# CALM experiments - leveraging CALM in the PoC Shared Domain Hypergraph

**Premise.** FINOS CALM ([`tm:finos-calm`](../../hypergraph-domain/registry/external-names.yaml)) is adopted as the **generic standardized modeling language** upon which cross-industry collaboration occurs, **deeply integrated with Pathway encodings**. CALM gives us machine-readable, validatable architecture (nodes, relationships, controls, flows); Pathways gives us provenanced, gated, cryptographically-linkable process. Each is the other's missing half:

- CALM controls declare *what must hold*; Pathway runs + PoC evidence prove *that it held at runtime*.
- CALM flows describe *how a change moves through an architecture*; Trust Key deep links make *each transition followable* across contexts and substrates.

These experiments are designed for co-development with FINOS and Karl Moll (see [`../../finos-invitation/OPEN_INVITATION.md`](../../finos-invitation/OPEN_INVITATION.md)). Each has a pre-registered hypothesis in [`../../collaboration-pathways/test/HYPOTHESES.md`](../../collaboration-pathways/test/HYPOTHESES.md).

The reference artifacts:
- Architecture: [`../architecture/incident-response-fabric.calm.json`](../architecture/incident-response-fabric.calm.json)
- Flow (how a vulnerability is identified and fixed, in CALM): [`../flows/vulnerability-lifecycle.flow.calm.json`](../flows/vulnerability-lifecycle.flow.calm.json)

---

## EXP-CALM-1 - CALM controls <-> PoC gap-matrix crosswalk
**File:** [`EXP-CALM-1.controls-gap-crosswalk.yaml`](EXP-CALM-1.controls-gap-crosswalk.yaml)
**Hypothesis:** H-HG-1

Every CALM `control` in the fabric architecture cites a `tm:` anchor. Test whether those controls map cleanly onto the Gap Analysis matrix rows (each effort's "stops short of open verification") and onto the PoC evidence properties. If a CALM control has no corresponding PoC evidence property, that is a concrete, machine-detectable gap.

**Method.** Join `control.requirements[].requirement-url` (a `tm:` slug) to `gap-analysis-matrix.v1.json` rows and to `canon/standard-sections.v1.yaml` evidence-property clauses. Report unmatched controls.

**Success.** >=90% of controls resolve to a gap-matrix row AND a standard clause; unmatched controls are enumerated as candidate gaps.

---

## EXP-CALM-2 - CALM flow <-> PathwayRun / Trust Key provenance binding
**File:** [`EXP-CALM-2.flow-pathwayrun-binding.yaml`](EXP-CALM-2.flow-pathwayrun-binding.yaml)
**Hypothesis:** H-HG-2

Each transition of the vulnerability-lifecycle CALM flow declares a `pathway` and a `trust_key_deep_link`. Test whether a CALM flow can be executed as a sequence of PathwayRuns whose provenance (Aqua stub -> Trust Key root) reconstructs the exact flow, so the CALM diagram and the cryptographic evidence are two views of one artifact.

**Method.** For each transition, launch the named `Hypergraph.*` pathway; bind its run into a Trust Key; confirm the `trust_key_deep_link` resolves back to the transition. Compare the reconstructed transition graph to the CALM flow.

**Success.** The reconstructed graph is isomorphic to the CALM flow, and every deep link verifies offline.

---

## EXP-CALM-3 - Per-customer in-situ PoC instantiation as a CALM pattern
**File:** [`EXP-CALM-3.in-situ-poc-pattern.yaml`](EXP-CALM-3.in-situ-poc-pattern.yaml)
**Hypothesis:** H-HG-3

The "process is the product" thesis: a customer's PoC standard is instantiated in situ from their threat vectors. Test whether `Hypergraph.PoC.InstantiateInSitu@v1` can emit a **valid CALM pattern** (a reusable, parameterized architecture fragment) specialized to a customer's threat profile, such that CALM tooling validates it and it composes the relevant SDG controls.

**Method.** Feed a synthetic threat profile (via `Hypergraph.Underwrite.ThreatProfile@v1`) into the in-situ pathway; emit a CALM pattern selecting nodes/controls from the six SDGs; validate against the CALM meta-schema.

**Success.** The emitted pattern validates under CALM and includes exactly the SDG controls implied by the threat profile (no more, no fewer).

---

## EXP-CALM-4 - AIGF / CCC control catalog mapped onto SDG hyperedges
**File:** [`EXP-CALM-4.aigf-ccc-hyperedge-map.yaml`](EXP-CALM-4.aigf-ccc-hyperedge-map.yaml)
**Hypothesis:** H-HG-4

Karl Moll convenes the AIGF ([`tm:finos-aigf`](../../hypergraph-domain/registry/external-names.yaml)) x CCC ([`tm:finos-ccc`](../../hypergraph-domain/registry/external-names.yaml)) x CALM convergence for governable-AI reference architectures. Test whether AIGF risks and CCC controls map onto the SDG hyperedges, so a CALM reference architecture can be generated per PoC domain.

**Method.** Map AIGF risk categories and CCC controls to `hyperedges.yaml` entries across the six SDGs; emit, per hyperedge, a CALM reference-architecture fragment with CCC controls attached.

**Success.** Each of the six SDGs yields at least one validating CALM reference-architecture fragment whose controls trace to CCC and whose risks trace to AIGF.