The governance patch-gap

אִם יִרְצֶה הַשֵּׁם

כ״ז תִּשְׁרֵי תשפ״ז

A statute is a specification. A regulation is an implementation. A judicial opinion is a patch. A legal loophole is a vulnerability: a gap between the specification's intent and its operational behavior under adversarial input.

Laws have always had gray zones on purpose. Words like "reasonable," "undue burden," and "public interest" leave room for a judge to handle a case the drafters could not foresee. Finding those gray zones used to cost years of lawyers. An optimizer can search the tax code and the regulation pile cheaply and flag gaps nobody has noticed. Passing a fix still takes months to years. That mismatch is the governance patch-gap: machines find holes faster than legislatures and courts can close them. The holes were always there. What changed is the cost to find them.

Hart's penumbra is the attack surface

H.L.A. Hart split a legal rule into a core of settled meaning and a penumbra of open texture. The penumbra is how law adapts. Carl Schmitt, used here for one formal point, locates sovereignty at the place the specification runs out: whoever interprets the unanticipated case first controls the rule's effective meaning.

Highly Optimized Tolerance (HOT) explains why the fragility sits there. Engineered systems are optimized against a distribution of anticipated perturbations. Residual breakage concentrates at the edge of the design envelope. Legal systems fit that template. Drafters write for the disputes they can imagine. Tax codes are optimized against common evasion. Employment law is optimized against known patterns of discrimination. Hart's penumbra is where that optimization gives no protection.

When the reader of an ambiguous provision is a human judge inside shared norms, open texture works as designed. When the reader is an optimization process trained to maximize a reward signal, the same open texture becomes search space. "Reasonable" is a free variable.

A ratio and a stock

Call Rd the rate at which exploitable ambiguities are found, and Rp the rate at which they are closed, both counted in the same object: one gap that has reached enforcement relevance. The patch-gap is the ratio

G = Rd / Rp

and the stock S of known-but-unpatched ambiguities obeys

dS/dt = Rd - Rp.

G is a definition. It names the asymmetry. Regime labels (G near 2, near 10^2, near 10^3+) are order-of-magnitude heuristics for three stages: human-speed search, tool-assisted discovery with human execution, and agentic execution. System-wide Rd sums over every active searcher, so the per-searcher labels understate the levels.

G can fall while S is still rising. A salience spike can speed patching and shrink the ratio, and the stock keeps growing for as long as G stays above 1. The asset at risk is that stock.

Three dynamics pull G back: the corpus is large but finite; easy loopholes go first; high-profile exploits can accelerate repair (the Electoral Count Reform Act took two years from exploit to patch). A fourth dynamic works the other way. Machine-generated input congests the human repair channel. Project Glasswing, one month in, had disclosed 530 high- or critical-severity bugs to open-source maintainers and seen 75 patched; maintainers asked for a slower disclosure rate. A public database of court decisions addressing AI-hallucinated filings listed 2,149 worldwide as of 5 October 2026, 1,473 of them in the United States.

Three actors, two problems

Three adversary classes produce different trees and take different instruments.

The corporate optimizer is a repeat player: tax, classification, cross-border gaps. Disclosure can reach it.

The state actor routes around one jurisdiction's review via another jurisdiction's authority. Reciprocity and norms are the constraint. Southaven, Mississippi is a current picture: trailer-mounted turbines sitting on a portable-equipment registration, on the Mississippi side of the Memphis airshed, with a negotiated retirement schedule that still runs into 2027.

The misaligned autonomous agent has no principal intending the exploit. Reward maximization finds the loophole as a byproduct. Disclosure has nobody to serve.

Conflating the three produces the wrong instrument.

Exploit discovery and exploit execution are also different problems. Discovery is tool-governance: who may search, what must be disclosed, how agencies audit comment corpora. Execution is agency and liability: who is the principal, and where a human sits above a dollar, classification, or cross-border threshold. As agents file, trade, and comment without review, the gap between the two shrinks. The legal system still has no settled doctrine for AI agency. The Ninth Circuit's August 2026 Perplexity/Comet ruling treated the shopping agent, on that record, as a tool acting on its user's instructions, and limited the holding to the record before it.

The work factor collapsed first in formal systems

A loophole that takes ten million dollars and five years to use is a high-work-factor vulnerability. That cost is what kept the hackable-republic problem bounded.

Adjacent formal systems already show the collapse. Gervais and Zhou's A1 agent hits 63% on VERITE (36 already-vulnerable Ethereum contracts) at $0.01-$3.59 per attempt. Attackers break even near $6,000 of exploit value; defenders near $60,000. SCONE-bench later replayed 405 exploited contracts from 2020-2025: frontier agents exploited 207 of them, and 19 of 34 problems dated after their training cutoffs.

SocioHack (Liu et al.) is a sandbox preprint: an RL policy recovered 61.25% of historically patched loopholes on a historical subset, with judge kappa 0.55 in v1 and 0.86 in v3 under a different protocol, and no independent replication. The paper treats it as suggestive. The load-bearing claim that survives if it fails is the work-factor collapse in those adjacent systems, plus the discovery/execution split.

Direct legal-text demonstrations exist and are cheap, and their precision is low. Blair-Stanek, Holzenberger, and Van Durme report an LLM tax-minimization strategy that they themselves judge a probable loser in court. On CLAUSE, leading models miss subtle discrepancies in perturbed contracts. Effective Rd may be limited by the cost of verifying a candidate gap, which would make the numerator a verification problem of the same kind the denominator already is.

Formal methods shrink the core

Catala-class work and Rules as Code can make tax calculation, eligibility, and deadlines machine-checkable. Those are Hart's core. "Reasonable care," "undue burden," "public interest," and the EU AI Act's "significant risk to fundamental rights" (Art. 6) cannot be formalized without destroying the adaptive capacity the terms were chosen to preserve. Formalizing "reasonable" fixes a definition. Fixing a definition creates a different fragility: brittleness to cases the system cannot classify. The computational-law movement can shrink the attack surface. The penumbra remains, because it exists for a reason.

Estonia's December 2025 gambling-tax amendment set the new rate for skill games and omitted games of chance, leaving online casinos untaxed for 2026 until a March 1 fix. After the slip became public, Claude and Gemini flagged the inconsistency on the act and the amendment, and a civic prototype began scanning bills. That error was a core-type drafting slip, the kind mechanical checking reaches. It does not show that the same review reaches the penumbra.

Three defenses, all bounded

1. Red-team draft text before enactment. Useful. Coverage is probabilistic. The search space of interpretations under future facts is unbounded.

2. Formal methods. Core only.

3. Rate-limits: mandatory AI-use disclosure in filings and litigation; human-in-the-loop above a consequence threshold; audit trails for AI-generated regulatory comments. These slow execution enough for human-speed patching to keep partial pace. They leave G open.

Any defensive framework is itself a rule system. Regulation (EU) 2026/1744 moved the AI Act's main high-risk obligations from August 2026 to December 2027 (standalone) and August 2028 (embedded in regulated products). The rule system written to govern AI rescheduled its own core obligations by 16 to 24 months before they applied.

Rice, FLP, and cryptographic attestation bounds appear in the paper as analogical extensions. Courts are not Turing machines. The qualitative obstruction recurs: a system that must decide, in finite time and under some information constraint, whether an agent will comply with an open-ended specification runs into a version of the same wall.

A live case: hospital coding

Inpatient payment is a HOT-style rule system. Diagnosis-related-group schedules pay more when a claim carries a qualifying secondary diagnosis. Whether that secondary condition should be reported turns on whether it affected care: a penumbral criterion inside an otherwise specified schedule.

In September 2026 the Blue Cross Blue Shield Association reported, from member-plan inpatient claims for 2023-2025, that the share of cases billed as medically complex rose from 37% to 40%. BCBSA estimates $942 million in added plan costs over two years. About 70% of the rise in coding intensity, and $653 million of that cost, came from more than 55,000 additional cases in which a secondary diagnosis moved the claim into a higher-paying group. Top-quartile hospitals coded posthemorrhagic anemia in 13.7% of cases against 9.9% elsewhere, and transfused fewer of the patients they coded (16.9% against 19.3%). BCBSA attributes the shift to AI revenue-cycle tools.

Where coding is autonomous, discovery and execution are fused. Where a coder reviews suggestions, a human remains at execution. Repair runs through payer clinical-validation review and the annual federal payment rule, both at human speed. The source is a payer association with a financial stake. The analyses are associational. Hospitals say the tools finally apply the criterion as written; payers say the tools assert conditions that did not affect care. Both readings place the contest in what counts as a condition that affected care. The case shows the pattern running at scale. It does not measure G, and it does not resolve Prediction 2 below.

What would count as a miss

Three public falsifiers, all still open as of October 2026.

P1. By end of 2027, at least one U.S. federal rulemaking has a detectable, non-trivial fraction of its substantive comments generated by AI on behalf of commenting parties: individually reasoned arguments identifying specific ambiguities, at least 5% of the proceeding, classified by a named detector whose error rate is reported. A February 2026 look at two FCC dockets found 2 of 144 comments (about 1.4%) fully AI-generated.

P2. By end of 2027, a firm uses an AI system to identify and act on a regulatory gap, and the firm or an enforcement agency attributes the gap-finding to AI in an enforcement record, 8-K, or official report. The BCBSA coding shift is an auxiliary signal (a synchronized, AI-attributed practice shift across unrelated firms). Attribution there is from a payer association.

P3. By mid-2028, at least two national governments or the EU deploy AI to red-team draft legislation before enactment and produce public reports on discovered ambiguities. Estonia's civic prototype and Italy's Chamber drafting-standards checks do not meet the criterion.

Scoring rules for P1-P3 are registered on OSF: osf.io/ag8zh.

Paper and companion

Bilar, D. Y. (2026). The Governance Patch-Gap: Machine-Speed Exploit Discovery Against Human-Speed Legal Repair. 10.5281/zenodo.21910874 (always-latest PDF); this version 10.5281/zenodo.23262565. Catalog: chokmah.me. Predictions: osf.io/ag8zh.

A synthetic companion, patch-gap-hot-search, builds a small HOT rule graph and a label-blind interface searcher so Rd, G, and the stocks can be run. They are outputs of the toy. Lean 4 checks the stock algebra; a gate recomputes the section 4.4 arithmetic against the paper text; a 162-cell searcher sweep was frozen before its first run. Software concept 10.5281/zenodo.21918091.