Two stages

The method derives from a peer-reviewed 2025 design of a resilient supply chain, adopted as a blueprint after a forensic analysis of what it optimises. The model is solved as a two-stage optimisation. First-stage decisions are the ones made now: which controls, capacity and redundancy to buy. Second-stage decisions are the ones made during each scenario: how to reroute, fail over and draw on reserves. The objective is expected value across the scenario set, subject to a floor on service to customers that is never crossed. The floor is swept from zero to 100 per cent in eleven steps, and each step yields a design with its cost.

The shape of the surface

The design does not change smoothly as the floor rises. The value of a mixed-integer programme as its constraint tightens is piecewise polyhedral with finitely many breakpoints, and the integer solution is constant between them, so the surface is flat and then jumps. In the seed study the network did not change until the floor reached 60 to 70 per cent. The shape transfers as a theorem; where the jumps fall is a fact about one enterprise, computed afresh for each engagement and never carried from one to another.

The blind test

Each design is frozen and run against 25 new scenarios, drawn at random and correlated, that the design never saw. The gain over the baseline under those scenarios is the design’s proven resilience. No design is called resilient because it was optimised; it is called resilient because it held under events it was not built for. Applied to a single deployment, the same step tests a model against adversarial and degraded scenarios its approval evidence never saw, and the measured residual is a figure the approver can put a price on.

The limit

Against an adversary who adapts, no test against drawn scenarios is a proof of resilience to the unforeseen. The seed’s claim to have validated against the unanticipated was struck in transfer: its 25 draws with one replication fall short of the reference procedure in its own field, which uses 20,000. The method states this limit wherever the test is reported, and routes deliberate disruption to an attacker-maximising branch and environmental disruption to an expectation branch, because each framework holds the other’s missing piece.

Status

The design surface and the blind test are the forward-looking state. They follow the reference run, the first end-to-end execution of the method on one real enterprise from its public record, which is the gate before this state is sold.