Capability deep-dive · formal methods

Counsel asks which part of the decision you can prove. Most systems cannot tell you where the proof stops.

A court will not accept “the model was confident”, and a regulator now wants the procedures and principles actually applied — concisely enough that the person affected can contest them. Handing over the algorithm does not discharge that duty. Neither does a confidence score.

Every component of this exists in production. None of them in insurance

> 1bnsolver queries a day inside one production compliance product, answering policy-containment questions[V]

productiona formally specified compiler for a national tax code, transitioned into government production[V]

medal tiermachine-checked natural-language-to-formal translation at competition level, every output checked rather than asserted[V]

not builttheir integration for insurance policy wordings — including ours — [P: to be calibrated][P]⧖

The formal lane — the policy-wording compiler and the solver integration — is designed and not built. Nothing on this page claims otherwise.

What becomes decidable once a fragment is encoded

The transferable pattern is narrow and it is real: compile a rule set with an ambiguity-free semantics into a solver, then ask “does this configuration ever permit X?” as a decidable question. Over an encoded fragment — a binder pen and its schedules first, because they are already near-tabular — five queries carry the weight.

The decidable query set over an encoded rule fragment
Query	The question in words	What a positive answer returns
Q1	Authority containment — is there any risk this pen would bind that sits outside the delegated authority?	A counter-example. The counter-example is the product.
Q2	Grant and exclusion conflict — is there a fact pattern where both fire and no carve-back applies?	The fact pattern, routed to a room. Detection, never adjudication.
Q3	Wording equivalence — did this endorsement change what is covered?	The scenario that separates the two versions.
Q4	Clause redundancy — does removing this clause change any outcome?	Either a witness, or the redundancy finding.
Q5	Aggregate feasibility — can this bind push the aggregate past its limit?	The binding arithmetic, given a declared event partition.

wording and binder ingestion(shipped)three-tier document cascade(shipped)the encoder that turns an ingested wording into a rule programme(designed, not built)the solver integration that answers the five queries(designed, not built)

What the verifier renders, and what it refuses to render

The scope block comes before any verdict

A certificate splits into two blocks that are visually distinct and always rendered together: the predicates that were formally decided, each with its checkable witness, and the predicates that were cross-checked only, each with the models and the evidence overlap that backed it. A cross-check may never be styled to read like a proof.

A certificate names its own scope

A certificate may assert a predicate only if that predicate has a checkable witness in its scope set. There is no code path that prints an unscoped assertion — which is what makes “never claim to verify what was not formally encoded” a mechanism rather than a house style. The sentence a certificate carries is “it asserts exactly these predicates”, not “the wording has been verified”.

THE SENTENCE LEDGER

Not “the system decided coverage” — but “the system decided everything downstream of the chair’s finding on these named open-textured terms”.
Not “the wording has been verified” — but “this encoding, at this version, counsel-signed against these clause anchors, entails this predicate”.
Not “the certificate resolves the slip and wording conflict” — but “a fact pattern exists where both fire; here it is; a room rules”.
Not “valid for the life of the policy” — but “valid at this event time, this knowledge time and this rule version, and re-verify fails loudly on drift”.
Not “the aggregate exposure is proven correct” — but “the arithmetic holds given this declared event partition”.

The five problems that bound the claim

These are the reasons nobody has shipped this, and each one deletes a sentence a vendor would like to write. An engineer who reads five correctly stated hard problems concludes the authors have done the work; the same engineer reading “provably compliant AI” concludes the opposite.

Open-textured predicates

“Reasonable precautions”, “flood”, “arising out of” — predicates whose extension courts fix case by case. They are encoded as uninterpreted terms whose valuation is a human input, so the proof is conditional. The formal layer relocates judgement onto an accountable, logged person; it does not eliminate it.

Formalisation fidelity

A machine-checked proof guarantees the code is consistent, not that the code means what the wording means. The best known answer is a literate, clause-anchored source a lawyer can review article by article — and that is a process guarantee, not a proof. The encoding version and its signature are part of the certificate, because the encoding is a claim someone made.

Priority across documents

Statute above regulation above wording above endorsement above schedule above slip, each amending the last. Local exception structure is tractable; the global priority order, and telling a genuine conflict from an intended override, is where encodings of real wordings blow up. So the product is conflict detection routed to a room, not adjudication.

Bitemporal obligations

Occurrence against claims-made, retroactive dates, notification deadlines, reinstatements, mid-term endorsements changing the rules during the period, losses developing over years. The component logics exist; combining them with defeasibility is research-grade, and decidability on realistic wordings is unestablished.

Quantitative clauses

Average clauses, sub-limits interacting with deductibles, allocation across years and layers, and aggregation — “one occurrence or two?” — which is open-textured and numeric at the same time. This also forbids attaching a formal certificate to a catastrophe-model number: a simulation run is a logged input to a record, never a proved object.

Where that leaves the pen

Scored against a full wording, all five are hard. Scored against a managing-agent binder pen — limits, classes, territories, aggregates, clean effective dates, one issuer — they are markedly easier, which is why the pen is the first fragment and not the last. That scoring is our own design judgement, used to choose a fragment and never reported as a measurement.

Where the verifier fails closed

REFUSED

HASH_MISMATCH

Re-verification found that the encoding, the rule version or the model identity sealed into this certificate is not the one live today. The certificate did not re-assert itself as valid.

A certificate is a statement about one decision trace at one event time, one knowledge time and one rule version — never a standing statement about a wording. When any of those drift, the honest verdict is a named mismatch rather than a fresh green tick, because a re-verify that quietly passes is worth nothing to the person relying on it. The hash-chained record and the never-dropped audit emitter under this are production; the seal and the solver-backed scope set above it are designed.

hash-chained, never-dropped record is production

The honest limit

WHAT THIS DOES NOT DO YET

The formal-methods lane — the policy-wording compiler and the solver integration. The cross-model gate that backs it up IS built; the formal lane is not.
A certificate never claims to verify what was not formally encoded; it names its own scope. Where a predicate was not encoded, the certificate says “cross-checked only” and shows the models that checked it.
No published deployment integrates formally semantic policy-as-code, decidable containment queries and justification trees for insurance wordings — including ours.
Every threshold in the two-lane design, and the coverage the formal lane would reach, are [P: to be calibrated]. If the five hard problems bite, what is lost is the premium assurance tier, not the platform: the gate, the room, the record and the validation lane stand on production capability alone.