QESIS+ Digital Twin OS · vintage v8.6 (2026-08-09)
Seven physical and institutional axes across 35 states. Every number on this page traces to a hashed asset, and every state without sufficient coverage is published as a gap rather than filled with an estimate.
Composite exposure combines the seven axes under declared weights. Higher means more exposed. Countries below the coverage threshold are named beneath the table rather than ranked, because a rank computed on missing data is a guess wearing a number.
Composite substrate exposure, most exposed first
32 states ranked, 3 excluded for coverage. Today's highlighted state rotates.
| # | State | Composite | Relative |
|---|---|---|---|
| 1 | Saudi Arabia | 75.6 | |
| 2 | United States | 68.2 | |
| 3 | Spain | 60.2 | |
| 4 | Belgium | 59.7 | |
| 5 | Bahrain | 58.1 | |
| 6 | United Arab Emirates | 56.5 | |
| 7 | Qatar | 50.9 | |
| 8 | Poland | 49.1 | |
| 9 | India | 48.7 | |
| 10 | Chile | 47.7 | |
| 11 | Israel | 46.8 | |
| 12 | Netherlands | 46.1 |
Source: QESIS+ v8.6 (2026-08-09) canonical index, asset QES-A0001, coverage 32/35 states, vintage v8.6 (2026-08-09).
The selection rotates daily across the ranked sample. This is an instrument for 35 states, and pinning one of them to the front page would quietly turn it into a case study about that state.
Canada across seven axes
Composite 26.0. Binding constraint: Rare Earth Element Stress at 55.5. Full coverage on all seven axes.
| Axis | Score | Relative to scale |
|---|---|---|
| WSE Water Stress Exposure | 24.7 | |
| CSE Cable Stress Exposure | 9.7 | |
| REE Rare Earth Element Stress | 55.5 | |
| FPE Foreign Platform Exposure | 25.0 | |
| ODI Operator Dependency Index | 25.0 | |
| CRD Cloud Risk Density | no coverage | |
| ESE Electricity Stress Exposure | 29.0 |
Source: QESIS+ v8.6 (2026-08-09) axis scores, asset QES-A0001, coverage see per-axis flags above, vintage v8.6 (2026-08-09).
An agent here cannot publish, spend, or grant itself privilege. High-risk operations stop at a gate and wait for a named person. That is a legal requirement under Article 14, and it is also the negative feedback that keeps a coupled system from running away from its operator. Twenty-five decisions currently sit behind it.
One thousand simulated deployments, calibrated on declared anchors and run through the local fsQCA engine, confirm both specified failure configurations and add a third result that was not specified. No condition is necessary on its own, so there is no single dial to watch. Concurrency and recursion depth together form the core of every surviving term. And the term carrying a human gate still survives the consistency cutoff at 0.822 under tool-switching, which says plainly that human oversight attenuates failure without preventing it. Solution coverage is 0.406, so this model explains part of the picture and is stated as partial.
| # | Decision | Risk | Unblocks on approval |
|---|---|---|---|
| 1 | Authorization boundary for autonomous GitHub PR generation and auto-merge | HIGH | Agents may open PRs; auto-merge stays closed until separately signed |
| 2 | Self-modification constraints for local agentic scripts | CRITICAL | Bounded self-edit inside `qesis_agents/`, never to the gate or the chain |
| 3 | Threshold limits for automated API token use and cloud provisioning | HIGH | Metered external calls under a declared cost envelope |
| 4 | Cross-repository refactoring without manual peer review | HIGH | Multi-repo edits; currently every repo is reviewed singly |
| 5 | Revocation protocol and emergency kill-switch parameters | CRITICAL | The stop control. **Read the analysis above: this is not redundant with the approval gate.** |
| # | Decision | Risk | Unblocks on approval |
|---|---|---|---|
| 6 | Licence resolution and monetization clearance for the unlicensed documents | HIGH | The content ladder. This is the binding constraint on all revenue. |
| 7 | External scraping parameters and data-feed integration policy | HIGH | SCOUT may collect beyond the local corpus |
| 8 | Data-masking verification for public commits (D-026) | HIGH | Public push; the credential gate already runs, this signs its scope |
| 9 | Embedding space integrity sign-off, 768 dimensions | MEDIUM | Confirmed: pgvector 0.8.2, `vector(768)`, matching nomic-embed-text |
| 10 | Dataset versioning and archival synchronization manifests | MEDIUM | Citable dataset releases with a persistent identifier |
| # | Decision | Risk | Unblocks on approval |
|---|---|---|---|
| 11 | Calibration bounds for behavioral simulation weights | HIGH | Simulated stakeholder response enters analysis with declared bounds |
| 12 | Macro-geopolitical scenario variables for the analytical models | HIGH | Scenario runs beyond the canonical vintage |
| 13 | Bias mitigation and variance thresholds for decision-support output | HIGH | Agent output may inform an external recommendation |
| 14 | Real-time telemetry integration from the reporting layer | MEDIUM | Live dashboard feeds rather than periodic exports |
| 15 | Structural drift criteria between the twin and real institutional metrics | HIGH | Automated drift alarms with a defined trigger |
| # | Decision | Risk | Unblocks on approval |
|---|---|---|---|
| 16 | Automated audit trail linking ticket closures to commits | MEDIUM | Closure evidence generated rather than asserted |
| 17 | Formal risk management framework documentation | HIGH | Closes the last substantive ISO 42001 clause gap |
| 18 | Human oversight protocol for high-risk classification changes | CRITICAL | Who may reclassify a system, and on what evidence |
| 19 | Transparency and explainability metrics for RAG retrievals | MEDIUM | Retrieval already returns matched terms and both component ranks; this signs the standard |
| 20 | Review schedule and accountability for the human supervisor | HIGH | Names the reviewer and the cadence. **Currently one person, which is risk R-01.** |
| # | Decision | Risk | Unblocks on approval |
|---|---|---|---|
| 21 | Publishing rights for thesis outputs and the governance dashboard | HIGH | The dashboard goes public; blocked also by the two design defects |
| 22 | Commercialization boundaries and IP protection for the architecture | HIGH | The licence split that is the business model |
| 23 | External ecosystem integrations, enterprise collaboration channels | HIGH | Third-party connectors touch the boundary; each needs its own review |
| 24 | Pricing, access tiering and data-sharing agreements | HIGH | The institutional tier becomes sellable |
| 25 | Master go-live authorization, staging to active autonomous operation | CRITICAL | Everything. Signed last, on the evidence of the other 24. |
Every asset carries an identifier, a SHA-256 and a lineage note. The register is re-checkable end to end: each entry can be recomputed from the file it names, and the audit chain commits each entry to its predecessor, so a retroactive edit breaks the chain downstream where an auditor can see it.
Coverage below 0.75 excludes a state from ranking. The gap is published as a finding and never imputed. Correlations are reported with a named confounder and a stated falsifier or they are not reported as findings at all, which is enforced in code rather than by good intentions: the analysis tool refuses to return an interpretation without both.
What would falsify the headline reading: stratify the sample by jurisdiction tier. If the cross-axis associations collapse inside every tier, the pooled coefficients were composition rather than mechanism, and the composite would need rebuilding on tier-relative rather than absolute terms.
One page per state: seven axis scores, the binding constraint, coverage flags and the full source trail. Free, licensed CC BY-NC. Commercial use needs an institutional licence.
Your address is used to send this sheet and nothing else unless you ask for the monthly note. It is stored inside the EU, never sold and never shared. Unsubscribe in one click. Lawful basis: consent, GDPR Art. 6(1)(a). The processor list and full terms live in the privacy policy. This form is not yet connected to a backend, and it says so rather than silently discarding what you type.