strategy/sovereign-correctness-brief-draft

docs/strategy/DRAFT-design-partner-matrix.md

@@ -0,0 +1,43 @@
+> ⚠️ **UNAPPROVED DRAFT — strategy brief, not endorsed.** Working analysis produced in a
+> 2026-07-02 session. Scores are structured estimates, not validated facts. Do not cite or
+> act on without review. See `README.md` in this folder.
+
+# Design-partner selection matrix — regulated vertical × localization force × our fit
+
+**Purpose:** pick the *one* first design partner to validate the open risk — is *correctness attestation* a felt buyer need today?
+**Method:** 6 vertical×region cells where hard localization bites, scored 1–5 on 5 weighted dimensions. Scores are structured estimates; items marked ⚠ are assumptions to verify with the partner.
+
+## Scoring dimensions (weights sum to 100)
+
+| Dim | Weight | What it measures |
+|---|---|---|
+| Localization force | 25 | How *legally compelled* in-border processing is (hard mandate vs. transfer-permitting) |
+| Correctness pain | 25 | How acutely the vertical feels "is the answer right" — our unique wedge |
+| Our asset fit | 20 | Existing assets/brains we can move with *now* |
+| Verified-compute differentiation | 15 | Where the dimensional/correctness gate visibly outclasses TEE-only |
+| Entry speed / capital | 15 | How fast + funded the buyer is (design partner ≠ full procurement) |
+
+## The matrix
+
+| Vertical × Region | Loc. force (25) | Correctness pain (25) | Asset fit (20) | VC diff (15) | Entry/capital (15) | **Weighted** |
+|---|---|---|---|---|---|---|
+| **Finance — Gulf (SAMA/UAE)** | 4 | 5 | 3 ⚠ | 5 | 5 | **4.35** |
+| **Finance — India (RBI)** | 5 | 5 | 4 | 5 | 2 | **4.35** |
+| **Health — Indonesia** | 5 | 5 | 3 | 4 | 2 | **4.00** |
+| **Finance — Brazil (open finance)** | 3 | 5 | 3 | 5 | 3 | **3.80** |
+| **Health — EU (EHDS)** | 4 | 5 | 3 | 4 | 2 | **3.75** |
+| **Gov/Sovereign — EU** | 5 | 3 | 2 | 3 | 2 | **3.15** |
+
+## Recommendation: Finance — Gulf (Saudi SAMA / UAE)
+
+Finance-Gulf and Finance-India tie at the top on the axes that make the *thesis* true (localization + correctness + differentiation). The tiebreak is **Entry/capital (5 vs 2)** — and for a *design partner* (not a TAM play) that is the dimension that matters most: you want a fast, funded, motivated first reference, not the biggest market.
+
+- **Why Gulf wins the tiebreak:** sovereign buyers are capital-rich, move fast, and have an explicit AI-sovereignty appetite right now (Confidential Computing Summit 2026 is themed *"AI Sovereignty"*). They will co-fund a lighthouse.
+- **Why finance, not health:** finance's correctness pain is *numeric* — valuation, risk, regulatory reporting — which is exactly where the dimensional/sympy correctness gate visibly beats TEE-only confidentiality. Health's pain is real but the medicine brain isn't launched, and health procurement is slower.
+- **Our asset:** `economic-prophet` (the canonical economic engine) + the Sloan/econ finance brain are the strongest existing fit — bind, don't reinvent.
+
+**#2 / scale-up target:** Finance-India (same top score, larger TAM, but slower and price-sensitive — pursue after the Gulf lighthouse proves the "correctness" wedge).
+
+## Honest caveats (verify with partner, don't research further)
+- ⚠ Gulf asset-fit scored 3 on an assumption of *no existing regional presence*. If there's a channel/relationship, this jumps to 4 and the recommendation strengthens.
+- The whole exercise rests on the still-open risk: that "correctness attestation" is felt *today*. The Gulf lighthouse *is* the test of that risk — a passing correctness gate on a regulatory-reporting or risk-valuation workload is the falsifiable proof.

docs/strategy/DRAFT-gulf-finance-lighthouse-brief.md

@@ -0,0 +1,79 @@
+> ⚠️ **UNAPPROVED DRAFT — strategy brief, not endorsed.** Working analysis produced in a
+> 2026-07-02 session. Assumes an unconfirmed Gulf channel; success metrics are proposed, not
+> agreed. Do not cite or act on without review. See `README.md` in this folder.
+
+# Gulf-Finance lighthouse brief
+
+**Design partner:** a SAMA (Saudi) or UAE-central-bank–regulated bank
+**The bet being tested:** that *correctness attestation* — proving a computation is **right**, not just that it ran privately — is a felt buyer need **today**, not ahead of the market.
+**Binds to:** `economic-prophet` / `open_ep_framework` (do not reinvent). **Runs in-region.** **Emits evidence on the reasoning spine.**
+
+---
+
+## 1. Why this cell (recap)
+
+Finance-Gulf tied Finance-India at the top of the design-partner matrix (4.35) on the thesis-making axes — localization force, correctness pain, verified-compute differentiation — and won the tiebreak on **entry speed + capital**: sovereign Gulf buyers are funded, fast, and have an explicit AI-sovereignty appetite right now. Finance (not health) because its correctness pain is **numeric** — the home turf of the dimensional/sympy gate — and because `open_ep_framework` is our strongest existing asset fit.
+
+## 2. The workload (bound to real modules)
+
+A bank's **regulatory profitability + capital computation** — the numbers it must defend to the regulator — run end to end on the existing engine:
+
+| Regulatory obligation | `open_ep_framework` module | What is computed |
+|---|---|---|
+| IFRS 9 Expected Credit Loss | `expected_loss.py` | ECL = PD × LGD × EAD, staged |
+| Basel III capital charge | `capital.py` | RWA-driven capital requirement |
+| Funds Transfer Pricing | `ftp.py` | risk-adjusted funding cost |
+| Economic profit / RAROC | `product_objects.py`, `attribution.py` | EP after capital charge; return on risk-adjusted capital |
+| Zero-EP / breakeven pricing | `breakeven.py` | the price that makes EP = 0 |
+| Recovery surface | `recovery.py` | LGD recovery modeling |
+| Audit trail | `audit.py`, `validation.py` | the existing evidence surface we extend |
+
+These are exactly the figures a Gulf bank must **prove** to SAMA / the UAE central bank, **in-country**, on a recurring reporting cycle. The pain is not hypothetical — it is a standing regulatory obligation with penalties.
+
+## 3. What the correctness gate proves that TEE cannot
+
+This is the whole wedge. A confidential-computing (TEE) competitor can prove the ECL job *ran privately on unmodified code inside a sealed enclave*. It proves **nothing about whether the ECL number is right**. Our dimensional/sympy correctness gate proves the computation is **valid**:
+
+- **Dimensional consistency** — PD is dimensionless [0,1]; LGD is dimensionless [0,1]; EAD and ECL are currency; the product's units must reconcile to currency. A unit error (e.g. a bps/decimal confusion in LGD) is caught and blocked, not silently reported to the regulator.
+- **Identity/invariant checks** — capital ratios in range, EP = revenue − cost − capital-charge reconciles, breakeven solve satisfies EP = 0 on replay.
+- **Replayable proof** — the gate emits a receipt that lets the regulator (or internal audit) *re-derive* the number, not just trust that it ran.
+
+> **The sentence no hyperscaler can say:** "This ECL/capital figure was computed **where your data is governed**, and here is a **replayable proof that the number is correct** — not merely a proof that it ran privately."
+
+## 4. Sovereignty posture
+
+- Executes at **`locus = trusted_private`** (in-region, in-bank) — reuses the `SyncCycleReceipt.locus` vocabulary already in sourceos-spec.
+- No cross-border transfer of customer/exposure data → satisfies the sector-specific localization that actually binds in the Gulf (SAMA/UAE central bank), independent of the softer transfer-permitting privacy regime.
+- The local model does the reasoning; the correctness gate + canon do the proving. Confidential computing (TEE) is used as the **confidentiality channel**, not the differentiator.
+
+## 5. Evidence emitted
+
+Extend the engine's existing `audit.py` output onto the reasoning-evidence spine:
+- a `ReasoningRun` per computation cycle (status → `completed`/`blocked`),
+- a **correctness receipt** (the gate result) referenced from each reported figure,
+- bound to the existing `policy_simulation_uvmc_audit.json`-style audit artifact.
+This makes the regulatory pack **replayable**, not just signed.
+
+## 6. Falsifiable success metric (this IS the risk test)
+
+The lighthouse succeeds iff **the bank's risk/finance team treats the correctness receipt as decision-relevant** — i.e. one of:
+1. they run a real reporting-cycle ECL or capital figure through the gate and it **catches a defect** they would otherwise have filed, OR
+2. they state the replayable proof **reduces their regulatory-review / audit burden** (a signed statement, not a vibe).
+
+If neither happens, the honest read is that correctness is ahead of the market (the Musketeer risk) — and we learn that from *one* partner in weeks, not from more desk research.
+
+## 7. Thin PoC scope (what to actually build)
+
+Deliberately small — this tests demand, not capability:
+1. Wire the **dimensional/sympy gate** around `expected_loss.py` + `capital.py` (two engines, not all seven).
+2. Emit the **correctness receipt** + `ReasoningRun` from `audit.py`.
+3. Run one **synthetic-but-realistic** SAMA/IFRS-9 portfolio in-region; demonstrate a caught unit/identity defect on a seeded-error variant.
+4. One-page **regulator-facing replay demo**: "here is the number, here is the proof, re-derive it."
+
+Everything else in `open_ep_framework` (FTP, recovery, attribution, UVMC) is out of PoC scope — pull in only after the wedge is validated.
+
+## 8. Honest risks / caveats
+- ⚠ **Assumed no existing Gulf channel.** If there is a relationship, PoC-to-signature compresses sharply. Confirm first.
+- The gate's value depends on the bank's figures having **derivable structure** to check (ECL/capital do; some downstream adjustments are judgmental overlays the gate can't validate — scope to the mechanical core).
+- Sovereign procurement can still be slow even when appetite is high; a **design-partner PoC** (not a sale) is the right first vehicle to stay fast.
+- Regulator acceptance of a "replayable proof" as audit-reducing is itself unproven — success metric #2 is the softer of the two; prioritize #1 (catch a real defect).

docs/strategy/README.md

@@ -0,0 +1,28 @@
+# Strategy briefs — ⚠️ UNAPPROVED DRAFTS
+
+**Status: DRAFT / not endorsed / not decision-authority.**
+
+This folder holds working strategy analysis produced in a 2026-07-02 exploration session.
+Nothing here has been reviewed or approved. Scores, market figures, and recommendations are
+structured estimates and point-in-time reads — **do not cite externally or act on without review.**
+Every file is prefixed `DRAFT-` and carries its own unapproved banner.
+
+## Contents
+
+| File | What it is |
+|---|---|
+| `DRAFT-strategy-memo-sovereign-reasoning.docx` | One-page memo: thesis → live-market retest → seven-ideals capability scorecard → sequenced play → weakest link |
+| `DRAFT-design-partner-matrix.md` | Scored 6-cell vertical×region matrix → recommends **Finance-Gulf** as first design partner |
+| `DRAFT-gulf-finance-lighthouse-brief.md` | The Gulf lighthouse PoC, bound to `economic-prophet`/`open_ep_framework`, with a falsifiable success metric |
+
+## The one thesis they share
+
+The moat is **verified *correctness*** (proving a computation is right), not verified compute /
+confidentiality — which went table-stakes as a ~$16B confidential-computing market in 2026.
+The **Gulf-Finance lighthouse is the experiment that proves or kills** that thesis:
+does a buyer treat a correctness receipt as decision-relevant *today*?
+
+## Related engineering (this repo + prophet-mesh)
+
+- CRDT design that closes local-first ideals 2/4 accretively: `../crdt-over-evidence-fabric.md` (SourceOS-Linux/sourceos-spec#130)
+- CRDT Slice 1 op-emitter: SocioProphet/prophet-mesh#13