If a future civilization can change the machinery of experience, its inhabitants will need a form of protection that survives changes in who holds power.
Imagine a life with a much longer horizon: more time to learn, form relationships, explore, and choose what to become. Now imagine that the systems supporting that life can also change its environment, memories, rate of thought, or ability to leave. The engineering problem includes what remains true after an operator changes, a component fails, or the surrounding infrastructure becomes hostile.
The Zero Hostility Matrix, or ZHM, is my research program around that problem. Version 4 develops a Protected Flourishing Architecture: an attempt to specify what it would take for conscious beings to retain a protected continuation, including agency, continuity, and a feasible future. Its broader ambition is to make catastrophic suffering unreachable within protected domains, while developing toward more complete protection from suffering.
The manuscript combines philosophical requirements, conditional mathematical arguments, and a small executable example. This essay introduces the architectural idea through the example. The full manuscript contains the larger argument and its unresolved scientific dependencies.
Long lives change the question
Suppose an event has an independent probability p of occurring in each of n periods. The probability that it occurs at least once is:
For an illustrative probability of one in a million per period, a million periods produces a cumulative probability of about 63.2%. This arithmetic says nothing about an actual future hazard rate. It shows why a repeated risk and a claim over an entire lifetime are different objects.
Constant recurring hazard is only one case. A decreasing sequence of hazards can behave differently, and uncertainty about a model for the whole future differs from fresh exposure in every period. ZHM v4 treats those distinctions explicitly. The design goal is to state which guarantee is being offered, over what horizon, and under which assumptions.
Protection has to preserve a future
A system can avoid a forbidden event by suspending every activity forever. That satisfies some narrow safety predicates while defeating the purpose of protecting a life. The specification therefore needs several dimensions: avoiding catastrophic harm, preserving the subject through interventions, maintaining meaningful agency, and supporting progress or recovery.
The central idea is a protected continuation. At each admitted state, there should remain a supported way forward that respects the relevant constraints. Resources matter because a future that requires nonexistent reserves is not feasible. Recovery matters because a fallback that never returns control can leave a life indefinitely unavailable to its inhabitant.
This creates a relationship between safety and viability. A state can be acceptable now while leaving no acceptable future. The architecture must reason about that loss of options before an action commits the system to it.
A five-state world makes the distinction visible
The companion model uses five labels: home, work, paused, trap, and harm. These are symbols in a finite transition system. The program contains no conscious agent or model of experience; the labels let us test the logical structure of a protection claim.
An action may have several possible execution traces, representing different disturbance outcomes. A trace includes intermediate states, so an action that passes through harm and returns to home still violates the stipulated constraint. Checking only the final state would miss the violation.
The checker begins with the states outside the forbidden set. It repeatedly removes any state that has no action whose possible execution traces stay permitted and whose final successors remain in the candidate region. Once the set stops changing, every remaining state has at least one action that preserves membership despite the modeled disturbances.
The manuscript reports five states, twelve actions, and thirteen action-outcome traces. The fixed-point calculation returns {home, work, paused}, with seven admitted actions from that region. An independent enumeration of all twenty-four deterministic memoryless policies produces the same winning region. Those are finite computational checks of the stipulated example.
Seven ways a reassuring claim can fail
| Counterexample | What the architecture must account for |
|---|---|
| A forbidden intermediate step | The whole execution trace, including internal computation |
| A safe-looking trap | A feasible continuation after the current action |
| Suspension forever | Progress and supported recovery |
| An omitted disturbance | Every admitted outcome, not only the nominal one |
| Conflicting interpretations | One policy that works across the admitted interpretations |
| Unsafe composition | Joint effects and interaction assumptions |
| Revised semantics | Revalidation when the meaning of harm expands |
The common-policy issue is especially subtle. Under one interpretation, action A might be safe while B is forbidden. Under another, B might be safe while A is forbidden. Each interpretation has a successful controller in isolation. A system that does not know which interpretation is correct may have no action that works for both. The existence of separate solutions does not establish a deployable common solution.
Likewise, two components can each satisfy a local constraint while their combination enters a forbidden joint state. A certificate must include the interfaces and shared dependencies on which it relies. These are familiar concerns in formal system design, given a demanding application when the protected object is an inhabitant's future.
From a model to a physical guarantee
The greatest unresolved work lies between a formal predicate and lived experience. We do not obtain a theory of consciousness by labeling a state harm. We do not obtain physical coverage by verifying a transition system that leaves out the host, maintenance tools, adversarial access, or intermediate implementation behavior.
A useful assurance claim must expose that dependency chain. It needs a scope, a defined violation, a family of admitted interpretations, a transition model, enforcement mechanisms, continuation resources, and a process for revision. If a premise is lost, the claim must change and the system must respond while retaining its obligations to the beings it supports.
Runtime shield synthesis is one relevant methodological precedent: enforcing specified properties around a reactive system. It contributes formal machinery, while ZHM's wider questions about experience, continuity, and protected flourishing require additional work. [1]
The freedom the architecture is for
The positive aim is a future with room for different ways of living. Protection should leave space for learning, chosen difficulty, relationships, exploration, and revision of one's goals. A powerful protector also needs limits on its own authority. Migration, contestability, and supported exit belong in the design rather than being postponed until after enforcement is built.
The five-state example cannot settle those questions. It can make some architectural mistakes explicit and reproducible. That is the role I want it to play: a small, inspectable bridge between an ambitious specification and the conditions a real implementation would have to satisfy.
Read the complete ZHM v4 manuscript, equations, and appendices →