans and smear campaigns rather than treating them as unthinkable.

Spec drift, vaporware, and scoreboard capture. Spec drift and vaporware can hollow out trust long before censorship does. Whitepapers without shipped code or inflated performance claims corrode the ecosystem’s credibility. In metrics, this shows up as:

• a widening gap between claimed and measured VerifyPrice(W);
• a mismatch between Work Credit issuance and actual workload utilization;
• chains with high market caps and low receipt volume;
• clients that are nominally “live” but barely process real workloads.

Active liveness tracking (clients, explorers, throughput under real load, settlement safety metrics) should replace social metrics or TVL as the industry’s scoreboard. Projects that publicly document testnet-to-mainnet milestones and publish SLOs and incident reports exemplify the discipline needed to maintain confidence as this new monetary substrate matures.

No dashboards, no trust. If VerifyPrice, swap success and refund safety, decentralization telemetry, and corridor health are not public, treat claims as unpriced risk. A system that refuses to show its receipts is asking you to underwrite the very soft guarantees this thesis is designed to escape.

Scoreboard capture in the Market Realization Plane. Scoreboard capture has a financial-product form as well as a protocol form, and it is the more seductive of the two. A product industry under competitive pressure increasingly asks “what ticker might catch a flow?” rather than “what does the investor actually need,” with capital chasing realized performance and sponsors launching ever more specialized wrappers. The result is a scoreboard on which a wrapper can be a triumph while its holders are destroyed — reverse splits keep the share price presentable, new inflows replenish assets, and fees keep accruing to the sponsor (§23.1.1, Capital Survival Ratio).

Definition: Scoreboard Capture, extended. Scoreboard capture occurs when product AUM, market capitalization, launch count, or trailing returns substitute for measurement of whether capital survived, native services were used, and the monetary loop functioned.

The countermeasures are the Capital Survival Ratio, the Wrapper–Native Growth Gap, and Native Use Share (§23.1.1). None of them can be gamed by launching another product.

27.1 Red Lines: When the SoV Thesis Fails

The thesis is falsifiable. Including explicit kill criteria increases trust because it shows we’re not writing an unfalsifiable manifesto. If any of the following conditions persist without credible remediation, the store-of-value claim for the triad is no longer defensible:

Red Line 1: Verification Affordability Breaks

Condition: Physical VerifyPrice p95 exceeds SLO bounds for core workloads (PROOF_2^20, MATMUL_4096, SETTLE_ATOMIC) for ≥3 consecutive months, with no credible remediation path published.

Why it kills the thesis: “Anyone can verify” is the hinge. If verification becomes expensive or slow, proofs become platform claims, not public facts. The asset reverts to “trust the prover.”

Red Line 2: Refund Safety Breach

Condition: Corridor refund_safe < 100% on any admissible route, with repeated (not isolated) incidents and no automatic delist + remediation.

Why it kills the thesis: Non-custodial settlement is the “Private Money” foundation. If funds can be locked or lost, corridors become custodial in practice. The asset reverts to “trust the LP.”

Red Line 3: Verification Monoculture

Condition: >70% of verifications or proof production on a single hardware profile, TEE vendor, or jurisdiction for ≥3 consecutive months.

Why it kills the thesis: Decentralization is not ornament; it’s what makes the system neutral. Monoculture means “trust the dominant vendor”—exactly what Layer 0 exists to prevent.

Red Line 4: Telemetry Capture

Condition: Receipt datasets become unavailable, unverifiable, or controlled by a single party. Dashboards go dark during crises or produce results that independent recomputation cannot reproduce.

Why it kills the thesis: “No dashboards, no trust” requires dashboards to be honest. If telemetry can be captured, the entire observability regime is theater.

Red Line 5: Fee Coverage Collapse

Condition: Fee+burn coverage falls below 10% of security budget and workload mix becomes >80% speculative for ≥12 months.

Why it kills the thesis: The SoV story requires structural demand, not pure narrative. If no one is buying capacity for real work, the asset is just another speculative token.

Red Line 6: Value Capture Failure

Condition: Triad usage grows (proof volume, settlement volume, compute demand) but native-asset fee volume, burns, collateral lockups, and fee coverage do not grow with it for ≥12 months.

Why it kills the thesis: The system may be useful infrastructure but not a store-of-value asset. Users are consuming triad capacity through bypass channels.

Red Line 7: Legal Incompatibility

Condition: Lawful users in major jurisdictions cannot use privacy rails without unacceptable compliance uncertainty for ≥12 months, and no lawful-privacy patterns (viewing keys, scoped disclosure) are adopted.

Why it weakens the thesis: If regulated actors cannot participate, the ‘Private Money’ leg loses its institutional constituency and anonymity sets shrink.

Red Line 8: Governance Capture

Condition: Governance can alter issuance schedules, fee routing, or telemetry rules without hard constitutional constraints, timelocks, or supermajority requirements.

Why it kills the thesis: If insiders can redirect value away from holders or inflate supply at will, the asset is a platform token, not a store of value.

Red Line 9: Wrapper Dominance Becomes Monetary Substitution

Condition: Wrapper Dominance Ratio (§6.4) rises for ≥2 consecutive quarters while native fee share, private settlement volume, and collateral lockups stagnate or decline. In its full form: custodial and synthetic exposure (CCR, SER) becomes the dominant form of ownership for a sustained period while protocol-native fees, burns, collateral, private settlement, proof demand, and verified-compute usage remain stagnant or declining, with a persistently positive Wrapper–Native Growth Gap (§23.1.1).

Why it weakens the thesis: Price rises while the monetary thesis dies. Government-approved wrappers becoming the dominant institutional form is co-option without censorship. The asset may remain a successful financial product, but the claim that it functions as a native store of value for Privacy, Proofs, and Compute is no longer supported by anything except its chart.

Red Line 10: Physical Infrastructure Opacity

Condition: Physical VerifyPrice (§19.7.4) exceeds threshold, or Facility Capacity Receipt data is unavailable or unverifiable for a material share of active capacity, for ≥2 consecutive quarters.

Why it kills the thesis: Layer 0 claims become trust-me claims; Work Credits lose infrastructure credibility.

Red Line 11: AI Enclosure

Condition: Top-3 hyperscalers, closed TEEs, or a single jurisdiction exceed a threshold share (e.g., >50%) of VerifyPrice-tracked verified compute capacity, i.e., the Enclosure Risk Flag (§4) triggers and persists.

Why it kills the thesis: AI Money becomes a cloud IOU; the frontier is enclosed rather than homesteaded.

Red Line 12: Agency Failure

Condition: Forced Disclosure Incidence (§24.1.2) becomes systemic, or participation/agency use cases (§2.4) fail to materialize while institutional usage grows, for ≥12 months.

Why it kills the thesis: Lawful privacy collapses socially, or the protocol serves institutions but not users — violating the ninth SoV requirement (§3). Emergency governance becoming routine is a related failure: neutrality decays into foundation fiat.

Red Line 13: Energy Sovereignty Failure

Condition: Network capacity-weighted sovereign optionality (O_s^net, §14.9) falls below threshold for ≥ 2 consecutive quarters, or more than a threshold share of VerifyPrice-tracked capacity is sited in jurisdictions with an active curtailment or power-rationing regime.

Why it kills the thesis: Verification affordability becomes a sovereign policy variable rather than a market outcome. Red Line 1 becomes externally triggerable — an adversary or host state can break the hinge without touching the cryptography, the governance, or the market. This is a qualitatively different failure from the rest of the set: every other red line requires breaking something the stack is watching; this one adjusts a parameter the thesis had classified as an environmental constant.

Relationship to RL10: Red Line 10 is opacity — we cannot see the physical substrate. Red Line 13 is fragility — we can see it clearly and it is bad. They must not be merged: a system can be perfectly transparent about being catastrophically fragile.

Pattern: The red line is not “bad thing happens once.” It is “sustained breach + no recovery.” Isolated incidents with rapid remediation are expected in any complex system. Persistent degradation without response is thesis failure.

What happens at a red line:

These are not punishments—they are truth in advertising. An asset that claims SoV properties must demonstrate them. If it can’t, it should stop claiming.

27.2 Market Realization Warnings

Red lines are protocol failures. The Market Realization Plane generates a second, weaker class of signal that must not be confused with them. A wrapper unwind can destroy price without damaging protocol function at all; treating that as thesis falsification would be as sloppy as treating a rally as confirmation. The distinction:

• Monetary red lines (above) mean the protocol’s monetary claim has failed: verification breaks, settlement safety breaks, native value capture fails, issuance becomes discretionary, censorship routes dominate, or native use can be bypassed.
• Market realization warnings (below) mean price has become an unreliable signal. They do not necessarily kill the protocol; they suspend the right to cite price as evidence about it.

Warnings trigger when:

1. A statistically significant break appears in holder flow elasticity.
2. Net mechanical gain $\kappa$ changes sign.
3. The Mechanical Pressure Ratio exceeds pre-declared market-depth bounds.
4. Wrapper creations dominate native spot demand.
5. Dealer swap capacity appears to bind.
6. Exposure migrates from swaps toward options.
7. Recursive leveraged wrappers appear.
8. Top wrappers or dealers exceed concentration thresholds.
9. The Wrapper–Native Growth Gap stays elevated.
10. Price rises while native fees and receipt volume fall.
11. Price falls while native monetary health improves.
12. Cross-jurisdiction hedges produce halt or settlement asymmetries.

The correct response to a warning is not intervention. It is epistemic: publish the warning, state which flow term is dominating, and stop using price as evidence in either direction until it clears. Governance must specifically not respond to warnings by inflating issuance, subsidizing price, or buying back supply — those are the reflexes of an entity managing a stock price, not operating a monetary constitution.

Tip: hover a heading to reveal its permalink symbol for copying.