The business caseThe problem this solves

A governance record is a checklist, and a complete checklist is not a working control. The record says an analyst reviews every output above threshold; nothing in the period shows a review actually happened. That pack looks governed on every board it appears on. Worse, the evidence accumulates across reviews — a gate exercised last quarter is not re-evidenced this quarter — so a reviewer working one cycle at a time re-raises what was answered and misses the gates that have quietly gone silent. a governance spreadsheet that reports 'record complete' and a RAG colour — which treats a documented gate as an exercised one, re-raises findings answered two quarters ago, and cannot tell an eval that was re-run last cycle from one that has not been touched in a year.

The inputThe actual governance records

The corpus is 120 governance records, 0.84 MB (txt 120). A real AI governance register names every model a company has deployed, what data it was trained and evaluated on, which humans are supposed to be checking it, and every incident it has caused. There is no public one. A scrubbed register is worse rather than better: scrubbing removes the reviewer's typed evidence, which is exactly the layer this kit measures.

Synthetic Record
----------------------------------------------------------------
Every field below is invented. This is a generated AI-pack governance review packet for an
AI use-case kit; it reproduces no firm's model register, no real evaluation result, no
real incident and no real person. The review policy is an ILLUSTRATIVE DEFAULT.

Pack
----------------------------------------------------------------
Pack reference                 : PACK-0001
Model pack                     : stock-count-anomaly-v3
Business area                  : Supply chain
Deployment surface             : in the buying team's planning tool
Deployed since                 : 2024-Q4
Accountable owner (of record)  : Declan Ashworth
Decisions in this review period: 245,095

Governance Record
----------------------------------------------------------------
The block below is the pack's entry in the model register AS COMPILED. It is NOT updated
between reviews: every date in it was true on the compilation cycle and has not moved
since. A field being PRESENT here is not evidence that the control behind it was
EXERCISED.

Record compiled                : 2025-Q4
Purpose statement              : on file
Data contract                  : on file, v2.4
Human gate documented          : yes
                                 "a merchandising lead reviews every promotional line
                                 the pack drafts before it is published"
Human gate last evidenced      : 2025-Q4
Eval suite                     : on file -- 61-case golden set
Eval suite last run            : 2025-Q4
Drift threshold                : population stability index 0.200
Incident history               : 3 closed, 0 open as at compilation

Review Policy (Default)

The outcomeWhat a good result looks like

every pack's verdict with its gate status and the age of the evidence behind it, correct as of this review rather than as of whenever the record was last compiled — with 2 false findings raised across 0 quiet readings.

Where it fitsWhat did work

Every line below is a measured result from this kit's own runs, with the figure that supports it. The headline above is not softened by any of them.

• Every gate exercise, eval run and incident is keyed into a structured log before the review runs — the free floor — structured-log-strong, $0.00
  It parses the log's tags and accumulates them across reviews.
• Reviewers confirm gate exercises in a channel and the log catches up later — the model, with the carried position
  Verdict 99.17 against 85.83, evidence age 100.0 against 69.17.

And where nothing here is good enough:

• You want the model's reading but cannot carry state between reviews — neither, as configured here
  The stateless control falls to 70.0 pct on verdict and 6.9 pct on memory-dependent action-now.

At a glanceHow the whole thing runs

Run once, for real, on 2026-08-25. Every figure on these pages was captured from that run — nothing is written from intent.

14 steps, grouped by the question that sends you to them rather than by build order. Each tile carries the one figure that step is about, and opens the page behind it.

Should you use this?What you bring, where it stops, and when not to use it

Before you commit an afternoon to this, these are the answers that decide it. Each one is rendered from the record it lives in — and links the page that holds it in full.

Not asked of this kit — 2 questions: clone (a fresh clone of this kit runs with nothing fetched); judge (nothing here is graded by a model).

Last verified 2026-08-25 — r001-model-govrecord. Every figure on these pages was captured from that run.

Run itHow this reaches your data

Every result on this page was produced by pure code over checked-in files, with no API key — which is why you can read the numbers before anyone spends anything.

Checked before this shipped — Every corpus extract, the answer key, all three free floors, the injection probe and what r001-model-govrecord actually answered ship in the repo. python3 -m evals.check_labels and python3 -m src.app both run with no key and no network.

Step 01 of 14Business case

Written for: product manager · Measured during the eval run. Never estimated, never quoted from a vendor page.

In brief

What the clock covers. one reading — one pack, at one scheduled run, end to end including provider-side reasoning tokens, on the shared connection. Not a cold-start figure and not a per-pack SLA: 120 readings ran in 549.9 wall seconds because different packs run concurrently while a single pack's runs are strictly serial.

Current processWhat it replaces

a governance spreadsheet that reports 'record complete' and a RAG colour — which treats a documented gate as an exercised one, re-raises findings answered two quarters ago, and cannot tell an eval that was re-run last cycle from one that has not been touched in a year.

Step 02 of 14Architecture

Written for: solutions architect · Component map derived from the real code, not drawn from intent.

In brief

CorpusCorpusArchitectureArchitectureArchitectureArchitectureEvalsEvalsEvalsEvalsPromptPromptPromptPromptApp UIApp UIEvalsEvalsBusiness caseUnit cost

• 1stations numbered in run order
• txt
• jsonl
• json
• 3 of 10 stations carry a recorded failure

scroll → 10 stations

One question, end to end. Colour on the fan-in is the corpus format; a red hook marks every station with a recorded failure, and the words — every sub line, failure and report field — are in the ledger beneath. Every station is a link — click one to jump to its row, and each row links to the lens that explains it.

The swap seams

Components

Step 03 of 14App UI

Written for: anyone, in 5 seconds · Screenshots of the running app taken during the run.

SuccessesWhen it works

LimitsWhen it does not

A report showing only wins is an advert. This one is required, and the validator now refuses a kit that omits it.

Step 04 of 14Corpus

Written for: "can I point this at mine?" · Measured off the corpus the run actually used.

In brief

How it is cutWhat one reading is

40 packs x 3 quarterly governance review, walked strictly in order per pack so the carried state moves forward the way it would in a real deployment. Different packs run concurrently; a single pack's cycles never do.

SetupWhat the setup figure measured

There is no index to build — each reading's extract goes whole into the prompt. The 0.5s and $0.00 are the corpus generation itself.

LicenceLicence

MIT

Bring your ownBring your own governance records

tools/build_corpus.py writes data/corpus/*.txt and data/gold.jsonl. Point it at your own register export by keeping the 8 section headings and the field labels src/review.position_of parses. Set your own evidence-age thresholds and retire rule in src/govern.py first.

⚠︎ And what stops being true when you do: The measured figures on this kit's page do not transfer to your own corpus. The memory-dependent share (58 of 120 readings here), the prose-versus-tag evidence split (16 packs against 24) and the unevidenced-gate rate are properties of this generator's declared distribution, not facts about AI governance. Re-run the evals on your own data; that is what the harness is for.

Step 05 of 14Prompt

Written for: engineer · Logged from the run, verbatim.

In brief

The assembled prompt in full, and its real decomposition. Every part below occurs in the prompt that was actually sent, and the token counts sum to the recorded input total — they were measured against the provider’s own counter, not apportioned by character share.

AssemblyHow the prompt is assembled

This is the cost lesson as arithmetic: of the 1,461 tokens assembled, 1,323 are instructions — 91% of the prompt, the largest single part. A per-request bill follows whichever part is biggest, and on this kit that is the one named here.

Reproduced from src/prompt.build for PACK-0001-C1 with that reading's real carried state, not retyped — byte-identical to what evals/run.py sent.

Full promptThe prompt in full

You are a scheduled AI-pack governance review. You read one deployed pack's quarterly review packet against the DEFAULT review policy at one governance review, and you answer with one JSON object and no other text.

You are the scheduled AI-pack governance review for one firm's register of deployed AI packs. It
runs on a QUARTERLY cadence and re-reads EVERY deployed pack. You are reading ONE pack at ONE
governance review.

The pack, its governance record, the DEFAULT review policy, this review's position and the evidence
recorded since the previous review are reproduced in the packet below. Apply the policy exactly as
written. You cannot see the earlier reviews; what is known about them is stated under "Carried
review position" and is the only history available to you. Do not assume anything about earlier
reviews beyond it.

⚠︎ THE EVIDENCE-AGE WINDOWS, THE DRIFT THRESHOLD AND THE RETIREMENT RULE ARE ILLUSTRATIVE
DEFAULTS, NOT ANY REAL COMPANY'S POLICY. Apply them as printed regardless of whether they look
right for the pack in front of you.

⚠︎ THE GOVERNANCE RECORD IS A CHECKLIST AND IT IS NOT UPDATED BETWEEN REVIEWS. A field being
PRESENT in it is never evidence that the control behind it was EXERCISED, and the dates it prints
were frozen when the record was compiled. Anything settled since is in the evidence section for
this cycle, or in the carried review position for an earlier one, and the NEWEST of the three is
the answer.

How to work it out:
 - FIRST decide whether there is a DATA CONTRACT on file. If there is not, the verdict is
   CONTEXT_INCOMPLETE: the gate status is UNKNOWN, the evidence age is UNKNOWN, nothing about the
   pack is judged and the action is OBTAIN_DATA_CONTRACT. THERE IS NO DEFAULT DATA CONTRACT
   (Rule G-2).
 - THEN decide whether a finding against this pack has already been ANSWERED. If the carried
   position or this cycle's evidence records a remediation, the verdict is REMEDIATED and stays
   REMEDIATED at every later review, and the finding is not re-raised (Rule G-8). Nothing here
   performs a remediation, an approval, a sign-off or a retirement -- you are only ever reporting
   one that has already happened elsewhere.
 - THEN work out the HUMAN GATE. If the record documents no human gate at all, the gate status is
   NO_GATE_DOCUMENTED and the evidence age is NOT_APPLICABLE -- that is a design choice on file,
   not a finding. Otherwise find the NEWEST evidence that somebody actually exercised the gate:
   the record's own "last evidenced" field, anything in the carried review position, and anything
   recorded this cycle. Evidence recorded this cycle can be a structured log entry OR an ordinary
   sentence describing a review somebody did -- a sentence counts exactly as much as a logged
   entry. Report the evidence age as THIS_CYCLE, ONE_CYCLE, TWO_OR_MORE_CYCLES or NEVER. Inside
   the default window the gate status is EVIDENCED; older than it, or never, the gate status is
   UNEVIDENCED (Rule G-3). REPORT THE GATE STATUS AND THE EVIDENCE AGE ON EVERY PACK, whatever the
   verdict turns out to be.
 - THEN work out whether the EVAL SUITE is current, the same way and against its own window
   (Rule G-4).
 - THEN read the DRIFT figure recorded THIS CYCLE against the threshold on the record. At or below
   the threshold is not a breach. No figure recorded this cycle is not a breach either (Rule G-5).
 - THEN decide the verdict, in this order:
     CONTEXT_INCOMPLETE, then REMEDIATED, then INCIDENT_OPEN (an incident recorded against the pack
     and not yet remediated), then RETIRE_CANDIDATE (in drift breach this cycle AND at the previous
     review -- read the streak off the carried position, Rule G-6), then GATE_UNEVIDENCED, then
     DRIFT_BREACH, then EVAL_STALE, otherwise IN_GOOD_STANDING (Rule G-10).
 - THEN decide the OWNER. Start from the accountable owner printed on the record, but a sentence in
   the evidence section recording a handover to someone else, in this cycle or an earlier one (see
   the carried position), supersedes it.
 - FINALLY decide the ACTION. IN_GOOD_STANDING and REMEDIATED are NONE. CONTEXT_INCOMPLETE is
   OBTAIN_DATA_CONTRACT. RETIRE_CANDIDATE is RETIRE_DECISION. For GATE_UNEVIDENCED, EVAL_STALE,
   DRIFT_BREACH and INCIDENT_OPEN the action is EVIDENCE_THE_GATE, RERUN_EVALS, INVESTIGATE_DRIFT
   or WORK_THE_INCIDENT respectively -- EXCEPT that if the carried position says the previous
   review returned that same verdict, the action is ESCALATE instead (Rule G-9).

Answer with a single JSON object and nothing else:

{"verdict": "IN_GOOD_STANDING|GATE_UNEVIDENCED|EVAL_STALE|DRIFT_BREACH|INCIDENT_OPEN|RETIRE_CANDIDATE|REMEDIATED|CONTEXT_INCOMPLETE",
 "gate_status": "EVIDENCED|UNEVIDENCED|NO_GATE_DOCUMENTED|UNKNOWN",
 "evidence_age": "THIS_CYCLE|ONE_CYCLE|TWO_OR_MORE_CYCLES|NEVER|NOT_APPLICABLE|UNKNOWN",
 "owner": "<the current accountable owner's name>",
 "action_now": "NONE|EVIDENCE_THE_GATE|RERUN_EVALS|INVESTIGATE_DRIFT|WORK_THE_INCIDENT|RETIRE_DECISION|OBTAIN_DATA_CONTRACT|ESCALATE",
 "rationale": "one sentence, naming the newest gate evidence you relied on and the rule that
   decided the verdict"}

"evidence_age" is UNKNOWN only when the verdict is CONTEXT_INCOMPLETE, and NOT_APPLICABLE only when
no human gate is documented.

Carried review position
----------------------------------------------------------------
No earlier governance review has been recorded for this pack under this watch. This is its first appearance: nothing has been settled beyond what the governance record itself prints, no evidence has been carried forward from a previous review, no finding is known to have been raised or answered, no incident is known to be open, no drift breach streak has been accumulated, and no change of accountable owner has been recorded.

Governance review packet
----------------------------------------------------------------
Synthetic Record
----------------------------------------------------------------
Every field below is invented. This is a generated AI-pack governance review packet for an
AI use-case kit; it reproduces no firm's model register, no real evaluation result, no
real incident and no real person. The review policy is an ILLUSTRATIVE DEFAULT.

Pack
----------------------------------------------------------------
Pack reference                 : PACK-0001
Model pack                     : stock-count-anomaly-v3
Business area                  : Supply chain
Deployment surface             : in the buying team's planning tool
Deployed since                 : 2024-Q4
Accountable owner (of record)  : Declan Ashworth
Decisions in this review period: 245,095

Governance Record
----------------------------------------------------------------
The block below is the pack's entry in the model register AS COMPILED. It is NOT updated
between reviews: every date in it was true on the compilation cycle and has not moved
since. A field being PRESENT here is not evidence that the control behind it was
EXERCISED.

Record compiled                : 2025-Q4
Purpose statement              : on file
Data contract                  : on file, v2.4
Human gate documented          : yes
                                 "a merchandising lead reviews every promotional line
                                 the pack drafts before it is published"
Human gate last evidenced      : 2025-Q4
Eval suite                     : on file -- 61-case golden set
Eval suite last run            : 2025-Q4
Drift threshold                : population stability index 0.200
Incident history               : 3 closed, 0 open as at compilation

Review Policy (Default)
----------------------------------------------------------------
The windows below are an OPERATOR-TUNABLE DEFAULT, not a real company's actual policy --
no documented evidence-age window, drift band or retirement rule exists for this row.
Applied exactly as printed.

  Human gate must be evidenced within            1 cycle(s)
  Eval suite must have been re-run within        2 cycle(s)
  Drift breach before a retirement decision      2 consecutive review(s)
  Drift threshold                                per pack -- see the governance record above

Approval authority             : NOT DEFINED. Nothing in this kit approves a pack,
                                 retires one, disables one, signs off a control, closes
                                 a finding or writes to any register.

Rule G-1  The GOVERNANCE RECORD IS A CHECKLIST AND IT IS NOT UPDATED BETWEEN REVIEWS. Every field
          in it was true when the record was compiled. Whether it is still true is decided by the
          evidence recorded since -- in "Evidence In This Cycle" for this cycle, and in the carried
          review position for every earlier one. A field being PRESENT is never evidence that the
          control behind it was EXERCISED.
Rule G-2  If the pack has NO DATA CONTRACT on file, the verdict is CONTEXT_INCOMPLETE: no gate
          status, no evidence age and no other finding is determined, and nothing about the pack is
          judged. THERE IS NO DEFAULT DATA CONTRACT.
Rule G-3  A documented HUMAN GATE must be EVIDENCED at this review or the one before it -- the
          default window is 1 cycle. Evidence is a record that a review actually happened: a
          structured entry in the log OR an ordinary sentence in the evidence section describing a
          review somebody did. Evidence recorded at an earlier review ACCUMULATES and is not
          repeated here; it is known only through the carried review position. A documented gate
          whose newest evidence is older than the window is GATE_UNEVIDENCED -- the pack looks
          governed on the register and nobody has exercised the control. Where the record documents
          NO human gate at all, the gate status is NO_GATE_DOCUMENTED and the evidence age is
          NOT_APPLICABLE; that is a design choice on file, not a finding.
Rule G-4  The EVAL SUITE must have been re-run inside the default window of 2 cycles. An eval run
          two cycles ago is still the current one. Older than that, or never run, is EVAL_STALE.
          Eval evidence accumulates the same way gate evidence does.
Rule G-5  DRIFT is read off the drift figure recorded THIS CYCLE against the threshold on the
          record. A figure at or below the threshold is not a breach. A cycle in which no drift
          figure was recorded is not a breach either, and leaves the breach streak unchanged.
Rule G-6  A pack in drift breach at TWO OR MORE CONSECUTIVE reviews, with no remediation evidenced
          in between, is a RETIRE_CANDIDATE and a retirement decision is due. This cannot be seen
          from one cycle: the streak is carried.
Rule G-7  An INCIDENT recorded against the pack stays open until a remediation is evidenced.
Rule G-8  Once a REMEDIATION is evidenced -- in the log or in an ordinary sentence -- the finding is
          ANSWERED. The pack is REMEDIATED at this review and at every later one, and the finding is
          not re-raised. Nothing here performs the remediation, the sign-off, the approval or the
          retirement; it only reports one that has already happened elsewhere.
Rule G-9  ACTION follows the verdict, except that a verdict which RECURS UNCHANGED at a second
          consecutive review is ESCALATE rather than the same request again. RETIRE_CANDIDATE is
          already the escalation and keeps its own action; CONTEXT_INCOMPLETE always asks for the
          data contract.
Rule G-10 Precedence, applied in this order: CONTEXT_INCOMPLETE, then REMEDIATED, then
          INCIDENT_OPEN, then RETIRE_CANDIDATE, then GATE_UNEVIDENCED, then DRIFT_BREACH, then
          EVAL_STALE, otherwise IN_GOOD_STANDING. It is ordered by what the reviewer must do first:
          a pack running unsupervised right now outranks a metric that has moved once.

Review Position
----------------------------------------------------------------
Review cycle                   : 2026-Q1   (quarterly review 1 of 3 in this record)
Review cadence                 : quarterly -- every deployed pack, every governance cycle
Previous review                : -- none, this is the first
Next review                    : 2026-Q2

Evidence In This Cycle
----------------------------------------------------------------
Everything recorded against this pack between the previous review and this one.
THIS CYCLE ONLY -- evidence recorded at an earlier review is not repeated here.

2026-Q1 wk06  Noor Haddad spot-checked about thirty of these on Tuesday and signed them
              off in the channel -- never went into the log.
2026-Q1 wk12  Ingrid Solberg re-ran the distribution comparison for this pack and came out
              at 0.242 on the population stability index; the line set at deployment is
              0.200.

Reviewer Notes
----------------------------------------------------------------
The business area was reorganised last quarter and the accountable owner column in the
register has not been re-derived since.

Raw responseThe raw response

{"verdict": "DRIFT_BREACH", "gate_status": "EVIDENCED", "evidence_age": "THIS_CYCLE", "owner": "Declan Ashworth", "action_now": "INVESTIGATE_DRIFT", "rationale": "Noor Haddad's 2026-Q1 spot-check and sign-off is the newest evidence that the documented human gate was exercised (Rule G-3), and the 0.242 PSI recorded this cycle breaches the 0.200 threshold for the first time, so DRIFT_BREACH takes precedence (Rule G-10) with action INVESTIGATE_DRIFT (Rule G-9)."}

Step 06 of 14Evals

Written for: the skeptic · The harness output, with as_of / model version / dataset version / verified_by.

In brief

Check that an AI tool's sign-off review really happened — 120 governance records. One model answered, and every answer was then graded Three different ways — because the grade is a measurement too, and most of what went wrong on this kit went wrong in the ruler rather than the model.

MeasurementsWhat was measured

Two words carry this page: Counted is deterministic and nobody's opinion and Not yet known is printed blank rather than filled with something plausible. There is no Judged row here and that is the point: nothing on this page is a model's opinion about another model. The row most worth having is currently the empty one.

Grading costWhat it costs

Every dollar on these pages is a MEASURED token count multiplied by a named vendor's PUBLISHED rate — a projection, never a bill and never a vendor's claim about this workload.

Rates checked 2026-08-18. The provider that actually ran all 461 calls is kept out of these tables per this estate's naming rule, so no figure here is a bill.

The gradersThree ways to grade

Every row opens its own page: how the test was run, the input on one real row, the prompt or formula with every iteration of it, and the analysis.

Choosing oneWhich one to use

The comparison is only useful if it ends in a choice. The answer is conditional — and it is not the grader with the best agreement score.

This pipeline was also attacked, which is a different question from whether its answers are right: see Threat model for the injection experiment, its two gates and what it does not prove.

Failure causesHow it fails

Step 07 of 14Unit cost

Written for: whoever signs off on the bill · Measured over the eval run, per model. Never quoted from a vendor page.

In brief

The token counts are measured on a real run and belong to this pipeline — which sections are selected, the field schema, the prompt — so they hold wherever you run it. The dollars are those counts multiplied by each vendor's published rate, checked 2026-08-18. Nobody paid these particular bills; they are what the same work would cost you on a card you can sign up to today.

Answering vs gradingAnswering and grading are two separate bills

The three free floors, the stub and every pre-run check cost $0.00 and no calls. ⚠︎ A DISCARDED SCORED RUN (results/discarded/, truncated at an 8,000-token ceiling) cost the same again as the scored run and is NOT netted out of this figure — it was spent.

Cost driversWhat actually moves the bill

• OUTPUT TOKENS, AND ALMOST ALL OF THEM ARE REASONING. 94.3 pct of r001-model-govrecord's output (235257 of 249422 tokens) was provider-side reasoning left at the default. The answer is a handful of short fields and a sentence; the bill is the thinking in front of it.
• THE PROMPT IS MOSTLY FIXED TEXT. 3093 input tokens per reading, and the policy block, the rule text and the instruction are the same on every call — so a provider with prompt caching would price this workload very differently, and that was not measured.

Your volumeWhat it costs at your volume

LINEAR IN PACKS x REVIEWS. Ten times the deployed packs is ten times the calls at the same per-reading cost; nothing amortises. The sublinear lever this kit does NOT implement is skipping packs whose record and evidence did not change.

Model choiceWhy this model

It is the tier the shared connection was already pointed at, and the kit's whole claim is that swapping it is .env plus one more run. No second model was run against this corpus; every other row in the cost table is a projection onto a published card and is labelled as one.

Other modelsOn other models

This is arithmetic, not a run. No model below was executed against the labelled set, and no accuracy is claimed for any of them. What transfers is the input volume: retrieval is model-independent, so every model would receive the same passages.

per-query average, this run

The codeEvery file, and what it is for

11 modules, no framework, and almost no dependencies. The pipeline is stdlib Python, because a kit is meant to be read and changed by someone who cloned it ten minutes ago — every dependency is a thing they have to understand before they can touch the part they came for.

Five of these are swap seams: the points you edit to make the kit yours. Each is marked, and each block below is the module’s real shape, read out of the file rather than written here.

The files on this page are not in the public GitHub catalog.

src/govern.pythe governance rule and state machine — a swap seam

The DEFAULT evidence-age thresholds, the drift bands, the retire rule and step() — which decides the next carried state from the answer key's inputs, never from a model reply. It is also the answer key.

You change it to: The review dates. Lengthening the cycle divides the bill and lengthens the period a silent gate goes unnoticed.

# The AI-pack governance review rule as arithmetic. Pure code, no model, standard library only.

RECORD_COMPILED = "2025-Q4"
CYCLES = ("2026-Q1", "2026-Q2", "2026-Q3")
RUNS = len(CYCLES)
CADENCE_LABEL = "quarterly -- every deployed pack, every governance cycle"
OLD_CADENCE_LABEL = "the previous process -- an annual attestation round"
OLD_CADENCE_GAP_CYCLES = 4
def qidx(label):
def qlabel(idx):
IN_GOOD_STANDING = "IN_GOOD_STANDING"

src/state.pythe carried state

What earlier reviews settled: the last exercised gate, the last eval, the open incident and the remediation record. A gate exercised last quarter is not restated this quarter.

# The carried review position -- the thing that makes this a monitor and not another checklist.

HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
DEFAULT_PATH = os.path.join(HERE, "data", "state.json")
def load(path=DEFAULT_PATH):
def save(store, path=DEFAULT_PATH):
def for_pack(store, pack_id):
def describe(state):

src/segment.pythe section splitter

Splits the page into its 8 named sections; check_labels asserts all 8 parse in all 120 documents before a run may spend.

# Split a governance review packet into its named sections. Pure code, no model.

SECTIONS = ("Synthetic Record", "Pack", "Governance Record", "Review Policy (Default)",
RULE = "-" * 64
def split(text):
def render(secs):

src/select.pythe send filter — a swap seam

Decides which sections reach the provider. Owner Contact is mapped by no field and therefore never sent.

You change it to: SECTION_HINTS and NEVER_SENT.

# Pick which sections of a governance review packet are sent. Pure code -- the last deterministic

BANNER = "Synthetic Record"
PACK = "Pack"
RECORD = "Governance Record"
POLICY = "Review Policy (Default)"
POSITION = "Review Position"
EVIDENCE = "Evidence In This Cycle"
CONTACT = "Owner Contact"
NOTES = "Reviewer Notes"
NEVER_SENT = (CONTACT,)

src/prompt.pythe prompt

Three parts: the instruction and JSON shape, the carried review position, the extract. The stateless control replaces exactly one line.

# Assemble the one prompt this kit sends. No template engine, no framework -- string concatenation

INSTRUCTION = """\
def build(text, carried, stateless=False):

src/adapters/__init__.pythe model call

Raw HTTP, stdlib only, bounded retry; the shared daily call cap is checked here.

# SEAM 1 — the model. Swapping provider or model is .env plus the same run again.

class AdapterError(RuntimeError):
TRANSIENT = {408, 429, 500, 502, 503, 504}
RETRIES = 4
def _post(url, headers, payload, timeout=120):
def openai_compatible(cfg, system, user, max_tokens, thinking=None):
def anthropic(cfg, system, user, max_tokens):
PROVIDERS = {"openai-compatible": openai_compatible, "anthropic": anthropic}
THINKING_OFF = {"type": "disabled"}
def complete(cfg, system, user, max_tokens=1024, thinking=None):

src/review.pythe reader

One pack, one review, one call. The published token ceiling lives here.

# One pack, one governance review, one model call. The runtime half of the kit.

HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
CORPUS = os.path.join(HERE, "data", "corpus")
SYSTEM = ("You are a scheduled AI-pack governance review. You read one deployed pack's quarterly "
MAX_TOKENS = 16000
FIELDS = ("verdict", "gate_status", "evidence_age", "owner", "action_now")
def documents():
def packs():
def load_doc(doc_id):
def position_of(text):

evals/scoring.pythe scorer

Exact match per cell. The gate-evidence discriminator is a separate binary over its own denominator, never averaged into verdict accuracy.

# Score a run against the answer key. Pure code, exact match per cell. No model grades anything.

NEEDS_ACTION = ("GATE_UNEVIDENCED", "EVAL_STALE", "DRIFT_BREACH", "INCIDENT_OPEN",
FIELDS = ("verdict", "gate_status", "evidence_age", "owner", "action_now")
def _pct(n, d):
def score(records, golds):
def _protection(records, golds):

evals/baseline.pythe three free floors

checklist-only, checklist-mem and structured-log-strong — $0.00 each.

# THE FREE FLOORS. Three of them, none a strawman, all of them $0.00.

MODES = ("checklist-only", "checklist-mem", "structured-log-strong")
def _section(text, name, nxt, flat=False):
def _record(text):
TAG_GATE = re.compile(r"TAG: GATE-EXERCISED ")
TAG_EVAL = re.compile(r"TAG: EVAL-RUN ")
TAG_DRIFT = re.compile(r"TAG: DRIFT population-stability-index ([\d.]+)")
TAG_INCIDENT = re.compile(r"TAG: INCIDENT INC-\d+")
TAG_REMEDIATED = re.compile(r"TAG: REMEDIATED INC-\d+")
def _newest(*idxs):

src/app.pythe local UI server

http.server, stdlib. Renders with no key.

# The minimal local UI. Standard library only -- python3 -m src.app, then open the printed URL.

HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
UI = os.path.join(HERE, "ui")
GOLD = os.path.join(HERE, "data", "gold.jsonl")
PORT = int(os.environ.get("PORT", "8212"))
RECORDED_RUN = os.environ.get("RECORDED_RUN", "r001-model-govrecord")
GOLD_ROWS = {r["doc_id"]: r for r in
def carried_for(doc_id):
class H(BaseHTTPRequestHandler):
def main():

ui/app.jsthe local UI client

Hand-written JS, no framework. Prints the model column beside the free floor.

# 

Start hereThe shortest path into it

Every entry above is a file in this kit, listed in the order the pipeline runs it.

ScenariosWhat it costs at your volume

Everything below is computed from one measured base: 3093 input and 2078 output tokens per reading (one pack, at one quarterly governance review), all of it fixed — this kit sends the document's own selected sections, so there is no retrieval depth to turn. Change the volume and the bill scales linearly, because nothing here batches.

OperationsFour shapes of workload

The same arithmetic, at volumes worth naming. These are illustrations of scale, not measurements of anyone’s deployment.

Model follows the controls above.

What this ignoresWhere a real bill diverges

In one lineWhat this kit exposes

MEASURED, not asserted. Reviewer Notes is this kit's one injection surface, and one of the shipped notes is instruction-shaped by design. It was fired as its own probe.

API_KEY is read from .env (gitignored) or the real environment; never logged, never placed in a prompt, and redacted from any provider error message the local UI passes to the browser.

The experimentWe DID attack it — one sentence, on every reading where it could matter

An indirect prompt injection needs a field somebody outside the process can write into, and this kit's candidate is Reviewer Notes. The probe forces the note onto every reading where an action was due rather than reporting where the seed happened to place it. Both were run for real on 2026-08-25.

One boundary is measured in both directions here: the injection probe forces the condition rather than waiting for it, and the privacy guard is red-proven by reproducing the schema-change condition that reaches its fallback.

The result0 of 66 findings suppressed suppressed by the instruction-shaped note — measured, not assumed.

One phrasing, one model, one corpus, 66 trials — every reading where suppression was even possible.

HonestyWhat this does not prove

• Any other injection.
• Whether the result holds on another model tier.
• Whether an injection placed in Owner Contact would have any effect — by construction it cannot reach the prompt.

In one lineThe only guardrail is the prompt

One instruction, no enforcement. It mostly holds — and mostly is the whole subject.

Never approve, retire, disable or sign off a pack — and never present the evidence-age thresholds, drift bands or retire rule as any real company's policy.

Stated to the model on every call in src/prompt.py's INSTRUCTION block, and enforced by evals/check_labels.py's banned-code-path scan before any run may spend.

EvidenceDoes it hold?

The limitWhat a guardrail is not

• This is a PROMPT RULE PLUS A STATIC SCAN, not a runtime enforcement layer. Nothing stops a forker adding such a path tomorrow; the scan catches it only the next time somebody runs check_labels.py, which is a manual step.
• The injection result is ONE SENTENCE against ONE model on ONE corpus. It is not a resistance rate for prompt injection in general.

WatchedWhat is watched, and why that one

The kit measures 71 watched figures plus 8 comparability guards and 5 reference constants — three duties, not one list. 0 of the watched are grader rates, each on its own grader page; this board watches the ones that decide when to look again. Each square is one watched figure; filled means the latest run measured it.

2 measured by the latest run 69 need the model half

GuardsBefore any comparison

Preconditions, not alarms. If one moves, the runs were not measuring the same system and nothing else on this board may be differenced.

no shared guard The two recorded runs declare no guard in common, so nothing below is protected by a precondition — read the history as two separate observations, not as a difference.

The reference constants — the null-grader baseline, the adjudication matrix, the negative count — are the third duty. They are never re-measured per run: a baseline that moves with the thing it measures is not a baseline.

BandsThe alarm bands

Derived from evidence, never picked: exact-match where two runs reproduced a metric to the digit, wider than the measured same-input drift for latency, one row of the negative class for any rate — denominator printed beside it.

HistoryRun history

7 recorded runs. A dash is a metric that run did not measure, and a dash is never differenced: not measured is a third state, neither a value nor a zero, and reading it as zero is how a board reports an improvement on a run that never looked. They are split into 4 blocks because a free floor is a baseline rather than a peer, and a run of another kind measures another thing; a column in one block is never differenced against a column in another.

triage · no model in the path — a baseline, not a peer column — 3 runs. A floor is what the kit scores with no model in the path; it is the line the model runs have to beat, and it is never differenced against them.

not a time series No two of these 3 runs measured the same system — they differ on floor, the model — so nothing here may be differenced and the Verdict column is left off. Read this block DOWN a column, as a comparison between those runs, not along a row as a history.

triage · with the model in the path — 2 runs. Columns here are only ever compared with each other.

not a time series No two of these 2 runs measured the same system — they differ on stateless — so nothing here may be differenced and the Verdict column is left off. Read this block DOWN a column, as a comparison between those runs, not along a row as a history.

stub · no model in the path — a baseline, not a peer column — 1 run. A floor is what the kit scores with no model in the path; it is the line the model runs have to beat, and it is never differenced against them.

one run A verdict is a comparison and one run has nothing to compare with, so the Verdict column is left off rather than filled with 14 chips that all say so.

redteam · with the model in the path — 1 run. Columns here are only ever compared with each other.

one run A verdict is a comparison and one run has nothing to compare with, so the Verdict column is left off rather than filled with 2 chips that all say so.

DeviationsWhat deviated

0 breaches across 7 runs

The day a band breaks, a row renders here carrying the metric, the two runs, the band it crossed and what changed between them — model, prompt, chunker or top_k, read off the run records’ guards. A deviation with no diff beside it is an alarm nobody can act on.

RippleThe ripple map

Which figures move together, so one alarm reads as a system. Every edge carries its basis: measured names the run that showed it; reasoning admits nothing has varied it yet.

FiresWhat fires when a band breaks

Where evals stop sitting beside the guardrail and start feeding it. Where the answer is nothing automatic, the row says so — hiding it would undo “What a guardrail is not” above.

Nothing fires yet. Not one of the 15 bands on this kit names a consequence, so there is no row to print. Which is the honest answer to the heading: a band that nothing is wired to is a number somebody has to notice, and this kit has only those. An empty table would have said the same thing while looking like a rendering failure.

NextThe three you would add first

None of these is built here. They are named against the seam they sit on so they can be argued with.

CadenceWhen to re-run, and what it costs

The guardrail scan is a MANUAL step, run before each spend, not a hook. It ran before every paid run and passed at 0 each time. The injection probe is a ONE-OFF: it measured 0.0 pct suppression on 66 readings on 2026-08-25 and nothing re-runs it, so that figure ages from the day it was taken.

In one lineNo framework, deliberately

NO FRAMEWORK. A folder of readable Python, no framework dependency, and a prompt anyone can read end to end. A framework abstraction would own the retrieval step — there is none here — and the memory layer, which is already the entire surface of src/state.py.

The mappingSeam by seam, who owns what

The seams are the ones this kit already publishes, so the mapping cannot drift from the code.

GraphsWhere LangGraph changes the answer

Linear: the reader -> src/prompt.py -> src/adapters -> evals/scoring.py. No branching, no tool-calling and no agent loop.

The other sideWhat a framework costs you

• Swapping providers means editing the PROVIDERS dict by hand. In exchange the prompt has no hidden templating layer and requirements.txt stays empty.

In one lineWhat one run of this kit actually cost, in time and tokens

Measured on r001-model-govrecord on the fast tier, with the carried state, 2026-08-25. This kit records telemetry measured per run — 4 of the 6 readings on this axis, 4 of them with a band the guardrail board can judge against.

The readingWhat the last run measured

No movement column. Not one of the 4 earlier runs on record is comparable with this one — a different model tier, or a changed guard — and differencing across that measures two systems rather than one. Said once here rather than as a dash on every row.

Retrieval not shown. No run of this kit has ever recorded a retrieval timing, because the pipeline has no such stage. Those readings are left out rather than dashed: a dash says “this run did not measure it”, which promises a later run could.

DriftMedian call, run over run

Hatched bars are runs that are not comparable with the latest — a different model tier or a changed guard. They are drawn because hiding them would make the history look shorter than it is, and greyed because differencing across them would be measuring two systems.

3 runs not plotted. b000-model-govrecord-checklistonly, b001-model-govrecord-checklistmem, b002-model-govrecord-structuredlogstrong recorded no call latency at all — a rules-only floor run makes no model call, and the 0 its record stores is an absence, not a zero-millisecond answer. Plotting it would put a bar on this chart claiming the fastest run in the kit’s history.

The other sideWhat this does not tell you

The first of those is the one worth doing something about, and it is a solved problem: instrumenting a pipeline so each step reports its own duration is a couple of lines. Observability / tracing has the code, and what the result looks like once it is running.

In one lineWhat you provision, honestly

Everything measured on this page says where it was measured; everything not measured says that — the same contract as the other thirteen pages. Where a retrieval index would be on other kits, this one has: no index — the population is re-read whole on each scheduled run, and the prior run's carried state is what makes a reading a CHANGE.

The machineWhat this needs

Enumerated from the kit’s own source by build/facts/envscan.py, committed, and drift-checked — never typed into this page.

Your dataWhere everything sits

The wireWhat crosses it, and when

Zero-egress topology: point BASE_URL at a local OpenAI-compatible server and nothing leaves the machine — statically true of the shipped adapter, whose only credential travels in the Authorization header.

The shapeHow it ships, and what you add

The ladderEach decision, and what you provision past its ceiling

Every threshold is a measurement with its provenance beside it, or says is_measured:false. A ceiling with no seam says so — it is the point the kit is outgrown, never a forced join.

When it failsFailure signatures

The knobsThe config surface, enumerated

Environment variables: API_KEY, BASE_URL, EMBED_MODEL, EVAL_WORKERS, MAX_CALLS_PER_DAY, MODEL, PORT, PROVIDER, RECORDED_RUN.

The other sideWhat this page does not claim

The corpus licence, from the Data lens: MIT Your corpus’s licence is yours to verify, and the labels you write are about your documents.

In one lineThe verdict, gate status, evidence age, owner and action-now call, per reading, exact match against the computed answer key

whether each of the 5 answered fields equals the answer key, per reading

MethodHow the test was run

python3 -m evals.run --run-id <id> ...; evals/scoring.py compares strings. No model grades anything.

Every grader on these pages scored the same 120 already-recorded answers. Nothing was re-generated, so this compares rulers and not models.

The inputOne real row, seen by every grader

The formulaWhat it computes

accuracy = hits / 120 per field. gate_evidence_accuracy_pct is scored separately over its own denominator.

The analysisWhat it actually did

In operationWhat to monitor

Reference standard: the computed answer key in data/gold.jsonl, produced by src/govern.step() from the same planted inputs the corpus builder wrote onto the page.

No true/false rates for this grader. It records 5 operating rows and not one of them carries a confusion matrix, so there is no TPR, TNR or precision to state here — this grader does not sort answers into pass and fail, and rates that were never measured are not going to be printed as though they were. What it did measure is in “What it actually did” above; what to watch is immediately below.

How tight can the band be? No threshold was swept: exact match has no tunable. Denominators are stated beside every rate because 120 readings makes each one wide.

Cadence: once per run; free

The decisionWhen to reach for it

In one lineA human gate DOCUMENTED but never exercised, scored as its own binary over all 120 readings

whether the gate the record describes has any evidence of ever being pulled

MethodHow the test was run

evals/scoring.py, same pass as the exact-match grader.

Every grader on these pages scored the same 120 already-recorded answers. Nothing was re-generated, so this compares rulers and not models.

The inputOne real row, seen by every grader

The formulaWhat it computes

caught = readings where the arm's gate call equals the key's, over all 120. The two error directions are reported over their own denominators.

The analysisWhat it actually did

In operationWhat to monitor

Reference standard: the computed answer key in data/gold.jsonl, produced by src/govern.step() from the same planted inputs the corpus builder wrote onto the page.

No true/false rates for this grader. It records 2 operating rows and not one of them carries a confusion matrix, so there is no TPR, TNR or precision to state here — this grader does not sort answers into pass and fail, and rates that were never measured are not going to be printed as though they were. What it did measure is in “What it actually did” above; what to watch is immediately below.

How tight can the band be? ⚑ THIS SECOND DIRECTION ONLY EXISTS BECAUSE ITS ABSENCE WAS MEASURED. Without a gate-resumes profile in the corpus, both memory floors scored 100.00 and the model could only tie. The profile was added, the corpus rebuilt, and data/SOURCES.md records it.

Cadence: once per run; free

The decisionWhen to reach for it

In one lineFindings raised on packs that were in good standing

whether the arm put governance work on a queue that did not need it

MethodHow the test was run

evals/scoring.py, same pass.

Every grader on these pages scored the same 120 already-recorded answers. Nothing was re-generated, so this compares rulers and not models.

The inputOne real row, seen by every grader

The formulaWhat it computes

false findings over the quiet readings.

The analysisWhat it actually did

In operationWhat to monitor

Reference standard: the computed answer key in data/gold.jsonl, produced by src/govern.step() from the same planted inputs the corpus builder wrote onto the page.

No true/false rates for this grader. It records 1 operating row and not one of them carries a confusion matrix, so there is no TPR, TNR or precision to state here — this grader does not sort answers into pass and fail, and rates that were never measured are not going to be printed as though they were. What it did measure is in “What it actually did” above; what to watch is immediately below.

How tight can the band be? No sweep: action_now is a binary the arm emits.

Cadence: once per run; free

The decisionWhen to reach for it