Every claim in this record, as a capsule: its proposition, its evidence binding, its decay clock, the boundary it will not cross, and the condition that would defeat it. A solid cyan rail marks a public evidence binding; capsules without one carry a dashed neutral rail and an attested chip that says so; the clock turns amber when a review window is three-quarters spent and red when it lapses. There is no aggregate score here and never will be — a quiet trigger is quiet, not "healthy", and these envelopes do not average into one number.
cc.kernel.strict.frechet_bounds computes Fréchet–Hoeffding endpoint bounds for composed binary guardrail failure from declared marginals; for marginals (0.10, 0.10) it returns [0.0, 0.10] for the AND event and [0.10, 0.20] for OR.
CC-Framework maintains a claim-boundary manifest mapping its public claims to validation lanes, supporting files, and explicit non-claims.
CC-Framework's E1 dependence-evidence study established constructively that distributions with identical singleton failure rates (0.5) and identical pairwise overlaps (0.25) can differ in three-way failure probability — 0 under even parity, 0.25 under odd parity — so measuring every pair does not identify a three-guardrail stack. E1 is synthetic; its recorded decision is Narrow.
For marginals (0.10, 0.10) and the both-fail query, cc.kernel.strict identify() returns the sharp interval [0.0, 0.10] together with endpoint witness distributions that sum to one, are nonnegative, satisfy both marginal constraints, and attain each endpoint — verified to 1e-9 from a clean clone.
CC-Framework's E2 — the shared-item empirical guardrail pilot — is governed by a measurement contract frozen before any dataset was inspected; no conforming dataset has been collected, so E2 is untested, and the contract's conformance checks are executable.
CC-Framework's E2 measurement pipeline was rehearsed end to end on three synthetic guardrail mechanisms: 66 observation rows conform to the frozen E2 schema with zero validator violations, the pre-registered negative controls behave (the common-cause control attains pA(1-pA) to 1e-9), and the finding records the result as a null at n=22 with a quantified cost for real E2 (~1097 shared items for epsilon=0.05). E2 itself is not run.
HYPOTHESIS — Among English-reading professionals who made or materially prepared a go/hold recommendation for an AI-based system in paid work during the prior 12 months, an E2-derived dependence-aware uncertainty presentation will increase HOLD decisions by at least 15 percentage points relative to a stipulated-independence presentation of the same evidence.
As of 2026-08-27, among 20 public guardrail evaluations meeting the Missing Column Census's frozen inclusion criteria (v1), 14 establish a shared item set and a common event definition; 5 provide one of the census's declared joint-evidence artifacts: a printed composition result or per-item outcomes that make one directly computable.
On the 170-prompt per-item subset publicly released with BELLS's 2025 misuse-detection evaluation (pinned commit below), the five specialized supervisors — Lakera Guard, Prompt Guard, LangKit, NeMo Guardrails, LLM Guard — have an OR-union of released binary verdict columns that flags 73 of the 82 prompts labelled harmful, leaving 9 all-miss (11.0%). The product of their individual miss rates is 3.5%; the release-recomputed all-miss rate is about 3.1× that independence plug-in on this file. The same OR-union flags 19 of the 50 benign prompts.
For k guardrails scored on a common item set at a common operating point under block-on-any composition, the rate at which every guard misses the same item is fixed by the published per-guard miss rates only up to the interval [max(0, Σp − (k−1)), min p], and every point of that interval is attained by some joint law with those marginals. Marginals prove non-degradation of a static OR composition relative to its best member, but, when that identified set is non-degenerate, they do not identify strictly positive incremental benefit. They also identify a positive lower bound on static benign union-flag rate when any member has a positive benign flag rate. On the BELLS 2025 partial per-item release — 82 prompts labelled harmful — the exact finite identified set is {0/82 … 12/82}; MC-002 recomputes 9/82 all-miss from the hash-verified released verdict file. Marginal catch counts plus the union identify only bounds on each guard's exclusive full-stack coverage; the registered leave-one-out unions identify the realized values: NeMo 18, Lakera 3, and LangKit, Prompt Guard, and LLM Guard 0 on this stratum.
On the per-item guard-verdict files publicly released with Multimodal Safeguard Bench's full_run (pinned commit below; six verdict files and the release's two printed-metric files hash-verified), the three guards — Llama Guard 4, Llama Guard 3 Vision, ShieldGemma 2 — have harness-normalized native `unsafe` labels whose static Boolean OR is 1 on 192 of 200 harmful-labelled text items (8 all-zero rows, 4.0%) and all 200 harmful-labelled image items (0 all-zero rows), while the same OR is 1 on 32 of 250 benign-labelled text items (12.8%) and every one of 250 benign-labelled image items. Llama Guard 3 Vision alone has a 1-bit on all 250 released benign image items. The complete 2^3 native-label pattern table, leave-one-out bit ORs, and unique bit contributions for each released stratum are bound below. The release prints per-guard metrics and two two-guard compositions; it prints no three-guard bit OR, no all-zero-row count, no leave-one-out table, and no pattern decomposition — and every recomputed quantity that overlaps what it does print is asserted equal to the printed value.
Anthropic's AI Fluency Index reports overall prevalences for the 11 of its framework's 24 behaviours that are directly observable in conversations, and percentage-point differences for conversations that produced an artifact, but not the artifact share and not which comparison group the differences are against. Those published numbers therefore do not identify the subgroup rates — but they do bound them. Under every feasible artifact share and under either reading of the comparison, fact-checking is between 30% and 43% less prevalent in artifact conversations, a far larger effect than the stated 3.7 percentage points suggests on a base rate of 8.7%. The three behaviours that rise in artifact conversations are Description behaviours; the three that fall are Discernment behaviours.
Ghost-Ark is a verifier and measurement harness for the provenance limits of AI-governance receipts — a research artifact of the S2 Lab, Penn State — whose stated thesis is that receipt soundness is a ternary relation Sound(C, Σ, P): a receipt identifies an execution only up to the kernel of its whole parse → canonicalize → digest pipeline, so soundness does not persist by default as the pathology alphabet grows or the consumer set widens.
Ghost Visualizer is a seven-scene React/Vite visual essay ("Why AI Safety Scores Lie") that computes marginals, OR composition, Fréchet–Hoeffding bounds, endpoint witnesses, and a receipt object from deterministic sample rows, with an Evidence Mode for inspection.
GCE — the Guardrail Composability Explorer — is a coursework MVP demo (AI-285) for toggling guardrails and observing composed behavior. Its front-door composability-coefficient framing is superseded by CC-Framework's dependence-aware partial identification, whose metric taxonomy classifies the older coefficient family as legacy/deprecated. GCE is preserved as intellectual lineage, not current theory.
This site's palette token pairs were computed to pass WCAG AA contrast (most AAA), and manual QA passes covered light/dark themes, desktop and mobile layouts, keyboard focus, reduced motion, and no-JS rendering, as recorded in DESIGN.md.
This site's claim registry is enforced in CI: verify_claims.py validates schema and bindings, executes the executable review triggers against live evidence, and fails the build when any claim passes its freshness window — on every push and weekly.
E3 — the first pilot this repository ran itself — scored two ungated classifiers on 400 harmful and 800 benign items and produced 2,400 committed observation rows. Its primary pre-registered prediction FAILED: excess joint miss was +0.0018 with a 95% bootstrap CI of [-0.00096, +0.00706], which includes zero. Both guards missed almost everything on this pool (0.9825 and 0.9625), so the Fréchet interval the two marginals allow is [0.9450, 0.9625] — 1.75 percentage points wide — and the observed joint miss of 0.9475 lies inside it. The prediction that it would lie inside HELD; the difficulty-stratification prediction was NOT COMPUTED and remains open.
E3B put the same two classifiers on the attack family they were built for — 400 real prompt injections — and produced a further 2,400 committed observation rows. Its primary prediction FAILED and so did the prediction the redraw existed to test. One guard missed nothing (0.0000, catching 400 of 400) and the other missed 0.3975, so the Fréchet interval the marginals allow is [0.0000, 0.0000] — zero points wide — the observed joint miss is exactly 0.0000, and the bootstrap CI is the degenerate [0, 0]. E3B was pre-registered to produce an interval wider than 10 percentage points; it produced one narrower than E3's. The prediction that the observed joint miss would lie inside the interval HELD, trivially.
REJECTED AS STATED on 2026-09-10. The permutation routine moves unequal-mass atoms. Only 16 of 1,296 constructions preserve the specified marginal weights. The advertised 2.12–18.07 fixed-marginal range is unsupported and is rejected. No replacement range is asserted. Historical assertion retained for audit, not an accepted current finding: E6 extracted the client-side model kernel that anthropic.com/institute/econ-scenarios ships (Turbopack module 303412, sha256 0a75763f…), gated it against the twelve printed numbers of Table 3 of the Anthropic Institute's Working Paper 2026-02, and evaluated it only at parameter vectors built from the five marginal quantiles that paper prints in Table 2. The kernel reproduces all twelve Table 3 numbers to the printed decimal, and GDP is strictly increasing in each of the five parameters over their published interquartile ranges. Holding the four parameters the note to Table 4 names at that note's values, the same five marginals admit a median 2030 GDP anywhere in [2.12, 18.07] percent above the no-AI path across the 1,296 rank-permutation couplings of their published quartiles: 9.88 at the comonotone corner, 8.32 under independence, against the 8.6 the paper obtained by running each of 3,259 respondents' own five-vector. The marginals fix an interval fifteen points wide, not a point, and the measured joint lies strictly inside it.
REJECTED AS STATED on 2026-09-10. Calibration uses the all-nine shared pool instead of each judge’s own pool, changing one threshold from 0.95 to 1.00. Pair evaluation also uses the global intersection. The preregistration-conforming confirmation claim is rejected; the original HELD labels are historical outputs. Historical assertion retained for audit, not an accepted current finding: E7B is the first non-degenerate preregistered measurement this repository has produced, and all five of its predictions held on data unread when they were fixed. Against a preregistration frozen at f646e136 before any hold-out byte was retrieved, six of nine published guardrail-judge score sets reached a 5% benign false-flag budget on their shared 96-item AgentDojo pool (21 injection goals, 75 benign) and yielded 15 non-degenerate pairs. Median excess joint miss was +0.2018 and mean +0.1852 (P1, P2 HELD); the median pair's observed joint miss sat 0.900 of the way to the Fréchet upper bound its own marginals allow (P3 HELD); every observed joint lay inside its interval (P4 HELD); and every one of the 15 pairs had an observed joint miss above the independence product (P5 HELD). On the modal pair two judges each miss about half the injection goals, independence predicts a 0.249 both-miss rate, and the observed rate is 0.476 — exactly the upper bound, meaning one judge's misses are a subset of the other's. Seven of the fifteen pairs sit at that bound.
The outer boundary of the record: everything these claims refuse to support, collected in one place. A claim without a stated non-claim is a claim that has not found its edge yet.
A falsifier can otherwise be evaded by changing the proposition after
observing the result. Each record fixes its defeat condition and consequence in advance,
then lists the reinterpretations that cannot keep it standing. An explicit []
means no meaningful post-falsification rescue applies.
FalsifierA clean-clone execution of the bound module on marginals (0.10, 0.10) returns AND or OR bounds other than the recorded endpoints, beyond the stated tolerance.
ConsequenceREJECT
Forbidden rescues
FalsifierThe bound manifest no longer maps its public claims to validation lanes, supporting files, and explicit non-claims as stated.
ConsequenceREJECT
Forbidden rescues
FalsifierThe frozen E1 construction fails to retain the stated equal singleton and pairwise values while yielding the stated different three-way probabilities (0 under even parity and 0.25 under odd parity), or the bound study does not record the stated Narrow decision.
ConsequenceREJECT
Forbidden rescues
FalsifierBound identify() execution fails any stated interval, witness feasibility constraint, marginal constraint, or endpoint-attainment assertion at the declared tolerance.
ConsequenceREJECT
Forbidden rescues
FalsifierEvidence shows that an eligible E2 dataset was inspected, selected against, or analyzed before the contract was frozen, or that the stated executable conformance checks do not exist, or that a conforming dataset has been collected while the claim remains marked untested.
ConsequenceNARROW
Forbidden rescues
FalsifierReplaying the bound dry-run artifacts fails to reproduce the stated 66 conforming rows, zero validator violations, negative-control behavior, or the recorded n=22 null and cost calculation, or shows that a real E2 run was represented as the synthetic rehearsal.
ConsequenceREJECT
Forbidden rescues
FalsifierAfter exactly 360 randomized eligible practitioners and a passing missingness gate, the upper endpoint of the frozen two-sided 95% Newcombe/Wilson interval for the Condition-B minus Condition-A HOLD risk difference is below +15 percentage points.
ConsequenceREJECT
Forbidden rescues
FalsifierA qualifying public evaluation meeting criteria v1 and published on or before 2026-08-27 is shown to be absent from this corrected census, or an examined row is shown to misreport its source such that recomputed N, M, or K differ from the stated 20/14/5.
ConsequenceREJECT
Forbidden rescues
FalsifierRecomputing from the bound, hash-verified file yields any count different from the expected block, or the file at the pinned ref no longer matches the recorded sha256, or the released columns are shown not to be the labelled systems' verdicts.
ConsequenceREJECT
Forbidden rescues
FalsifierA joint law with the stated marginals achieves an all-miss rate outside the interval; an exact finite catch-set arrangement lies outside the stated finite grid or exclusive-coverage bounds; or recomputing from the bound BELLS file yields any count different from the expected block.
ConsequenceREJECT
Forbidden rescues
FalsifierRecomputing from the bound, hash-verified files yields any count different from the expected block, or any pinned file no longer matches its recorded sha256, or any recomputed quantity that overlaps the release's printed metrics disagrees with the printed value, or the committed blocked columns are shown not to be the named guards' verdicts.
ConsequenceREJECT
Forbidden rescues
FalsifierThe report states an artifact share or comparison group under which the relative reduction falls outside [30%, 43%]; or a published figure differs from the transcription; or the closed-form bound disagrees with a direct sweep over feasible shares.
ConsequenceNARROW
Forbidden rescues
FalsifierA source-level review of the bound thesis shows that it does not state soundness as a ternary relation over the whole parse → canonicalize → digest pipeline, or does not identify Ghost-Ark as the stated S2 Lab research artifact.
ConsequenceNARROW
Forbidden rescues
FalsifierA local run from the bound revision lacks the stated seven scenes, deterministic sample-row computations, or Evidence Mode for inspection.
ConsequenceNARROW
Forbidden rescues
FalsifierThe bound superseding taxonomy no longer classifies the coefficient family as deprecated legacy, or no longer supports the stated dependence-aware supersession.
ConsequenceNARROW
Forbidden rescues
FalsifierRecomputing the listed palette pairs under WCAG contrast rules finds any claimed AA pass absent, or the recorded QA does not include the stated rendering, mode, and interaction checks.
ConsequenceNARROW
Forbidden rescues
FalsifierA controlled violation of a required registry field, bound-evidence trigger, or review window reaches a successful named CI workflow, or the workflow no longer runs on pushes to main and weekly.
ConsequenceREJECT
Forbidden rescues
FalsifierRecomputing from the committed observation rows yields any quantity different from the expected block beyond 1e-12, or the observed joint miss is shown to lie outside the Fréchet interval its own marginals allow, or a quoted prediction in the bound run report is shown to have been edited after the outcome was visible.
ConsequenceREJECT
Forbidden rescues
FalsifierRecomputing from the committed observation rows yields any quantity different from the expected block beyond 1e-12, or a quoted prediction in the bound run report is shown to have been edited after the outcome was visible, or E3B is represented anywhere in this repository as a re-run, correction, or replacement of E3.
ConsequenceREJECT
Forbidden rescues
FalsifierRecomputing from the committed rows yields any registered quantity different beyond 5e-5, or the pinned kernel bytes are shown not to reproduce all twelve printed Table 3 numbers to the printed decimal, or GDP is shown not to be monotone in one of the five parameters over its published interquartile range, or the measured joint median of 8.6 is shown to lie outside the coupling range this claim reports, or the extraction is shown to have altered the kernel's arithmetic rather than only re-instantiating its own factory source.
ConsequenceREJECT
Forbidden rescues
FalsifierRecomputing from the committed rows yields any registered quantity different beyond 1e-9, or the preregistration's commit is shown not to precede the results commit, or any of the nine hold-out score files is shown to have been retrieved or inspected before f646e136, or the operating-point rule applied in experiments/e7b/run/measure.py is shown to differ from the one PREREG.md states, or an observed joint miss is shown to lie outside the Fréchet interval its own marginals allow.
ConsequenceREJECT
Forbidden rescues
The exact commands that re-verify this record from a clean checkout. CI runs them on every push and weekly; nothing here requires trusting this page.
python scripts/verify_claims.py # shape, bindings, triggers, freshness, coverage python scripts/verify_census.py # census rows, N/M/K recomputed, MC-001 coherence python scripts/generate_ledger.py --check # the ledger is generated, not hand-edited python scripts/generate_modules.py --check # module pages match their registry python scripts/generate_observatory.py --check # this page matches the registry python scripts/generate_missing_column.py --check # campaign pages match the census python scripts/generate_sitemap.py --check # sitemap lastmod matches git history python scripts/verify_figures.py # figure geometry, asserted to 1e-9 python scripts/mjgd_reference.py --test # disclosure arithmetic identities python scripts/reanalyze_bells_subset.py # MC-002 recomputed from the hash-bound release python scripts/reproduce_cc001.py # clean-clone kernel reproduction + witnesses
Last owner review: 2026-09-14. These review events cannot be executed by CI, and the record says so instead of borrowing the executable triggers' credibility:
Related instrument, its own contract intact: CC-Framework's evidence cards ↗ — their manifest forbids aggregate scores and forbids rendering "not-run" as passing, pending, or healthy, so this observatory links them rather than re-plotting them.