EAL v1

Status: implementation in progress; no EAL production activation is claimed.

eal-v1 is experimental, informational risk data. It annualizes the existing published issuer-model EDL and allocates that same total across supported factor identities. It is not an independent factor-frequency forecast, a cover quote, or an actuarially calibrated premium.

Existing measure and exact annualization

For an eligible vault:

annual_eal_bps = 4 × published edl_bps_3m

The multiplication uses the published four-decimal string, with integer arithmetic. It neither recomputes an unrounded EDL nor compounds or caps the result. The original EDL field remains unchanged.

The existing EDL divides modeled loss from mapped, scored issuers by all observed dependency dollars in the closure. Unmapped dependency dollars remain in that denominator. EAL preserves this basis; it does not divide by only mapped dollars or by vault TVL. Every available value retains mapped_share and the statement unmapped exposure is unknown, not zero.

Under constant hazard, fixed severity and a fixed exposure interpretation, 1 - (1 - p)^4 <= 4p bounds annualization of each modeled mapped component. This conditional rationale is not a bound on unknown unmapped risk, whole-vault loss, changing exposures or model error.

Availability and provenance

A missing EDL or any of low_coverage, data_gap, and stale_model makes EAL unavailable, even if an older numeric EDL remains in the response. Unavailable values and factor buckets are null, never numeric zero. An eligible published zero remains a legitimate model output; it is not a claim of zero actual risk.

The proxy also refuses to use model, map or score information that became available after its as-of time. A graph snapshot alone does not identify these inputs. Results bind the graph snapshot and time, model version and bundle hash, exact model-context hash, issuer-map version and hash, issuer-score input hash and availability, factor publication manifest, and implementation revision. Source hashes retain the original six-digit PostgreSQL timestamps; eligibility rounds availability upward to milliseconds so sub-millisecond future evidence cannot enter early. Factor evidence retains the PHI-145 point-in-time and current-retained-cohort selection rule; it is not a reconstruction of historical parent/disposition states. With the flag enabled, a missing vault payload is null and excluded from the numeric aggregate. A cache fault or corrupt EAL generation makes the optional EAL block null, without changing the existing look-through or policy response. Missing closure exposure has no measured dollar amount; the unavailable vault identity remains explicit.

Factor allocation

Factor amounts are allocations of the issuer-model annual total. They are not independently estimated factor frequencies, additional loss, or additive pricing premiums on top of EAL.

Only exact, verified look-through factor identities can match source-backed PHI-145 allocations. A provider name, common mechanism, symbol, or unverified registry relationship cannot create a match. Missing identity bindings and unresolved corpus loss remain unattributed. Verified bridge entity IDs retain their canonical bridge: namespace. Current signer_set: graph IDs have no reviewed crosswalk to attribution signer: identities; shared names or suffixes do not create a match. No exposure age or exposure-years are inferred.

For each matched factor type, allocate its eligible attributed-loss share of the same published EAL. Integer truncation and every unmatched remainder stay in the unattributed bucket. The five factor-type buckets plus unattributed reconcile exactly to the published annual total. A zero assigned factor bucket means no proxy amount was assigned there; it is not evidence of zero factor risk.

If the factor partition is unavailable, the annual issuer proxy can remain available with the whole amount unattributed and explicit missing factor coverage. This does not turn missing evidence into an observed zero.

Portfolio aggregation

Aggregate available values by their observed dependency-dollar basis under the calling graph endpoint's stated position normalization. Look-through weights the whole selected closures by their observed dependency dollars. Check normalizes each position across its closure's dependency dollars, whose sum is the supplied position amount. Neither route divides by vault TVL. Do not weight these bps as though they were bps of vault TVL. Unavailable positions are excluded from the numeric aggregate and reported separately with their dependency-dollar amount, share and identities. An entirely unavailable portfolio has no numeric aggregate. Rounding residuals again remain unattributed, preserving exact bucket reconciliation and input-order invariance.

API, signing and rollout

The implementation is additive behind GRAPH_EAL_ENABLED, disabled by default. Look-through and check blocks carry version eal-v1, horizon 1y, annualization rule, basis, coverage, as-of time, maturity experimental and source provenance. Existing EDL, exposure findings and policy results retain their own semantics.

EAL is an informational signed input. It does not enter policy limits, findings, approve/caution/reject evaluation or tier transitions. The existing service signer binds it to the decision envelope; no person signs or approves the model output by virtue of that service signature. Disabling the feature reverses the new read/materialization path while retaining durable evidence and previous decisions.

A source-bound Morpho example with qualifier ok is retained in docs/methodology/examples/eal-v1-morpho-20261020-v2.json and rendered by scripts/eal-worked-example.mts. Its captured model, map and issuer scores reproduce the exact published EDL at the pinned snapshot. The tested pure kernel generates its annual value and factor buckets; no values are entered by hand. This retrospective derivative is not a historical EAL publication or a backtest. No cover provider or design partner is claimed.

Existing published disclaimer

The following wording is reused verbatim from the published methodology overview:

• Not a guarantee of safety
• Not a guarantee of returns
• Not investment advice
• Not legal or regulatory certification

Independent exposure-normalized factor frequencies, out-of-sample calibration and any actuarial premium interpretation remain separate future work. Their deferred exposure-years denominator does not block this approved annualization proxy.