Assumptions
Everything the model believes, stated before the math. If you do not buy one of these, do not buy the output.
- A scenario is counterfactual re-execution, not a separate model: a shock rewrites specified inputs and the Delivery, Cost, Dependency and Financial Bridge models re-run on the shocked inputs.
- Combined shocks compose linearly per input with no interaction terms - combined shocks do not fake precision.
- A scenario number never touches baseline data; every scenario output is badged SCENARIO.
- Each scenario runs a fixed number of Monte Carlo draws under stored seeds; the same shock on the same pinned record reproduces the identical result.
- A shock whose target field is UNKNOWN or the wrong type does not bind: it is reported in the unbound list, never coerced.
Derivation
A shock set s rewrites inputs on an isolated copy of the store - dates shift, capacities scale, costs multiply, rates move - and the engine re-runs the model chain end to end:
The propagation chain is the full path: assumption, dependencies, milestones, COD, revenue, financing, debt service, liquidity, returns, covenant risk, revised distributions, recommended action. The engine supports the eight shock families (build spec Section 36) and ships the five initial scenarios (Section 53) as predefined shock sets. Default horizon is 20 quarters (60 months) - a judgment call awaiting the owner's ruling.
Engine-level validation is determinism and boundaries: a zero shock must reproduce the baseline exactly, and seed replay must reproduce any scenario bit-for-bit.
Identification strategy
Why the estimate supports the claimed meaning - and where the model refuses to claim more than the data carries.
- Because a scenario re-runs the same models on shocked inputs, the scenario delta is identified: every point of difference between baseline and scenario traces to the shocked input through the same deterministic chain. There is no scenario-specific math that could smuggle in an extra assumption.
- Linear composition with no interaction terms is a deliberate under-claim: where interaction effects are not modeled, the engine does not manufacture them, and combined shocks read as the sum of their parts.
- Badging every output SCENARIO is the epistemic firewall: a counterfactual can never be quoted back into the record as an observation.
Inputs and outputs
Reads
- Shock set
- Spec Section 36 families; Section 53 predefined scenarios; user-specified shocks in Scenario mode
- Pinned record
- The frozen store the shock applies to; seeds stored in the scenarios collection
- Model chain
- Delivery (M02), Cost (M05), Dependency (M04), Financial Bridge (M06)
Writes
- The full propagation chain with revised distributions and covenant consequences
- Unbound shocks listed with reasons
- Seed and frozen inputs for exact replay
Calibration and gate evidence
Validation design
- The engine inherits each component model's backtest; engine-level validation is determinism (seed replay) and boundary tests (zero shock reproduces baseline).
Evidence on record
- Determinism is gated in the smoke suite (same shock on the same pinned record reproduces the identical result). The 60-month default horizon is flagged in source as awaiting the owner's ruling.
Failure modes
The ways this model declines, degrades or goes UNKNOWN - and what it prints when it does.
- Shock targeting an UNKNOWN field: reported unbound, never coerced to a number.
- Shock on a project with no deal terms: the Financial Bridge leg returns UNKNOWN per its own iron rule; the scenario shows the physical chain and the UNKNOWN money side honestly.
Sensitivity
- The scenario answer is exactly as sensitive as the component models are to the shocked input - delay shocks move through the Delivery gate, cost shocks through the reference-class moments, rate shocks through sculpting.
- The horizon default (20 quarters) bounds how much of the tail the chain can show; it is a policy choice, pending ruling.
Iron rules
A scenario number never touches baseline data; every scenario output is badged SCENARIO; seeds and frozen inputs are stored in the scenarios collection.
The default horizon is a judgment call (Decisions for Eni).
Source and audit
Written from the sealed model source. Every run is recorded - model version, frozen inputs, input hash, timestamp. There is no unrecorded model execution.