Seven public repositories: six on applied technology governance and one tool under development. Every governance claim here is a piece of code with a failure mode, a test that proves it refuses, and a journal entry that proves it refused on a given date.
A governance claim nobody can inspect is a claim nobody has to honour. These repositories are public so that verification does not have to be requested from us.
They do not read as six separate objects. They form a chain: decide, measure, operate, prove. Each link answers a question an industrial buyer asks before asking anything about the model.
Figures for the six governance repositories taken on 21 August 2026, those for Cartocortex on 17 October 2026, by running the test suites. None is copied from the README files.
Link 1 of 4
Decide, and refuse
"Does the control fire, or is it decorative?"
Most governance artefacts count what happened. Almost none count what was prevented, which is the only figure that separates a load-bearing control from an ornamental one.
edge-ai-refusal-runtime
A runtime that refuses to load a model whose paperwork does not hold. The model card is signed, and it is checked before the model loads, not after.
Governance controls enforced in circuitry, with no policy note involved, across five Arduino boards. Four invariants, one of which the supervised part cannot revoke.
Four refusals and one escalation. The figure that matters is the middle one: a forbidden action that never happened leaves no trace anywhere except in the control that stopped it.
Link 2 of 4
Measure
"Was that figure measured, and by what instrument?"
Published edge-AI figures are burst figures, taken in the first thirty seconds while the part is still cold. Sustained inference drives a passively cooled processor to its thermal limit within minutes and the governor pulls the clock back. The gap between the two is the figure a deployment actually lives with.
measurement-harness
An instrument-agnostic, device-agnostic harness. It integrates energy over the timestamps actually achieved, publishes its uncertainty, and refuses to hand over a figure that was never measured.
The record set where the other repositories' estimates will be discharged. An entry with no declared instrument is refused at the door, and an estimate stays visible, labelled as one, until a measurement replaces it.
No bench measurement to date: the record set is waiting for its first reading.
Two refusals, taken from the repositories on 21 August 2026.
$ mh energy-model run/report.json
synthetic-result-refused: report sha256:22cf9ff0… has provenance 'synthetic';
pass allow_synthetic=True to export a rehearsal figure, which will be labelled as one
$ wb summary
energy-model-calibration 0 measured 7 estimate(s)
lora-range-survey 0 measured 0 estimate(s)
The record set today holds no measurements and seven estimates, and it says so itself. The bench has not run yet; the gap has a tool, a procedure and an owner, which is worth more than a disclaimer.
Link 3 of 4
Operate
"What happens when an update is bad?"
Two rules, and neither is negotiable. Silence is a rollback: a node that boots a new image and does not check in reverts to what it was running before, on its own timer, consulting nothing. And the fleet halts itself: a wave over its failure budget stops the rollout, with no flag to continue.
fleet-ops-lab
A/B slots, automatic rollback, digest-bound manifests, SBOM diffing and reproducible builds. The model that answers the four questions asked before any question about the model.
Real output of the demonstration rollout, 21 August 2026.
plan : inspection-agent -> 2.4.0
waves : canary, pilot, fleet
updated : 2
failed : 4
rolled back : 2 <- the number that matters
untouched : 6
✓ node-01 updated health probe passed
✗ node-03 transport-failure link dropped during transfer
✗ node-04 digest-mismatch manifest says sha256:ceba2163…, bytes hash to sha256:c1735458…
✗ node-06 health-probe-failed no health probe supplied
digest-mismatch
The download succeeded and delivered the wrong bytes. A check that asks whether the transfer worked says yes.
no health probe supplied
Rolled back for the absence of a check. A machine nobody can ask does not keep a change on the strength of its silence.
The rollout halted itself in the pilot wave, four nodes of five having failed against a budget of one. Six machines were never touched and are still running the version that works: that is the rollout succeeding, not failing.
Link 4 of 4
Prove
"On 11 September, can you produce the file?"
Regulatory deadline
From 11 September 2026, a manufacturer of a product with digital elements has 24 hours to file an early warning with ENISA and its coordinating CSIRT after becoming aware of an actively exploited vulnerability, 72 hours for the substantive notification, and 14 days from a fix becoming available for the final report. Full application of the Regulation follows on 11 December 2027.
Twenty-four hours pose an inventory problem, a triage problem and a clock problem, and most organisations discover which of the three they failed at somewhere around hour nineteen.
cra-in-a-box
The Cyber Resilience Act chain, end to end and offline: SBOM, VEX, vulnerability scan, Article 14 reporting, signed update, Annex VII pack.
Real output of the demonstration chain, 21 August 2026.
SBOM 9 components, 88.9% matchable
scan 6 raw match(es) → 3 actionable → 1 with an Article 14 deadline
VEX audit 1 stale 'under_investigation' statement
Article 14 case CASE-2026-004
early_warning due 2026-09-16T07:20:00.000Z filed
notification due 2026-09-18T07:20:00.000Z filed
final_report due 2026-10-03T06:40:00.000Z filed
update 2.3.1 accepted: True
rollback to 2.2.1 : False ← security_version 6 is below the device's 8
Annex VII pack: 4 gap(s), retain until 2036-03-01
The rollback is refused because it would take the device below its security-version floor. A compliance file that cannot say no amounts to an archive.
Test bench
The lab
The repositories above are tested on real hardware, hosted at home.
home lab
A home lab where models, data and connected objects stay at home: segmented network, local compute, long-term storage and access through a single tunnel.
An agent-based simulator that reproduces the integration of an acquired company, published with its full guide and its limits.
simulateur-integration
Forty engineers, a three-year migration, ongoing operations to maintain and attrition. The model compares three team structures and measures the distance to the threshold where an integration runs away. Synthetic values, anonymised reference case.
Guide and code published on 24 October 2026, in French and English.
The gaps are in the repository, and they stay on this page
This work is honest about what it does not do, and that honesty is the positioning. A page that erased it would damage the asset it describes.
No bench-measured figure to date. Apart from the Arduino demonstrator, nothing here has run on hardware. No bench result, no field deployment, no customer installation.
No certification language. No "compliant", no "certified", no "audited". The AI Act, the Cyber Resilience Act and ISO 42001 are the standards these controls answer to, never accreditations held.
Estimates remain estimates. The runtime's energy figures are estimated, and the label travels with them for as long as they exist.
Tamper-proof, no. The harness reports detect editing, not a recomputed forgery, since nothing signs them.
These public engineering artefacts demonstrate a method of working. None is sold.
A governance claim is verifiable, or it is worth nothing
The code of each link is public. To discuss this work, write to the author.