Proof is public infrastructure
Public infrastructure is the set of things everyone relies on and no one has to personally vouch for. You do not take the water company's word that the water is clean; there is a measurement, a standard, and a record someone independent can check. That arrangement is what lets a whole society trust a system built by parties it will never meet.
AI is being wired into public life without that arrangement. The prevailing model of trust is a vendor's assurance: we tested it, it is fine, take our word. For a technology now shaping determinations that affect citizens, a promise is not enough — not because vendors are dishonest, but because a promise cannot be checked, and unchecked trust does not scale. What is missing is the civic layer: evidence about a model that a third party can verify for themselves.
Trust that does not require taking anyone's word
The unit of that layer is a specific, unglamorous thing: a replayable, signed artifact. When a model is read, each claim about what its finetune did travels with a witness — a reproduction that an independent party can run to make the effect appear with ordinary tooling. Not a summary of a test someone else ran. The test itself, packaged to be re-run.
That distinction is the whole game. A claim is a sentence; a witness is a thing you can execute. One asks to be believed; the other asks to be checked. A record built from witnesses does not depend on trusting the party that produced it, which is exactly the property public infrastructure needs and vendor assurance lacks.
Who gets to check
Make proof re-runnable and three different parties inherit a capability they do not have today.
- Regulators can move from reviewing a company's account of its diligence to verifying the artifact directly — a shift from paperwork to evidence, the same one the compliance obligations are directionally reaching toward.
- Procurement can stop adjudicating competing promises and ask instead for the witness: show the finding, and let our team replay it. A buyer who can re-run the evidence is no longer choosing on faith — the move proof wins procurement walks through from the seller's side of the table.
- The press and the public gain a way to hold a claim to account after the fact. When a model is alleged to have done something, a replayable record is the difference between a he-said dispute and a checkable fact.
None of these parties has to trust the maker. Each can trust the reproduction. That is what it means for proof to be infrastructure rather than a courtesy.
The abstain discipline is a civic good
There is a second civic property, and it is easy to underrate. An honest instrument does not only prove what it can — it declares, out loud, what it cannot. Where an effect cannot be demonstrated, it abstains, and the abstention is recorded as plainly as any finding.
This matters to the public more than to any single buyer. A tool that invents findings to look thorough is worse than no tool, because it launders guesses into apparent facts and poisons the record everyone else is relying on. In a public setting, a false certainty is a liability with a long tail. An instrument that says "I could not prove this" is handing the regulator and the citizen something they can actually use: a map of the edges of what is known. Calibrated honesty is not a hedge here; it is a precondition for the evidence being worth anything at all.
The open record as a commons
The last piece is that the evidence is kept in the open, misses included. The published record shows what was caught and what was not; the trust page carries the same discipline. A record that surfaces only its wins is advertising. One that shows what was held and what slipped is the only kind a regulator, a journalist, or a rival can trust — because its credibility comes from the losses it was willing to print.
That openness is what turns a company's audit trail into something closer to a commons: a public reference for what these methods can and cannot do, maintained in daylight rather than asserted behind a login.
What this is, and what it isn't
The discipline is deliberately narrow, and the narrowness is the point. This produces evidence, not certification: it does not certify a model, perform a conformity assessment, or replace counsel or a notified body. It is not legal advice, and obligations should be confirmed with counsel. It calls no model provably clean and claims no power to catch every backdoor. The models it can open are open-weight and self-hosted; anything behind a closed API is out of reach. Only the Audit and its dossier are open today, with a free read; other surfaces are staged and not yet buyable.
Public infrastructure earns trust by being checkable, honest about its limits, and open to inspection. Applied to AI, that is not a product feature. It is the minimum a society should ask of a system it has decided to rely on.
