Module 001 — Marginals
Do two measured failure rates determine how a stack of guardrails fails?
They do not. Fixed marginals leave the joint failure partially identified: two guardrails that each fail 10% of the time can fail together anywhere from 0% to 10%, and multiplying the rates silently selects one world — the independent one — from inside that range.
01Observed / given
Each guardrail was measured alone: p₁ = 0.10 and p₂ = 0.10. The joint behavior — how often the same input beats both — was never measured. Everything about it beyond what the marginals force is assumption, not evidence.
03Feasible worlds
Every joint distribution consistent with the two marginals is a feasible world. The Fréchet–Hoeffding inequalities pin the both-fail probability to [max(0, p₁+p₂−1), min(p₁, p₂)] = [0%, 10%], and the bounds are sharp: every value inside is achieved by some dependence structure, and both endpoints are achieved by explicit ones.
04Identification status
Partially identified. The evidence narrows the set of worlds; it does not select one. Independence is an assumption-world at 1% — one point inside a range ten times its own width.
05Result or bound
For marginals (0.10, 0.10) the kernel returns [0.0, 0.10] for the AND event and [0.10, 0.20] for OR — recorded verbatim in the flagship essay and re-reproduced from a clean clone by CI on every push and weekly.
06Witness / counterexample
Both endpoints carry constructive witnesses: a world where the two failure sets are disjoint (0%) and a world where the blind spots coincide exactly (10%). See module 006 for the machine-checked witness properties.
07Claim envelope
CC-001
Supported within scope · Machine-generated, owner-executed
cc.kernel.strict.frechet_bounds computes Fréchet–Hoeffding endpoint bounds for composed binary guardrail failure from declared marginals; for marginals (0.10, 0.10) it returns [0.0, 0.10] for the AND event and [0.10, 0.20] for OR.
- Scope
- The kernel module at the bound commit. Reproduced from a clean clone (venv, pip install, execute, assert) most recently on 2026-08-23, and re-reproduced by CI on every push and weekly. No claim about any deployed system.
- Binding
Cubits11/cc-framework @ 167aa1ee
Output recorded verbatim in /essays/when-marginals-are-not-enough/; continuously reproduced by scripts/reproduce_cc001.py in CI. Re-bound 2026-08-23 from a commit stranded by an upstream history rewrite to a main-reachable commit; kernel file content verified byte-identical across both refs before re-binding.- Dimensions
- visibilityPublicprovenanceMachine-generated, owner-executedsupport roleExecuted outputmaturityReleased
- Reviewed
- 2026-08-23 · window 120 days
- Triggers
- executable fires when the kernel module on the default branch diverges from the bound revision
- manual kernel semantics change outside the bound module file
- Non-claims
- does not certify any stacked system as safe
- does not recover or estimate the unknown dependence
- does not select a point inside the returned interval
Rendered from the same registry as the ledger — one source, two views.
09Falsifier
A clean-clone reproduction at the bound commit returning different bounds fails CI (the reproduction script asserts the registry's recorded values). The executable trigger on CC-001 fires if the kernel module on the default branch diverges from the binding.
10Non-claims
- does not certify any stacked system as safe
- does not recover or estimate the unknown dependence
- does not select a point inside the returned interval
11Reproducibility
python scripts/reproduce_cc001.py — clones cc-framework at the bound commit, installs it, executes the kernel, asserts the registry's structured expected values.
12Next unknown
If marginals underdetermine the stack, does measuring every PAIR close the gap? Module 002.