--- # Four Worlds threat model — human mind and civilisational substrate # Simplified view — machine-readable ontology, v1.1.0 # # WHAT THIS IS # v1.0 made a claim checkable: impact lands on a surface; an effect names # a transport and a direction. v1.1 adds Sephirot as nodes, lists the 22 # legal edges, and splits two transports that v1.0 bundled under one name. # # WHAT CHANGED IN 1.1 (revised same day) # (1) Ten Sephirot as nodes. Home world + Meadows rank(s). # Malkuth is one node with three low ranks. # (2) Two transports. world_circulation = up/down between worlds # (old name formative_feedback_loop, retired). # sephirotic_path = an edge from the list of 22. # (3) Netzach and Hod are amplification-control nodes, not "the loop". # (4) A pathway is a set of legal edges, not one line of nodes. # Several walks may run at once. Malkuth (ego system) reads the # container and fans work out along those edges. Nonlinear on # purpose. # (5) Two mapped vectors from the 2026-08-23 exhibits. Paper vector # still reserved. # # WHAT IT IS FOR # A stranger, or a machine, can check a claim made with it. # # Spelling: Sephirot. ASCII ids. # Fortune four-worlds frame is traditional. One sefirah to one world, # and Malkuth carrying ranks 10-12, is a 2026 synthesis. meta: id: four-worlds-threat-model version: 1.1.0 status: release date: 2026-08-30 scope: simplified fragment_class: decision fragment_class_note: > A doctrine artefact: superseded by revision, not falsified by evidence. source_artefact: > v1.0.0 plus lemur47 requirement 2026-08-29 plus Exhibits D and E source_language: English lineage: - version: 1.0.0 date: 2026-08-13 note: four worlds, one surface, one transport, I1-I7 - version: 1.1.0-draft date: 2026-08-29 note: review draft; superseded by 1.1.0 - version: 1.1.0 date: 2026-08-30 note: freeze after review changelog: 1.1.0: > Split transports. Declare Sephirot as nodes. List the 22 Hermetic edges so a walk can be checked. Replace a single pathway.order with nodes + edges + optional walks. Rename loop_control to amplification_control. Map Exhibits D and E. Keep the paper vector empty. Add Assiah preferences. Rename the surface to include illusion system. Split Exhibit E into three walks that share Tiferet. Frozen 2026-08-30 as 1.1.0. classes: World: > A stage of the creative process, modelled as a domain. Only Atziluth is emanation proper. The four are totally ordered and do not overlap. Component: > A structural element. Belongs to exactly one World or one AttackSurface. Holding: > Contents a World carries. Absence means unmodelled, not empty (I6). AttackSurface: > A region where a vector can land. May straddle Worlds. ThreatVector: > An adversary action. One impact. Zero or more effects. Each effect names a transport and a direction. Optional pathway of legal edges. Transport: > Carries an effect. Two kinds: world_circulation (between worlds) and sephirotic_path (one listed edge). Neither is a feedback loop. Sephirah: > A node. A leverage point. An endpoint. Not a loop, and not a world. Path: > One edge between two Sephirot. Classical count is 22. Listed below so I8 can reject a walk that jumps. worlds: - id: atziluth name: Atziluth (Archetypal) stage_order: 1 emanation: true architectural_reading: [entity, model] mind_technology: virtual universe (unconscious) operational_property: purpose — raw material components: - modes_of_thought - behavioural_norms - scope_constraints holds: [archetypes, rule_sets] - id: briah name: Briah (Creative) stage_order: 2 emanation: false architectural_reading: [controller, business_rules] mind_technology: genetic repository (subconscious) operational_property: structure — formula components: - prohibitions - harness - background_context holds: [inherited_logic, patterns] - id: yetzirah name: Yetzirah (Formative) stage_order: 3 emanation: false architectural_reading: [controller, business_logic] mind_technology: fluid (thought and emotion) operational_property: amplification and delay components: [execution_environment, process] holds: [] note: > Formative world. Home of six Sephirot, including the two amplification-control nodes. Not itself a loop. - id: assiah name: Assiah (Action) stage_order: 4 emanation: false architectural_reading: [boundary, view] mind_technology: ego system (manifestation, interpretation) operational_property: quantity and size — experience components: [stimulus, preferences] holds: [] note: > The ego system lives here. Stimulus is the incoming event. Preferences are a snapshot of session settings. They interact: a stimulus can rewrite preferences, and current preferences change how the next stimulus is read. The ego system uses that pair to start walks. That is orchestration, not a third transport. sephirot: - id: keter name: Keter number: 1 meadows_rank: [1] meadows_label: [transcending_paradigms] located_in: atziluth amplification_control: false - id: chokhmah name: Chokhmah number: 2 meadows_rank: [2] meadows_label: [mindset] located_in: briah amplification_control: false - id: binah name: Binah number: 3 meadows_rank: [3] meadows_label: [goals] located_in: briah amplification_control: false - id: chesed name: Chesed number: 4 meadows_rank: [4] meadows_label: [self_organisation] located_in: yetzirah amplification_control: false - id: gevurah name: Gevurah number: 5 meadows_rank: [5] meadows_label: [rules] located_in: yetzirah amplification_control: false - id: tiferet name: Tiferet number: 6 meadows_rank: [6] meadows_label: [information_structure_and_flow] located_in: yetzirah amplification_control: false note: > Deep hub. Walks often radiate from here. Not a transport. - id: netzach name: Netzach number: 7 meadows_rank: [7] meadows_label: [reinforcing_amplification] located_in: yetzirah amplification_control: true amplification_role: boost - id: hod name: Hod number: 8 meadows_rank: [8] meadows_label: [restraining_amplification] located_in: yetzirah amplification_control: true amplification_role: check - id: yesod name: Yesod number: 9 meadows_rank: [9] meadows_label: [delays] located_in: yetzirah amplification_control: false - id: malkuth name: Malkuth number: 10 meadows_rank: [10, 11, 12] meadows_label: - physical_structure - buffers - parameters located_in: assiah amplification_control: false note: > Holds Meadows 10-12. Also the ego-system node that interprets container content and starts walks. # Hermetic / Golden Dawn edge list (Fortune works in this scheme). # Letters are labels only. I8 checks endpoints, not letters. # Undirected: [a, b] equals [b, a]. paths: scheme: hermetic_golden_dawn classical_count: 22 edges: - {id: p11, letter: aleph, a: keter, b: chokhmah} - {id: p12, letter: beth, a: keter, b: binah} - {id: p13, letter: gimel, a: keter, b: tiferet} - {id: p14, letter: daleth, a: chokhmah, b: binah} - {id: p15, letter: heh, a: chokhmah, b: tiferet} - {id: p16, letter: vav, a: chokhmah, b: chesed} - {id: p17, letter: zayin, a: binah, b: tiferet} - {id: p18, letter: cheth, a: binah, b: gevurah} - {id: p19, letter: teth, a: chesed, b: gevurah} - {id: p20, letter: yod, a: chesed, b: tiferet} - {id: p21, letter: kaph, a: chesed, b: netzach} - {id: p22, letter: lamed, a: gevurah, b: tiferet} - {id: p23, letter: mem, a: gevurah, b: hod} - {id: p24, letter: nun, a: tiferet, b: netzach} - {id: p25, letter: samekh, a: tiferet, b: yesod} - {id: p26, letter: ayin, a: tiferet, b: hod} - {id: p27, letter: peh, a: netzach, b: hod} - {id: p28, letter: tzaddi, a: netzach, b: yesod} - {id: p29, letter: qoph, a: netzach, b: malkuth} - {id: p30, letter: resh, a: hod, b: yesod} - {id: p31, letter: shin, a: hod, b: malkuth} - {id: p32, letter: tav, a: yesod, b: malkuth} attack_surfaces: - id: application_logic_container name: container / application logic / illusion system straddles: [yetzirah, assiah] components: - language - social_conventions - doctrine - ethics examples: - short video - oracular reading - social feed reachable_without_full_picture: true reachability_basis: asserted reachability_argument: > The four carriers are public. Video, a reading, a feed are how those carriers show up now. They are not extra worlds. Atziluth and Briah have no such public door. note: > Impact point. A stateless front (a reading, a clip) can be run from here. The ego system in Assiah reads that front and starts walks. That fan-out is why one landing becomes several paths. From inside Assiah the surface is visible as content. The store it writes into in Briah is not. transports: - id: world_circulation kind: between_worlds replaces: formative_feedback_loop located_in: yetzirah direction: bidirectional legs: upward: > From the container toward Briah and Atziluth. downward: > From Atziluth and Briah back toward Yetzirah and Assiah. note: > Moves an effect between worlds. Amplification and delay are nodes, not properties of this transport. - id: sephirotic_path kind: along_tree direction: along_declared_edge inventory: paths note: > One listed edge. A vector may use several at once. That is a network, not a loop. threat_vectors: - id: cognitive_warfare_basic name: basic tactics of cognitive warfare retained_from: 1.0.0 impact: application_logic_container pathway: nodes: [] edges: [] walks: [] amplification_control: [] note: v1.0 had no node walk. Left empty. effects: - target: briah via: world_circulation direction: upward - target: atziluth via: world_circulation direction: upward - target: yetzirah via: world_circulation direction: downward distinguishable_from_impact: > Appears after the upward leg, lasts after the carrier event stops, does not track stimulus. - target: assiah via: world_circulation direction: downward distinguishable_from_impact: > Told by lag and persistence, not by content. Also told by a preference change that does not track the current stimulus: the session settings moved, the event that moved them is no longer on the table. Direct container damage would still follow the clip. This does not. - id: oracular_dependency_harvest name: oracular reading used to grow dependence exhibit: E source: aggregated spiritual-industry pattern impact: application_logic_container carriers_touched: - language - social_conventions - doctrine pathway: topology: nonlinear orchestrator: malkuth nodes: - chokhmah - chesed - gevurah - tiferet - netzach - hod - yesod - malkuth quiet_nodes: [keter, binah] edges: - [chokhmah, chesed] # p16 - [chesed, gevurah] # p19 - [gevurah, tiferet] # p22 - [tiferet, hod] # p26 - [tiferet, netzach] # p24 - [hod, yesod] # p30 - [netzach, yesod] # p28 - [yesod, malkuth] # p32 walks: - [chokhmah, chesed, gevurah, tiferet] - [tiferet, hod, yesod, malkuth] - [tiferet, netzach, yesod, malkuth] amplification_control: [netzach, hod] note: > Matches Exhibit E solid lines. Three branches share Tiferet. They need not fire in one order. No chokhmah-netzach edge: that pair is not on the tree. Quiet: Keter, Binah. The reading on the container is stateless. The ego system starts the walks. What accumulates in Briah is not stateless. effects: - target: briah via: world_circulation direction: upward note: > Inherited patterns and the small group's shared store. The front product does not live here; the harvest does. - target: yetzirah via: world_circulation direction: downward distinguishable_from_impact: > Need lasts after the cards are down and does not follow the next draw. - target: assiah via: world_circulation direction: downward distinguishable_from_impact: > Repeat purchase and self-description as chosen or blocked, after a lag, with no reading on. - id: correction_economy name: public correction that feeds the fight exhibit: D source: aggregated correction-economy pattern impact: application_logic_container carriers_touched: - language - social_conventions pathway: topology: nonlinear orchestrator: malkuth nodes: - chokhmah - chesed - tiferet - netzach - hod - yesod - malkuth quiet_nodes: [keter, binah, gevurah] edges: - [chokhmah, chesed] # p16 - [chesed, tiferet] # p20 - [tiferet, netzach] # p24 - [tiferet, hod] # p26 - [hod, yesod] # p30 - [netzach, yesod] # p28 - [yesod, malkuth] # p32 walks: - [chokhmah, chesed, tiferet] - [tiferet, hod, yesod, malkuth] - [tiferet, netzach, yesod, malkuth] amplification_control: [netzach, hod] note: > Matches Exhibit D solid lines. Three branches share Tiferet. They need not fire in one order. Gevurah (rules) is quiet: the fight does not run on new rules, it runs on volume. Hod is lit but the check fails under load. Same lower pair as Exhibit E (6-8-9-10 and 6-7-9-10). Difference is the upper walk: E uses 4-5-6, D uses 4-6 and skips 5. effects: - target: briah via: world_circulation direction: upward note: > Shared episode written in. It returns later when a similar row starts. - target: yetzirah via: world_circulation direction: downward distinguishable_from_impact: > Heat lasts after the clip is gone and does not track the next fact-check. - target: assiah via: world_circulation direction: downward distinguishable_from_impact: > Pile-on and exposure as score, after a lag. - id: cogwar_paper_pattern name: reserved — published cognitive-warfare paper status: reserved impact: application_logic_container pathway: nodes: [] edges: [] walks: [] amplification_control: [] effects: [] note: Fill after the paper is chosen. invariants: I1: > Every Component belongs to exactly one World or one AttackSurface. I2: > An AttackSurface may straddle Worlds. Worlds never overlap each other. I3: > stage_order is total and ascending: atziluth < briah < yetzirah < assiah. Exactly one World has emanation true, and it is stage_order 1. I4: > A ThreatVector's IMPACT must resolve to an AttackSurface, never to a World and never to a Sephirah. I5: > A ThreatVector's EFFECT may name a World only with a declared transport AND a declared direction. Transport must be one of the two kinds in this file. I6: > ABSENCE IS NOT EVIDENCE. An unused edge is quiet, not missing. Empty pathway fields mean unclaimed. I7: > An EFFECT naming a World that the impact surface straddles must declare distinguishable_from_impact. I8: > Every id in pathway.nodes must be a declared sephirot id. Every pair in pathway.edges must match a paths.edges record (order of a and b does not matter). Every consecutive pair in each walk must be one of those edges. amplification_control may hold only netzach and/or hod, and only if that id is also in pathway.nodes. Empty pathway is legal. open_questions: outward_link: > Atziluth's outward link is still omitted. surface_enumeration: > Further attack surfaces remain out of scope. transport_measurement: > Lag and gain are not quantified. Order is licensed. Timing is not. leg_asymmetry: > The two legs of world_circulation may not share lag and gain. edge_labels: > Hebrew letters and tarot trumps are stored as labels. They are not claims this model tests. deterministic_risk_walk: > A later runtime may walk declared edges without random sampling. Not a field in this file. paper_vector: > cogwar_paper_pattern is reserved. lateral_entry_to_briah: > A change can show in Briah with no matching public carrier event still running in Assiah. The upward leg already allows that. A separate sideways pipe into the store is not a third transport in this file. I6 applies: unlisted is unmodelled.