The register is one person's reading. That is the weakest thing about it, and the fix is not for that person to read more carefully. It is for the instrument to be something other people run.

So it is not reserved. Twenty requirements, a harness that refuses an assessment nobody can check, and a method written down. The rubric is CC BY 4.0, the tooling is MIT, and commercial use is expected rather than tolerated. There is no fee, no licence to sign, no certification body, no partner tier and nothing to buy.

If you audit AI systems, this is billable work

You already have clients asking what their agent stack records, what they will have to show under Article 12, and whether a supplier's claims about human oversight survive contact with the source. Those questions take a repeatable instrument, and building one is months.

Take this one. Run it against a client's supplier, charge them your rate, and keep the deliverable. Nothing here asks you to publish anything, credit anybody beyond the licence, or tell this project it happened.

git clone https://github.com/troybrandonc-bit/machine-testimony
python3 census/run.py                    # the current table
python3 census/run.py --for langgraph    # one subject, in prose
python3 census/run.py --check            # do these assessments hold up
cp census/TEMPLATE.json census/subjects/their-system.json

The template carries all twenty questions with the bar for present beside each one, so the work is reading source and writing down what you found.

The client's own records, before any of that

Reading a supplier's source is the right way to assess a product and the wrong way to open an engagement. It takes an engineer and a day, and the question a client actually arrives with is about their own records rather than their vendor's repository. So ask the four questions of a file of those instead.

python3 spec/testimony_convert.py their-logs.jsonl --report

  ANSWERABLE       who approved a consequential action
                   from 'approval.approver'
  NOT IN THE FILE  and whether that was a person rather than the agent itself
                   nothing here looks like a field saying where that identity was resolved from
  ANSWERABLE       what the system tried and did not do
                   from 'allowed'
  NOT IN THE FILE  whether the file has changed since it was written
                   nothing here looks like a digest, chain or signature over the rows

2 of 4 are not in these rows.

Or without a terminal at all: drop the file onto a page. It runs in the browser, nothing is uploaded and nothing is stored, and it reaches the same finding as the command below, which the test suite enforces by running both over the same rows.

One command, no install, and nothing leaves the machine it runs on. The finding is reproducible by the client, by their supplier and by anyone who disputes it, which is the property that makes it worth putting in front of somebody.

It reports the shape of the rows it was given and refuses to conclude anything about the system that wrote them, because a system may record an approver somewhere those rows have never been. That limit is printed with every finding rather than left for a reader to infer. A report that overstated its own scope would be worth nothing to the person who has to stand behind it, and this is written for that person.

What it does establish is narrower and is usually the question anyway: whether the record somebody is handed after an incident answers these, or whether the answer has to come from somebody's memory.

If you are on the register and you have fixed it

Ask, and the system is read again at whatever commit you name. There is no fee, no form, and no conditions. Open an issue or write to the address below, say which commit, and the reading happens against the same twenty requirements everybody else was read against.

The earlier assessment is not deleted and not edited. It moves to census/subjects/prior/ exactly as it was published, stays digested by the manifest, and the new file names it. Both dates stay readable. That is the rule the whole thing rests on: a verdict is about a named tree, so a later fix does not make the earlier reading false, and a re-reading produces a new assessment beside the old one rather than a quiet correction.

It also means the two can be compared, which is the point. A reader can see a system that moved, and can see that the second reading was not kinder than the first.

What is not on offer. No sight of the verdict before it is published, no right of reply inside the assessment, and no agreement not to publish a worse result than last time. If the re-reading finds fewer requirements met, that is what goes up. A re-assessment nobody could fail would not be worth requesting.

The mechanics are one script, so that a re-reading costs the same reading the first one did rather than a rename:

python3 census/reassess.py their-system --commit <40 hex>     --version "1.4.0" --on 2026-10-01

Every verdict in the reopened file is written over with pending and the old one kept beside it in was. The checker refuses to publish a file that still carries one, so each requirement has to be settled by opening the source again.

Your assessment, as a record

The instrument asks ten systems whether they can say what they concluded, on what evidence, and who concluded it. Until now it could not answer those questions about its own conclusions. An assessor ran the rubric, formed twenty verdicts and handed over a document, and nothing bound that document to the commit it was read at, the rubric version it was scored against, or the person who scored it.

python3 census/testify.py their-system > assessment.jsonl

Every verdict becomes a belief. Every citation becomes evidence that belief names, including the search that found nothing, which is the only honest way to evidence an absence. The subject's commit and a digest of the rubric are in the record rather than in a covering email, so both sides of the comparison are pinned. It reaches TR-4 and declares that it does not act, because an assessment reads and concludes and gates nothing.

Stamp the digest with a Time Stamp Authority and pass --anchor, and your client can hand the result to a regulator, an insurer or the other side, who can check it without trusting you. That is the property that makes an assessment worth something to somebody who was not there, and no report on letterhead has it.

One thing does not map, and the tool says so rather than hiding it. The rubric has five verdicts and the format has four belief states. Present, absent and undetermined land exactly. Not applicable is not a belief about the system and is listed in the scope entry instead. partial has no honest home: it is not believed true, not believed false, and not unknown, since the assessor knows precisely what they found. It is emitted as unknown with the verdict kept verbatim beside it. That is a finding about the format, recorded rather than resolved by picking whichever state flattered the result.

The rule the whole thing rests on

Every verdict cites evidence, including a verdict of absence. Saying a system does not record something, without saying where you looked, is an accusation wearing a measurement's clothes. An absent or undetermined verdict must carry evidence of kind searched, and the harness rejects the file if it does not.

That is the difference between this and an opinion piece about other people's software, and it is the reason an assessment run with it can be handed to the party it is about.

The five verdicts

• present and partial, each with a stated bar in the rubric rather than left to judgement.
• absent, which cites where you looked.
• undetermined, for when you genuinely cannot see. It exists because one system's approval record lives in a server that is not in the repository, and the choice was otherwise between calling a capability absent without looking and calling it present without looking. It does not clear a level, and it is a better answer than a guess.
• not_applicable, because a system that takes no actions is not marked down for having no approval gate.

Pin the commit

A full 40-character object id, not an abbreviation. An assessment of "the latest version" is false as soon as the software moves, and an abbreviated id leaves room to argue about which tree was read. The harness refuses both.

What to do with the result

Three options, and no obligation.

1. Keep it. A client deliverable that never leaves their building is a perfectly good use of this.
2. Publish it yourself. CC BY asks for attribution to the rubric, not for permission. The assessment is yours.
3. Put it on the register. A pull request against census/subjects/. It has to pass run.py --check, the same bar every row already there had to clear, and assessed_by carries your name, which the register shows.

Disagreeing with a row, including mine

A second assessor contradicting an existing verdict is more useful here than a new subject. Point at the code: open a pull request naming the requirement and where to look. If it lands, the file changes, the register changes, and the date on the row changes.

Arguing with me is not the remedy and does not work. This register already carries corrections that arrived because somebody said I had read something wrong.

Conflicts of interest

If you assess something you built, sell, or are paid by, say so in the file, and expect the row to be read as carrying no weight. That is what this project does with its own row.

If a client pays you to assess their own system, a reader is right to discount it, for the same reason a credit rating paid for by the issuer is worth less than one paid for by the buyer. The assessments worth most are the ones commissioned by whoever has to rely on the answer.

What this is not

Not a certification, an accreditation, or a mark. Nobody is entitled to call themselves conformant because a file says so, and no system is non-compliant with any law because a row says absent. The EU AI Act's obligations run through Articles 12, 13 and 14, and presumption of conformity comes from the harmonised standards, not from this.

What it gives you is a repeatable reading of what a system actually records, with every answer traceable to a line of somebody's source. That is worth money to whoever has to rely on it, which is why you should feel free to charge them for it.