Capability deep-dive · formal methods
Counsel asks which part of the decision you can prove. Most systems cannot tell you where the proof stops.
A court will not accept “the model was confident”, and a regulator now wants the procedures and principles actually applied — concisely enough that the person affected can contest them. Handing over the algorithm does not discharge that duty. Neither does a confidence score.
Every component of this exists in production
Each figure describes somebody else’s system, cited from the research corpus with its primary source: a public cloud provider’s policy-verification service, a national tax administration’s compiler, and a published proof agent evaluated at competition level. None of them is ours and none is an insurance deployment. The corpus searched for a production deployment of formally verified insurance policy adjudication — a wording with a mechanised semantics, its meaning encoded so a machine can compute with it, each claim decision carrying a machine-checked justification — and found none. That absence is the opportunity and, read honestly, evidence about the difficulty.
What becomes decidable once a fragment is encoded
The transferable pattern is narrow and it is real: compile a rule set whose meaning is fixed without ambiguity into a solver — a programme that answers logical questions exhaustively — then ask “does this configuration ever permit X?” as a decidable question, one with a guaranteed yes-or-no answer. Over an encoded fragment — a binder pen and its schedules first, because they are already near-tabular — five queries carry the weight.
| Query | The question in words | What a positive answer returns |
|---|---|---|
| Q1 | Authority containment — is there any risk this pen would bind that sits outside the delegated authority? | A counter-example. The counter-example is the product. |
| Q2 | Grant and exclusion conflict — is there a fact pattern where both fire and no carve-back applies? | The fact pattern, routed to a room. Detection, never adjudication. |
| Q3 | Wording equivalence — did this endorsement change what is covered? | The scenario that separates the two versions. |
| Q4 | Clause redundancy — does removing this clause change any outcome? | Either a witness — a concrete case where the outcome changes — or the redundancy finding. |
| Q5 | Aggregate feasibility — can this bind push the aggregate past its limit? | The binding arithmetic, given a declared event partition. |
wording and binder ingestion(shipped)NX/services/nexus-fileprocess/api/src/orchestration/SandboxFirstOrchestrator.tsthree-tier document cascade(shipped)NX/services/nexus-graphrag/src/processors/ocr/ocr-cascade.ts
What the verifier renders, and what it refuses to render
The scope block comes before any verdict
A certificate splits into two blocks that are visually distinct and always rendered together: the predicates that were formally decided, each with its checkable witness, and the predicates that were cross-checked only, each with the models and the evidence overlap that backed it. A cross-check may never be styled to read like a proof.
A certificate names its own scope
A certificate may assert a predicate only if that predicate has a checkable witness in its scope set. There is no code path that prints an unscoped assertion — which is what makes “never claim to verify what was not formally encoded” a mechanism rather than a house style. The sentence a certificate carries is “it asserts exactly these predicates”, not “the wording has been verified”.
THE SENTENCE LEDGER
- Not “the system decided coverage” — but “the system decided everything downstream of the chair’s finding on these named open-textured terms”.
- Not “the wording has been verified” — but “this encoding, at this version, counsel-signed against these clause anchors, entails this predicate”.
- Not “the certificate resolves the slip and wording conflict” — but “a fact pattern exists where both fire; here it is; a room rules”.
- Not “valid for the life of the policy” — but “valid at this event time, this knowledge time and this rule version, and re-verify fails loudly on drift”.
- Not “the aggregate exposure is proven correct” — but “the arithmetic holds given this declared event partition”.
The five problems that bound the claim
Naming these plainly, rather than smoothing over them, is itself the credibility signal. An engineer who reads five correctly stated hard problems concludes the authors have done the work; the same engineer reading “provably compliant AI” concludes the opposite.
Open-textured predicates
“Reasonable precautions”, “flood”, “arising out of” — predicates whose extension courts fix case by case. They are encoded as uninterpreted terms — placeholders the logic leaves undefined — whose valuation is a human input, so the proof is conditional. The formal layer relocates judgement onto an accountable, logged person; it does not eliminate it.
Formalisation fidelity
A machine-checked proof guarantees the code is consistent, not that the code means what the wording means. The best known answer is a literate, clause-anchored source a lawyer can review article by article — and that is a process guarantee, not a proof. The encoding version and its signature are part of the certificate, because the encoding is a claim someone made.
Priority across documents
Statute above regulation above wording above endorsement above schedule above slip, each amending the last. Local exception structure is tractable; the global priority order, and telling a genuine conflict from an intended override, is where encodings of real wordings blow up. So the product is conflict detection routed to a room, not adjudication.
Bitemporal obligations
Occurrence against claims-made, retroactive dates, notification deadlines, reinstatements, mid-term endorsements changing the rules during the period, losses developing over years. The component logics exist; combining them with defeasibility — rules that later or higher rules can override — is research-grade, and decidability on realistic wordings is unestablished.
Quantitative clauses
Average clauses, sub-limits interacting with deductibles, allocation across years and layers, and aggregation — “one occurrence or two?” — which is open-textured and numeric at the same time. This also forbids attaching a formal certificate to a catastrophe-model number: a simulation run is a logged input to a record, never a proved object.
Where that leaves the pen
Scored against a full wording, all five are hard. Scored against a managing-agent binder pen — limits, classes, territories, aggregates, clean effective dates, one issuer — they are markedly easier, which is why the pen is the first fragment and not the last. That scoring is our own design judgement, used to choose a fragment and never reported as a measurement.
Where the verifier fails closed
REFUSED
Re-verification found that the encoding, the rule version or the model identity sealed into this certificate is not the one live today. The certificate did not re-assert itself as valid.
A certificate is a statement about one decision trace at one event time, one knowledge time and one rule version — never a standing statement about a wording. When any of those drift, the honest verdict is a named mismatch rather than a fresh green tick, because a re-verify that quietly passes is worth nothing to the person relying on it. The hash-chained record and the never-dropped audit emitter under this are production; the seal and the solver-backed scope set above it are designed.
What you can do next
NX/services/nexus-workflows/src/services/audit-emitter.tsDetails for support
HASH_MISMATCH
What this connects to
The lane that is built
Cross-model gates cover everywhere the formal lane does not reach — and the page states what they do not catch.
Evidence fabric
The hash-chained layer beneath the certificate, which is the part that is already production.
The sources
Every external claim on this page is somebody else’s published result, with its primary citation.
Four working papers. A person sends the one you pick — no download wall, and no meeting is booked.
Work out what this costs