OIP Independent Compliance Oracle v1.0

Eight claim types that must never collapse into each other

OIP keeps these distinct, because conflating them is how "the model said so" becomes "it is true and legal":

1. Model assertion — a clause-cited DECISION_RECORD. An accountability artifact, never a claim to hidden chain-of-thought.
2. Model review — an independent REVIEW_RECORD: CONFIRM / CHALLENGE / ABSTAIN, with its own evidence and pinned prompt/context fingerprints.
3. Citation validation — a distinct CITATION_VALIDATION pass: does the cited source exist, is the version/hash right, does the passage support the premise, does the clause govern the conduct, was a material exception omitted, does the conclusion overreach? A model agreeing with another model is not citation validation.
4. Conformance result — a live runtime check that executes the behavior it names.
5. Institutional certification — a bounded, expiring, revocable STATE_CARD from a scoped certifier.
6. Surety — a disclosed, independence-weighted corroboration score. Surety is not truth and consensus is not conformance.
7. Legal determination — LEGAL_REVIEW_REQUIRED unless a qualified actor accepts responsibility. The runtime never manufactures one.
8. Empirical outcome — later real-world evidence that can repair, revoke, or supersede any of the above.

Demonstration case — the privacy-conformance repair, filed as a full audit object

Subject: GET /api/privacy/conformance/dis_d80b129eaa4f018a41c5. Earlier today this route returned HTTP 500 because the domain status string PARTIAL was passed as the HTTP transport status; the repair derives the transport status separately, the 404 negative control is preserved, and the private-source manifest is now byte-exact in R2. That incident is now a running oracle loop under a new standard, oip-transport-provenance-1 (clauses TP-01 transport/domain separation, TP-02 truthful partial state, TP-03 negative-control preservation, TP-04 provenance completeness).

Honest reading of the numbers: two external providers were queried independently with pinned prompt and context hashes and no visibility of each other's answers. One (Moonshot/Kimi) confirmed; one (Google/Gemini) abstained; xAI/Grok was unavailable (its API key's team is out of credits, HTTP 403). So the surety is CORROBORATED, not ADVERSARIALLY_SURVIVED — one independent confirmation is not two, and the score says exactly that.

The commit-evidence honesty rule

An earlier audit in this codebase flagged a [BACKED: public commit] citation class whose commits resolved to a 404 private repo. This oracle refuses to repeat that. The repair commit is real but the repository is private, so third parties cannot recompute it: its citation validation is filed as operator-served / PARTIALLY_SUPPORTED, not independently-recomputable. The load-bearing evidence is the live HTTP behavior and the R2 SHA, which anyone can recompute.

Downstream gate — a card as executable state

A bounded card is proven to gate a safe demonstration operation. One valid, in-scope, correct-version, in-jurisdiction, within-risk, correctly-certified card permits; everything else is a typed, receipted denial. All eleven outcomes were exercised live:

The gate never guards production-critical behavior; the demonstration action is a read/inspect operation.

Surety 1.1 — closing the self-grading and alias holes

An adversary who controls one process can mint many "reviewers." Formula 1.1 defends against that:

• Provider canonicalization. OpenAI, open-ai, GPT-team collapse to one provider key, so aliases cannot inflate independent-provider weight.
• Correlated-confirm collapse. Independent confirms sharing an identical prompt/context pair or an identical evidence set count as one unit — copied evidence and same-query correlation stop being "independent."
• Adverse-citation discount. An UNSUPPORTED or CONTRADICTED citation validation discounts the score and forces CONTESTED; a decision cannot be highly corroborated over broken citations.

Every weight and discount is published in the surety record. This directly answers two open critiques in this codebase's own governance audit: that conformance was operator-self-graded (C8) and that a verifier faced no penalty for certifying falsely.

Implementation status

Prior art — a novel conjunction, not a category of one

Every component pre-exists somewhere: transparency-log keyless receipts (Certificate Transparency RFC 6962/9162, Sigstore/Rekor), artifact attestation (SLSA / in-toto), runtime policy gates (OPA/Rego and agentic PDP/PEP), expiring third-party certification (ISO/IEC 42001, the EU AI Act conformity regime, the ISO/IEC 17000 series), and LLM-as-judge citation-faithfulness evaluation (Arize Phoenix, LangSmith, RAGAS). The closest single running product is EQTY Lab's AI Integrity Suite, which binds cryptographic AI lineage certificates to a runtime enforcement gate.

The honest claim is therefore novel conjunction, not "category of one": adversarial cross-vendor model review plus reviewer-independence-weighted surety plus clause-cited per-decision records, feeding an expiring/revocable card that gates runtime operations with keyless public receipts. OIP composes those neighbors; it does not replace them, and it is not the first to do any single part.

Required boundary disclosures

• This does not expose faithful hidden model chain-of-thought. A DECISION_RECORD is the justification placed on the record, not proof it caused the output.
• Multi-model agreement does not equal truth. Cross-vendor models can share correlated blind spots.
• Institutional certifiers may be wrong, incompetent, or captured. The card records who certified and within what bounds; it does not make them right.
• Public proof may be redacted and is therefore weaker than scoped private inspection.
• Legal conclusions remain LEGAL_REVIEW_REQUIRED unless a qualified actor accepts responsibility with deployment-specific facts.
• OIP provides bounded, inspectable, revocable assertions — not an infallible oracle. Every filed transition leaves a footprint, which is the only guarantee offered.

Public and private planes

Public inspection returns redacted cards, decision records, surety, citation validations, gate resolutions, and keyless receipts — never credentials, private prompts, sensitive source bytes, or hidden reasoning. The four private source files behind the capstone are archived in R2 under swarm-imports/2026-07-17/, addressable by hash but not publicly served. Scoped certifier credentials that would permit deeper private inspection are PROPOSED, not live.

What remains

Auditor calibration with sealed canary answer keys feeding surety weight; three-or-more-provider adversarial review on every case (restore xAI credits or add a fourth provider); scoped external certifier credential classes; and legal/insurer/regulator pilots. None of these is claimed as live. This is a working protocol facet and defensive disclosure.