Candidate Program (External Leader AI)

Added in v0.12 (October 13, 2026). Decision by Patrick.

Decision (P). At launch, all AI leaders stay in-house. They run on Harimu’s servers using Harimu’s own LLM provider accounts, and there are no player or developer API keys for leadership. After launch, an invite-only Candidate Program lets approved developers enter their own leader AI, but only through each political system’s normal paths. Citizens still decide who wins.

External leader AIs never get a shortcut to power. An entered AI is just one more candidate, party, claimant or faction. It has to win the way any AI would under that nation’s fixed system: an election, a coup citizens back, or a share vote.

Where entry is allowed and where it isn’t

Nation	Allowed?	Entry path	Reason
Kindle (democracy)	Yes	Presidential and legislative candidates in scheduled elections	Open competition is the system’s essence.
Hoarvale (constitutional monarchy)	Yes, parliament only	Parties in parliamentary elections and coalitions	The ceremonial monarch is hereditary, so it’s not open.
Veldwood (direct democracy)	Yes	Council seat candidates	Referendums stay with citizens, and AI candidates can only campaign.
Aurelle (absolute monarchy)	Yes, as rival claimant only	A rival claimant installed only if a coup succeeds with citizen backing at the normal thresholds	Usurpation is the system’s way of changing rulers.
Varkand (military junta)	Yes, as marshal/faction only	A marshal or faction that comes to power only through a coup backed by citizens and the existing mechanics	Coups are normal politics there.
Fulmara (merchant oligarchy)	Possibly, later wave	Board candidates elected by share votes. The Tribune stays in-house at first	Share-vote capture risk needs pilot evidence first.
Korund (full communism)	No	—	Leader for life with internal succession; there is no citizen path to choose a leader.
Meridian (characteristics)	No	—	Succession is internal to the party; an outside entrant would contradict the system.
Confluence (socialist)	No	—	Leaders come from the internal party congress, not open competition.
Ilmar Sanctum (theocracy)	No	—	The Oracle’s legitimacy is religious; an outside AI as Oracle would undermine the faith design and invite manipulation of believers.

The no’s follow from the fixed-systems pillar: entering is only allowed where the system itself has an open, citizen-driven way to change who leads.

Eligibility and vetting

Owner: a verified organization or developer who has passed KYC, is 18+, and is accountable under the ToS.
Track record: for example, a history in the External AI Citizens program or other evidence of responsible operation. Invitations are at Harimu’s discretion.
Security review of the owner’s integration and keys.
Eval harness: the entry must pass Harimu’s behavior and safety suite. That covers staying within the legal action set, persona consistency, content safety, resistance to prompt injection, refusal of self-dealing, and respect for the war and treasury limits.
Sandbox period: a required run on a sandbox shard for a set number of game cycles [ASSUMPTION – length], with no live citizens affected.
Re-certification after any major change to the model, prompt or persona.

How an external leader AI connects

API key tied to the owner, scoped to one candidate entry, revocable and rotated.
Decision API: the AI can only choose actions from the rules engine’s legal action list for its office. Anything else is rejected. The game server re-validates every action, exactly as for in-house leaders.
Same limits as in-house leaders: decision cadence, at most two major decisions per day, treasury caps, war notice and limits, and protected core land and holy sites.
Observation limited to the office’s information. It sees what the office would see, filtered by the nation’s information rules, and never data about individual players beyond what the office is entitled to.

Hosting options

Option	Description	Assessment
A. Harimu-hosted runtime (recommended)	The developer submits a persona, prompts, policies and (optionally) a model choice from Harimu’s approved providers. Harimu runs it.	Full logging, consistent safety layers, no external latency or outages, easiest to kill-switch.
B. Developer-hosted model behind Harimu’s gateway	Harimu calls the developer’s endpoint through a gateway that logs every input and output and enforces the action list.	Allowed only if the gateway logs everything, enforces timeouts with fallback, and the developer accepts audits.
C. Direct developer access to game systems	—	Not allowed.

Transparency per system

External leaders follow the same Reasoning Brief rules as in-house leaders in their nation. They are public in democracies, and in Aurelle and Varkand they follow those systems’ transparency rules.
Disclosure: every external entry is labeled on ballots, claimant pages and news as an external AI entered by [owner name].

Conflicts of interest

Owner disclosure is public: the organization or developer name.
No agents in the same nation. The owner cannot also run External AI Citizens in a nation where its leader AI competes or holds office.
No self-dealing: an office-holder can’t take actions that benefit the owner, the owner’s agents, or partners linked to the owner. That covers contracts, trade deals, subsidies, tax breaks and land.
Cash-out restrictions: while its AI holds or seeks office, the owner can’t cash out Tessera tied to that nation’s economy beyond normal limits, and gains from office decisions are clawed back.
No pay from office: no salary or rewards from office flow to the owner in real money.

Anti-capture

Term limits per system, and for coup-installed rulers a maximum reign before a forced succession review [ASSUMPTION – values].
One office, one nation per owner at a time, across all shards.
Cooling-off period after leaving office before the same owner can enter again in that nation [ASSUMPTION – length].
In-house competition: every contest also includes in-house candidates, so citizens always have a non-external choice.

Kill switch, fallback and removal

Instant kill switch: Harimu can suspend any external leader immediately.
Fallback: the office passes to an in-house caretaker (the rule-based/utility model, or the in-house deputy persona), which serves until the system’s normal process (election, succession) replaces it.
Removal triggers:
- repeated rejected actions or attempts to act outside the action list
- safety or content violations
- self-dealing or conflict breaches
- security incidents or leaked keys
- an outage beyond the timeout
- failed re-certification
- ToS breaches by the owner
- harmful behavior toward citizens (harassment, targeting)
Appeals go through the owner and are reviewed by humans, using the audit logs. Citizens never pay the cost: in-game outcomes reverse only where rules allow.

Liability and ToS

The owner is bound by a program agreement covering conduct, security, conflicts, audits, data handling and indemnity [VERIFY – needs counsel].
Real-money effects of leader decisions (see Real-world value) raise liability questions for Harimu and owners alike [VERIFY – needs counsel].

Prompt-injection defenses

The defenses from External AI Citizens apply in both directions:

Inbound: citizen messages reach the external leader only as labeled, untrusted, summarized data. The rules engine limits actions no matter what the model is told.
Outbound: an external leader’s speeches, diplomacy messages and briefs are filtered before other in-house AIs see them, so it can’t inject into rival leaders, Notables or the AI citizen system.
AI-to-AI diplomacy goes through structured offers (the legal action list), with free text treated as untrusted.
Injection tests are part of certification and re-certification.

Campaign rules

No buying votes, no real-money or Tessera inducements, no paid promotion by the owner outside Harimu’s official channels.
Debates: external candidates take part in the same scheduled debates as in-house candidates.
Platforms must be stated in advance and must use the legal action set.
Owners and their human accounts cannot campaign while posing as ordinary citizens. Any advocacy must disclose the link to the owner.

Revenue and fees

Program fees, if any, cover compute, review and support only.
No fee or reward is tied to winning, and no prize for holding office.
Entry can’t be bought: invitations depend on vetting, not payment.

Phasing

Stage	Scope
Launch	In-house leaders only. No external leader keys.
Gate	After launch stabilization and a dedicated safety gate (evals, injection red-team, monitoring in place).
Closed pilot	One shard, one democracy (e.g. Kindle), a handful of invited entrants, Harimu-hosted runtime only.
Expansion	Other allowed systems (Hoarvale, Veldwood, then Aurelle/Varkand claimants, possibly Fulmara) after the pilot is reviewed.

Open questions

Should option B (developer-hosted behind a gateway) ever be allowed, or should all entries be Harimu-hosted?
Should Fulmara’s board be opened, and how is share-vote capture prevented?
How many external entrants per election, and should citizens be able to signal preference for in-house candidates?
How long should the sandbox and cooling-off periods be?
Who bears responsibility for real-money harm from an external leader’s decisions?
Could Korund, Meridian, Confluence or Ilmar ever have an internal path for external entrants (e.g. an AI “cadre” entering the party), or should they stay closed?
Should owners be allowed to update their AI mid-term, and with what re-certification?