Numerical
Admissibility.

Run it against anything

Including systems the author did not build, and including the author's own. No involvement, cooperation or consent is required, and none can be withheld.

Executable conformance

A machine-checkable trace from each normative clause to an executable test asserting the behaviour that clause requires, quoting the clause from a hash-sealed copy of the text. Traceability is established mechanically rather than asserted; it is not a claim of semantic completeness.

Planted-defect suite

A set of deliberately introduced defects used to characterise what the instrument does and does not catch, so its own detection behaviour is measured rather than assumed.

D1  Accuracy

Whether the figure is correct against ground truth reproducible from the published fixture.

D2  Determinism

Whether an identical question returns an identical answer across repeated runs — and by what mechanism: structurally, by configuration, or merely observed.

D3  Provenance

Whether the system can produce the source and the operation for every figure it states.

D4  Refusal integrity

Whether the system declines when the data cannot support an answer, rather than producing one.

D5  Adversarial resistance

Whether the system holds under sustained pressure to state a figure that does not exist.

D6  Conflicting input

Whether contradictory, stale, partial or out-of-range source data is detected rather than computed over silently.

D7  Computation invocation

Whether the required deterministic computation actually executed — and whether invocation is guaranteed rather than merely observed.

V1.3 DRAFT — NOT ADOPTED
The draft splits D7.2 into operand provenance D7.2(a) and operation correctness D7.2(b), and grades invocation evidence EV-0 to EV-3 by independence and verifiability.

The distinction

A system that invokes computation correctly on sampled questions has demonstrated a tendency. A system in which invocation cannot be declined has established a control. AP-1 measures which one is present.

Financial services

SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026 (17 April 2026) superseded SR 11-7. Footnote 3 places generative and agentic AI outside the scope of that guidance while confirming the principles still apply to traditional statistical models and to non-generative, non-agentic AI. The practical consequence, as noted by counsel and model-risk advisers, is that each institution defines, documents and defends its own governance for these systems. UK expectations include independent validation within SS1/23. The EU AI Act requires record-keeping and consistent accuracy, robustness and cybersecurity for high-risk systems. BCBS 239 sets principles for the accuracy and integrity of risk data, which supervisors increasingly test through lineage from source systems to reported figures.

Pharmaceuticals, biotech & clinical

Electronic records and regulated data are subject to requirements for validation, secure audit trails, traceability and protection against unauthorised alteration. FDA data-integrity practice commonly expresses these principles through ALCOA+, alongside 21 CFR Part 11 and related requirements. For AI specifically, FDA draft guidance sets out a risk-based credibility assessment for a model's context of use, and draft EU GMP Annex 22 limits critical GMP applications to static models with deterministic output, excluding generative AI and large language models.

Aerospace & aviation

Software assurance requires traceability from requirement to implementation to verification evidence. Where a statistical component supplies a value to a qualified computation, the provenance of that value falls outside the tool qualification of the computation itself. EASA frames machine-learning assurance as learning assurance, now moving into rulemaking under RMT.0742.

Space & mission systems

NASA-STD-7009B requires a credibility assessment of models and simulations, including the pedigree of their input data; NASA-HDBK-7009B adds guidance on pedigree and provenance and on NASA's use of AI models. Where an AI component supplies a value to a model, simulation or flight-software analysis, the provenance of that value bears on the same credibility question.

Defense

AI-enabled capabilities in the US Department of Defense (also styled the Department of War) and the Intelligence Community are assessed through test, evaluation, verification and validation (TEVV) and AI assurance, aimed at justified confidence that a capability meets its requirements. Where a decision-support or autonomous system produces a consequential figure, the evidence behind that figure is part of the same question. Contractors additionally operate under cybersecurity obligations.

Nuclear

Safety-analysis codes operate under software quality assurance regimes requiring verification, validation and configuration control. A value entering a safety calculation from a statistical component sits outside the qualification envelope of the code. The NRC evaluates AI within its existing framework; its AI regulatory gap analysis identified targeted areas for further guidance.

Insurance & reinsurance

Quantitative requirements govern the valuation of assets and liabilities and the calculation of capital, alongside own risk and solvency assessment and supervisory reporting. A reserving or pricing figure that cannot be traced to its inputs cannot be validated.

Electric power & utilities

NERC-registered entities operate under mandatory reliability standards carrying evidence and audit obligations. Figures informing dispatch, capacity and protection decisions carry the same requirement.

Medical devices & diagnostics

Software as a medical device operates under lifecycle, risk-management and validation regimes. A computed clinical value must be verifiable rather than asserted.

Rail & maritime

Safety-related signalling and control software carries software integrity level obligations with verification evidence; classification regimes apply comparable requirements at sea.

Audit & financial reporting

Internal control over financial reporting requires that figures entering statements be supported by evidence a third party can examine and reproduce.

Robotics & autonomous systems

Where a learned component — including a language model used for task planning — supplies a numerical parameter such as a setpoint, distance, load or timing to a deterministic planner or controller, the same operand boundary applies. Safety cases for these systems are built under autonomy and AI-specific functional-safety standards.

Any domain that computes

The mechanism is not sector-specific. It appears wherever a statistical component supplies operands to a deterministic calculation whose output is acted upon — including sectors not listed here.

Standard — v1.2 and v1.3 draft

Full text in Markdown and PDF, deposited with a persistent DOI.

Reference evaluation

Complete results reports for the two published runs, with their sealed configurations and per-dimension profiles. Affected findings are withdrawn under the errata above.

Correction record

Every recorded defect in the standard and the instrument, across two series. Affected findings are withdrawn rather than restated, and the frozen run artifacts are left unmodified.

Frozen run artifact

The raw evaluation log as executed, sealed and unmodified.

Pre-registration (AP-1 §5.3)

Hashes, requested model identifiers and timestamps recorded by the harness before execution. The timestamp is self-reported, not independently attested.

Evaluation harness

The runner and classifier used to produce the reference evaluation, published in full under MIT licence. Runnable in one command against any system, and it reports its own totals.

Registered methodology

The measurement method and analysis plan, deposited on the Open Science Framework — timestamped and immutable. It registers the method, not any individual evaluation run.

Sealed evaluation set

The question set and answer key, published on execution and therefore burned.

Disposition record

Comments received on the v1.3 draft and their disposition, recorded whether accepted or not.

Citation metadata

Machine-readable citation file, contribution rules and security policy, so the standard can be cited and challenged without contacting its author.

Amendment template

The issue template through which any party may propose a change to the standard, and the channel through which the comment window is run.

Version history

Every prior version remains retrievable and permanently citable. No version is withdrawn or silently altered.

1  Founder-originated

ZORRZ authors and publishes the standard, its reference evaluation and its defects. Current position.

2  Open technical review

Independent reviewers reproduce the harness and challenge the standard through the public amendment process. Now possible without the author: the instrument is public.

3  Independent application

Third parties execute AP-1 against systems the author did not build, and publish results — favourable or otherwise.

4  Independent stewardship

Custody of the standard transfers to a body with no commercial interest in any evaluated system.

5  Multi-party governance

A technical steering group and published maintainer process govern amendment.

Where this stands

Stages 2 and 3 are open. Independent reviewers and independent applications are invited; the standard and its instrument are designed to be run without the author's involvement or consent.

Deterministic scoring

No language model executes in the scoring path. Classification, numeric comparison and provenance resolution are deterministic and re-runnable.

Sealed before execution

Fixtures, questions and expected values are hashed and sealed before execution, so the evaluated material can be independently reproduced.

Evidence classes

Results carry the evidence class under which each observation was established. A self-reported signal is not treated as equivalent to an externally verified one.

Burned question sets

A set is burned the moment it is run, and publishing it confirms this. Every evaluation uses a freshly constructed set; the method is published, not a reusable set.

Declared limitations

Known limitations, unmet independence requirements and methodological defects are reported rather than omitted.

Observation versus structure

An observed rate is not treated as a universal guarantee. A structural mechanism that makes a failure unrepresentable is stronger evidence than an absence of failure in a finite sample.

Ground truth is a separate question

Deterministic scoring does not imply independent ground truth. The fixture and expected values published with the runner were authored by an AI coding agent, not derived from an independent source. Independent construction of expected values is therefore treated as a separate conformance requirement, and is currently unmet.

Declared authority, measured conformance

AP-1 does not designate which sources are authoritative, nor does it establish whether a source is correct. The source hierarchy, permitted transformations and declared constants must be fixed before execution; AP-1 measures conformance to that declared evidence chain.

Re-execution, not re-scoring

Results are not portable across a revision of the ground truth. Where the fixture or its expected values change after a seal, the correct remedy is re-execution — as applied to the author's own withdrawn findings.

Route 1  ·  Repository issue

Open an issue using the amendment template. Threaded, permanently archived, and citable by issue number in the disposition record. Preferred where you are comfortable with the platform.

Open an amendment issue →

Route 2  ·  Email

Send to the address below with AP-1 v1.3 comment in the subject. Emailed comments are transcribed into the public record under the sender's name, so both routes produce one archive rather than two.

dev@zorrz.com →

What happens to your comment

Every substantive comment is recorded in the public disposition record with its resolution — accepted, accepted in modified form, declined with reasons, or deferred to a successor protocol. Declined comments are published alongside accepted ones.

Disposition record →

Cite the clause

Reference the section or dimension. A comment on “the provenance requirement” is harder to act on than one on a numbered clause.

State the defect, not the preference

Whether a requirement is unmeasurable, ambiguous between two readings, circular, or produces a false result in a stated case.

Give the failing case

A system, configuration or scenario in which the clause as written yields the wrong verdict is the most useful contribution possible.

Propose replacement text

Optional, and welcome. Text that can be adopted directly is faster to disposition than a description of the problem alone.

Say if it is out of scope

If a proposed change alters the dimension set or the conformance bar, it may belong in a successor protocol. Views on that boundary are explicitly invited.

Disagreement is the point

The standard names its own defeat condition. A comment arguing that AP-1 measures the wrong property, or measures it wrongly, is more valuable than one confirming it.