Surveillance Impact Model

Assumptions

Everything the model believes, stated before the math. If you do not buy one of these, do not buy the output.

1. The change set arrives verified: this model never discovers events and never writes prose - it evaluates impact only.
2. Unsourced changes are rejected and listed, never evaluated.
3. A threshold with no verified change on its cell is UNRESOLVED - silence is not not-crossed.
4. Low-materiality churn logs but does not contact: non-material changes cap the notification class at LOG.
5. Model reruns come from the versioned field-to-model map only.
6. Identical change sets evaluate identically; dedupe happens upstream via event hash.

Derivation

Only sourced changes enter. Each verified change maps to its affected input cells, and the versioned field-to-model map translates those cells into the models requiring rerun: a COD change reaches delivery, state, and capacity-at-risk; a sponsor change reaches structural correlation and effects propagation. The map is printed policy, versioned with the contract.

Each watch threshold is then evaluated against the verified changes on its cell. A change in the watched direction crosses; one that does not, does not; and a threshold whose cell saw no verified change is UNRESOLVED, because silence cannot be read as not-crossed. A non-numeric change against a numeric threshold is likewise UNRESOLVED.

Surveillance items bind each change to its threshold: crossed means breached - unless the change is non-material, which stays unresolved - not-crossed means satisfied, and unresolved stays unresolved. The notification class is a fixed ladder: ESCALATE when a blocking breach exists, NOTIFY on any breach or decision-relevant change, LOG when only non-material churn arrived, NONE when nothing verified arrived.

Identification strategy

Why the estimate supports the claimed meaning - and where the model refuses to claim more than the data carries.

• Verified-only entry is the provenance rule: impact can never be driven by an unsourced claim, and rejected changes are listed rather than dropped silently.
• Silence is identified as no-evidence, not as evidence of no-change: UNRESOLVED thresholds keep 'watched and clear' distinct from 'not observed.'
• The notification ladder separates urgency from volume: only a blocking breach escalates, so a noisy feed cannot manufacture alarms.
• The versioned rerun map is the causal routing: which models must re-answer after a change is a printed contract, not a judgment made at alert time.

Inputs and outputs

Calibration and gate evidence

Validation design

• Gate-verified discipline: unsourced changes are rejected before evaluation, thresholds cross only on verified changes, silence reads UNRESOLVED, blocking breaches escalate, the rerun map is deterministic, and identical change sets evaluate identically.

Evidence on record

• Smoke gates at seal (7 m20-specific): unsourced change rejected, never evaluated; threshold crossed by a verified change; silence is UNRESOLVED, not not-crossed; a blocking breach escalates; the rerun map is deterministic; identical verified subsets evaluate identically; audit row written for every run.

Gates at seal

• smoke: 7 m20 gates incl. unsourced-rejected, silence-is-UNRESOLVED, blocking-escalates, determinism + audit row (suite counts at seal per the build agent's seal report)
• sealed at 456d820 on atlas-nl-shock-redesign

Failure modes

The ways this model declines, degrades or goes UNKNOWN - and what it prints when it does.

• Unsourced change: rejected and listed - it cannot drive impact.
• Non-numeric change against a numeric threshold: UNRESOLVED, not crossed - the mismatch is named.
• No watch threshold binds a changed cell: the item is logged with no verdict, so coverage gaps in the watch list stay visible.

Sensitivity

• Materiality is assigned upstream: reclassifying a change as blocking moves its breach from NOTIFY to ESCALATE, and the ladder shows which changes sit near that line.
• The rerun map is versioned: adding a field-to-model edge widens the rerun set, and the printed map is the record of what a change will wake.