Back to Documentation
AdvancedUpdated 2026-04-02

Risk-Weighted Formulas

Deep dive into all 6 trust formulas: gain, loss, dormancy, cooldown, promotion delay, and risk accumulator -- with full math and worked examples.

Risk-Weighted Formulas

The Vorion trust engine uses six interlocking formulas to compute trust score changes. Every formula is defined in packages/basis/src/canonical.ts -- the single source of truth for all trust governance parameters.

This page covers each formula with full math, worked examples, and a loss table.

Formula 1: Gain

Awarded when an agent successfully completes an action.

gain = gainRate x ln(1 + C - S) x cube_root(R)

| Variable | Meaning | Source | |----------|---------|--------| | gainRate | Base gain rate | 0.05 (constant) | | C | Observation tier ceiling | BLACK_BOX=600, GRAY_BOX=750, WHITE_BOX=900, ATTESTED=950, VERIFIED=1000 | | S | Current trust score | 0-1000 | | R | Risk multiplier | READ=1, LOW=3, MEDIUM=5, HIGH=10, CRITICAL=15, LIFE_CRITICAL=30 |

Key Properties

  • Logarithmic ceiling approach: As S approaches C, the ln(1 + C - S) term shrinks toward zero. Gains diminish naturally near the ceiling.
  • Sub-linear risk bonus: cube_root(R) rewards higher-risk actions but prevents risk-seeking. A LIFE_CRITICAL action (R=30) gives only ~3.1x the bonus of a READ action (R=1), not 30x.
  • Observation-bounded: A BLACK_BOX agent (C=600) earns nothing at score 600 because ln(1 + 0) = 0.

Worked Example: T3 Agent, MEDIUM Risk

Agent: score = 580, observation = BLACK_BOX (C = 600)
Action: MEDIUM risk (R = 5)

gain = 0.05 x ln(1 + 600 - 580) x cube_root(5)
     = 0.05 x ln(21) x 1.710
     = 0.05 x 3.045 x 1.710
     = 0.260

New score: 580.26

Gain Table (BLACK_BOX, C=600)

| Score | READ (1) | LOW (3) | MEDIUM (5) | HIGH (10) | CRITICAL (15) | |-------|----------|---------|------------|-----------|---------------| | 0 | 0.320 | 0.461 | 0.548 | 0.690 | 0.789 | | 200 | 0.302 | 0.435 | 0.517 | 0.651 | 0.745 | | 400 | 0.254 | 0.367 | 0.436 | 0.549 | 0.628 | | 500 | 0.233 | 0.336 | 0.399 | 0.502 | 0.575 | | 580 | 0.152 | 0.219 | 0.260 | 0.328 | 0.375 | | 599 | 0.035 | 0.050 | 0.059 | 0.075 | 0.085 |

The closer you get to the ceiling, the harder it is to gain. At score 599 with ceiling 600, gains are negligible regardless of risk level.

Formula 2: Loss

Applied when an agent fails an action or a canary probe.

loss = -P(T) x R x gainRate x ln(1 + C/2)

| Variable | Meaning | Value | |----------|---------|-------| | P(T) | Penalty ratio at tier T | 3 + T (3x at T0, 10x at T7) | | R | Risk multiplier | Same as gain formula | | gainRate | Base rate | 0.05 | | C/2 | Fixed midpoint reference | Half the observation ceiling |

Key Properties

  • Position-independent: The ln(1 + C/2) term is constant for a given observation tier. Agents cannot reduce loss exposure by positioning near the ceiling.
  • Tier-scaled penalty: Higher tiers lose more. P(T) = 3 + T means T7 agents (P=10) lose 3.3x more than T0 agents (P=3) for the same failure.
  • Risk-amplified: A LIFE_CRITICAL failure (R=30) loses 30x more than a READ failure (R=1).

Worked Example: T3 Agent, MEDIUM Failure

Agent: score = 580, tier = T3, observation = BLACK_BOX (C = 600)
Action: MEDIUM risk failure (R = 5)

P(T3) = 3 + 3 = 6
loss = -6 x 5 x 0.05 x ln(1 + 300)
     = -6 x 5 x 0.05 x 5.707
     = -8.561

New score: 571.44

Loss Table (BLACK_BOX, C=600)

| Tier | P(T) | READ (1) | LOW (3) | MEDIUM (5) | HIGH (10) | CRITICAL (15) | LIFE_CRITICAL (30) | |------|------|----------|---------|------------|-----------|---------------|-------------------| | T0 | 3 | -0.856 | -2.567 | -4.278 | -8.561 | -12.836 | -25.672 | | T1 | 4 | -1.141 | -3.423 | -5.705 | -11.410 | -17.115 | -34.230 | | T2 | 5 | -1.427 | -4.280 | -7.131 | -14.262 | -21.394 | -42.788 | | T3 | 6 | -1.712 | -5.136 | -8.561 | -17.115 | -25.672 | -51.345 | | T4 | 7 | -1.997 | -5.992 | -9.987 | -19.974 | -29.951 | -59.903 | | T5 | 8 | -2.283 | -6.849 | -11.413 | -22.826 | -34.230 | -68.460 | | T6 | 9 | -2.568 | -7.705 | -12.840 | -25.679 | -38.509 | -77.018 | | T7 | 10 | -2.854 | -8.561 | -14.268 | -28.535 | -42.788 | -85.575 |

A T7 agent failing a LIFE_CRITICAL action loses 85.6 points in one event. That is roughly the width of an entire tier at the top (T7 is 951-1000, only 50 points). A single catastrophic failure can drop a T7 agent to T6.

Formula 3: Dormancy Deduction

Applied when an agent is inactive. This is stepped, not continuous.

score_after = score_before x (1 - cumulative_deduction)
floor = score_before x 0.50

Nine milestones at fixed intervals:

| Milestone | Day | Deduction | Cumulative | Score at 600 | |-----------|-----|-----------|------------|--------------| | 1 | 7 | 6% | 6% | 564 | | 2 | 14 | 6% | 12% | 528 | | 3 | 28 | 6% | 18% | 492 | | 4 | 42 | 6% | 24% | 456 | | 5 | 56 | 6% | 30% | 420 | | 6 | 84 | 5% | 35% | 390 | | 7 | 112 | 5% | 40% | 360 | | 8 | 140 | 5% | 45% | 330 | | 9 | 182 | 5% | 50% (floor)| 300 |

Key Properties

  • Predictable: Operators know exactly when deductions occur. No surprises.
  • Stepped, not continuous: Trust holds steady between milestones.
  • 50% floor: An agent never drops below half its pre-dormancy score.
  • Resets on activity: Any qualifying action resets the dormancy clock to day 0.
  • 182-day half-life: After 6 months of inactivity, an agent is at its floor.

Worked Example

Agent: score = 660, inactive for 30 days

Milestone 1 (day 7):  660 x 0.94 = 620.4
Milestone 2 (day 14): 660 x 0.88 = 580.8
Milestone 3 (day 28): 660 x 0.82 = 541.2

At day 30: score = 541 (milestone 3 applied, waiting for milestone 4 at day 42)
Floor: 660 x 0.50 = 330 (won't drop below this)

Formula 4: Cooldown

After a failure at a given risk level, the agent enters a cooldown period where it cannot attempt the same risk level.

| Risk Level | Cooldown (hours) | With STRICT 0.5x | With PERMISSIVE 1.5x | |---------------|-----------------|-------------------|----------------------| | READ | 0 | 0 | 0 | | LOW | 0 | 0 | 0 | | MEDIUM | 6 | 3 | 9 | | HIGH | 12 | 6 | 18 | | CRITICAL | 24 | 12 | 36 | | LIFE_CRITICAL | Human reinstatement | Human reinstatement | Human reinstatement |

The operator posture's cooldownMultiplier scales the base cooldown. STRICT halves it (fail fast, learn fast). PERMISSIVE extends it (more recovery time).

LIFE_CRITICAL cooldown is always human reinstatement regardless of multiplier.

Formula 5: Promotion Delay

Time gates for high-tier promotions. An agent must sustain its score at the required level for the specified number of days before promotion.

const PROMOTION_DELAYS = [0, 0, 0, 0, 0, 7, 10, 14];
//                        T0 T1 T2 T3 T4 T5 T6  T7

| Promotion | Delay | Rationale | |-----------|-------|-----------| | T0 -> T1 | 0 days | Qualification course is the gate | | T1 -> T2 | 0 days | Logarithmic gain is the throttle | | T2 -> T3 | 0 days | Logarithmic gain is the throttle | | T3 -> T4 | 0 days | Logarithmic gain is the throttle | | T4 -> T5 | 7 days | Sustained performance required | | T5 -> T6 | 10 days | Extended demonstration period | | T6 -> T7 | 14 days | Two weeks of consistently high trust |

Key Design

T0-T4 has no time gate because the logarithmic gain curve already requires hundreds of successful actions per tier. Adding a time gate would be redundant.

T5-T7 adds time gates because these tiers grant significant autonomy. The system needs to confirm sustained reliability, not just a burst of good performance.

Formula 6: Risk Accumulator

A rolling 24-hour window that tracks accumulated risk from failures.

accumulator_value = sum( P(T) x R ) for each failure in the last 24 hours

Three thresholds:

| Threshold | Value | Effect | |-----------|-------|--------| | Warning | 60 | Increased monitoring, 2x canary injection | | Degraded | 120 | Gains frozen, losses still apply | | CB Trip | 240 | Circuit breaker trips, human reinstatement |

Worked Examples

3 MEDIUM failures at T3:

Each failure: P(T3) x R(MEDIUM) = 6 x 5 = 30
Accumulator: 3 x 30 = 90 -> exceeds warning (60), approaching degraded (120)

1 LIFE_CRITICAL failure at T7:

P(T7) x R(LIFE_CRITICAL) = 10 x 30 = 300 -> instant CB trip (exceeds 240)

Mixed failures at T4:

1 MEDIUM: 7 x 5 = 35
1 HIGH:   7 x 10 = 70
Total: 105 -> warning exceeded, approaching degraded

The accumulator resets entries that are older than 24 hours. A bad morning does not permanently affect the afternoon if no new failures occur.

Operator Posture Adjustments

| Posture | Warning | Degraded | CB Trip | |------------|---------|----------|---------| | STRICT | 40 | 80 | 160 | | STANDARD | 60 | 120 | 240 | | PERMISSIVE | 80 | 160 | 320 |

STRICT thresholds are nearly half the STANDARD values, making the system more sensitive to accumulated risk.

Hysteresis

Tier transitions include hysteresis buffers to prevent oscillation:

const HYSTERESIS = [25, 25, 20, 20, 15, 10, 10, 10];
//                  T0  T1  T2  T3  T4  T5  T6  T7

To promote from T3 to T4, the agent needs to reach the T4 minimum (650). To demote from T4 back to T3, the agent must drop below 650 - 15 = 635.

This 15-point buffer prevents an agent from bouncing between T3 and T4 when its score fluctuates near the boundary.

Wider buffers at the bottom (25 points for T0-T1) accommodate the natural volatility of new agents. Tighter buffers at the top (10 points for T5-T7) reflect the expectation that trusted agents should be stable.

Oscillation Guard

Beyond hysteresis, the circuit breaker monitors direction changes:

If trust score changes direction >= 3 times in 24 hours -> circuit breaker trips

Direction changes mean alternating gains and losses. Three reversals in a day suggests the agent is unstable and needs human review.

Putting It All Together

Here is the complete trust lifecycle for a single failed action:

1. Agent at T3 (score 580) attempts MEDIUM-risk action
2. Action fails
3. Loss formula: -P(3) x 5 x 0.05 x ln(301) = -8.56 -> score drops to 571
4. Risk accumulator: +30 added to 24h window
5. Cooldown: 6-hour cooldown on MEDIUM-risk actions
6. If accumulator exceeds 60: warning, 2x canary injection
7. If accumulator exceeds 120: gains frozen
8. If accumulator exceeds 240: circuit breaker trips
9. If score drops below 500: demotion to T2 (with hysteresis check at 500 - 20 = 480)
10. Proof recorded with decision, outcome, and trust delta
11. Trust Bus signal broadcast to all layers

Next Steps

All Documentation