Systemic and Tail Risk Model

Assumptions

Everything the model believes, stated before the math. If you do not buy one of these, do not buy the output.

1. Dependence is never a fabricated covariance matrix: every common-cause group carries three explicit contracts - independence, comonotonic (perfectly linked), and Frechet bounds for unknown dependence.
2. Member failure probabilities are group-empirical when the group has at least 5 resolved members, else the class prior; the source is printed per group.
3. A common-mode cluster requires at least 3 members; smaller groups are excluded, and when none qualify the tail is UNKNOWN with the reason.
4. Shared exposure dedupes across layers via unique exposure; a subject in two mechanisms is not double-counted.
5. Tail contributions follow a printed deterministic allocation rule and sum by construction.
6. Thin tails never produce precise extreme quantiles: bands, not points.

Derivation

Common-cause groups come from the structural graph (M22): projects bound by a documented shared mechanism - a node, a queue request, a sponsor. Each group with at least 3 members carries its exposure in MW and one failure probability per member, sourced group-empirically when the group has enough resolved members and from the class prior otherwise, with the source printed.

For a group with member failure probabilities p_1..p_n, the joint failure probability is bounded three ways:

The product is the independence contract, the minimum is the comonotonic contract, and the Frechet-Hoeffding bounds bracket every dependence structure in between - so an unknown dependence is a width, never a guess. The group's tail MW band is its exposure times the independence-to-comonotonic range; the portfolio band is the sum over groups.

Attribution is deterministic: each group's contribution is its capacity share of total common-cause exposure times the upper band, so contributions sum to the printed total by construction - an accounting rule, not a fitted model.

Identification strategy

Why the estimate supports the claimed meaning - and where the model refuses to claim more than the data carries.

• The model's identification stance is that dependence is not estimated at all: it is contracted (independence, comonotonic) or bounded (Frechet). Nothing in the output pretends to a fitted correlation, which is exactly what separates this from a fabricated covariance matrix.
• Failure probabilities carry their provenance: group-empirical only when the group has at least 5 resolved members (the M22 minimum), otherwise the class prior - and the source prints per group, so a prior-driven cluster reads as prior-driven.
• The contagion output is permanently UNKNOWN: pairwise documented links are not enough for a systemic contagion claim, and the model says so with the reason rather than upgrading co-exposure into contagion.
• Any scenario-set input feeding the model is labeled SCENARIO, never predicted frequency - a what-if never launders into a base rate.

Inputs and outputs

Calibration and gate evidence

Validation design

• Contract-exact gates: the independence, comonotonic, and Frechet bounds are checked against known analytic values, so the arithmetic cannot drift.

Evidence on record

• Smoke gates at seal (11 m28-specific): independence and comonotonic contracts exact against analytic values; Frechet bounds bracket correctly; clusters meet minimum membership; every cluster prints dependence bounds; probability source printed per cluster; tail band lower does not exceed upper; contributions sum under the printed rule; pairwise links never claim contagion (UNKNOWN, reason printed); determinism (identical input hash on re-run); audit row written for every run.

Gates at seal

• smoke: 11 m28 gates incl. contract-exact bounds, no-contagion UNKNOWN, determinism + audit row (suite counts at seal per the build agent's seal report)
• sealed at 68dd1cb6 on atlas-nl-shock-redesign

Failure modes

The ways this model declines, degrades or goes UNKNOWN - and what it prints when it does.

• No common-cause group reaches 3 members: portfolio tail is UNKNOWN - a tail claim from marginals alone would be false precision, and the reason prints.
• Group with thin resolution history: member probabilities fall to the class prior and the source prints class_prior, so the width of the band is honestly prior-driven.
• A subject bound by two mechanisms appears in both groups but once in the unique exposure count - cross-layer dedupe is reported, never silently merged.

Sensitivity

• The band width is the dependence ignorance: on a large cluster the independence and comonotonic ends sit far apart, and that distance is the correct report - narrowing it would require dependence evidence the record does not carry.
• The class prior dominates small or thinly resolved groups; their bands move with the global withdrawal rate, which the printed source makes visible.