Finding 2026.4A release gate for modelled results, and the provenance that backs it
Abstract. The doctrine under which the research platform admits a result — a three-level claim status, an append-only Ed25519 ledger with four checks per entry, measurements signed at the instrument, a battery of release gates that must all pass, corpus pinning that reproduces everything from one commit, and a restore drill — together with the one thing provenance cannot do.
2026-09-05 — v1.1: cross-model agreement updated to 98.3% (the revision-3 release record; 98.2% was revision 2.1); the two acquisition-journal gates are stated as exercised on a separate simulated campaign, not on the artifacts of Finding 2026.2; the ledger entry count is no longer printed, because the deposited ledger is rebuilt per release.
| §2026.4(i) | Purpose |
| §2026.4(ii) | Claim status |
| §2026.4(iii) | Artifact ledger |
| §2026.4(iv) | Instrument journal |
| §2026.4(v) | Release gates |
| §2026.4(vi) | Corpus pinning and restore drill |
| §2026.4(vii) | What provenance cannot do |
§2026.4(i) Purpose
Chapters 1 and 2 state the principles: a verifier independent of the writer, signatures made at the moment of the act, sequence numbers that make omission visible. This finding records how those principles are applied to the research platform that produced Finding 2026.2 and Finding 2026.3, so that a reader of those findings can see what stood between a number and its publication. The doctrine is shared by two further workstreams in sensing evaluation and system-architecture optimisation, whose results are reported elsewhere.
§2026.4(ii) Claim status
Every quantitative statement the platform emits carries one of three labels, printed inline and carried in the artifact metadata. MODELLED marks the output of a deterministic forward model or simulation executed on the verified chain; it regression-tests a pipeline and can support no claim about physical hardware until measured data replaces the synthetic corpus. COMPUTED marks arithmetic from nameplate or catalogue values. TO-VERIFY marks any site- or sample-dependent figure that has not been measured. A statement without a label is not admitted. Negative results are retained under the same labels: a comparison that shows no gain is reported beside the ones that do, because the positive results are only credible in that company.
§2026.4(iii) Artifact ledger
Every artifact the platform produces — a regenerated corpus, a trained model, an evaluation record — is appended to a hash-chained ledger in the form of §2.2, with the chain head
and an Ed25519 signature over each head. Verification runs four checks per entry: the signature verifies under the platform key; the entry's recorded previous head equals the recomputed head of the prefix; the entry's own digest recomputes; and the artifact on disk matches the digest in the entry. The ledger is rebuilt for each release and verified before publication; an entry that fails any check fails the whole verification, and the ledger is never rewritten to make it pass.
§2026.4(iv) Instrument journal
Measurements of a simulated campaign are written by the acquisition software at the moment each is taken, as receipts with the fields
so that the sequence number makes a missing measurement detectable as a gap, the previous-head field makes reordering detectable, and the signature binds each receipt to the instrument's key at the time of acquisition. The schema has been exercised on a simulated acquisition campaign that belongs to a separate workstream and is not part of the Raman deposit; the same schema will be used unchanged when the instrument is real.
§2026.4(v) Release gates
A result is admitted only when every gate passes; the gates are run at generation time and their outcome is printed on the document that reports the result.
| Gate | Criterion | Latest |
|---|---|---|
| Corpus determinism | Regeneration from seed is byte-identical to the ledgered digest | Pass |
| Reproducibility | Retrained metrics within 10⁻⁶ of the ledgered evaluation | Pass, difference 0 |
| Cross-model agreement | Stage assignments of independent models agree on ≥ 95% of samples | Pass, 98.3% |
| Journal validity | Hash chain and every Ed25519 signature of the acquisition journal verify | Pass, on the separate simulated campaign; not part of the Raman deposit |
| Hypothesis determinism | Journal payload chain identical across runs, timestamps excluded | Pass, on the separate simulated campaign; not part of the Raman deposit |
| Optimisation gain | Each pipeline revision improves or holds the score it targets; a gated evaluation never scores worse than the ungated one | Pass |
| Probe sanity | Out-of-distribution error exceeds in-distribution error; no clean row refused; shuffled controls at chance; attribution shift under 1 Å | Pass |
Five of the seven gates are exercised on the artifacts of the Raman record by the public repository's verification script; the two journal gates are exercised on the acquisition journal of the separate simulated campaign above.
The gates are deliberately mechanical. None of them asks whether a result is interesting; each asks whether it is the result the ledger says it is.
§2026.4(vi) Corpus pinning and restore drill
Code and pointers live in version control and binaries in a content-addressed data store, so that one commit identifier reproduces the entire corpus and every model trained on it. Off-site copies are written to immutable, object-locked storage under an append-only credential, with a retention ladder of daily, weekly and monthly snapshots and periodic read-back verification, and encrypted offline copies are kept with the key stored apart from the media. A quarterly restore drill on a clean machine — clone, check out the commit, pull the binaries, verify the ledger with zero failures, retrain and reproduce the stage-assignment score — is itself a gate.
§2026.4(vii) What provenance cannot do
Stated plainly: the ledger proves that data has not changed since it was logged. It says nothing about whether the label was right at the moment of logging. A mislabelled excitation wavelength signed at the instrument is a perfectly provenanced error. That is what the planted corruptions of Finding 2026.2, the refusal gate of Finding 2026.3, and the cross-model agreement gate are for; provenance and verification are different instruments and the platform keeps them separate.
R. J. York, “A release gate for modelled results, and the provenance that backs it”, Finding 2026.4, ryanjamesyork.com, version 1.1, 2026-09-05. https://ryanjamesyork.com/findings/2026/4
@misc{york2026_4,
author = {York, Ryan James},
title = {A release gate for modelled results, and the provenance that backs it},
year = {2026},
month = {9},
note = {Finding 2026.4, version 1.1},
url = {https://ryanjamesyork.com/findings/2026/4},
howpublished = {ryanjamesyork.com}
}
This finding is compiled, with Finding 2026.2 and Finding 2026.3, in the preprint “Resolving the Raman crystallite size turnover in nanocrystalline graphite with a synthetic benchmark” (v2.0, 2026-09-05, PDF, 17 pp.). See Publications.
Source: /findings/2026/4.md · SHA-256 2947b73556b102999315ce90a037d47c9c80103d9b85b33b29d735575f4b2884
How to verify