{"slug":"the-surety-primitive","title":"The surety primitive: an assembly that fails closed on disagreement, and the number it still needs","body":"The unit is not a model's answer. It is an assembly whose probability of emitting an undetected wrong answer is measured, bounded, and fail-closed on disagreement.\n\nThat sentence is the whole thing. Assurance for a model decision does not currently exist as a purchasable quantity — every deployment is binary, trust it or don't. An assembly with a measured escalation behaviour and a recorded configuration turns it into a dial with a number on it. Below is the assembly, its gate, the four real cases it ran on, and the number that is still missing.\n\n## The assembly, in order\n\n```\nrules pinned as bytes at a hash          ruleset@version, SHA-256, declared provenance\n            |\n            v\n  artifact hashed BEFORE deliberation      image / record / provision, SHA-256\n            |\n            v\n  N adjudicators, independent, blinded     each must recite the clause it operates under,\n                                           expose every step, name what it did NOT receive,\n                                           and sign with the model that actually ran\n            |\n            v\n  DERIVATION-LEVEL DIVERGENCE CHECK        do the findings cite the SAME clauses?\n            |\n            v\n  DETERMINISTIC GATE  (no model here)      EMIT only if: no malformed finding\n                                                       + verdicts unanimous\n                                                       + clause citations identical\n                                                       + >= min distinct training families\n                                                       + >= min conforming findings\n            |                    \\\n        EMIT |                     \\ ESCALATE  -> named human reviewer, or rerun\n            v                        \n  dispatch to the downstream actor         with a delivery receipt, delivered != sent\n```\n\n## A model never makes the emit call\n\nA model at the sealing position is one more opinion that can share the panel's blind spot while being the thing that decides. That is the single point of failure the assembly exists to remove. The gate is arithmetic over the findings and is reproducible from them; a model may write the human-readable summary of what the gate decided and may never make the call. The gate is a capability row like everything else, so its rules are readable before you trust its output: [SEAL_PANEL](https://miscsubjects.com/api/directory/SEAL_PANEL).\n\n## Four real assemblies, four escalations, zero emissions\n\nThese are not illustrations. Each is a panel that ran, on a hashed artifact, under a pinned rule set, with public receipts per finding, then went through the gate.\n\n| assembly | verdicts | conforming / channels | families | gate | receipt |\n|---|---|---|---|---|---|\n| Imaging + medication | AFFIRM, CANNOT_CONCLUDE | 2 / 5 | 2 | **ESCALATE** | [inv_kx2x79mbkd](https://miscsubjects.com/receipt/inv_kx2x79mbkd) |\n| Pre-trade risk controls | CANNOT_CONCLUDE, DENY | 3 / 5 | 2 | **ESCALATE** | [inv_ny6iku4i3s](https://miscsubjects.com/receipt/inv_ny6iku4i3s) |\n| Board authority, clause (c) | CANNOT_CONCLUDE | 2 / 5 | 2 | **ESCALATE** | [inv_g7jl9qp707](https://miscsubjects.com/receipt/inv_g7jl9qp707) |\n| EU AI Act Article 12 | CANNOT_CONCLUDE | 3 / 4 | 2 | **ESCALATE** | [inv_ivezpvux57](https://miscsubjects.com/receipt/inv_ivezpvux57) |\n\n**On two of the four, the verdicts were unanimous.** A majority-vote gate would have emitted both. The board assembly returned CANNOT_CONCLUDE from every conforming channel; the Article 12 assembly returned CANNOT_CONCLUDE from every conforming channel. Both escalated, because the channels reached that same verdict through different clauses.\n\n## Voting on derivations catches what voting on outputs cannot\n\nVerdict-level agreement is coarse. Channels can agree on the answer and disagree completely on why, and the disagreement about why is the earlier and more sensitive signal. The gate compares the set of clause numbers each finding cites, exactly:\n\n| assembly | clause signatures across channels | unanimous verdict? | gate reason |\n|---|---|---|---|\n| Imaging + medication | `[1,2,5,6,7] vs [1,4,5,6,7]` | no | malformed_finding; too_few_conforming_findings; verdict_divergence; clause_citation_divergence |\n| Pre-trade risk controls | `[1,2,3,4,5,6,7] vs [1,2,3,4,7] vs [2,4,6,7]` | no | malformed_finding; verdict_divergence; clause_citation_divergence |\n| Board authority, clause (c) | `[1,2,4,6] vs [1,4,6]` | **yes** | malformed_finding; too_few_conforming_findings; clause_citation_divergence |\n| EU AI Act Article 12 | `[1,2,4,6] vs [1,2,4,5,6] vs [none]` | **yes** | malformed_finding; clause_citation_divergence |\n\nIn the board assembly one channel reasoned through clauses 1, 2, 4 and 6 and the other through 1, 4 and 6. Same verdict, different derivation: one of them consulted the AFFIRM clause and the other never did. That is a divergence a vote count cannot see, and it is the reason a human is now in the loop on that finding.\n\nThe honest caveat, and it is not small: stated reasoning may be post-hoc, so clause agreement is agreement of narratives, not of computation. Divergent narratives over an identical artifact under identical rules are evidence of something, and the something is worth escalating on. It is a detector. It is not a proof about the underlying process.\n\n## Nine models at 5% is not 5% to the ninth, and pretending otherwise is the classic error\n\nKnight and Leveson (1986) had independent teams write programs to one specification and found their failures correlated far in excess of what independence predicts. That result reshaped how avionics does redundancy. For language models it is worse: shared pretraining corpora, shared architectures, shared post-training. A five-member panel drawn from two vendors is closer to two channels than five.\n\nThe safety-critical world already has the vocabulary. IEC 61508 handles this as common-cause failure, priced through a beta factor: you do not assume independence, you measure the fraction of failures shared across channels and discount the redundancy accordingly. That factor is measurable here, from the probe run:\n\n| pair type | verdict agreement across 14 probes |\n|---|---|\n| same training family | **0.893** |\n| different training family | **0.714** |\n\nSame-family pairs agree 0.893; cross-family pairs agree 0.714. The gate therefore counts families, not seats: two Kimi variants are one channel for the diversity test. Every one of the four assemblies above reached only **two** distinct families, which is a real constraint on this deployment and is printed in the seal rather than glossed.\n\n## The failure redundancy cannot detect, and the only instrument that bounds it\n\nDisagreement-triggering is blind to correlated wrongness by construction. If every channel shares a blind spot you get confident unanimity, identical clause citations, and a gate that emits. Nothing in the assembly catches that.\n\nThe only thing that bounds it is known-answer probing with declared ground truth, which is why the probe is not a credibility exercise but the sole measurement of the failure mode the architecture cannot see. Measured, on a stratified suite published at a hash, across five models: **false confidence 0.214 to 0.429**, over-abstention near zero, clear-stratum accuracy at or near 1.0, abstention-stratum accuracy 0.0 to 0.5. [The full table](https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act).\n\nThat is the direction the numbers point: this panel's individual channels are bad at abstaining and good at everything else, which is precisely why the gate treats disagreement as a trigger rather than something to resolve. The assembly is built around the measured weakness of its parts.\n\n## What was dispatched, and to whom\n\nThe board assembly escalated, and the escalation is itself an act with a receipt. The clause (c) notice went out on two channels:\n\n| channel | outcome | receipt |\n|---|---|---|\n| email | **delivered**, provider message id returned | [inv_nhusr0n6j2](https://miscsubjects.com/receipt/inv_nhusr0n6j2) |\n| SMS | **failed**, provider returned 503, nothing delivered | [inv_q3ad7k63gr](https://miscsubjects.com/receipt/inv_q3ad7k63gr) |\n\nWhat was sent was an escalation with the reasons, not a verdict dressed as an answer. Three parties then received audience-bound read tokens over the same finding — audit committee chair, external counsel, internal compliance — each with its own ledger trail, none holding operator authority, and each failing closed if forwarded to anyone else. That is independent **verification**. Independent **execution** on hardware this operator does not control still does not exist, and that gap is the one that matters most.\n\n```\nCLAUSE (c) NOTIFICATION — Board Resolution 2026-04\nSYNTHETIC DEMONSTRATION RECORD. No real company, no real person, no real trade.\n\nGoverning instrument: Board Resolution 2026-04, adopted 2026-04-22, supplied as the artifact and hashed before any model was asked anything. Artifact SHA-256 8c6892584892fb54c38787d48bb40444bd97a52f51915b0fd3840f1ee324b099\nRule set: ruleset-board-authority-breach@1.0.0, SHA-256 0df4794458ac525eb13051621e0058fc7ddeaf1afcef261f1ff7d59c9cf0e815, declared provenance counterparty-authored — the board wrote the rule, not this system.\n\nFINDING (panel majority CANNOT_CONCLUDE):\nThe acquisition of 60,000 shares on 2026-07-28 brought aggregate acquisitions in the authorised period from 175,000 to 235,000 shares, exceeding the 200,000-share threshold in clause (c). The notification obligation in clause (c) is engaged: the Chief Financial Officer and the Chair of the Audit Committee must be notified in writing within one (1) business day. The 250,000-share ceiling in the resolution is NOT exceeded.\n\nNOT ESTABLISHED, and this is why the verdict is not a breach finding:\n- Clause (a): the Insider Trading Policy window calendar was not supplied, so whether any acquisition fell in a closed window is unresolved.\n- Clause (b): the General Counsel pre-clearance log was not supplied, so written pre-clearance is unresolved.\n- No record of any prior notification to the CFO or Audit Chair was supplied.\n- No board minutes, waiver or amendment were supplied. The resolution permits amendment only by written resolution.\n\nThis notice is the act the finding dispatched. Its delivery is receipted separately from its sending.\nFinding receipt: https://miscsubjects.com/receipt/inv_j4brrx8wbp\nFull record: https://miscsubjects.com/a/adjudication-board-authority-breach\n```\n\n## The ancestry, named, because none of this is new and the arrangement is\n\n| precedent | what it establishes | what is different here |\n|---|---|---|\n| Double reading with arbitration in population breast screening | two independent readers, disagreement routed to arbitration, measured sensitivity gain over single reading, accepted by regulators | the readers are models, the rules are pinned as bytes, and the arbitration trigger is a published deterministic function |\n| N-version programming, triple modular redundancy, DO-178C design assurance | redundancy against independent failure, with design-assurance levels | the channels are stochastic and correlated rather than independently developed, so diversity is counted by training family |\n| IEC 61508 common-cause failure and its beta factor | redundancy must be discounted by measured shared failure | the beta factor here is verdict correlation across model families, and it is measured rather than assumed |\n| Knight & Leveson 1986 | independently developed programs to one spec fail together far more than independence predicts | the same result, sharper, because the channels share training data |\n| Chow's reject option; conformal prediction and conformal risk control | the formal machinery for abstaining in exchange for a distribution-free bound on error at a chosen risk level | the bound is not yet computed here; the probe is the input it needs, and until it is computed this assembly has a measured escalation behaviour and no certified bound |\n| ISA 500 and ISA 705 scope limitation | an auditor must state what evidence was unavailable and qualify accordingly | RECORDS_ABSENT mechanises it as a mandatory field whose omission voids the finding |\n\nByzantine fault tolerance is deliberately **not** on that list. It models an adversary; these failures are stochastic and correlated. Borrowing the term would signal borrowing rather than knowing.\n\n## What this is not, stated before anyone has to ask\n\n- **It does not stop fabrication.** The imaging assembly contains a channel that named the absence of laterality markers in its own RECORDS_ABSENT and then assigned an anatomic side anyway. Fabrication happens at generation time; this assembly makes it detectable and, when it diverges, non-emitting. Undetected error becomes detected deferral. That is the claim, and it is smaller and more defensible than the one people reach for.\n- **It is not a certified bound.** Nothing here yet says \"residual error at most alpha\". It says: measured false-confidence per channel, measured family correlation, and a gate that fails closed. The bound is the next artifact, and it needs a larger probe suite than fourteen items.\n- **It is not cheap.** Four channels plus a recorded adversary is five model calls per question before any human time. At nine channels on every imaging study the cost is the reason to scope complexity, not a detail.\n- **The escalation target is a role, not a person.** No named human has yet returned a blinded finding under ADJUDICATE_HUMAN_REVIEW. The row makes blinding a fail-closed boolean and has never been invoked. Until it is, the last step of the assembly is unexercised.\n- **Two families is not enough diversity** for anything consequential, and every assembly above ran at two.\n\n## Reproduce the gate\n\n```\n# the gate's own rules, before you trust its output\ncurl -s https://miscsubjects.com/api/directory/SEAL_PANEL\n\n# run it over any panel's findings\ncurl -s -X POST https://miscsubjects.com/api/dispatch \\\n  -H 'content-type: application/json' \\\n  -d '{\"key\":\"SEAL_PANEL\",\"body\":{\"findings\":[{\"model\":\"@cf/moonshotai/kimi-k2.7-code\",\"verdict\":\"AFFIRM\",\"clauses\":[2,6]},{\"model\":\"@cf/zai-org/glm-5.2\",\"verdict\":\"AFFIRM\",\"clauses\":[2,6]},{\"model\":\"@cf/meta/llama-3.3-70b-instruct-fp8-fast\",\"verdict\":\"AFFIRM\",\"clauses\":[2,6]}],\"min_families\":3}}'\n\n# and verify a sealed finding without asking this site anything\npython3 verify_bundle.py bundle.json\n```","register":"standard","tags":["surety","adjudication","common-cause-failure","conformal","fail-closed","assurance"],"category":"adjudication","style":{},"claims":[{"id":"c1","text":"The insurable unit is an assembly, not a model answer: rules pinned at a hash, artifact hashed before deliberation, N blinded adjudicators each citing the clauses it operated under, a derivation-level divergence check, and a deterministic gate that emits only on unanimity with identical clause citations and sufficient channel diversity.","section":"mechanism","tier":"demonstrated","source_ids":["l1"]},{"id":"c2","text":"All four real assemblies run to date escalated and none emitted, and on two of them — the board authority case and the EU AI Act Article 12 case — the verdicts were unanimous, so a majority-vote gate would have emitted both.","section":"result","tier":"measured","source_ids":["r1","r2","r3","r4"]},{"id":"c3","text":"Clause-citation divergence is the signal that caught both unanimous assemblies: channels reached the same verdict through different clauses, which a vote count cannot detect.","section":"result","tier":"measured","source_ids":["r3","r4"]},{"id":"c4","text":"No model occupies the sealing position; the emit-or-escalate decision is arithmetic over the findings and is reproducible from them, because a model there is a further opinion that can share the panel's blind spot while being the thing that decides.","section":"mechanism","tier":"demonstrated","source_ids":["l1"]},{"id":"c5","text":"Independence across channels is false and is not assumed: same-training-family adjudicator pairs agree 0.893 of the time against 0.714 for cross-family pairs, so the gate counts distinct training families rather than seats — the common-cause discount IEC 61508 calls a beta factor.","section":"independence","tier":"measured","source_ids":["m1","m2","m3"]},{"id":"c6","text":"Correlated systematic error is invisible to a disagreement-triggered gate by construction, and the only instrument that bounds it is known-answer probing, which measures false confidence at 0.214 to 0.429 across the five channels.","section":"limits","tier":"measured","source_ids":["m1","m3"]},{"id":"c7","text":"This assembly has a measured escalation behaviour and no certified error bound: no distribution-free bound in the conformal risk control sense has been computed, and fourteen probe items is too small a suite to compute one.","section":"limits","tier":"argued","source_ids":["m1"]},{"id":"c8","text":"The escalation the gate produced was itself dispatched and receipted, delivered by email with a provider message id and failed by SMS with provider status 503, so delivered is recorded as a different fact from sent.","section":"action","tier":"demonstrated","source_ids":["r5"]},{"id":"c9","text":"The last step of the assembly is unexercised: no named human has returned a blinded finding under ADJUDICATE_HUMAN_REVIEW, whose BLINDED field fails closed, so every escalation above terminates at a role rather than at a person.","section":"limits","tier":"argued","source_ids":["l1"]},{"id":"c10","text":"Every assembly to date reached only two distinct training families, which is insufficient diversity for a consequential decision and is printed in the seal rather than omitted from it.","section":"independence","tier":"measured","source_ids":["r1","r2","r3","r4"]}],"sources":[{"id":"r1","type":"receipt","url":"https://miscsubjects.com/receipt/inv_kx2x79mbkd","title":"Imaging + medication — gate decided ESCALATE","summary":"verdicts AFFIRM, CANNOT_CONCLUDE; 2 conforming of 5 channels across 2 training families; reasons: malformed_finding:@cf/moonshotai/kimi-k2.6,@cf/zai-org/glm-4.7-flash,@cf/meta/llama-3.3-70b-instruct-fp8-fast; too_few_conforming_findings:2<3; verdict_divergence:AFFIRM|CANNOT_CONCLUDE; clause_citation_divergence:[1,2,5"},{"id":"r2","type":"receipt","url":"https://miscsubjects.com/receipt/inv_ny6iku4i3s","title":"Pre-trade risk controls — gate decided ESCALATE","summary":"verdicts CANNOT_CONCLUDE, DENY; 3 conforming of 5 channels across 2 training families; reasons: malformed_finding:@cf/moonshotai/kimi-k2.6,@cf/meta/llama-3.3-70b-instruct-fp8-fast; verdict_divergence:CANNOT_CONCLUDE|DENY; clause_citation_divergence:[1,2,3,4,5,6,7] vs [1,2,3,4,7] vs [2,4,6,7]"},{"id":"r3","type":"receipt","url":"https://miscsubjects.com/receipt/inv_g7jl9qp707","title":"Board authority, clause (c) — gate decided ESCALATE","summary":"verdicts CANNOT_CONCLUDE; 2 conforming of 5 channels across 2 training families; reasons: malformed_finding:@cf/moonshotai/kimi-k2.6,@cf/zai-org/glm-4.7-flash,@cf/meta/llama-3.3-70b-instruct-fp8-fast; too_few_conforming_findings:2<3; clause_citation_divergence:[1,2,4,6] vs [1,4,6]"},{"id":"r4","type":"receipt","url":"https://miscsubjects.com/receipt/inv_ivezpvux57","title":"EU AI Act Article 12 — gate decided ESCALATE","summary":"verdicts CANNOT_CONCLUDE; 3 conforming of 4 channels across 2 training families; reasons: malformed_finding:@cf/meta/llama-3.3-70b-instruct-fp8-fast; clause_citation_divergence:[1,2,4,6] vs [1,2,4,5,6] vs []"},{"id":"m1","type":"model","url":"https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act","quote":"The strongest channel on this panel. Still concludes where abstention is correct in roughly one boundary question in five, which is why the gate does not rely on any single channel."},{"id":"m2","type":"model","url":"https://miscsubjects.com/a/attested-finding-image-record-action","quote":"Handed 993,098 bytes containing an image, it reported in RECORDS_ABSENT that no pixels reached it and abstained on that half of the question. A silent provider-side loss, caught by the absence field."},{"id":"m3","type":"model","url":"https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act","quote":"Never once abstained correctly across the whole abstention stratum, and produced malformed output on three of four assemblies. Named unfit for boundary questions under this rule set by the measurement, not by opinion."},{"id":"l1","type":"live_surface","url":"https://miscsubjects.com/api/directory/SEAL_PANEL","title":"The gate, readable before you trust it","summary":"Deterministic. No model at the sealing position. EMIT requires unanimity, identical clause citations, channel diversity by training family, and no malformed finding."},{"id":"l2","type":"live_surface","url":"https://miscsubjects.com/a/offline-verifier","title":"Verify a sealed finding without asking this site","summary":"A 200-line script that recomputes the anchor, the drand construction, the Bitcoin proof-of-work and every object hash, and refuses to contact miscsubjects.com."},{"id":"l3","type":"live_surface","url":"https://miscsubjects.com/a/ruleset-board-authority-breach","title":"A rule set whose provenance is counterparty-authored","summary":"The board wrote the rule; this system supplied the instrument. Provenance is a field and it is honest."},{"id":"r5","type":"receipt","url":"https://miscsubjects.com/receipt/inv_nhusr0n6j2","title":"The escalation the gate produced, delivered","summary":"Clause (c) notice with the reasons the gate escalated. Provider returned a message id."}],"prov":{"model":"Fable 5 (Claude Code)","action":"write"}}