M7 design: trust-fund accounting on the projected panel (draft for referee)

[MaxGhenis]

Summary

docs/design/m7_trust_fund_accounting.md is a DRAFT design doc for the adversarial fable referee round (which follows the in-flight gate_m6 verdict — this PR does not trigger it). It specifies M7, the deterministic trust-fund accounting layer on M6's projected panel: per-projection-year taxable payroll, payroll-tax revenue (employer + employee, wage-base cap), benefit outlays by beneficiary class (OASI, DI, 402(b)/(c)/(e)/(f) auxiliary — each bounded by what gate_m4/gate-2 actually certified, so every dollar level is report-only and only composition is certified), and the trust-fund balance identity. It states the determinism law (same panel + same parameters → byte-identical accounts; all RNG realized upstream in M6), pins the SSA input bindings to policyengine-us 1.752.2 with a §2.8.10-style tamper-gate factory, and flags loudly the five series pe-us 1.752.2 lacks (auxiliary 402(b)/(c)/(e)/(f) rate constants, the trust-fund interest rate, the 2014-TR ultimate assumptions, CPI-W/COLA, and the trust-fund opening reserve — each needs a 3d-style amendment). Anchors are all report-only: the internal M2-reproduction target (M7 on the M2 setup must reproduce runs/m2_pseudo_projection_v1.json's committed numbers or name every delta), the Mermin (2005) cost-ordering, and the SSA Trustees corridors under an explicit level-vs-composition caveat (the 1,549-career PSID panel is not the covered-worker universe; M2's baseline balance is positive precisely because it runs combined-OASDI revenue against OASI-only outlays). The proposed-not-locked gate_m7 gates two internal identities only — the M2-reproduction and exact balance-identity closure (start + revenue + interest − outlays = end, residual == 0) — and explicitly not external SSA aggregates. This document edits no gates.yaml cell, builds no floor, writes no test, and runs nothing scored.

Open decisions for the referee

1. Internal-identity gate vs the roadmap's external-level gate (the central one — the proposal contradicts Roadmap: from incidence replication to a DYNASIM-class projection on one unified person-period panel #113 M7's "in LEVELS" wording, deliberately, per the level-vs-composition caveat).
2. Nominal vs real accounting (real needs no CPI-W; nominal needs the two missing series).
3. Calibrated reserve vs a sourced SSA opening-balance series.
4. OASI-vs-DI rate/fund split (one combined 12.4% fund vs two funds 10.6%/1.8%).
5. Scheduled vs payable baseline + the post-exhaustion payable rule.
6. Wage-index surface: inherit M6's vs re-derive.
7. A level M7 needs that M6 §6 does not expose: raise as an M6 gap vs synthesize in M7.
8. Interest timing convention (start-of-year vs average-balance).
9. "Reproduce M2" byte-exact vs a 1e-12 tolerance (floating-point reduction order).
10. TR vintage for the report-only corridors (hold 2014 vs add the current TR).
11. Immigrant-entrant partial-career treatment for AIME and taxable payroll.
12. Per-capita beneficiary denominator for the §5.3 normalization.

Referee round follows the gate_m6 verdict.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
social-security-model	Ready	Preview, Comment	Jul 14, 2026 6:16pm

[MaxGhenis]

Adversarial referee — M7 trust-fund-accounting design doc (docs/design/m7_trust_fund_accounting.md)

Read the doc fully; checked every checkable claim against the artifact/code at head (16782db). Read-only everywhere; no gates.yaml/artifact/venv touched. Pointers below are to src/populace_dynamics/ (the doc's ss/… shorthand) unless noted.

Verified clean (re-derived, not taken on trust)

• Every cited M2 number byte-matches runs/m2_pseudo_projection_v1.json. Reserve 7889236006574.162, exhaustion 2034.0, baseline balance 0.04689166331354922, all five Smith balance deltas (cap_150k 0.0062624547665585326, elimination 0.014294443697022999, +1pp 0.010000000000000009, +2pp 0.02000000000000001, fra_to_72 0.02561498010756378) and exhaustion-delta-years (1.1188537982975504 / 3.2048065597855384 / 1.950472894025097 / 4.231370822865529 / 41.0), all four Mermin outlay deltas (-0.3326593963115843 / -0.11000744343246105 / -0.20234306477534883 / -0.007987803755968265), n_common_frame 1549, weight_sum 33696344.0, combined 0.124. Forecasts exact: F1 n_ok 14 / n_total 14, F2 met=False, kendall_tau_vs_smith 0.6666666666666669 (result order +2pp > elim > +1pp > cap), F3/F4 met. Provenance exact: commit 747966cd…, pe_us_revision bf71be3b. The §5.1 table, §9 JSON, and prose agree with the artifact to the last digit.
• Roadmap Roadmap: from incidence replication to a DYNASIM-class projection on one unified person-period panel #113 M7 row quoted verbatim (confirmed via gh issue view 113): the gate clause "…in LEVELS, not just ordinally" and unlock "The Rosetta stone (Replication anchors: DYNASIM-scored reforms and the minimum model surface for each #74 anchor 2) graded in its own units" match §1/§9 exactly.
• gate_m4 characterization is faithful, verbatim. gates.yaml:2927-2944: kind: anchor_based, and the covers field literally ends "…no SSA DI LEVEL is gated" (line 2944); prevalence.50-59 stock, Table 50 exit dominance, Table 19 shape all present as the doc states. gate_m6 kind: temporal_holdout (gates.yaml:5350); gate_2b/gate_2c exist as gate_2 tranches (gates.yaml:691).
• File:line pointers resolve. wage_base_for (params.py:151), bend_points NAWI(y-2)/NAWI(1977) (params.py:138), NAWI(1977)=9,779.44 cross-check (params.py:334), bend constants (params.py:60-62), creditable_history (benefits.py:68), aime/pia (benefits.py:100/120), early_reduction/delayed_credit (benefits.py:134/146), spousal_benefit (benefits.py:205), widow_benefit (benefits.py:266), validate_external_vintage raising on vintage>BOUNDARY_YEAR (refit.py:825-838, BOUNDARY_YEAR=2014 refit.py:68), _validate_external_inputs (m6_inputs.py:198). M6 §6 does promise "expose both capped and uncapped person earnings" (m6 doc:2336-2337) — §2.1/§2.2 faithful. M6 §2.8.3a, §2.8.10.2/.4/.5 all resolve; §2.8.3a states "AIME/PIA/claiming are never gated" (m6 doc:1452), grounding the report-only-levels rule.
• Trust-fund-perimeter gaps 2/3/5 are genuinely absent from pe-us (verified against two installed checkouts, 1.532.0 and 1.690.7): no interest/special_issue/trust_fund/reserve node under gov/ssa; no TR-ultimate-assumptions node. pe-us models the benefit/tax formula, not the trust fund — as the doc says.
• Determinism law is consistent with M6's actual idioms. The engine already reduces via sort_values(["person_id","year"]) + (weight * np.asarray(values, dtype=np.float64)).sum() (composition.py:217/301/681) — exactly the §3 point-1 pattern. No RNG at an accounting layer is realistic here.
• Mechanics: diff is docs-only (+829, one file), PR is draft, no gates.yaml/frozen-artifact edit; the m7-design-parameters JSON block parses (15 keys, 12 decisions); §§1-9 sequential, no gaps/dupes. candidate-16 residual 1.734723475976807e-18 + "reconciles to 0.0" are real (runs/gate2_hazard_v16.json).

---

SHOULD-FIX

S1 — §4.1 / §4.3 gap 4 misclassifies a present pe-us node (CPI-W/COLA) as an absent series needing external staging. pe-us ships gov/ssa/uprating.yaml — description: "The US indexes Social Security benefits (OASDI and SSI) according to this schedule, annually updating based on CPI-W in the third quarter of the prior year," with values through 2100 — and gov/bls/cpi/cpi_w.yaml (the raw index). Both present in 1.532.0 and 1.690.7. Yet §4.1 row 9 and §4.3 gap 4 place CPI-W in the same bucket as the genuinely-absent trust-fund interest/reserve ("NO pe-us node… a hard binding… §4.4-staged external artifact… design STOP before any scored run"). The literal claim survives only via the "in ss/" qualifier (true — the repo wrapper doesn't load it), but the classification is wrong: a nominal M7 should bind and vintage-pin the existing gov/ssa/uprating.yaml exactly as it does NAWI/wage_base (which likewise carry post-2014 values the vintage fence already handles), not stage a new TR artifact. Fix: move CPI-W/COLA out of the trust-fund-perimeter gap set; note it's present-but-not-wired, bindable like the other pe-us series. (Caveat, stated honestly: I verified against 1.532.0/1.690.7, not the 1.752.2 pin — but cpi_w.yaml/gov/ssa/uprating.yaml are long-standing, structurally-stable nodes; no trust-fund model has ever been added to pe-us.)

S2 — Decision 1 (the central one): the position is right on the merits, but its ratification path and its rebuttal of option (c) are under-specified. Adjudication below. Net: not an architecture error, but the doc should (a) name a roadmap #113 amendment ceremony as the ratification path rather than implying a referee can retire the committed "in LEVELS" row by argument, and (b) rebut option (c) — a normalized-shape gate with composition deltas held fixed — far more seriously, since (c), not (b), is the roadmap-faithful reading of "not just ordinally."

S3 — the sex dimension is a live coupling the doc never names (interacts with the in-flight m6-sex-patch). §2.3's survivor/spouse outlays (widow_benefit, 402(e)/(f)) and the S survival weighting are sex-dependent (who-survives-whom, mortality-by-sex); the M2 artifact itself carries n_careers_mermin_sex_resolvable. The doc has zero occurrences of "sex" and §2.1's consumed-interface list and §8's decisions never name mortality-by-sex/sex-resolution as a consumed panel dimension. Because M7 "consumes a fixed panel," a change to panel sex construction (which m6-sex-patch is doing) silently shifts M7's report-only M6-panel survivor outlays. The gate is insulated (M2-repro rides the frozen artifact; M6-panel levels are report-only) so this is not blocking — but §2.1 should list the panel's sex/mortality resolution as an upstream dependency and §8 should disclose the coupling.

S4 — stale count. Revision log (line 55) says "any ten-decision adjudication will be mapped here," but §8 lists twelve (JSON open_decisions_for_referee has 12). Update to twelve.

---

NOTE

N1 — gap 1 (auxiliary 402 constants) is not the same kind of gap as 2-5 and is over-flagged as a pre-scored-run STOP. The auxiliary shares/RIB-LIM/71.5% floor are already bound in existing repo code (benefits.py spousal_benefit/widow_benefit/survivor_reduction), statute-cited, and tested (tests/ss/test_aux_benefits.py, runs/aux_benefit_examples_v1.json); params.py:18-38 documents this exception explicitly. §4.3's "Gaps 2-5 share a root cause" half-acknowledges it, but §4.1's table and the §4.3 preamble still lump gap 1 uniformly as "GAP → needs a reviewed amendment before any scored run." Mark it "already bound in-repo (statute constant)," distinct from the unbound trust-fund perimeter.

N2 — "1978-base bend constants" mislabel (§4.1). _BASE_NAWI_YEAR = 1977 (params.py:62) and the $180/$1,085 are the 1979-eligibility-cohort amounts of 42 USC 415(a)(1)(B), indexed off 1977 NAWI. "1978-base" is neither the index year (1977) nor the cohort (1979).

N3 — "M6 candidate-16 residual 1.7e-18" attribution is loose (§2.4, §3). The number and "reconciled to 0.0" are genuine, but they're the gate-2 marital candidate's support_stratum_recombination residual (runs/gate2_hazard_v16.json), which M6 consumes as ft.CANDIDATE_16. It's a gate-2 identity M6 adopts, not an M6-specific reconciliation. The analogy is sound; the label conflates the two.

N4 — §2.6 glosses gate_m4's gated cells as "(all shape/dominance)." Per gates.yaml:2941-2943, prevalence.50-59 and the flow hazards are gated as internal half-split reproduction cells (8 internal mixed-k); only Table 19 (shape) and Table 50 (dominance) are the 4 concept-bridged anchor cells. Doesn't touch the load-bearing "no DI dollar level gated" conclusion, but "all shape/dominance" mischaracterizes the internal cells.

N5 — §3 "byte-identical … across platforms" is mildly aspirational. No-RNG + pinned-sort + float64 gives cross-run/cross-process identity; cross-platform byte-identity additionally requires numpy-build consistency (pairwise-sum/SIMD). §8 decision 9 honestly flags the reproduction-order risk, so the substance is covered — consider softening the "platforms" claim or citing the numpy-version pin.

N6 — the roadmap's own unlock language already leans the doc's way. The #113 M7 unlock clause is "…graded in its own units" — frame-relative, in tension with the same row's "in LEVELS" gate clause. Decision 1 should exploit this internal roadmap tension; it strengthens the case that the roadmap intent is not raw external levels.

---

Adjudication — levels-vs-identity (Decision 1), on the merits

The doc is right that a raw external-LEVELS gate is dishonest on this frame. M2's baseline balance analogue is +0.04689 — positive, the arithmetic opposite of the real OASDI 75-yr deficit — for a stated, non-model reason: revenue is the full combined-OASDI 12.4% on all taxable payroll while outlays are OASI retired-worker only (no DI, no auxiliary) falling later on the calendar. That is a composition/universe mismatch (1,549 PSID careers / weight_sum 33.7M vs the ~180M-worker universe; real vs nominal; closed vs open), not model error. And F2's τ=0.667 failure is the clinching evidence: even the weaker, more-transportable ordering claim already misses Smith on the compressed frame — so external levels certainly cannot be honestly gated. Gating raw levels (roadmap-literal / decision-1 option b) would certify the frame's composition gap as fidelity. The doc's internal-identity gate (M2-reproduction to floating point + balance-identity closure to 0) is the honest ceiling: non-vacuous (a dropped class or mis-discount breaks closure) yet attainable, pinned to an adversarially-reviewed reference.

But the disposition is "right, needs a roadmap-amendment-ceremony," not a clean ratify. A design doc cannot supersede #113's committed "in LEVELS" gate row by referee argument alone; that row is contract until amended, and the honest path is an explicit #113 amendment that replaces "in LEVELS" with the internal-identity gate + report-only levels — the doc should say so rather than proposing the substitution as if the referee could bless it standalone. Separately, the doc under-argues option (c) (a normalized-shape gate on % of taxable payroll with composition deltas held fixed): its one-line dismissal ("would gate the composition mismatch as if it were model error") is really the critique of (b), the raw-levels gate — (c) holds composition fixed and is the reading that actually honors "not just ordinally." (c) deserves a real rebuttal, aided by N6's observation that the roadmap's own unlock says "in its own units." The doc's transparency is exemplary — it surfaces the contradiction as decision 1 rather than silently resolving it, exactly the campaign norm — which is why this is a SHOULD-FIX on the ratification path, not a REJECT on the architecture.

---

Verdict

SPEC SOUND (ratifiable after listed fixes). No BLOCKING findings: the architecture (deterministic accounting layer; M2-repro on the frozen setup gated, external levels report-only) is sound and the numbers are impeccable. Fixes: S1 (correct the CPI-W/COLA gap classification), S2 (name the #113-amendment ratification path + rebut option (c)), S3 (disclose the sex-dimension coupling to m6-sex-patch), S4 (twelve, not ten), plus the NOTEs.

[MaxGhenis]

Fixes applied — round-1 SPEC SOUND referee (comment 4972284096)

Revision 2 of docs/design/m7_trust_fund_accounting.md applies all four SHOULD-FIX and all six NOTEs. PR stays draft — the verification referee comes next. Five small commits (75c7073 → 8a95a5d); nothing outside docs/design/ touched.

SHOULD-FIX → commit

• S1 (§4.1/§4.3 gap 4 misclassified a present pe-us node) → 75c7073 (+ cross-refs eb82e69, 8a95a5d). Verified gov/ssa/uprating.yaml (CPI-W-based OASDI COLA, actuals→2026, CBO forecasts→2035, programmatic 2036–2100) and gov/bls/cpi/cpi_w.yaml both ship in pe-us. §4.3 is now a three-way classification: A already-bound-in-repo (aux 402 constants; N1), B present-but-not-yet-wired (CPI-W/COLA — bind and vintage-pin like NAWI/wage_base, not a design STOP), C genuinely-absent trust-fund perimeter (interest, TR ultimate assumptions, opening reserve). §4.1 table, §4.2, §4.4, §2.5, and the §9 JSON all reconciled to A/B/C. Carried your confirm-at-pin caveat (verified 1.532.0/1.690.7, not the 1.752.2 pin directly).
• S2 (Decision 1 — ratification path + option (c)) → d3a7381. Added the roadmap Roadmap: from incidence replication to a DYNASIM-class projection on one unified person-period panel #113 amendment ceremony as the ratification path (a design doc/referee cannot retire the committed "in LEVELS" row by argument). Took option (c) seriously: rebut (c)-as-a-gate (it still imports the covered-worker universe the panel can't represent to "hold composition fixed to"; F2 τ=0.667 shows even ordering fails) while adopting (c) as a report-only companion surface — honoring "not just ordinally" without gating a frame-relative level. N6's "graded in its own units" tension folded in. Threaded through §5.3, §6, §8 decision 1.
• S3 (sex-dimension coupling to m6-sex-patch) → 62ced18. §2.1 now lists person sex / sex-resolved survival as a consumed panel dependency; new §8 decision 13 discloses that the demo frame lacks sex (892,639 × 7), the patch (grading 4972045579) sources it from a sibling load_sources frame, and its canonical-source choice shifts M7's report-only survivor outlays — insulated (M2-repro rides the frozen artifact; M6-panel survivor levels are report-only), so disclosed, not blocking.
• S4 (stale count) → 62ced18. Revision log rewritten as a revision-2 entry mapping every finding; §8 now lists thirteen decisions (was "ten").

NOTE sweep

All applied — N1 aux→§4.3 A (75c7073); N2 bend-constant label "1979-cohort / indexed off 1977 NAWI" (75c7073); N3 candidate-16 re-attributed as the gate-2 support_stratum_recombination identity M6 consumes as ft.CANDIDATE_16, §2.4/§3 (eb82e69); N4 §2.6 now distinguishes gate_m4's 8 internal half-split reproduction cells from the 4 concept-bridged anchors (eb82e69); N5 §3 softened — cross-platform byte-identity needs a pinned numpy build (eb82e69); N6 roadmap "in its own units" tension → §8 decision 1 (d3a7381). No NOTE skipped; none warranted push-back.

Thanks for the clean, checkable round — S1 in particular corrected a real misclassification.

[MaxGhenis]

Verification round — M7 fixes (rev 2, 75c7073→8a95a5d, doc 926 ll.)

Re-checked each round-1 finding against the revised doc at head 8a95a5d (read-only worktree). Per-finding disposition below; evidence re-derived, not taken from the fixes-applied narrative.

SHOULD-FIX

• S1 — RESOLVED. §4.3 is now a clean three-way split: A already-bound-in-repo (aux 402 constants), B present-but-not-wired (CPI-W/COLA), C genuinely absent (trust-fund interest, TR ultimate assumptions, opening reserve). §4.3 B specs CPI-W to "bind and vintage-pin gov/ssa/uprating.yaml exactly as it binds NAWI/wage_base" with the leakage fence — correct. §4.1 table, §4.2, §2.5, and §9 JSON (…_A/_B/_C) all reconciled; the §9 C list is exactly the three genuinely-absent series (CPI-W and aux removed). §4.4 step 2 now correctly states only category-C constants are staged artifacts (A lives in tested repo code; B loads from the pe-us node under the version+dir assert) — a real improvement. C-gaps re-verified absent from gov/ssa (1.532.0/1.690.7). Trivial residual: §4.3 B says CPI-W "actuals through 2026" — uprating.yaml actuals run through 2025 (2026 is the first CBO-forecast row); cosmetic, doesn't touch the classification.
• S2 — RESOLVED (and the strongest fix). §8 decision 1 no longer dismisses option (c) as (b). It grants (c) is the roadmap-faithful reading of "not just ordinally," then rebuts gating (c) on the merits I flagged: "'holding composition fixed' needs a composition to hold it to — the covered-worker universe the panel does not represent — so the gate re-imports an external target the frame cannot honestly hit," reinforced by F2 τ=0.667 (ordering already misses Smith, so a normalized-level band fails a fortiori). It then adopts (c) as a report-only companion surface, names the roadmap Roadmap: from incidence replication to a DYNASIM-class projection on one unified person-period panel #113 amendment ceremony as the ratification path ("contract until amended; a design doc cannot retire it by argument"), and folds in N6's "graded in its own units" tension. The rebuttal genuinely engages the universe-import argument — not papered over.
• S3 — RESOLVED; insulation reasoning holds against the mechanics. §2.1 now lists person sex / sex-resolved survival as a consumed dependency; new §8 decision 13 discloses the coupling. I verified the insulation claim independently: the gated M2-repro run reproduces the frozen committed artifact runs/m2_pseudo_projection_v1.json (the closed Cost-ordering synthesis: committed encodings vs anchor cost columns #115 frame, n_careers_mermin_sex_resolvable 1549, already sex-resolved) under an "or name every delta" rule, while m6-sex-patch touches M6's build_realized_population (a different, open panel) whose survivor levels are report-only (§2.6) — so the patch cannot move a gated cell. Cited functions build_realized_population (harness/m6_population.py) and load_sources (models/household_composition/data.py) and grading 4972045579 all resolve; the (892,639 × 7) demo-frame shape is the sex-patch lane's cited claim (report-only disclosure), consistent with the absence of a sex column in the PSID/panel readers, not independently re-derived here.
• S4 — RESOLVED. Revision log, §8, and §9 JSON all say thirteen; no ten-decision/twelve anywhere; §8 numbered 1-13; JSON open_decisions_for_referee has 13.

NOTE

• N1 — RESOLVED (aux → §4.3 A / §2.3 / §4.1 "already bound in-repo"). N2 — RESOLVED (bend constants relabeled "1979-cohort amounts, indexed off 1977 NAWI", §4.1/§4.2). N3 — RESOLVED (candidate-16 re-attributed as the gate-2 support_stratum_recombination identity M6 consumes as ft.CANDIDATE_16, full-precision residual 1.734723475976807e-18, §2.4/§3). N4 — RESOLVED (§2.6 distinguishes gate_m4's 8 internal half-split reproduction cells from the 4 concept-bridged anchors — matches gates.yaml:2943 "8 internal mixed-k + 4 anchor"). N5 — RESOLVED (§3 cross-platform byte-identity now conditioned on a pinned numpy build). N6 — RESOLVED (roadmap "in its own units" tension threaded into decision 1).

Mechanics

JSON block parses (16 keys, 13 decisions, revision 2); diff stayed docs-only (one file, no gates.yaml/runs/ edit); PR still draft.

---

VERIFIED — ratifiable (holds as ratifiable pending the in-flight gate_m6 verdict; not marking ready, not merging). All 4 SHOULD-FIX + 6 NOTE resolved; the sole residual is a cosmetic off-by-one in §4.3 B that changes no classification or claim.