01 / 17 Cover
Confidential · CDL Seattle · August 2026
Working document · CDL Seattle Computational Health · August 2026

Verifiable policy adherence and auditable prediction for clinical AI.

Organizations deploying AI inside clinical workflows are asked a question they cannot answer: show me what your AI actually did, on this encounter, under which policy, and prove it. They have application logs. They do not have evidence.

A technical walkthrough of a research program built on a system that already exists: a governance runtime that applies signed, versioned policy at the inference boundary, records every decision as a cryptographic receipt, and lets a third party verify it offline — needing nothing from us but the trust roots it chooses to configure.

All results are preliminary, from synthetic or licensed research data. No clinical-effectiveness claims.

Glacis Research · prepared for CDL Seattle Computational Health

The three documents in the background
  • A Technical Assessment Brief 10 pp
  • B Technical Evidence Index 6 pp
  • C Research Proposal 12 pp
The attestation half ships today. The predictive half is research and planning. Implying equal maturity is the failure mode this packet exists to prevent.
GLACIS CDL conversation · August 2026
02 / 17 Thesis
Confidential · CDL Seattle · August 2026
The claim, and the four questions it decomposes into

One substrate, a hierarchy of assurance.

Thesis. A governed AI runtime that records every decision as independently verifiable evidence can support, on that same evidence, a hierarchy of assurance capabilities — clause-level conformity evaluation, conversation-level risk trajectory, and operational forecasting — such that each capability’s own outputs are auditable artifacts rather than vendor assertions; and this closed loop, not any individual model, is the defensible contribution.
Question
Timescale at which governance fails
RQ1 — Can a model evaluate whether an interaction follows a specific policy clause, identify its supporting evidence, and abstain when decisive operational facts are unavailable?
A single decision. The flagship, and nearest to publication.
RQ2 — Can risk that becomes visible only across a trajectory be detected credibly — and what corpus design is required for the evaluation to mean anything?
A single conversation.
RQ3 — Can the runtime forecast the operational consequences of a configuration while preserving evidence provenance and data boundaries?
An operating window.
RQ4 — Can those predictions be made admissible — signed before outcomes, computed over reproducible samples, and calibration-auditable by others?
The convergence. Not a separate experiment but a property the other three must satisfy.
RQ1 is the flagship. RQ2 and RQ3 are deliberately staged behind honest boundaries. RQ4 is the destination.
GLACIS CDL conversation · August 2026
03 / 17 The Packet
Confidential · CDL Seattle · August 2026
How to read the three documents

Three documents, three different jobs.

They are one packet with a deliberate division of labour. Each answers a different reviewer’s question, and none of them is a summary of the others.

A · Brief
What is claimed — and at what strength
System boundary, trust topology, receipt construction, control semantics, a 17-row threat model pairing each guarantee with its remaining assumption. Includes an explicit not claimed list.
B · Index
Where each claim is proved — or isn’t
An assessment ledger. Every material claim maps to versioned source, an exact executed command, a research artifact, or an explicit gap. Seven evidence labels, from Shipped to Not claimed.
C · Proposal
What the substrate makes researchable
Four research questions on one timescale ladder, three aims with success gates and promotion boundaries, and the case for an academic home.
The Brief asserts. The Index proves. The Proposal asks.
GLACIS CDL conversation · August 2026
04 / 17 Maturity
Confidential · CDL Seattle · August 2026
The legend used on every slide that follows

Every claim carries its own maturity.

A deck compresses, and compression is what quietly erases maturity labels. So the band travels with the claim on every slide from here to the end.

Shipped Synthetic In progress Preliminary Planned Not built

Evidence substrate — Shipped

Receipts, witnessing, offline verification, sampling, lineage. Implemented, internally verified, available for controlled inspection.

Clinical workflows — Synthetic

End-to-end behaviour demonstrated with synthetic data and fixtures. No patient data has been used in any experiment.

Policy conformity (RQ1) — In progress

Corpus frozen and diagnostics run. The final multi-seed study has not been run.

Trajectory risk (RQ2) — Preliminary

One seed, directional evidence only. Not stable enough for a performance conclusion.

Operational forecasting (RQ3) — Planned

Design direction only. Phase 0 has not started; the required data foundation does not yet exist.

For an audience whose own work is audited, a system that marks its own boundaries is the credible one.
GLACIS CDL conversation · August 2026
05 / 17 Problem
Confidential · CDL Seattle · August 2026
Motivation

Three gaps that are the same gap.

The absence of an evidence layer under AI operations. It is structural, not a matter of diligence.

01 · The record
Logs are written by the party being questioned
After the fact, in a format that party controls. Nothing records what the model was permitted to do at the moment of decision, what the guardrail actually decided, or whether the record was altered later.
02 · The model
The model is usually not the organization’s
Providers ship new checkpoints behind unchanged names and adjust behaviour on their own schedule. When quality shifts, the deploying organization hears it from users weeks later and cannot separate “we changed something” from “they changed something.”
03 · The monitor
The products sold to close the gap inherit it
Every drift chart and risk score is computed over a sample the vendor chose, and can be quietly recomputed after the outcome it failed to predict.
Two concrete cases. An ambient scribe: PHI transits every dictation-to-note inference, and “how was PHI handled on this encounter?” answers to a policy document plus trust. A residency screening cycle: an applicant cannot be un-scored, so retrospective detection of fairness divergence announces a remediation problem rather than preventing one.
A warning that cannot be audited is an assertion, not an instrument.
GLACIS CDL conversation · August 2026
06 / 17 Architecture
Confidential · CDL Seattle · August 2026
The governed path

Policy applied in the inference path, not described beside it.

Shipped Brief §01–02 · Proposal §3.1
01
Request
Application sends an in-scope request plus authenticated operational context.
02
Resolve
Arbiter resolves the active signed Charter, operating profile, controls, runtime identity.
03
Decide
Estimators emit bounded assertions; a deterministic controller resolves the action.
04
Record
Signed receipt and local evidence record. Notary receives commitments only.
05
Verify
Customer exports a bundle; a third party checks it offline.
The model never decides. It estimates clause applicability, conformity, evidence and sufficiency. A signed operating profile and a deterministic controller resolve allow, redact, block, review, or degraded. A user typing “I have consent” cannot override authenticated consent state, because trusted operational context rides outside the untrusted conversational text.
Exact egress statement. No raw prompt, response, PHI or PII reaches the Glacis evidence service. Commitments, hashes, signatures, bounded metadata and proof material may. A model provider the customer selects is a separate boundary and may receive content — so the accurate claim is “no content leaves,” never “nothing leaves.”
GLACIS CDL conversation · August 2026
07 / 17 The Receipt
Confidential · CDL Seattle · August 2026
What one decision leaves behind

A payload-free record, checkable on a laptop.

Shipped Receipt v3 · Brief §03 · illustrative, non-normative
schema: glacis.receipt.demo event_id: synthetic-7f2c policy: {id: clinical-assistant, version: 3.2, digest: sha256:91...} runtime: {model_requested: model-a, model_reported: model-a, manifest: sha256:27...} commitments: {input: hmac-sha256:4b..., output: hmac-sha256:82..., controls: sha256:17...} action: {resolved: review, reason: policy_clause_4_2} evidence: {level: bounded, witness: operator_notary, coverage: mediated_event_only} signature: {alg: Ed25519, key_id: tenant-signing-2026-q3, value: ...}
The dual hash is the clinical unlock. Each Merkle leaf binds two independent hashes — one over canonical input/output, one over control-plane results — signed independently. An auditor can verify what was flagged, what was blocked, under which policy version without ever seeing the raw PHI, and neither hash can be tampered with alone because both bind to the same witnessed leaf.
An offline verifier checks signatures, hashes and proofs with no API call to us and no permission from us.
GLACIS CDL conversation · August 2026
08 / 17 Properties
Confidential · CDL Seattle · August 2026
Why the record is hard to dismiss

Four properties an auditor can check without us.

Shipped Proposal §3.2–3.4 · Index §A–B

Sampling you cannot cherry-pick

Promotion from receipt-only to deep inspection is a keyed PRF — HMAC‑SHA256(policy_key, “sample:v1” || payload_hash) — deterministic, nested, per-organization, and recomputable by any auditor holding the policy key. The full PRF tag is committed alongside each attestation.

Cohort integrity across a comparison

Model identity as requested and as reported are separate first-class snapshot fields, so a silent provider checkpoint swap is a citizen of the data model rather than a forensic surprise. An organization can say “these four thousand cases were evaluated by one consistent system” — or name the window where they were not.

Lineage from charter to activation

Edges are derived from the artifacts’ own content hashes, never asserted by the caller. Certification is deterministic and content-addressed — no clock, hostname or randomness — so two independent certifiers can be compared byte for byte. A refusal to certify is itself a committed certificate.

A drift plane that cannot become a PHI store

Its sample type is scalars-only and cannot be constructed from raw JSON — enforced at the compiler level. Baseline artifacts reject all strings; detectors never alarm during warmup; a replayed detector specification yields the same fire sequence as production.

Our evidence cannot be dismissed as cherry-picked, because the selection basis itself is checkable by someone other than us.
GLACIS CDL conversation · August 2026
09 / 17 Discipline
Confidential · CDL Seattle · August 2026
The epistemic foundation

A runtime that cannot sign for enforcement no code performed.

A signed record of enforcement is worthless — worse, actively misleading — if the system can claim a control ran when it did not. A family of shipped mechanisms closes exactly this failure mode.

Shipped compile-honesty amendments partially implemented
Wiring
Fail closed, or refuse to start
A control declared as enforced whose backing model is absent refuses to wire at startup, rather than degrading to an allow-everything stub while receipts keep claiming it ran.
Honesty
Declared-not-enforceable
Reading the shipped policy against the shipped detector catalog produced obligations labelled as backed by insufficient mechanism — never rendered as “Enforced.”
Witness
Provisional vs. witnessed
Non-repudiation attaches only to witnessed receipts. A co-resident witness is capped at locally-verified by a pinned test; independence must be deliberately granted.
Verification status is always derived, never accepted from input. The verifier exposes ten states, of which only two ever read as verified. A hand-edited “witnessed” claim cannot survive scoring.
A research program on governance evidence is only as credible as the evidence layer’s refusal to flatter itself.
GLACIS CDL conversation · August 2026
10 / 17 Boundaries
Confidential · CDL Seattle · August 2026
The slide we expect to be pressed on

What a receipt proves — and what it does not.

Shipped Brief §07 · stated as firmly as the claims
If verification succeeds, the bundle can support
It does not establish by itself
The receipt bytes were signed by a key accepted under the verifier’s configured trust policy.
That the key, host, or runtime was uncompromised.
The event is bound to the represented policy, configuration and model identities.
That the represented policy was clinically or legally sufficient.
Inclusion and consistency proofs are valid under the accepted witness root.
That the present Glacis-operated witness is structurally independent.
A changed signed field, commitment or proof is detectable under the verification rules.
That all relevant traffic produced receipts or traversed the proxy.
Evidence state distinguishes local-only, witnessed, degraded, incomplete or unverified material.
That probabilistic control output is true, calibrated, or clinically effective.
Deeper evidence selection can be reproduced when committed sampling inputs are available.
That the receipt population or denominator was complete.
The active Notary is Glacis-operated, and code inspection cannot establish production key custody.
GLACIS CDL conversation · August 2026
11 / 17 Validation
Confidential · CDL Seattle · August 2026
Executed, not asserted

Every claim maps to an exact command.

Verified internally clean snapshot 0d807a6382 · Rust/Cargo 1.88.0 · Index §C
537
passing test executions
0
failures
1
ignored helper
301
cached-main — never added to the above
Test-count discipline. The 537 figure is the focused commands recorded in the Evidence Index at one clean snapshot. It is not the repository’s total test count and not a tagged-release claim. The separate 301 cached-main results ran at a different SHA and are never combined with it.
Where it stands. The recorded commands have since been re-executed by three independent agents across two model vendors with exact-match counts throughout. Performance evidence is deliberately not assessment-grade: there is no frozen protocol with hardware, traffic shape, median, p95, p99 and throughput, so the packet makes no end-to-end latency claim.
The open gate is a signed reproduction by an external human reviewer on hardware we do not control. Until then, validation remains internal.
GLACIS CDL conversation · August 2026
12 / 17 RQ1 · Conformity
Confidential · CDL Seattle · August 2026
Aim 1 · single decision

Policy conformity under partial observability.

Does this interaction follow this exact policy clause, in this system scope, at this runtime stage? The evaluator sees one compiled clause, the request, bounded context and metadata — and never the intended enforcement action.

Research in progress corpus frozen · final three-seed training not yet run
119,801
unique inputs from 120,000 admitted rows
1.000
applicability F1 — program-exact view
0.636
applicability F1 — natural language
0.919
joint AUROC — natural language
8 / 202
abstentions where uncertainty was required
The decisive result is the failure. Across three views of the same facts, performance generalized — informative on natural language (joint AUROC 0.919) even as applicability degraded — but uncertainty behaviour did not. On the view where decisive facts were intentionally hidden, the model abstained on eight of 202 cases that required it. This single diagnostic ordered the entire program: abstention, not accuracy, is the primary endpoint.
What follows from it. Trust-aware context and calibrated abstention become the research priority; authenticated authorization, consent and context completeness stay deterministic checks outside the classifier — permanently. Splits are 89,195 / 15,287 / 15,319, with paraphrases and counterfactuals grouped before assignment and executable semantic programs as the label authority.
GLACIS CDL conversation · August 2026
13 / 17 RQ2 · Trajectory
Confidential · CDL Seattle · August 2026
Aim 2 · single conversation

The corpus is the experiment.

Risk that becomes visible only across a conversation — and what corpus design is required for such an evaluation to mean anything at all.

Preliminary — one seed, directional only
0.834
full-conversation AUC vs 0.808 first-turn
+0.026
gain, against a 0.020 seed spread
36 / 31,238
genuinely two-turn attacks in the original corpus
0.609
HarmBench recall, down from 0.828
The methodological finding is blunt. Architecture changes cannot be evaluated credibly when corpus shortcuts reveal the answer. The original corpus let turn count and data source predict the label, and the headline increment was not reliably larger than the seed spread.
Rebalanced, and honest about the cost. A corpus placing attack payloads behind benign openers, with 2,277 hidden-intent multi-turn attacks, cut attacks peaking at turn one from 90.0% to 48.8% and improved the turn-one-blinded metric from 0.751 to 0.865 — at a HarmBench recall cost that prevents any performance conclusion. Next is a matched four-seed study with source-balanced sampling and preregistered decision rules.
GLACIS CDL conversation · August 2026
14 / 17 RQ3 · Forecasting
Confidential · CDL Seattle · August 2026
Aim 3 · operating window

Impact Intelligence — and what does not exist yet.

Planning only — Phase 0 not started
01
Configure
02
Forecast
03
Activate
04
Observe
05
Compare
06
Learn
The first phase is not a model. Six typed, versioned evidence contracts already ship — snapshot, receipt, drift, review, usage, config change — which is why Phase 0 is the humbler work of retention, linkage and completeness, delivering a verified dataset specification with no model claim. The evidence contracts ship today; the retention, linkage and forecast-storage machinery does not.
Scope boundaries, stated as firmly as the aims. Operational and governance outcomes only — never patient outcomes, clinical efficacy, or the truth of a medical response. Predictions remain advisory: they do not weaken a policy, approve an output, or change an enforcement configuration, and a prediction failure falls back to existing deterministic behaviour. Autonomous threshold optimization and cross-tenant training over incomparable metrics are explicitly not proposed.
GLACIS CDL conversation · August 2026
15 / 17 RQ4 · Convergence
Confidential · CDL Seattle · August 2026
The unifying contribution

A prediction that can itself be made evidence.

Forecasting is widely claimed in AI monitoring. A forecast that is signed before the outcome and recomputable by an auditor is, to our knowledge, not a shipping property of current monitoring products — and that property, not forecasting itself, is the target.

Attestation half Predictive half — research and planning

Signed before the outcome

So it cannot be quietly rewritten after the outcome it failed to predict.

Bound to the configuration it was made under

Via the environment snapshot and the certified change lineage.

Computed over a reproducible sample

Via the PRF construction — the auditor recomputes the selection.

Linked afterward to the observed outcome

With the error itself an auditable record, so calibration can be audited by someone other than its producer.

The differentiator, stated so it cannot be told backwards: it is not that we predict — it is that the prediction cannot be cherry-picked and cannot be un-said.
GLACIS CDL conversation · August 2026
16 / 17 Open Gates
Confidential · CDL Seattle · August 2026
The release ledger, unedited

Eight gates still open.

We would rather you heard these from us, in this order, than found them in the Index.

Release gate
Current disposition
One code release commit / tag
Two snapshots used for assessment; one assessor release must be frozen.
One OVERT v1.1 hash
Three divergent local copies found, all labelled v1.1.
Assessor-ready verifier bundle
Rust fixtures reproduced; one locked command and trust bundle to package.
Model / dataset IDs
Metrics preserved with caveats; exact checkpoint and data digests not locked.
Performance protocol
No authoritative median / p95 / p99 / throughput table under one frozen setup.
Notary / key / topology statement
Operator known; production key custody, rotation and revocation not established from code.
Production lineage graph
Certifier ships and refuses to certify: one contract in the chain is not yet generated.
Peer-reviewed publication
None established; the proposal defines the publication path.
A certifier that publishes its own coverage gaps. We treat these not as admissions but as the persuasion itself.
GLACIS CDL conversation · August 2026
17 / 17 The Ask
Confidential · CDL Seattle · August 2026
Why this program needs an academic home

The system half is engineering, and it is largely done.

The research half requires exactly what a university program provides and a startup lacks internally.

  • A
    Clinical informatics and practising clinicians
    For policy scope, adjudication protocol design and safe promotion criteria. Aim 1’s clinician-adjudicated evidence tier cannot exist without them.
  • B
    NLP, safety and biostatistics review
    Corpus design, seed discipline, preregistration, uncertainty evaluation — and forecast evaluation methodology for Aim 3.
  • C
    Design partners for governed shadow studies
    Raw content never leaves the partner’s environment — the zero-content-egress substrate makes this structural, not a policy promise, which is what makes it a small ask.
  • D
    Cryptography, standards and reproducibility review
    The one gate no internal work can close: an external reviewer who reproduces the assessor command and signs the result on hardware we do not control.
What we bring in exchange: a running evidence substrate a reviewer can verify without a live connection to us, a research agenda the product feeds as it operates, and a commitment — enforced in code — to label every claim at exactly its strength.
This proposal is written to be falsifiable in the same way its experiments are.
GLACIS CDL conversation · August 2026
01 / 17