About SDL
The emphasis is on claims stated narrowly enough to be wrong, artefacts a reader can inspect, and verification that happens outside the system that produced the thing being verified. That principle is the whole of it, and it is what the two published artefacts have in common: one is a control, the other is a record format, and neither asks to be taken on trust.
Approach
Artefacts are built to be checked outside the system that generated them, by someone who has no reason to take the producer's word for it. Signed records, hash-chained logs, retained inputs, and a verifier that reports what it could not establish rather than rounding it up to a pass.
The work applies where an answer is a function of its inputs and its policy rather than of a model: an authorisation check, a tool-call gate, a rate limiter. In SIR's case that control point sits before a model is called. The record format does not care what the procedure decides, only that it is deterministic.
Implementation and proof surfaces are published for inspection, specifications written to be implemented from, and run artefacts anyone can fetch and check. SIR's source is under the MIT licence; the record format's terms are stated in its own repository.
What SDL works on
The control
Rule-driven control paths that move governance to the request boundary rather than leaving it to provider-side probability. Each run leaves a signed certificate bound to a hash-chained ledger, and the rows the rules do not cover are published by identifier.
The record
A specification for the record any deterministic procedure leaves behind, with a verifier that reports what it could not establish rather than rounding it up to a pass. It applies wherever an answer is a function of its inputs and its policy, and it does not need SIR.
How they meet
A gate is a deterministic procedure, so SIR is one of the things a decision record can be written about. The dependency runs one way only: the format is useful without the gate, and nothing in it assumes a gate produced the rows.
Why this matters
Training-time alignment and post-hoc monitoring do not by themselves create a deterministic boundary in front of inference, and neither produces a record of a decision that someone outside the system can check. SIR addresses the first gap. Decision Record addresses the second, for any deterministic procedure and not only for a gate.
Deterministic controls and signed artefacts can be relevant to assurance and underwriting conversations because they create a clearer review surface than informal safety language alone.
The cryptographic provenance mechanisms in SIR are the subject of a pending United States patent application, 19/820,502, filed 25 September 2026, with priority from a provisional filing in 2025. A United States application is not open to public inspection until it publishes, so this number cannot be independently verified before then.
SIR's source is published under the MIT licence and this does not change that. The MIT licence grants rights in the source code; it does not grant a licence under any patent. See PATENTS.md or contact info@structuraldesignlabs.com.