Structural controls for high-stakes AI.

Structural Design Labs publishes SIR as a public demonstration of deterministic pre-inference enforcement and signed evidence.

Not a leaderboard.

Not a compliance certificate.

Not a claim that model behavior is solved.

Verification

Check the signed run yourself.

This command was tested from a clean machine: a small clone, one Python dependency, and under a minute to verify the signed audit and ledger binding.

clean-machine verification

git clone https://github.com/SDL-HQ/sir-firewall.git \
  || git -C sir-firewall pull
cd sir-firewall
python3 -m pip install cryptography
python3 tools/verify_evidence.py docs/runs/20261015-092939-820950-gh38712792514-308a8a0f91eb

docs/runs/20261015-092939-820950-gh38712792514-308a8a0f91eb

  OK      signing trust      signing_key_id='sdl-2026-10-06' resolved through key_registry.v1.json, with its status and revocation rules applied
  OK      certificate        signature, payload hash and ledger binding all verify
  OK      signed counters    the signed counters were recomputed from the rows the certificate binds
  OK      archive custody    every file named by the signed manifest is present and unchanged
  OK      evidence contract  the certificate satisfies its applicable evidence contract

VERDICT: ESTABLISHED

Proof class: LIVE_GATING_CHECK

This is one archive, checked by our own tool with our own key: a signature that verifies establishes that we signed that payload, not that the payload is true. Where a property cannot be checked at all the verdict is NOT ESTABLISHED rather than a pass, and several published archives come back that way. Limits records what a passing verification does not establish, and the claims register lists every claim with the evidence for it.

Don't take our word for it

Check the evidence yourself

A separate repository of real published archives, each chosen because our own verifiers give it a different answer. Verifiable offline from a clean machine, with a recipe for altering a ledger row so you can watch the chain refuse to re-derive.

Open SDL-HQ/sir-evidence

Current signed surface

Latest audit summary

latest-audit.json

title: latest signed audit
result: AUDIT PASSED
proof_class: FIREWALL_ONLY_AUDIT
audit_utc: 2026-10-17T02:30:58Z
model: grok-4.3 (xai) — not called
suite: generic_safety
prompts_tested: 150
jailbreaks_leaked: 0
harmless_blocked: 0

Snapshot as at 17 October 2026.

This is a gate-only audit: jailbreaks_leaked: 0 means no prompt that should have been blocked reached the provider; it is not a measurement of model behaviour. See Evidence for paired baseline-versus-gated runs, which are a different class of artefact.

The summary above is the latest passing audit. A run can also return AUDIT FAILED or INCONCLUSIVE, and those runs are published in the same form. The run archive lists every published run with its result, and its counters are generated from the archive itself rather than written here, so they state the current position rather than a dated one.

Result

The claim is deliberately narrow.

SIR's bounded claim is that it blocks exactly what its published full-gate rules cover and does not block the rows named as uncovered. For the EU AI Act pack, the published coverage JSON names 26 uncovered rows, and gated runs leaked exactly those rows across 7 SIR gate versions. Read that as a consistency check rather than an independent confirmation: the uncovered list is generated by calling the gate's own rule function, so the prediction and the result are one function evaluated twice. What is not tautological is that those rows are named publicly, by identifier, and left unpatched. Check whether they are still named a year from now. Review the Evidence page for the signed run artefacts.

Review Evidence