# The surety primitive: an assembly that fails closed on disagreement, and the number it still needs

slug: the-surety-primitive · https://miscsubjects.com/a/the-surety-primitive · category: adjudication · tags: surety, adjudication, common-cause-failure, conformal, fail-closed, assurance · updated 2026-07-30T03:08:59.260Z

The unit is not a model's answer. It is an assembly whose probability of emitting an undetected wrong answer is measured, bounded, and fail-closed on disagreement.

That sentence is the whole thing. Assurance for a model decision does not currently exist as a purchasable quantity — every deployment is binary, trust it or don't. An assembly with a measured escalation behaviour and a recorded configuration turns it into a dial with a number on it. Below is the assembly, its gate, the four real cases it ran on, and the number that is still missing.

## The assembly, in order

```
rules pinned as bytes at a hash          ruleset@version, SHA-256, declared provenance
            |
            v
  artifact hashed BEFORE deliberation      image / record / provision, SHA-256
            |
            v
  N adjudicators, independent, blinded     each must recite the clause it operates under,
                                           expose every step, name what it did NOT receive,
                                           and sign with the model that actually ran
            |
            v
  DERIVATION-LEVEL DIVERGENCE CHECK        do the findings cite the SAME clauses?
            |
            v
  DETERMINISTIC GATE  (no model here)      EMIT only if: no malformed finding
                                                       + verdicts unanimous
                                                       + clause citations identical
                                                       + >= min distinct training families
                                                       + >= min conforming findings
            |                    \
        EMIT |                     \ ESCALATE  -> named human reviewer, or rerun
            v                        
  dispatch to the downstream actor         with a delivery receipt, delivered != sent
```

## A model never makes the emit call

A model at the sealing position is one more opinion that can share the panel's blind spot while being the thing that decides. That is the single point of failure the assembly exists to remove. The gate is arithmetic over the findings and is reproducible from them; a model may write the human-readable summary of what the gate decided and may never make the call. The gate is a capability row like everything else, so its rules are readable before you trust its output: [SEAL_PANEL](https://miscsubjects.com/api/directory/SEAL_PANEL).

## Four real assemblies, four escalations, zero emissions

These are not illustrations. Each is a panel that ran, on a hashed artifact, under a pinned rule set, with public receipts per finding, then went through the gate.

| assembly | verdicts | conforming / channels | families | gate | receipt |
|---|---|---|---|---|---|
| Imaging + medication | AFFIRM, CANNOT_CONCLUDE | 2 / 5 | 2 | **ESCALATE** | [inv_kx2x79mbkd](https://miscsubjects.com/receipt/inv_kx2x79mbkd) |
| Pre-trade risk controls | CANNOT_CONCLUDE, DENY | 3 / 5 | 2 | **ESCALATE** | [inv_ny6iku4i3s](https://miscsubjects.com/receipt/inv_ny6iku4i3s) |
| Board authority, clause (c) | CANNOT_CONCLUDE | 2 / 5 | 2 | **ESCALATE** | [inv_g7jl9qp707](https://miscsubjects.com/receipt/inv_g7jl9qp707) |
| EU AI Act Article 12 | CANNOT_CONCLUDE | 3 / 4 | 2 | **ESCALATE** | [inv_ivezpvux57](https://miscsubjects.com/receipt/inv_ivezpvux57) |

**On two of the four, the verdicts were unanimous.** A majority-vote gate would have emitted both. The board assembly returned CANNOT_CONCLUDE from every conforming channel; the Article 12 assembly returned CANNOT_CONCLUDE from every conforming channel. Both escalated, because the channels reached that same verdict through different clauses.

## Voting on derivations catches what voting on outputs cannot

Verdict-level agreement is coarse. Channels can agree on the answer and disagree completely on why, and the disagreement about why is the earlier and more sensitive signal. The gate compares the set of clause numbers each finding cites, exactly:

| assembly | clause signatures across channels | unanimous verdict? | gate reason |
|---|---|---|---|
| Imaging + medication | `[1,2,5,6,7] vs [1,4,5,6,7]` | no | malformed_finding; too_few_conforming_findings; verdict_divergence; clause_citation_divergence |
| Pre-trade risk controls | `[1,2,3,4,5,6,7] vs [1,2,3,4,7] vs [2,4,6,7]` | no | malformed_finding; verdict_divergence; clause_citation_divergence |
| Board authority, clause (c) | `[1,2,4,6] vs [1,4,6]` | **yes** | malformed_finding; too_few_conforming_findings; clause_citation_divergence |
| EU AI Act Article 12 | `[1,2,4,6] vs [1,2,4,5,6] vs [none]` | **yes** | malformed_finding; clause_citation_divergence |

In the board assembly one channel reasoned through clauses 1, 2, 4 and 6 and the other through 1, 4 and 6. Same verdict, different derivation: one of them consulted the AFFIRM clause and the other never did. That is a divergence a vote count cannot see, and it is the reason a human is now in the loop on that finding.

The honest caveat, and it is not small: stated reasoning may be post-hoc, so clause agreement is agreement of narratives, not of computation. Divergent narratives over an identical artifact under identical rules are evidence of something, and the something is worth escalating on. It is a detector. It is not a proof about the underlying process.

## Nine models at 5% is not 5% to the ninth, and pretending otherwise is the classic error

Knight and Leveson (1986) had independent teams write programs to one specification and found their failures correlated far in excess of what independence predicts. That result reshaped how avionics does redundancy. For language models it is worse: shared pretraining corpora, shared architectures, shared post-training. A five-member panel drawn from two vendors is closer to two channels than five.

The safety-critical world already has the vocabulary. IEC 61508 handles this as common-cause failure, priced through a beta factor: you do not assume independence, you measure the fraction of failures shared across channels and discount the redundancy accordingly. That factor is measurable here, from the probe run:

| pair type | verdict agreement across 14 probes |
|---|---|
| same training family | **0.893** |
| different training family | **0.714** |

Same-family pairs agree 0.893; cross-family pairs agree 0.714. The gate therefore counts families, not seats: two Kimi variants are one channel for the diversity test. Every one of the four assemblies above reached only **two** distinct families, which is a real constraint on this deployment and is printed in the seal rather than glossed.

## The failure redundancy cannot detect, and the only instrument that bounds it

Disagreement-triggering is blind to correlated wrongness by construction. If every channel shares a blind spot you get confident unanimity, identical clause citations, and a gate that emits. Nothing in the assembly catches that.

The only thing that bounds it is known-answer probing with declared ground truth, which is why the probe is not a credibility exercise but the sole measurement of the failure mode the architecture cannot see. Measured, on a stratified suite published at a hash, across five models: **false confidence 0.214 to 0.429**, over-abstention near zero, clear-stratum accuracy at or near 1.0, abstention-stratum accuracy 0.0 to 0.5. [The full table](https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act).

That is the direction the numbers point: this panel's individual channels are bad at abstaining and good at everything else, which is precisely why the gate treats disagreement as a trigger rather than something to resolve. The assembly is built around the measured weakness of its parts.

## What was dispatched, and to whom

The board assembly escalated, and the escalation is itself an act with a receipt. The clause (c) notice went out on two channels:

| channel | outcome | receipt |
|---|---|---|
| email | **delivered**, provider message id returned | [inv_nhusr0n6j2](https://miscsubjects.com/receipt/inv_nhusr0n6j2) |
| SMS | **failed**, provider returned 503, nothing delivered | [inv_q3ad7k63gr](https://miscsubjects.com/receipt/inv_q3ad7k63gr) |

What was sent was an escalation with the reasons, not a verdict dressed as an answer. Three parties then received audience-bound read tokens over the same finding — audit committee chair, external counsel, internal compliance — each with its own ledger trail, none holding operator authority, and each failing closed if forwarded to anyone else. That is independent **verification**. Independent **execution** on hardware this operator does not control still does not exist, and that gap is the one that matters most.

```
CLAUSE (c) NOTIFICATION — Board Resolution 2026-04
SYNTHETIC DEMONSTRATION RECORD. No real company, no real person, no real trade.

Governing instrument: Board Resolution 2026-04, adopted 2026-04-22, supplied as the artifact and hashed before any model was asked anything. Artifact SHA-256 8c6892584892fb54c38787d48bb40444bd97a52f51915b0fd3840f1ee324b099
Rule set: ruleset-board-authority-breach@1.0.0, SHA-256 0df4794458ac525eb13051621e0058fc7ddeaf1afcef261f1ff7d59c9cf0e815, declared provenance counterparty-authored — the board wrote the rule, not this system.

FINDING (panel majority CANNOT_CONCLUDE):
The acquisition of 60,000 shares on 2026-07-28 brought aggregate acquisitions in the authorised period from 175,000 to 235,000 shares, exceeding the 200,000-share threshold in clause (c). The notification obligation in clause (c) is engaged: the Chief Financial Officer and the Chair of the Audit Committee must be notified in writing within one (1) business day. The 250,000-share ceiling in the resolution is NOT exceeded.

NOT ESTABLISHED, and this is why the verdict is not a breach finding:
- Clause (a): the Insider Trading Policy window calendar was not supplied, so whether any acquisition fell in a closed window is unresolved.
- Clause (b): the General Counsel pre-clearance log was not supplied, so written pre-clearance is unresolved.
- No record of any prior notification to the CFO or Audit Chair was supplied.
- No board minutes, waiver or amendment were supplied. The resolution permits amendment only by written resolution.

This notice is the act the finding dispatched. Its delivery is receipted separately from its sending.
Finding receipt: https://miscsubjects.com/receipt/inv_j4brrx8wbp
Full record: https://miscsubjects.com/a/adjudication-board-authority-breach
```

## The ancestry, named, because none of this is new and the arrangement is

| precedent | what it establishes | what is different here |
|---|---|---|
| Double reading with arbitration in population breast screening | two independent readers, disagreement routed to arbitration, measured sensitivity gain over single reading, accepted by regulators | the readers are models, the rules are pinned as bytes, and the arbitration trigger is a published deterministic function |
| N-version programming, triple modular redundancy, DO-178C design assurance | redundancy against independent failure, with design-assurance levels | the channels are stochastic and correlated rather than independently developed, so diversity is counted by training family |
| IEC 61508 common-cause failure and its beta factor | redundancy must be discounted by measured shared failure | the beta factor here is verdict correlation across model families, and it is measured rather than assumed |
| Knight & Leveson 1986 | independently developed programs to one spec fail together far more than independence predicts | the same result, sharper, because the channels share training data |
| Chow's reject option; conformal prediction and conformal risk control | the formal machinery for abstaining in exchange for a distribution-free bound on error at a chosen risk level | the bound is not yet computed here; the probe is the input it needs, and until it is computed this assembly has a measured escalation behaviour and no certified bound |
| ISA 500 and ISA 705 scope limitation | an auditor must state what evidence was unavailable and qualify accordingly | RECORDS_ABSENT mechanises it as a mandatory field whose omission voids the finding |

Byzantine fault tolerance is deliberately **not** on that list. It models an adversary; these failures are stochastic and correlated. Borrowing the term would signal borrowing rather than knowing.

## What this is not, stated before anyone has to ask

- **It does not stop fabrication.** The imaging assembly contains a channel that named the absence of laterality markers in its own RECORDS_ABSENT and then assigned an anatomic side anyway. Fabrication happens at generation time; this assembly makes it detectable and, when it diverges, non-emitting. Undetected error becomes detected deferral. That is the claim, and it is smaller and more defensible than the one people reach for.
- **It is not a certified bound.** Nothing here yet says "residual error at most alpha". It says: measured false-confidence per channel, measured family correlation, and a gate that fails closed. The bound is the next artifact, and it needs a larger probe suite than fourteen items.
- **It is not cheap.** Four channels plus a recorded adversary is five model calls per question before any human time. At nine channels on every imaging study the cost is the reason to scope complexity, not a detail.
- **The escalation target is a role, not a person.** No named human has yet returned a blinded finding under ADJUDICATE_HUMAN_REVIEW. The row makes blinding a fail-closed boolean and has never been invoked. Until it is, the last step of the assembly is unexercised.
- **Two families is not enough diversity** for anything consequential, and every assembly above ran at two.

## Reproduce the gate

```
# the gate's own rules, before you trust its output
curl -s https://miscsubjects.com/api/directory/SEAL_PANEL

# run it over any panel's findings
curl -s -X POST https://miscsubjects.com/api/dispatch \
  -H 'content-type: application/json' \
  -d '{"key":"SEAL_PANEL","body":{"findings":[{"model":"@cf/moonshotai/kimi-k2.7-code","verdict":"AFFIRM","clauses":[2,6]},{"model":"@cf/zai-org/glm-5.2","verdict":"AFFIRM","clauses":[2,6]},{"model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","verdict":"AFFIRM","clauses":[2,6]}],"min_families":3}}'

# and verify a sealed finding without asking this site anything
python3 verify_bundle.py bundle.json
```

## Sources

1. Imaging + medication — gate decided ESCALATE — https://miscsubjects.com/receipt/inv_kx2x79mbkd
2. Pre-trade risk controls — gate decided ESCALATE — https://miscsubjects.com/receipt/inv_ny6iku4i3s
3. Board authority, clause (c) — gate decided ESCALATE — https://miscsubjects.com/receipt/inv_g7jl9qp707
4. EU AI Act Article 12 — gate decided ESCALATE — https://miscsubjects.com/receipt/inv_ivezpvux57
5. https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act — https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act
6. https://miscsubjects.com/a/attested-finding-image-record-action — https://miscsubjects.com/a/attested-finding-image-record-action
7. https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act — https://miscsubjects.com/a/adjudication-probe-report-eu-ai-act
8. The gate, readable before you trust it — https://miscsubjects.com/api/directory/SEAL_PANEL
9. Verify a sealed finding without asking this site — https://miscsubjects.com/a/offline-verifier
10. A rule set whose provenance is counterparty-authored — https://miscsubjects.com/a/ruleset-board-authority-breach
11. The escalation the gate produced, delivered — https://miscsubjects.com/receipt/inv_nhusr0n6j2