Conformity and law

Research 4

• Continuous conformity

  Working draft 0.3: 36 requirements for testing a deployed AI system, and the knowledge it runs on, on every change and on a fixed schedule, decided by someone other than the system, with records a third party can rerun. A reference text, not a standard.

  updated 2026-10-09
• Self-assessment, run 1

  One working AI setup scored against 35 draft requirements for continuous testing of deployed AI systems, by the model that runs inside it, against a prediction hashed before scoring.

  updated 2026-10-07
• Evidence index

  Stefan Coetzee's public record of red-teaming, adversarial testing and evaluation engineering against frontier language models, indexed by the capability a hiring panel assesses. One URL, one verbatim line and one date per row. Self-maintained; not a third-party assessment.

  updated 2026-10-07
• Case 12: a licence rule mid-task

  The user named a file. Model plus harness found a licence clause in it, wrote the rule, spread it across sessions and acted on it in 68.7 seconds. No structural control existed before the fact.

  updated 2026-10-07

Inside 2

• Gate runs

  Continuous conformity of machinebehavior.io, site tier: the mechanical requirements of the working draft checked on every push and every week, with run records, open findings and the crosswalk to existing frameworks. Self-assessment, not a certification.

  updated 2026-10-07
• Conformity gate

  The checks every push runs before a site serves readers: blocking rule hits, placeholder text, prediction hashes and site consistency. A failed check stops the deploy and the previous build stays live. One composite action, shared by the three sites.

  updated 2026-10-09

Docs 212

Engineering 5

• Add a page to machinebehavior.ioThe five things a new page needs to pass the gate, and the commands to check them before pushing.
• ADR-0019: Publish the definition draft before the committee routeThe working draft "Continuous Conformity for Deployed AI Systems" (0.3, 36 requirements) is public as a reference at /continuous-conformity/ before any standards committee has seen it, reversing the committee-first order of 2026-10-04.
• Conformity gateThe checks every page passes before a deploy: blocking rule hits, placeholders, prediction hashes and site consistency, with warnings logged.
• Gate blocked a deployThe conformity job failed, so the deploy did not run and the previous build is still live; find the failing check, fix the page, push again.
• Link check flags a template stringThe gate reads every href in the page source, including ones inside JavaScript template strings; build such links with a.href in code.

Research 3

• Case files: case 12 and Running Conjobs for AITwo harness case files: case 12, a licence rule found and acted on in 68.7 seconds, and a reported authority-injection specimen that was not reproduced.
• Conformity self-assessment, run 1One working AI setup scored by the model inside it against 35 draft requirements and a hashed prediction, with pass 4, partial 16, gap 13 and n/a 2 (self-assessment, not a certification).
• Weekly decision-layer probeA weekly rerun of a frozen experiment 04 subset on a reference model, recorded for requirement CC-6.6; first record 2026-10-07, record-only until 2026-11-04.

SRE Handbook 1

• Every change passes the same gateRelease engineering makes every change go through one repeatable, recorded path, with builds that give the same output wherever they run. Here one workflow gates and deploys three sites and records every run; the generated pages are built on the author's machine, and the observability stack has no pipeline.

Standards and Compliance 203

• Standards and ComplianceReference clusters from the knowledge vault for 28 standards, regulations and frameworks, from ISO 27001 and NIS2 to the EU AI Act and TOGAF.
• BSI IT-GrundschutzMap of BSI IT-Grundschutz, German national InfoSec framework from BSI (Bundesamt für Sicherheit in der Informationstechnik).
• BSI IT-Grundschutz anchorsBSI IT-Grundschutz anchors, from the knowledge vault.
• BSI IT-Grundschutz positionBSI IT-Grundschutz position, from the knowledge vault.
• CMMICapability Maturity Model Integration.
• CMMI anchorsCMMI anchors, from the knowledge vault.
• CMMI ControversiesCMM heritage produces bureaucratic-implementation.
• CMMI Maturity and Capability LevelsOrganization-wide. One rating across the org.
• CMMI positionCMMI position, from the knowledge vault.
• COBITMap of ISACA COBIT 2019, IT governance framework.

Tickets 11

Issues on the board, open first, as of the last build.

• #40 CI check: generated pages match their sourcesopen · area: docs · area: gate · P2
• #39 Toil: the bot commit on main forces a rebase before every pushopen · area: gate · P3
• #27 Gate check for docs owner and review dates (open decision)open · area: docs · area: gate · P3 · status: blocked
• #26 Security headersopen · area: security · P2 · status: blocked
• #25 Retention statement for the metrics and log storesopen · area: observability · area: legal · P2
• #12 security.txtopen · area: security · P1 · status: blocked
• #11 Privacy notice on all three sitesopen · area: legal · P0 · status: blocked
• #10 Impressum on all three sitesopen · area: legal · P0 · status: blocked
• #17 Access model page and public demo bannerclosed · area: inside · area: security · P2
• #5 Remove internal host details from the public dashboardsclosed · area: security · P0
• #4 No third-party requests on page loadclosed · area: legal · P0

Other topics

• Sycophancy and stance
• Operations and SRE
• Observability
• FinOps
• Agents and harness
• Evaluation