Services · Renewal
Continuous per-constraint re-validation against pre-registered floors, with attested loss-of-warrant events and a graded fallback that never leaves a constraint ungoverned.
What the harness runs
Each gated at a pre-registered per-domain floor recorded in the traceability matrix.
Renewal triggers
A new model or embedding invalidates the prior calibration by construction.
Detected by a delay-optimal change detector, CUSUM / Shiryaev-Roberts, minimising detection delay at a stated false-alarm rate.
A scheduled re-validation regardless of observed change.
Whichever comes first.
The fallback ladder
The account never loses enforcement, only assurance tier, and each rung down is a trigger to re-engage. The bottom rung is not a failure state: it is the site's Mode B, deterministic, decidable, and still enforced.
A competitor's threshold has one response to drift, to be wrong.
Episodic / step-change drift, bounded coverage gap.
Continuous drift, long-run coverage.
The attested run-record and provenance ledger the harness writes to is the pinpole-proven lifecycle, carrying validation evidence instead of simulation runs. pinpole.cloud → Status legend →
The honest boundary
Both drift mechanisms preserve a coverage guarantee with a bounded gap; they do not restore the original bound, and a large enough gap is itself a demotion trigger. Demotion is the fallback, not the first response.
Rule 7 for the detector itself, a loss of warrant is an attested, visible event, never a silent decay. The eight rules →