The centerpiece · live engine

Risk Underwriting Workbench

Toggle any signal and the file is re-underwritten from scratch. The delta is checked against an independent spec recompute that shares no code with the engine - a check that can fail, and does fail against the broken engine variants in the harness below. Under a capped inspection the delta is deliberately not the toggled item's points: the cap backfills.

✓ ledger reconcileshash f6ecbf9a · 0.119ms

Driver

Driver B-2207 · Solid record with a cluster of recent moving violations and one out-of-adjustment brake. Score lands in the manual-review band; no hard gate.

Signal sources

CDLIS

License validity & status

MVR

State violations

PSP

5-yr crash / 3-yr inspection

Clearinghouse

Drug & alcohol status

Severity model

The 1-10 severity table with a +2 out-of-service uplift - the model in force before the Dec 1, 2025 overhaul.

DENY

peer band ~75-95th pct (illustrative)index mapping: synthetic anchor

Decision rationale

Composite Risk Index 100 exceeds the deny threshold (>55).

Score identity (reconstructable)

Σ line-item points = 74
index = round(74 ÷ 6 × 10) = 100

÷6 = fixed synthetic exposure proxy (demo stability). Not an official FMCSA percentile.

Reason ledger - every point traced to a violation

7 line items

Violation	Source	BASIC	Sev	×TW	Pts
	MVR	Unsafe Driving	5	3	15
	MVR	Unsafe Driving	5	3	15
	MVR	Unsafe Driving	5	2	10
	MVR	Unsafe Driving	5	1	5
	PSP	Unsafe Driving	5	3	15
	PSP	Vehicle Maint	6*	2	12
	PSP	Crash Indicator	2	1	2
Total risk points (Σ)					74

Engine checks (falsifiable)✓ Σ line items = Σ BASICs = total✓ Identical input → identical output✓ Independent recompute = engine total✓ Counterfactual re-runs = independent prediction (7 re-runs)✓ Removing a violation never raises the total✓ Per-inspection·BASIC severity sum = min(Σ, 30), integer worst-first✓ Events older than 24 months score 0✓ Pre-cap severity = catalog base (+2 if OOS, legacy)

Prove it can fail · property-test harness

seeded fuzzing · runs in your browser · no network

A check that cannot fail proves nothing - v1 of this demo shipped exactly that mistake, and an external audit called it out. This harness throws 300 seeded-random configurations (driver × severity model × signal toggles × disabled line items) at the engine and verifies every result against an independent spec recompute that shares no aggregation code with the engine. Then run it against the deliberately broken variants - including the actual proportional-cap bug v1 shipped - and watch the named check fail with a concrete counterexample.

Engine under test

seed 20260704 - same seed, same trials, same result

Pick an engine and run the trials. Production should survive; the broken variants should not.