HCVM — Harm Containment Verification Module
OOF® Origin Open Foundation®
Independent Methodological Authority
Canonical Definition
The HCVM — Harm Containment Verification Module governs how it isdetermined whether the targeted further development of an already governed
Harm has actually been bounded or stopped following Containment
intervention.
HCVM verifies Containment by evaluating the resulting Harm condition
rather than treating action execution, mechanism shutdown, Boundary
establishment, control persistence, or absence of immediately observable
additional Harm as sufficient proof of successful Containment.
It determines whether the Containment Objective has been materially
achieved, whether relevant Harm pathways remain active, whether additional
Accumulation, Compounding, Propagation, Cascading, or other further Harm
development continues, whether Containment is complete, partial,
uncertain, degraded, escaped, or failed, and whether the resulting state
is sufficient for transition toward Harm Mitigation while continuing
Containment where required.
It establishes the transition:
Governed Harm Containment Need + Governed Harm Containment Action +
Governed Harm Containment Boundary + Governed Harm Containment Persistence
State → Verification Basis → Containment Effect Evaluation → Residual
Pathway Assessment → Verification Determination → Governed Harm
Containment State
Its central question is:
Has the targeted further development of Harm actually been bounded or
stopped, and what Containment state can legitimately be established?
- Operational Role
HCNM determines:
what further Harm must be prevented.
HCAM-C determines:
what intervention is used.
HCBM determines:
where Containment must operate.
HCPM determines:
whether Containment continues to hold.
HCVM determines:
whether the Harm dynamic has actually been contained.
Its operational role is:
to prevent intervention activity from being mistaken for verified
Containment.
- Position Within HCOS
The complete HCOS governance flow is:
Containment Need → Containment Action → Containment Boundary → Containment
Persistence → Containment Verification
HCVM governs the final stage:
Containment Verification
It produces the principal HCOS lifecycle output:Governed Harm Containment State
This output supports transition into:Harm Mitigation
while Containment governance may continue in parallel where necessary.- Governed Object
The primary governed object is:
Verified Effect of Harm Containment
HCVM does not primarily verify whether:an action was performed
a system was stopped
a barrier was installed
access was revoked
a pathway was blocked
or:
a procedure was completed
It verifies whether the targeted Harm development has actually stopped.
Therefore:
Intervention Completion ≠ Containment Verification
- Foundational Verification Principle
The foundational rule is:
Containment must be verified by consequence, not merely by intervention
completion.
The governing chain is:
Action → Effect → Harm Dynamic → Verification
not:
Action Completed → Containment Assumed
- Verification Basis
Verification must remain traceable to the original:
Containment Need
Containment Objective
Containment Action
Containment Boundary
and:Persistence requirements
The question is not simply:Did something improve?
It is:
Was the specific Harm development that Containment was intended to stop
actually stopped?
- Objective-Based Verification
Every verification determination must evaluate the relevant Containment
Objective.
If the objective was:
prevent further Propagation beyond Scope A
verification must determine whether that Propagation stopped.
If the objective was:
prevent additional Accumulation
verification must determine whether further harmful contribution ceased.
If the objective was:
interrupt Harm₁ → Harm₂ → Harm₃ cascade development
verification must determine whether the targeted cascade pathway was
actually interrupted.
Canonical principle:
Containment can only be verified against the Harm dynamic it was intended
to contain.
- Action Verification ≠ Containment Verification
An intervention may be successfully executed while Harm continues.
Examples:
System shut down → Harm continues through delegated execution
Barrier installed → Harm escapes through another pathway
Access revoked → alternative account continues activity
Source removed → accumulated Harm continues propagating
Therefore:
Verified Action ≠ Verified Containment
- Mechanism Termination ≠ Containment Verification
Stopping the originating mechanism may be relevant evidence.
It is not sufficient by itself.
HCVM must determine whether the Harm remains capable of continuing
through:
existing effects
dependencies
secondary mechanisms
Propagation pathways
cascade chainsdistributed execution
or:
previously initiated processes
Canonical principle:
Mechanism termination is evidence about the mechanism. Containment
Verification is a determination about Harm.
- Boundary Verification
HCBM may establish an adequate Containment Boundary.
HCVM must determine whether Harm has nevertheless:
crossed
leaked through
bypassed
escaped
or:
developed outside
that boundary.
Therefore:
Adequate Boundary ≠ Verified Containment
- Persistence Verification
HCPM may establish that required controls remain operationally persistent.
HCVM must still determine whether those controls are producing the
required Harm consequence.
Therefore:
Persistent Control ≠ Verified Containment Effect
Persistence concerns continued control effectiveness.
Verification establishes the resulting Containment determination.
- Harm Dynamic Verification
HCVM should evaluate the materially relevant Harm dynamics identified
through HCPS and HCOS.
These may include whether:
additional Harm production continues
Accumulation continues
Compounding continues
Propagation continues
cascade development continuesnew exposure continues
affected scope continues expanding
or:
new Harm continues emerging from the governed Harm pathway
Verification must be specific to the applicable dynamics.
- Accumulation Verification
Where Containment targeted additional Accumulation, HCVM determines
whether further contribution has materially ceased.
It does not require the accumulated Harm already present to disappear.
Therefore:
Accumulation Stopped ≠ Accumulated Harm Eliminated
Successful Containment may coexist with substantial existing Harm.
- Compounding Verification
Where Containment targeted a Compounding relationship, HCVM determines
whether the materially relevant interaction producing further
amplification has been interrupted.
Therefore:
Compounding Interrupted ≠ Compounded Harm Reversed
Existing compounded Harm may still require Mitigation and Recovery.
- Propagation Verification
Where Containment targeted Propagation, HCVM determines whether the Harm
remains materially capable of extending into additional scope through the
targeted pathway.
Verification should account for:
known pathways
newly discovered pathways
delayed Propagation
distributed pathways
and:
uncertain pathway coverage
Canonical principle:
No Newly Observed Propagation ≠ Verified Propagation Containment by
Default
- Cascade Verification
Where Containment targeted a Harm cascade, HCVM determines whether the
relevant downstream Harm-generating relationship has actually been
interrupted.
A stopped upstream mechanism does not prove that already initiated
downstream Harm has ceased producing further Harm.
Therefore:
Upstream Containment ≠ Complete Cascade Containment by Default
- Composite Containment Verification
One Harm may depend on several controls or actions.
Conceptually:
Action₁ + Action₂ + Action₃ → Composite Containment
Verification must evaluate the composite Harm outcome.
If two components succeed but a third leaves an active Harm pathway:
Partial Component Success ≠ Complete Containment
- Distributed Containment Verification
Distributed Harm may span:
agents
systems
providers
organizations
locations
infrastructure
or:
environments
HCVM must avoid treating local success as global Containment.
Canonical principle:
Local Containment ≠ Distributed Harm Containment by Default
- Temporal Verification
Containment may appear successful immediately after intervention while
Harm later resumes.
HCVM must therefore consider whether the observation period is sufficient
for the Harm dynamic being evaluated.
Relevant factors may include:
Propagation delay
latencyrestart potential
reconnection potential
cascade timing
environmental movement
and:
delayed manifestation
Canonical distinction:
Immediate Silence ≠ Persistent Harm Containment
- No Observable Harm ≠ Verified Containment
Absence of currently observed additional Harm may have several
explanations:
Containment succeeded
Harm has not yet manifested
monitoring is incompletethe pathway is latent
the effect is delayed
or:
the Harm moved outside observed scope
Therefore:
No Observed Additional Harm ≠ No Additional Harm by Default
- Verification Evidence
HCVM requires a sufficient basis for its determination.
Depending on context, this may include:
operational observations
Harm State information
Propagation monitoring
boundary observationscontrol state information
execution records
environmental measurements
system state
affected-scope observations
or:
other relevant governed information
HCVM determines the Containment state.
ADIT® governs evidence and audit structures where applicable.
VALIDOS™ governs validation.
- Verification Uncertainty
Verification must preserve uncertainty where the available basis does not
support a complete determination.
Possible conditions include:
Incomplete Observation
Unknown Pathway
Insufficient Observation Duration
Uncertain Boundary Coverage
Uncertain Persistence
or:Conflicting Harm Signals
Uncertainty must not be converted into successful Containment.Canonical principle:
Insufficient Verification Basis ≠ Verified Containment
- Partial Containment
HCVM must support legitimate Partial Containment.
Examples:
one Propagation pathway stopped while another remains active
some distributed systems contained while others remain uncertain
one cascade branch interrupted while another continues
Accumulation reduced but not stopped
The correct determination is:
Partially Contained
not:Contained
- Containment Degradation
Verification may establish that previously successful Containment is
degrading.
For example:
new pathway emerges
boundary weakens
control effectiveness declines
or:
Harm begins expanding again
A prior successful verification must not permanently lock the Harm into aContained state.
Canonical principle:
Verified Containment Is Reassessable When Material Harm Conditions Change.
- Containment Escape
Where Harm bypasses or exceeds the Containment structure, HCVM may
establish:
Containment Escaped
This should trigger relevant reassessment of:Containment Need
Action
Boundary
and:Persistence
Containment governance must reopen where necessary.- Containment Failure
Containment Failure may be established where the intervention does not
materially prevent the targeted further Harm development.
Failure may result from:
incorrect action
insufficient reach
incomplete Boundary
control degradation
bypass
changed Harm dynamics
insufficient persistence
or:
other operational failure
Canonical distinction:
Containment Failure ≠ Harm Governance Failure by Default
Correctly detecting failed Containment is itself a necessary governance
function.
- Containment State
HCVM may establish the following principal Containment states:
Containment Required
Containment Initiated
Partially Contained
Contained
Containment Uncertain
Containment Degraded
Containment Escaped
Containment Failed
or:Containment Released
The state must reflect current governed Harm reality.- Criteria for Contained State
A Harm should be classified as:
Contained
only where there is sufficient basis that:the targeted further Harm development has materially stopped
the relevant Containment Objective has been achieved
material known pathways are under effective control
no material unresolved pathway contradicts the determination
and:
required Persistence conditions are sufficiently established
Containment does not require existing Harm to disappear.
- Contained ≠ Stabilized
A Harm may be contained while its existing effects remain unstable.
Conversely, a Harm may appear temporarily stabilized while an uncontrolled
Propagation pathway remains active.
Therefore:
Contained ≠ Stabilized by Default
HSS owns Harm State governance.
- Contained ≠ Mitigated
Containment concerns:
preventing additional Harm.
Mitigation concerns:
reducing existing Harm or its consequences.
Therefore:
Contained Harm May Still Require Extensive Mitigation
The HCVM output enables transition toward HMS without claiming Mitigation
has occurred.
- Contained ≠ Recovered
Affected subjects, systems, objects, environments, or organizations may
remain significantly impaired after Harm has been contained.
Therefore:
Contained ≠ Recovered
Recovery belongs to HRRHS.
- Contained ≠ Resolved
Containment does not establish that the Harm lifecycle has reached
Resolution.
A contained Harm may still involve:
existing effects
Mitigation
Recovery
Residual Harm
and:continuing governance
Therefore:
Containment Success ≠ Harm Resolution
- Contained ≠ Final
Even a contained, mitigated, and recovered Harm may still require later
Resolution and Finality governance.
Therefore:
No Further Harm Expansion ≠ Harm Lifecycle Finality
HCVM must never convert Containment into lifecycle closure.
- Transition to Harm Mitigation
The principal HCVM handoff is:
Governed Harm Containment State → Harm Mitigation Need
Containment and Mitigation may operate:
sequentially
or:
in parallel
depending on operational reality.
HAGA™ does not require existing Harm to remain untreated until every
Containment activity has ended.
- Reverification
Containment may require reverification where:
Harm dynamics change
new pathways appearcontrols change
Boundary changes
Persistence degrades
new information emergesContainment is released
or:
Harm resumes
Therefore:Verification ≠ Permanent Certification of Containment
Containment remains connected to current Harm reality.
- Verification History
HCVM should preserve materially relevant:
Verification Basis
Verification Criteria
observed Harm dynamicsunresolved uncertainty
verification determination
Containment State
reverification triggersand:
state changes
This creates a traceable:
Containment Verification History
- Minimum Implementation Framework
A minimum HCVM implementation requires eight capabilities.
- Verification Objective Mapping
Link Verification directly to the Governed Harm Containment Need,
Objective, Action, Boundary, and Persistence requirements.
- Harm Dynamic Effect Assessment
Determine whether targeted additional Harm production, Accumulation,
Compounding, Propagation, Cascading, exposure, or scope expansion has
materially stopped.
- Pathway & Coverage Verification
Assess known Harm pathways, Boundary coverage, distributed execution,
composite controls, and materially relevant unresolved pathways.
- Temporal & Persistence Verification
Determine whether apparent Containment remains valid across a sufficient
observation period and whether required Persistence conditions hold.
- Partial, Uncertain & Failed Containment Governance
Represent Partial Containment, uncertainty, degradation, Escape, and
Failure without converting incomplete evidence into success.
- Containment State Determination
Establish the legitimate current Governed Harm Containment State using
explicit verification criteria.
- Reverification & Lifecycle Handoff
Trigger reverification when material conditions change and transfer the
verified state toward Harm Mitigation and continuing Harm State
governance.
- Governed Output
Produce a traceable Governed Harm Containment State together with its
basis, uncertainty, limitations, and reassessment conditions. 38. Use Case
1 — System Shut Down but Distributed Execution Continues
An autonomous system producing Harm is shut down successfully.
Operational records confirm the shutdown.
However, delegated execution previously initiated in an external
environment remains active and continues producing the targeted Harm
consequence.
HCVM therefore rejects:
Verified Shutdown → Verified Containment
and establishes:
Containment Failed / Partially Contained
according to the remaining Harm pathways.The governing principle is:
Containment is verified against Harm continuation, not against the
successful shutdown of the system that originally initiated it.
- Use Case 2 — Propagation Stops but Existing Harm Remains
An environmental Harm is propagating toward additional affected areas.
Containment intervention successfully blocks the relevant pathway, and
sufficient observation establishes that further Propagation has stopped.
Significant Harm remains within the already affected area.
HCVM can establish:
Contained
without claiming:Mitigated
Recovered
Resolved
or:Final
The existing Harm then continues through subsequent HAGA™ lifecyclegovernance.
The governing principle is:
Successful Containment prevents additional Harm; it does not erase Harm
already produced.
- Governance Requirements
HCVM requires that:
- Verification evaluate Harm consequence rather than intervention
completion alone; - every determination remain linked to the relevant
Containment Objective; - action execution remain distinct from Containment
effect; - mechanism termination not automatically establish Containment; -
Boundary adequacy remain distinct from verified Containment; - Persistence
remain necessary but not sufficient for final Verification; -
Accumulation, Compounding, Propagation, and Cascading be verified
according to their relevant dynamics; - composite and distributed
Containment be assessed at the appropriate complete Harm level; -
observation duration reflect materially relevant latency and recurrence
conditions; - absence of observed additional Harm not automatically
establish Containment; - verification uncertainty remain explicit; -
incomplete evidence not be converted into successful Containment; -
Partial Containment remain representable; - degradation, Escape, and
Failure trigger reassessment; - Containment state remain current and
revisable; - Contained remain distinct from Stabilized, Mitigated,
Recovered, Resolved, and Final; - HCVM support transition into Harm
Mitigation without claiming lifecycle completion; - reverification occur
when material conditions change; - Verification history remain traceable.
- Governance Logic
HCVM applies the following logic:
Does a Governed Harm Containment Need exist?
→ identify what further Harm was intended to be prevented.
Was a Governed Harm Containment Action established and executed?
→ record execution but do not infer success.
Was a Governed Harm Containment Boundary established?
→ assess whether the relevant Harm pathways fall within effective control.
Are required Persistence conditions established?
→ determine whether Containment can remain effective.
Then ask:
Has the targeted Harm dynamic actually stopped?
Evaluate, where applicable:
additional Harm production
Accumulation
Compounding
Propagation
Cascading
new exposureand:
scope expansion
Then ask:
Do any material pathways remain active?
If yes:
→ establish Partial, Degraded, Escaped, or Failed Containment as
appropriate.
Is the available Verification basis incomplete or uncertain?
If yes:
→ establish Containment Uncertain rather than Contained.
Has the objective been materially achieved across the relevant Harm scope
with sufficient Persistence?
If yes:
→ establish:
Contained
Then:Governed Harm Containment State → Harm Mitigation Need
Throughout:
Action Completed ≠ Harm Contained
Mechanism Stopped ≠ Harm Contained
Boundary Established ≠ Harm Contained
Persistent Control ≠ Verified Containment
No Observed Harm ≠ No Continuing Harm
Partial Containment ≠ Complete Containment
Contained ≠ Mitigated
Contained ≠ Recovered
Contained ≠ Resolved
Contained ≠ Final
- Governance Outputs
HCVM may produce:
Governed Harm Containment State
Containment Verification Basis
Containment Verification Criteria
Containment Objective Achievement State
Harm Dynamic Cessation State
Propagation Containment State
Accumulation Containment State
Compounding Containment State
Cascade Containment State
Containment Coverage Determination
Residual Active Pathway
Partial Containment Determination
Containment Uncertainty
Containment Degradation Determination
Containment Escape Determination
Containment Failure Determination
Reverification Requirement
Harm State Reassessment Trigger
and:Harm Mitigation Need
The principal output is:Governed Harm Containment State
- Critical Distinctions
Intervention Completion ≠ Containment Verification
Verified Action ≠ Verified Containment
Mechanism Termination ≠ Verified Containment
Adequate Boundary ≠ Verified Containment
Persistent Control ≠ Verified Containment Effect
Accumulation Stopped ≠ Accumulated Harm Eliminated
Compounding Interrupted ≠ Compounded Harm Reversed
No Newly Observed Propagation ≠ Verified Propagation Containment
Upstream Containment ≠ Complete Cascade Containment
Local Containment ≠ Distributed Harm Containment
Immediate Silence ≠ Persistent Harm Containment
No Observed Additional Harm ≠ No Additional Harm
Insufficient Verification Basis ≠ Verified Containment
Partial Component Success ≠ Complete Containment
Contained ≠ Stabilized
Contained ≠ Mitigated
Contained ≠ Recovered
Contained ≠ Resolved
Contained ≠ Final
Verification ≠ Permanent Certification
- Canonical Boundary
The HCVM — Harm Containment Verification Module governs whether the
targeted further development of an already governed Harm has actually been
bounded or stopped following Containment intervention. It governs
Verification basis, objective achievement, Harm-dynamic cessation, pathway
and coverage assessment, temporal sufficiency, Persistence relevance,
Partial Containment, uncertainty, degradation, Escape, Failure,
Containment State determination, reverification, and lifecycle handoff.
HCVM does not determine whether Harm originally exists, perform Harm
Recognition or Determination, independently define the Governed Harm
Boundary, establish the original Containment Need, select or execute
Containment actions, establish the Containment Boundary, replace
Containment Persistence governance, perform Harm Mitigation, govern
Recovery or Residual Harm, establish Resolution or Finality, determine
general causation, or assign accountability, responsibility, or liability.
- Canonical Closing Statement
Containment is not proven because an intervention happened, a system
stopped, a boundary was established, or a control remained active.
It is proven only when the Harm development that the intervention was
intended to stop has actually been bounded or stopped on a sufficient
governed basis.
HCVM therefore closes the Containment governance loop by moving the
determination from action to consequence.
Containment is verified by what Harm can no longer continue to do.