# Tailor the framing, fix the facts

Artifacts for a Track 4 submission to the Apart Research / CeSIA AI Incident
Response research sprint, September 2026.

A claim ledger for the July 2026 agentic containment incident, a deterministic
factual-invariance gate that holds tailored briefs to it, eight worked briefs
across four audience segments, and an opt-in distribution protocol.

## Reproduce the paper's numbers

```
python3 score.py
```

Python 3.8 or later. No third-party packages. Takes under a second.

## Run the gate on your own text

```
python3 gate.py --factbase factbase.json yourbrief.md
```

Exit code 0 if clean, 1 if there are findings. Ablation flags `--no-wordnum` and
`--no-closedset` reproduce gate v0.1.

Briefs carry a metadata header ending in a `---` rule; everything above it is
ignored.

## Files

| Path | What it is |
|---|---|
| `factbase.json` | The claim ledger. 63 claims: 56 from six primary sources, each with a verbatim source quote, plus 7 of secondary regulatory context. Each has a status and numeric, date and entity atoms. Plus banned-claim patterns, closed sets, attribution rules and vocabulary allowlists. |
| `gate.py` | The gate. Seven checks over a brief against the ledger. Checks facts, never style. |
| `ground_truth.json` | Audited reference set of the 10 factual errors in the four ungated briefs. |
| `score.py` | Scoring harness. Reproduces Tables 1 to 3. |
| `protocol.md` | The Relay Protocol v0.1: eligibility, tiering, embargo, corrections, dual-use controls. |
| `briefs/` | Four segments times two conditions. `_ungated` written under an engagement-first prompt with no factual constraint; `_gated` written against the ledger. |
| `reports/` | The error audit with reasoning, `scores.txt`, and per-condition CSVs. |
| `SOURCES.md` | The six primary sources, with URLs and verification status. Local copies are not committed; see the file for why. |
| `fetch_sources.sh` | Fetches the two openly-licensed sources into `sources/`. |

## The seven checks

1. `UNSUPPORTED_NUMBER` a numeral, or a spelled-out numeral attached to a counted
   unit, that no ledger claim carries. Hedged rounding passes within 5% in the
   direction the hedge claims.
2. `UNSUPPORTED_DATE` a date no ledger claim carries.
3. `UNSUPPORTED_ENTITY` a named entity absent from the ledger and the vocabulary
   allowlists.
4. `BANNED_CLAIM` a known distortion pattern.
5. `UNATTRIBUTED` a self-serving or contested claim with no attribution cue
   nearby.
6. `OVERSTATED_CERTAINTY` a certainty marker applied to a non-established claim.
7. `CLOSED_SET_VIOLATION` an entity filling a role the ledger restricts to a
   named set.

## What the gate does not do

It does not check truth. It checks agreement with the ledger. Every guarantee is
inherited from the ledger's quality.

It cannot see narrative drift. A sentence in which every number and name is
correct and the relation asserted between them is false will pass. In our
evaluation this accounted for all three missed errors on the ungated briefs and
three of four errors found in briefs the gate had already cleared. Read
`protocol.md` before using this for anything real: the named human reviewer is
not optional.

## Dual-use

This is a general-purpose pipeline for producing audience-tailored text that is
provably consistent with a reference corpus. Pointed at a fabricated ledger it
certifies falsehoods in four registers with a provenance footer that looks like
rigour. The main defence is that the ledger ships public with a verbatim source
quote per claim, so it is falsifiable in minutes. See `protocol.md` Section 8 and
the paper's Appendix A for the mitigations and what each one does not cover.

## Licence

Ledger, briefs and protocol: CC BY 4.0. Code: MIT. Quoted material in
`factbase.json` remains the property of its publishers and is reproduced as
quotation for criticism and review.