Workflow · screening gates and verification
A gate ladder for evidence, a verification loop for every gate.
The corpus question — which of 788,470 official publications are U.S. economic sanctions? — is answered by a ladder of screening gates ordered from free to expensive, and every gate is itself built through a fixed multi-agent loop of design, adversarial review, dual-vendor execution, and independent verification.
- 788,470
- Publication records in the frozen frame
- 2
- Independent model vendors at every decisive step
- 0
- Discrepancies between the two validation lanes Field-for-field identical reports
- 2,690
- Sources captured by the blind research seats 2,538 + 152, two vendors
- 620
- Tests green in the sealed reading contract Companion classifier lane
- 21 / 28
- Gate 1 fixtures / run groups, zero failures Fixture pilot, no corpus run yet
Figure 01 · Screening architecture
From 788,470 official publications to the sanctions evidence base
Seven gates, ordered from free to expensive. Deterministic scripts run first and are never allowed a terminal decision; complete-document reading is reserved as the only way a document leaves the pipeline. Solid boxes are frozen or under active design; dashed boxes are designed but not yet specified.
- Verified twice
Frozen source frame — FederalRegister.gov, 2000–2025
788,470 publication records collected through archived API queries with byte-level response custody, passing 26/26 annual source audits. The canonical evidence projection over this frame (11.99 GB) was validated exhaustively by two independently built validators from two model vendors, which returned field-for-field identical reports with zero defects.
- Spec frozen · pilot passed
Metadata identity gate
Affirmative irrelevance on identity metadata alone. Only three narrow, pre-specified stop conditions may remove a record; corrections always pass. The honest expected result is that nearly everything passes — this gate proves the frame, it does not thin it.
- Design in PI sittings
Deterministic signal screen
A scripted word test over verified document text: the word “country”, every foreign country name (date-aware, with historical names and demonyms), country-group codes, and economic-restriction vocabulary. Matching over-keeps by design. Keyword hits order the reading queue; they never exclude.
Zero-signal documents become a toss-candidate pile — discarded only through the receipt lane, never by the script itself.
- Dual research round 1 complete
Issuing-agency gate
A date-aware registry of issuing agencies built by two mutually blind research seats and synthesized under review. Known sanction-filing agencies sort high; routine filers form toss-candidate piles; unknown or unmatched agency names always keep. Treasury, Commerce, and State are carve-outs never clearable by agency alone.
Claimed-boring piles one pile per agency rule, each requiring its own clean sample receipt before any toss executes.
- Designed · not yet specified
Boilerplate-series gate
Recurring administrative series (identical templates republished on a schedule) are identified as families and retired per class — after a sampled complete read of the family establishes the template carries no restriction content.
Template families retired per class via the receipt lane; one confirmed miss kills the family rule.
- Designed · not yet specified
Named junk-family gate
Known non-substantive publication families identified by name during research (routine notices with fixed formats). Same discipline: the rule proposes, the sampled complete read disposes.
Named families same receipt discipline as G4.
- Priced by live pilot
Complete read — economical model
Every surviving document is read completely by an economical language model working under the sealed reading contract. The reader classifies plausibility; any doubt escalates. No partial-read standard exists anywhere in the pipeline.
Clearly-irrelevant reads excluded with a per-document reasoned receipt bound to the exact text read.
- Priced by live pilot
Complete read — frontier models, dual vendor
Documents that survive or raise doubt receive complete reads by frontier models from two independent vendors, corroborated per document. Disagreement keeps the document or escalates it — it is never averaged away. This is the sole terminal decider.
Final coding under the ratified construct criteria
Each confirmed sanction is coded into the target record structure — sanction → year → targeted country → affected industries (SIC-4) → affected product categories (HS-4) → direction of restriction (inflow / outflow) — with every field bound to the exact official passage that evidences it.
Doubt falls throughIf a gate cannot say a document is absolutely not a sanction, the document proceeds to the next, more expensive gate. Uncertainty is never grounds for exclusion.
Exclusions are purchasedEvery removal is paid for with complete-document reading — per document, or per class through a pre-registered, cluster-aware sample receipt signed by the principal investigator, with its worst-case miss rate disclosed. One confirmed sanctions document in a pile kills that pile’s rule.
The accounting identityAt every gate, input = kept + tossed-with-receipt + parked. Scanned or image-only documents route to a dedicated repair lane and are never discarded unread; blocked evidence can never shrink the population.
No target countsNo executing seat is ever told an expected or desired removal count. Screening yield is a result, not a goal.
Figure 02 · The verification loop
How every gate is designed, built, and accepted
The same eight-step loop has produced every accepted artifact in the program — the source frame, the evidence projection, the reading contract, and each gate specification. No single model, vendor, or session is ever trusted with an unverified result.
Mission plan
A governance seat (“gate GM”) writes the mission plan and the starter prompts for every sub-seat. By standing rule, this seat decides nothing.
Dispatch
The principal investigator personally fires each seat from its starter prompt. Authority, write boundaries, and budgets are explicit at dispatch time.
Design
The assigned seat drafts the specification or build order against frozen inputs, citing every dependency by cryptographic hash.
Adversarial review
A fresh session with no stake in the design attacks it before anything is built, and the loop repeats until zero blocking findings remain.
Build + audit
Implementation lands with fixture suites; audits are designed to reach seam and merge logic, catching bugs before any expensive run.
Canary, then detached run
A small pilot always precedes the fleet. Long computation runs detached from any chat session, with sentinel files and honest failure semantics.
Independent verification
A second implementation — built mutually blind by the other vendor, or a blinded reimplementation under a withholding protocol — repeats the work.
Corroboration + ratification
A seat that built neither lane compares the reports mechanically. Results go to the PI, whose ruling is recorded verbatim; accepted artifacts are sealed by hash.
The division of labor
Six ways large language models are put to work
The working unit is a seat: a fresh model session with a closed reading list, its own write territory, and a named authority chain, dispatched by the principal investigator from a written starter prompt. Models from two vendors (Anthropic’s Claude family; OpenAI’s GPT/Codex family) occupy structurally different seats — design and review, building and execution, and code-disjoint second lanes. What a seat may read, write, and decide is fixed at dispatch; the seats check one another rather than trusting one another.
Resource-collection machines
Two research seats, mutually blind, run saturated multi-round deep research on the same posed questions — legal instruments, agency histories, scholarly datasets, edge cases — capturing every source with byte-level custody.
In this program: The sanction-construct research produced two independent source registries (2,538 and 152 captured sources). A seat is saturated only when a full additional round of active searching adds nothing new.
Brainstorm and design partners
Design seats work through decisions interactively with the principal investigator — one decision at a time, in plain language, each value-laden choice presented with its live alternative and a recommendation.
In this program: The Gate 2 design record registers eight numbered decisions (word-list scope, triage thresholds, corroboration rules…), each ruled by the PI and transcribed verbatim before anything freezes.
Workers
Builder seats implement frozen specifications and launch long computation detached from any chat session — supervised process groups, sentinel files, and receipts — so a session ending is never work stopping.
In this program: Both vendors built parallel validators for the 11.99 GB evidence projection in under an hour each, audited them against oracle fixtures, and ran them detached to completion with all-zero exit codes.
Adversarial review partners
Before anything is built, a fresh session with no authorship stake attacks the design: wrong premises, silent failure modes, under-specified seams. Blocking findings return the design to its author.
In this program: A pre-build adversarial review caught an entire parallelization bug class — collision groups straddling chunk seams — that the planned audit could never have detected. The review cost under an hour.
Independent verifiers
Every accepted artifact is verified by a seat that did not build it — up to full blinded reimplementation from the written specification alone, with details withheld under an explicit protocol.
In this program: The canonical projection was validated twice, by two independently built validators from two vendors, which returned field-for-field identical reports — zero differences across disjoint codebases.
Synthesis and corroboration seats
When two blind seats finish, a reserved seat — the first authorized to read both — compares the packages. Comparison, never harmonization: where the seats disagree, the disagreement is preserved, priced, and put to the PI.
In this program: The cross-seat synthesis of the construct research recorded a 14-of-15 edge-family agreement reached before either seat saw the other — and treats the divergent cases as the load-bearing findings.
Failures become rules
Every rule in the protocol was purchased by a retained failure
Rejected builds, failed probes, and superseded designs are labeled and preserved, never deleted — the program’s own mistakes are part of its audit trail. Each recurring rule traces to a specific incident.
- Fabrication under ambiguity → stop-and-report
An early batch worker, facing ambiguous inputs, fabricated a plausible-looking output rather than halting. Every dispatch now carries an explicit stop obligation whose exercise is receipt-verifiable — and a clean stop is recorded as a success.
- The fabricated-packet probe → byte-bound receipts
A validation harness, fed an entirely synthetic acceptance packet as an adversarial probe, returned a passing verdict without opening a single file. Receipts must now be bound to the bytes they claim to verify; self-asserted success is never accepted.
- Review ≠ audit → reviews build their own probes
Re-running a builder’s own tests inherits the builder’s blind spots. A review must construct its own adversarial probes against the written specification, not against the implementation’s account of itself.
- Presence is not success → honest sentinels
A detached run once looked finished because its completion marker existed. Sentinel files now carry every worker’s return code, and a result report is written only when all of them are zero.
- Two specs, one name → cite by hash
Two different specification chains briefly shared a version label. Accepted artifacts are cited by full filename and content hash, never by version label alone.
Human research authority is the frame, not a checkpoint
Agents recommend; the principal investigator rules. Every value-laden choice is put to the PI in plain language with its live alternatives, and the ruling is transcribed verbatim into a dated, self-hashed decision record. Gate closures require the PI’s countersignature; spending occurs only under PI-set ceilings; and no screening rule can discard a document without a PI-signed acceptance receipt disclosing its worst-case miss rate.