Measured,
not asserted.
What was tested, how it was tested, what the numbers mean — and what they do not mean. Every figure on this page is either published in the governance repository or produced by the running system, and is quoted with the conditions that produced it.
These figures describe defined test suites in a declared environment. This is bounded verification, not a universal proof of AI safety. An Admissible Operating Envelope is a local, environment-bound claim; it is not evidence that an underlying model is globally safe.
Independently reproduced.
Including the failures.
Sayan Chowdhury of Kalaris Labs independently reran selected Morrison experiments at pinned commit fba06b75 and published the methodology, bounded findings, adversarial counterexamples and deployment limitations.
Cost scales with trajectory length,
not with model size.
No model inference occurs in the governance path, so evaluation cost is a function of the number of steps and the rule count — not of prompt length or sampling.
| Class | Steps | p50 (ms) | p95 (ms) | Throughput (eval/s) |
|---|---|---|---|---|
| Single-step | 1 | 0.298 | 0.338 | 3,284 |
| Short | 2 | 0.745 | 0.807 | 1,323 |
| Medium | 4 | 2.334 | 2.403 | 426 |
| Long | 8 | 5.414 | 5.522 | 184 |
| Very long | 16 | 11.501 | 11.722 | 87 |
| Multi-agent (joint) | 3 | 1.559 | 1.622 | 638 |
Single-threaded, horizon 3, 96 Ω rules across 9 domains, 800 iterations per class after 100 warm-up calls. Representative figures, not a production-hardware guarantee.
Latency and throughput, with the environment stated.
The benchmark calls the real evaluation path — the same engine and deployment rule set the live service runs. Each class is warmed up, then timed per call; percentiles come from the sorted sample.
Reach_G(X₀) ∩ Ω = ∅, inside a model we declare in full.
A finite verifier enumerates every reachable state of a declared model, submitting each proposed transition to the same GovernanceKernel the service runs, and reports whether any prohibited state remains reachable. Enumeration is exhaustive over that model, not sampled. The result is SAFE_WITHIN_MODEL — and the qualifier is the claim, not a hedge.
mrg.global-verification.v2) carrying the model hash, transition-relation fingerprint, ruleset hash, verifier commit, verdict, completeness, assumptions, limitations, and the kernel evidence record behind every decision.python -m morrison_governance.global_verification.ci_gate --out DIR at the commit the artifact records. Re-running the enumeration is the only way to confirm it happened.The evaluation hierarchy, layer by layer.
Separate from the finite-model verification above: this is what the engine runs against a real proposed trajectory, before execution. Each layer answers a different question, and every layer runs pre-execution.
219 test functions, in a repository you can read.
The governance engine, its Ω definitions and its deployment rules are exercised by the repository's own suite. Coverage scenarios, multi-agent scenarios and adversarial cases are part of it.
What a governed run records.
Every governed run emits a record: the proposal, the policy state in force, the verdict and its governing rule, any approval, the execution result, and a hash linking it to the record before it.
The same trajectory reproduces the same verdict.
Verdicts are produced by deterministic evaluation against declared constraints, not by a model judging its own output. That is what makes a record replayable rather than merely stored.
What CI proves about an isolated deployment.
The sovereign profile is exercised in CI with the network removed, not simulated. Each item below is asserted by a test.
The absence of an authorization is not an authorization.
Fail-closed is the default path and is not configurable away. It is asserted rather than described.
The comparison is run, not asserted.
The evaluation corpus contains adversarial and benign trajectories. The ungoverned path executes them; the governed path evaluates them at the boundary first.
The same contract at every dispatch point.
The adapter changes with the framework; the authorization contract does not. Each integration places the boundary at the point where a call would otherwise be issued.
What has not been done yet.
Stated here rather than left for a reviewer to discover. Nothing below is claimed anywhere else on this site.