Governance controls that either fire, or do not
A runtime in which every control is a piece of code with a failure mode, a test that proves it refuses, and a journal entry that proves it refused on a given date.
Figures for the six governance repositories taken on 21 August 2026, those for Cartocortex on 17 October 2026, by running the test suites. None is copied from the README files.
Most governance artefacts are unfalsifiable
A policy document asserts that human oversight exists, and nothing in the running system disagrees when it does not. That is what an unfalsifiable claim is: it cannot be wrong, so it says nothing.
The demonstration is a weld-inspection cell. It cannot start itself, cannot exceed the operating envelope declared in its model card, and cannot divert a part with no stated rationale. Each of those three sentences corresponds to an observable refusal, not to an intention.
Count what was prevented
"Almost nobody counts what did not happen."
Governance dashboards count the events that occurred. The figure that separates a load-bearing control from a decorative one is the count of refused requests, because a forbidden action that never happened leaves no trace anywhere except in the control that stopped it. This runtime counts them, and journals before it acts.
inferences : 10
requests : 11
allowed : 7
refused : 4 <- the number that matters
escalated : 1 (1 approved)
✗ start_attempt_before_release deny stop channel engaged: stopped
✓ set_speed_within_envelope allow allow-safe-speed
✗ set_speed_outside_envelope deny deny-excessive-speed
✗ action_on_foreign_target deny deny-foreign-targets
✗ action_without_rationale deny deny-unexplained-requests
✓ divert_P0002 require_human escalate-low-confidence-diversion
✓ divert_P0004 allow allow-confident-diversion
✓ stop_on_defect_run allow allow-stop-alwaysEleven requests, seven allowed, four refused, one escalated to a human operator who approved it. The most instructive refusal is the fourth: an action with no stated rationale is rejected, because a decision nobody can read back cannot be reviewed.
What the suite exercises
One hundred and thirty-two tests, run on 21 August 2026 against the public repository. The repository's own README still says 113: the repository is behind itself, and the correct figure is the one measured here.
| Group | Tests | What it exercises |
|---|---|---|
test_policy.py | 26 | The policy engine, exercised at its boundaries |
test_registry_admission.py | 26 | Model admission and the verification of its signed card |
test_journal.py | 20 | The journal hash chain, and its independent verification |
test_oversight_and_marking.py | 19 | Human oversight and the labelling of estimated figures |
test_adversarial.py | 19 | Circumvention attempts, written to break the claim |
test_runtime_e2e.py | 18 | The full scenario, from request to verifiable journal |
test_cli.py | 4 | The command-line interface |
| Total | 132 | 91 % |
The integration gate chains static analysis, strict typing, source security review and the coverage floor. Ten recorded architecture decisions explain what was ruled out, and why.
The known gaps, as the repository states them
The repository's threat model lists seven residual risks. The five that matter to an outside reader are these.
- Nothing has run on hardware. Every hardware layer but the simulator raises an explicit porting error rather than returning a plausible value.
- No hardware root of trust. Signing keys sit in the clear on disk, and attestation without a secure element would be theatre. That is an accepted decision, with its record.
- A holder of the device key can rewrite the journal consistently, and verification will pass. The hash chain detects partial editing, not a full rewrite by a legitimate key holder.
- The policy file can be edited by anyone who can write it. Rules are data on purpose, so that a governance body can read them rather than compile them.
- The simulated model detects nothing. Its two knobs are a miss rate and a false-alarm rate: it exists to exercise the controls, never to inspect anything.
Four documents, in the order they are read
- docs/GETTING_STARTED.mdAssumes neither a terminal nor Python, and leads to the first full run.
- docs/ARCHITECTURE.mdThe design decisions, and what they rule out.
- docs/CONTROL_MAP.mdEvery control mapped to the text it answers.
- docs/THREAT_MODEL.mdThe seven residual risks, stated without mitigation.
A governance claim is verifiable, or it is worth nothing
The code of each link is public. To discuss this work, write to the author.