Enterprise Calculus

A falsifiable, self-verifying mathematical foundation for enterprise viability.

Enterprise Calculus models an enterprise as a stochastic process over operating regimes: the state is a probability distribution p ∈ Δ(Ω), transformations are Markov kernels, and solvency is a set of regimes that admissible dynamics must keep absorbing. From nine axioms and seven primitives it derives the working vocabulary of business — tasks, workflows, departments, invoices, mergers, agents — and proves machine-checked theorems about them, several of which contradict standard practice.

Two of its axioms make predictions that real operating data could refute, and this repository ships the instruments to run that refutation. Please try.

---

What this is — and is not

It is: a mathematical theory with 29 machine-checked theorems (each paired with a mutation test that must catch a deliberately corrupted claim), two falsification instruments, and an exact, refusal-first control-layer runtime (viability kernel, safety filter, objective solver, reach-avoid planner, priced scheduler, online estimator, copy-map simulator).

It is NOT: an autonomous system, an "Enterprise OS," or anything that runs a company. It has never been validated against a real enterprise — no real firm's data has ever been through it. It is a guardrail, not a value creator: it makes ruinous actions infeasible and optimizes within a given objective; it does not invent products, find customers, or set goals. It is not financial, legal, or solvency advice (DISCLAIMER).

The two claims you can try to refute

1. The Markov property (A2). Enterprise regime transitions are memoryless — or become so after adjoining finitely many delay coordinates (an open invoice is one; that is a theorem, T29). If a real regime sequence needs unboundedly many, the algebra is wrong.
2. The tolerance floor (A4 + T12). No firm can satisfy two mutually exclusive constraints more than half the time; in general no state beats an exactly computable capacity ceiling. A sustained, significant violation refutes the constraint geometry.

Both instruments live in 03-experiments/axiom_falsification.py:

python 03-experiments/axiom_falsification.py                 # self-test (synthetic, known truth)
python 03-experiments/axiom_falsification.py --real seq.csv  # point it at YOUR regime data

60-second quickstart

git clone <this-repo> && cd enterprise-calculus
pip install -e .            # Python 3.10+, one dependency (sympy)
python verify.py            # watch it prove itself: 29 theorems, 58 mutations, 19 checks

Then try the instruments on the bundled examples:

ec-markov examples/memory_regimes.csv        # how many delay coordinates does this owe?
ec-capacity --d 3 --set 0,1 --set 1,2 --set 2,0   # joint feasibility, with certificate
ec-viability examples/firm_episodes.csv --viable 0,1,2    # insolvency hazard report

Watch it prove itself

python verify.py runs the entire epistemic stack, in order: schema self-checks, all 29 theorems, all 58 mutation tests (every one must be detected — a proof that cannot fail proves nothing), the benchmark audit and the audit's own negative test, the exact capacity LP, the falsification harness, seven runtime self-tests, the end-to-end simulated-firm demo, and the dependency-graph validator (every node's anchor string must literally occur in its file; a focus gate fails the build if abandoned formalism vocabulary reappears). CI runs exactly this.

Findings that contradict standard practice

Each is machine-checked here and re-runnable; see docs/theorems.md.

Folklore	What the calculus proves	Where
"Goodhart's law: any measured metric gets corrupted."	Goodhart is a contingent Pareto frontier, not a law. Two KPIs can both be sharp; when they cannot, the tradeoff is exact and computable.	T16–T17
"Break work into tasks with acceptance thresholds."	Thresholds do not compose. Two tasks each passing at 4/5 compose to 23/50. Only viability composes.	T23
"Two healthy companies make a healthy merger."	Two solvent firms merge insolvent exactly when the joint viable set does not factorise (cross-default).	T28
"Draw the org chart, then measure the departments."	A department is valid iff the partition is lumpable for the kernel — otherwise its numbers describe a process that does not exist.	T21
"Better dashboards, better decisions."	Observation alone can never raise capacity. Only realising a genuinely new operating regime can.	T14–T15
"Ship faster."	Time-optimal is not viability-optimal; a deadline's price is an exact exchange rate in survival probability.	T22
"More data removes the risk."	Learning shrinks the estimate's covariance to a positive floor set by market volatility — never the volatility itself.	T27
"Steady-state means safe."	Bankruptcy is a stationary distribution. Bankruptcy is a process.	D5

What is honestly open

Stated here because hiding it would defeat the point (full list: docs/open-questions.md):

• The reality gate. No real enterprise data has been through the instruments. Market proxies suggest A2 fails on a bare state space — exactly as T29 predicts — and the dilation remedy works there; a real firm's ledger is the outstanding experiment.
• Robust control. The control layer consumes the point estimate of the kernel; acting on the confidence set is unbuilt.
• Recovery. Everything keeps a solvent firm solvent. Turning around an insolvent one (drift synthesis) is open research.
• Competition, and where objectives come from. One theorem, no runtime; the reward vector is an input, not a discovery.

The strategy, stated plainly

By this theory's own analysis, a published optimal decision procedure is a commodity — everyone converges to the same equilibrium. The only durable asset is the estimated generator Q̂, a functional of a lived trajectory that cannot be copied, only lived. Publish the calculus; keep the generator. That is why everything here is public.

Repository map

00-foundations/    the theory: axioms, algebra, derived concepts, benchmark, denotation
01-specifications/ exactly 7 schemas, one per primitive (self-checking)
02-validation/     29 theorems, 58 mutations, benchmark audit, dependency graph + gates
03-experiments/    what the world can refute: the two falsification instruments
04-runtime/        the control layer: 11 exact, refusal-first modules
05-demo/           end-to-end demo on a simulated firm (which the calculus may reject)
docs/              overview, quickstart, instruments, theorems, methodology, paper
examples/          runnable sample data for the CLI instruments

Contributing

The bar is unusual and non-negotiable: add a theorem, add its mutation; every claim needs an anchor; validators never mutate the tree. See CONTRIBUTING.md. The most valuable contribution is a falsification attempt — point the instruments at real regime data and open an issue with what happened, either way.

License & citation

Apache-2.0 (LICENSE). Not financial advice (DISCLAIMER). Cite via CITATION.cff.