[aruintelligence]

ĀRU Decision Evidence Lab — prospective risk watch and witnessed release evidence

Review in two minutes

Buyer problem: an AI team's result can look convincing while difficult requests, adverse grades, stale checkpoints or substituted keys are missing from the evidence. This PR adds an opt-in, human-governed evidence gate for a closed cohort. Start with the evaluation brief for the buyer proposition, proof path and pilot boundary.

What changed: a predeclared sequential risk watch; signed issuance, preinference receipt and grade ledgers; a public-key grader checkpoint; two Ed25519 witness approvals over the same closed evidence; and a release gate that checks exact source offsets, the host-pinned signed calibration policy, full request/grade/receipt coverage, watch outcomes, authorized key pins and local rollback state. A valid signed statement paired with missing records cannot advance the verifier head. The existing scaffold remains the default. No gate automatically rolls out a model.

Evidence that can be inspected

Evidence	Observed result	What it does not prove
Corrected preinference receipt challenge	120 issued requests, 120 CI-generated receipt claims, 120 real-model calls, 15 rubric errors, zero execution failures, 120 source-span certificates; no alarm at a predeclared 50% research target	Customer delivery, independent operations, acceptable customer error rate or safety
First real-model risk-watch audit	12/120 errors and no alarm; in six synthetic suffix label-flip stress replays, only one severe injection alarmed	Observed live drift detection; the five misses remain a disclosed negative result
Adversarial witness tests	A fully signed attacker grader log can pass the low-level gate with self-fed pins, while the setup-pinned witnessed gate denies substitution; incomplete signed evidence cannot poison rollback state; a second valid policy signed with the same key cannot lower the release threshold	Independent human witness operation or a public transparency clock
Human-gold retrieval benchmark	82.1% versus 78.5% answer-containing sentence selection on 2,000 public questions; one topic regressed and advancement was blocked	Better LLM reasoning or customer workflow performance

The archived receipt cohort was not witnessed at scoring time; later witness tests do not retroactively give it independent custody. Receipt, inference and grading ran in one CI environment. The witness review path currently needs ingress, receipt and watch HMAC verification secrets. The source-offset certificate establishes text provenance, not factual entailment.

Reproduce the bounded software checks

python3 -m pip install '.[public-grader]'
aru-witness-demo
python3 -m unittest -v tests.test_grader_witness_quorum
python3 -m unittest -v tests.test_receipt_cohort_ledger tests.test_public_grade_ledger
python3 -m unittest discover -s tests -q

The one-command synthetic demo reports an honest two-epoch cohort and six rejected attack attempts as JSON, exits nonzero on unexpected acceptance, and makes zero model calls. It is installable and runs from any directory with published demo keys. The local suite passed 251 tests on this commit. These tests use constructed attack cases; they do not rerun model inference. The protocol and falsification notes, public grader design, witness operations, and product brief describe assumptions and commands. The frozen prospective ledger protocol SHA-256 is dde659f6dfb28a46c7bb6fe5c4b9c91d9a5fec5333d21f9ef4bba8f744bffd69; the receipt extension SHA-256 is 20e67ca8514d06201a49d469cc3fae434426b42a81dc5108d1521f9936dcdab4. Both were unchanged in this update.

Commercial next step and limits

The six-week design-partner draft proposes one non-consequential workflow, a frozen baseline and candidate, customer-approved tasks, independently specified grading and a reproducible human go/no-go package. Its $20,000 fee is a pricing hypothesis, not a validated sale. Before a customer deployment: independent delivery and checkpoint custody, separate grader/witness operators, key management, privacy controls, failure recovery, statistical review and external security assessment. No customer pilot, production SLA or security certification is claimed.

The public code is MIT licensed. Contributor rights and any customer-specific IP require separate review.

CI on 6c181e4: running; verify the PR checks for this policy-pin change before treating it as remotely validated.