> How the Integrity Services suite measures: five-hop lineage traces for every number on a dashboard, and drills that prove a CI gate can actually fail. - Canonical: https://hadalinstruments.com/methodology/services/ --- Receipt page · Integrity Services # How the Integrity Services suite measures This is a receipt page. Dossier §8.2 fixes what one contains, and the five sections below are that anatomy in order: the versioned methodology, the pre-registrations, the proof corpus, the changelog, and the invitation to recompute any published number without asking me for anything. **Nothing has been measured yet.** Three of the five sections are therefore empty, and they are empty in a way you can inspect — the structure is printed, the slots are named, and each one says NOT YET PUBLISHED rather than showing you something plausible. Looking for what this family will contain instead? That is the [Integrity Services suite hub](https://hadalinstruments.com/suites/services/). Receipt anatomy · dossier §8.2 Integrity Services suite Receipt version v1.0 - **Instruments in scope** — 2 - **Metrics defined** — 8 - **Pre-registrations posted** — NOT YET PUBLISHED - **Artifacts published** — NOT YET PUBLISHED - **Measurements published** — NOT YET PUBLISHED - [Methodology, versioned](#methodology-versioned) Prose and formal definitions. Every metric carries its name, its definition, the estimator that computes it, its known failure modes, and what it does not establish. The page carries a version, and the version is printed on it. DEFINED · v1.0 - [Pre-registrations](#pre-registrations) Declarations made and dated before any measurement runs: decision thresholds, exclusion rules, completeness bars. Immutable once posted — an amendment appends beneath the original with its reason, and never overwrites it. NOT YET PUBLISHED - [Proof corpus](#proof-corpus) The published artifacts themselves: dataset descriptors, content hashes, download links, and the version tag of the code that generated each one. A result whose inputs are not downloadable is not a receipt. NOT YET PUBLISHED - [Changelog](#changelog) Append-only, dated, written by a person. What changed on this page, when, and why. A correction is a new entry naming the entry it corrects — entries are never edited away. 1 ENTRY - [Independent recomputation](#independent-recomputation) The exact numbered steps a stranger follows to re-derive a published number without asking me for anything. Where the recomputation disagrees, the disagreement is the finding. PROCEDURE STATED ## Methodology, versioned version v1.0 last changed 2026-08-01 8 metrics · 2 instruments The Integrity Services suite measures other people’s trust surfaces. One service traces every number on a trading UI through its full chain — component, loader, artifact, publisher, computation — with FABRICATED as a first-class finding status. The other proves that a CI gate can actually fail, by planting violations the gate must catch in self-reverting drills, and grades the evidence with a receipt taxonomy: BEHAVIORAL, STRUCTURAL, DECLARED-GAP. Both methods ran on me before they were offered to anyone. The lineage audit has been executed twice on my own cockpit and caught real fabrications — hardcoded statistics, random-number telemetry. The falsification drills found one of my own parity gates green over nothing. A dashboard nobody has traced and a gate that has only ever passed are the same object: an unexamined claim. Every metric below carries five fields, because four of them are the fields a methodology usually leaves out. **Definition** states what the quantity is, closely enough that a stranger could implement it. **Estimator** states how it is computed and which parameters must be fixed before the data is read. **Known failure modes** states where the estimator breaks — written now, while nothing depends on it, rather than conceded later under questioning.**Does not establish** states the claim the metric will not support, however natural the reading. The last field is the one that costs something to publish, which is why it is published. P20 ### [Dashboard Lineage Audit](https://hadalinstruments.com/instruments/dashboard-lineage-audit/) A service that traces every number on a trading UI through its full chain of custody — component, loader, artifact, publisher, computation — and names what it finds, with FABRICATED as a first-class finding status. #### Display-surface inventory - **Definition** — The complete enumeration of every number, gauge and status indicator on the audited interface. - **Estimator** — A full enumeration, never a sample — fabrications do not distribute themselves conveniently across a sample, which is the whole reason sampling is refused here. - **Known failure modes** — A surface that renders conditionally can hide figures from an enumeration taken in one state, so the states themselves are enumerated as part of the surface. - **Does not establish** — A complete inventory does not establish that the numbers are correct. It establishes what must be traced. #### Five-hop lineage trace - **Definition** — The chain behind each displayed figure, traced component to loader to artifact to publisher to computation. - **Estimator** — Each hop is resolved against the codebase at a recorded commit and against the artifact store. The trace terminates either at a real computation over real inputs, or at the hop where the chain breaks — and the break point is itself the finding. - **Known failure modes** — A chain crossing a third-party boundary may be untraceable past it. The boundary is reported as the terminus rather than used as grounds to close the trace optimistically. - **Does not establish** — A closed trace does not establish that the methodology behind the number is sound. A fully traced number can still come from a bad model — that is a different audit. #### Finding status - **Definition** — The status assigned to each traced number, in a taxonomy where FABRICATED — hardcoded, generated, or otherwise not produced by the computation it claims — is a first-class outcome. - **Estimator** — Status follows directly from the trace result under a fixed taxonomy. A number whose chain breaks is unverifiable and is never rounded up to verified because the rest of the panel checked out. - **Known failure modes** — A taxonomy can be softened under pressure, which is why FABRICATED is named in the deliverable itself rather than described gently in a summary. - **Does not establish** — A verified status does not establish that the value is useful, current, or well modelled. #### Ledger completeness - **Definition** — Whether the per-number ledger covers the enumerated inventory, so a reader can re-walk every chain independently. - **Estimator** — Ledger rows are reconciled against the inventory; any inventory row without a ledger row is itself a finding. - **Known failure modes** — Completeness is measured against the enumerated surface. A surface that changed during the engagement is re-enumerated rather than assumed stable. - **Does not establish** — A complete ledger does not issue a clean bill of health. The dashboard is as honest as its worst-traced number. **Standing limit.** The audit establishes what a number’s lineage is, not whether the methodology behind it is good. Findings from client engagements stay private to the client. [Full instrument page](https://hadalinstruments.com/instruments/dashboard-lineage-audit/) P21 ### [Gate Falsification Kit](https://hadalinstruments.com/instruments/gate-falsification-kit/) A service and toolkit that proves a CI gate can actually fail: violations the gate must catch are planted in self-reverting drills, and the evidence is graded with a receipt taxonomy. #### Falsification drill outcome - **Definition** — Whether a gate failed when a violation of the class it exists to catch was deliberately planted against it. - **Estimator** — A real defect of the guarded class is planted and the gate is run. The drill is self-reverting: the planted violation is removed whether or not it was caught, so the exercise leaves no residue. - **Known failure modes** — A drill exercises one violation, not the class. A gate that catches the planted defect may still miss a neighbouring one, so the receipt states exactly what was planted. - **Does not establish** — A caught drill does not establish that the gate catches every violation of its class. #### Receipt classification - **Definition** — The grade assigned to each gate: BEHAVIORAL where it was drilled and observably caught a planted violation, STRUCTURAL where its failure path was verified by inspection but not exercised, DECLARED-GAP where it could be neither drilled nor verified. - **Estimator** — Classification follows directly from what was observed. A gate that resists falsification is DECLARED-GAP even where the client is confident it works — confidence is what I had in my own parity gate. - **Known failure modes** — STRUCTURAL depends on an inspector reading a mechanism correctly, which is weaker evidence than a drill. It is labelled as weaker rather than blended into one pass rate. - **Does not establish** — A BEHAVIORAL receipt does not establish pipeline safety. It establishes one gate’s demonstrated ability to fail. #### Gate coverage of the pipeline - **Definition** — How many of the pipeline’s gates were drilled, how many inspected, and how many neither. - **Estimator** — A count per classification against an enumerated gate set, with the enumeration published so the denominator can be argued with. - **Known failure modes** — A gate absent from the enumeration is absent from the coverage figure. Enumeration is therefore done from the pipeline definition rather than from anyone’s memory of it. - **Does not establish** — High coverage does not establish that the pipeline guards the right invariants. #### Receipt decay - **Definition** — How long ago each gate’s receipt was earned — since a gate proven able to fail last quarter can be quietly broken by this quarter’s refactor. - **Estimator** — Each receipt carries the commit it was earned against; decay is the distance between that commit and the current one. - **Known failure modes** — Commit distance is a proxy for risk, not a measure of it. One small refactor can break a gate that a thousand unrelated commits would not have touched. - **Does not establish** — A recent receipt does not establish that a gate is currently working. Only a re-run does. **Standing limit.** The kit proves a gate can fail; it does not prove the gate catches everything. A gate that has only ever passed proves nothing — and a drill that ran once, long ago, decays toward the same state. [Full instrument page](https://hadalinstruments.com/instruments/gate-falsification-kit/) Versioning rule: this page is v1.0. A change to any definition, estimator, failure mode or limit above increments the version and appends an entry to the changelog in §04 naming what changed. Definitions are never edited silently, because a definition that can move after a result is published is not a definition — it is a degree of freedom. ## Pre-registrations A [pre-registration](https://hadalinstruments.com/glossary/pre-registration/) is a declaration made and dated *before* the measurement runs: the thresholds that will decide, the rules that will exclude, and the sample bar below which the honest null publishes instead of a number. Its entire value comes from its ordering. Posted before the answer is known it is a constraint; posted afterwards it is a description of a result, which is a different and much cheaper object wearing the same clothes. Pre-registration record · Integrity Services NOT YET PUBLISHED No pre-registration has been posted for the Integrity Services suite. Not one that is pending review, not one that is drafted and unhashed — none. This block is the structure a registration will occupy, printed empty on purpose, because the alternative is a page that describes a discipline while quietly implying it has already been exercised. A pre-registration is worth exactly the provability of its ordering. It has to be posted, dated and content-hashed while the answer is still unknown; posted afterwards it is a description of a result, which is a different and much cheaper object. So the first registration cannot be backdated into this slot, and the slot stays visibly empty until one is posted in the only way that counts. The field schema of a pre-registration record for the Integrity Services suite: each field, what it will hold, and its current value. Every value reads NOT YET PUBLISHED because no registration exists. Field | What it will hold | Value | `registration_ref` | The permanent identifier this registration is cited by. | NOT YET PUBLISHED | `scope` | The instruments and the measurement window the declaration binds. | NOT YET PUBLISHED | `declared_utc` | When the declaration was posted — necessarily before any data was touched. | NOT YET PUBLISHED | `first_data_utc` | When collection began. This must fall after the line above, and the ordering is the evidence. | NOT YET PUBLISHED | `thresholds` | Every decision threshold, fixed while the answer was still unknown. | NOT YET PUBLISHED | `exclusion_rules` | What will be dropped from the sample, and on what stated grounds. | NOT YET PUBLISHED | `completeness_bar` | The minimum sample below which the honest null publishes instead of a number. | NOT YET PUBLISHED | `document_sha256` | The content hash of the registered document itself. Any later edit changes it, visibly. | NOT YET PUBLISHED | `amendments` | Appended corrections, each with its own date and reason. The original text stays. | NOT YET PUBLISHED | **What a Integrity Services registration must fix in advance.** The lists below are *classes* of declaration, not declarations. They name the decisions that have to be made before the data is touched, because each one is a decision that could otherwise be made afterwards, in the direction that flatters the result. No value below has been registered. Thresholds - What closes a lineage hop, so a trace either terminates at a computation or names the hop that broke. - What counts as a planted violation of a gate class, so a drill tests the class it claims to test. - The evidence required for each receipt grade: BEHAVIORAL, STRUCTURAL, DECLARED-GAP. Exclusion rules - The enumeration rule that produces the denominator, including conditionally rendered figures and dormant gates. - How a chain crossing a third-party boundary is reported, given it cannot be traced past it. - What is done with a gate that resists falsification. The standing answer is DECLARED-GAP, never a pass. Completeness bars - The reconciliation requirement: every enumerated figure or gate has a ledger row, or the ledger is incomplete and says so. - The minimum drill evidence before a gate is graded BEHAVIORAL rather than STRUCTURAL. - The commit distance beyond which a receipt is reported as decayed and must be re-earned. **Immutability, stated before it is tested.** Once a registration is posted it is not edited. If it is wrong, an amendment is appended beneath it carrying its own date and the reason for the change, and the original text stays where it is, readable, above the correction. A registration that quietly improved after the data arrived would be indistinguishable from one that was right all along — which is precisely why the append rule is written here, now, while there is nothing yet to be tempted by. Amendment rule, stated in advance: a posted registration is never edited. An amendment is appended beneath the original carrying its own date and its reason, and the original text stays above it, readable. This page will show both. ## Proof corpus The corpus is the set of artifacts a published measurement ships with — not a description of them, the artifacts themselves, downloadable, each with the digest that proves you received the bytes I measured and the code tag that produced them. A result whose inputs cannot be downloaded is not a receipt; it is an assertion with better typography. **The corpus for this suite is empty.** Every row below is a slot, and every slot is NOT YET PUBLISHED. The table is printed anyway, because a reader should be able to see the exact shape of what will arrive — and because a page that described a corpus without showing how empty it currently is would be making the claim it exists to refuse. Five columns: artifact, contents, content hash, code tag, download. Scroll sideways if they do not all fit. Proof corpus for the Integrity Services suite: the seven artifact classes a published receipt carries, what each will contain, and its current state. Every content hash, code tag and download reads NOT YET PUBLISHED, because no artifact from this suite's proof corpus has been published yet. Artifact | What it will contain | Content hash | Code tag | Download | Registered methodology document | The versioned document these definitions are taken from, in the exact form it was registered — estimators, parameters, and the limits stated above. | SHA-256 NOT YET PUBLISHED | NOT YET PUBLISHED | NOT YET PUBLISHED | Pre-registration record | The dated declaration: thresholds, exclusion rules and completeness bars, plus any amendments appended beneath the original with their reasons. | SHA-256 NOT YET PUBLISHED | NOT YET PUBLISHED | NOT YET PUBLISHED | Engagement inputs | The enumerated display surface or gate set, the codebase commit each trace or drill was run against, and the drill harness at its tag. | SHA-256 NOT YET PUBLISHED | NOT YET PUBLISHED | NOT YET PUBLISHED | Result set | Per-metric results with intervals and effective sample sizes, and the honest nulls wherever a sample could not support a metric. | SHA-256 NOT YET PUBLISHED | NOT YET PUBLISHED | NOT YET PUBLISHED | Can-fail proof transcript | For every test in the battery: the planted defect, the refusal that was expected, and the outcome that was observed. | SHA-256 NOT YET PUBLISHED | NOT YET PUBLISHED | NOT YET PUBLISHED | Kill-ledger extract | Hypotheses registered against this suite and killed by the data, each with the run that killed it. Published with the same visibility as a registration. | SHA-256 NOT YET PUBLISHED | NOT YET PUBLISHED | NOT YET PUBLISHED | Generation code | The tagged commit that produced the result set, with its build receipt. Named here because a result whose code version is unstated cannot be re-run. | SHA-256 NOT YET PUBLISHED | NOT YET PUBLISHED | NOT YET PUBLISHED | ### Corpus state, per instrument Per instrument, so that the emptiness cannot hide behind a suite-level summary. - [Dashboard Lineage Audit](https://hadalinstruments.com/instruments/dashboard-lineage-audit/) 4 metrics defined NOT YET PUBLISHED - [Gate Falsification Kit](https://hadalinstruments.com/instruments/gate-falsification-kit/) 4 metrics defined NOT YET PUBLISHED ## Changelog Append-only, dated, written by a person. It records changes to *this page* — it is not a measurement log, and it will not become one. A correction is a new entry that names the entry it corrects; nothing here is ever edited away, because a changelog you can rewrite is a marketing surface with a monospace font. - 2026-08-01 v1.0 Receipt page established for the Integrity Services suite, carrying all five parts of the §8.2 anatomy: the versioned methodology with a formal definition, estimator, failure modes and non-claim for each of the 8 metrics its 2 instruments measure; the pre-registration structure with no registration in it; the proof-corpus table with no artifact in it; this changelog; and the independent-recomputation procedure. Supersedes the earlier per-suite methodology summary at this URL, which carried the battery outline without the receipt anatomy. No measurement, pre-registration, artifact or hash accompanies this version — every receipt slot below is empty as a matter of fact, not of omission. ## Independent recomputation Independent recomputation is what makes the rest of the page checkable rather than merely well-written. It is the exact sequence a stranger follows to re-derive a published number from this suite using only artifacts I published — no account, no request, no conversation with me at any point. **Today the procedure terminates at step 1**, because no measurement from the Integrity Services suite has been published and there is no receipt to open. The steps are written now, in the specific form they will take for this suite, precisely so that they exist before the first result does and cannot afterwards be shaped to fit one. - Open the receipt and take its four identifiers. Every published measurement links a receipt carrying four: the registration reference, the methodology-document digest, the input-manifest digest, and the generation-code tag. If any one is missing, stop — the result is not recomputable and should not be treated as though it were, including by me. - Verify the methodology document against its digest. Download it, hash it, compare. A mismatch means the method you are about to apply is not the method that was registered, and everything after this step would be measuring a different thing. - Check the ordering before you check anything else. The registration timestamp must precede the first-data timestamp on the manifest. If it does not, the registration is a description of a result rather than a constraint on one, and no statistic downstream can repair that. - Take the published ledger and verify its digest against the receipt. The per-number lineage ledger or the per-gate receipt ledger. The ledger is the deliverable; a summary judgement without it is not a receipt and was never offered as one. - Apply the registered rules yourself. The enumeration rule that produced the denominator, the status taxonomy, and the classification rule that assigns each grade. A denominator assembled after the findings is the failure this step exists to prevent. - Re-walk one row end to end. For a lineage row, resolve each of the five hops — component, loader, artifact, publisher, computation — against the codebase at the recorded commit. For a gate row, re-run the recorded drill from the harness at its tag. - Compare your outcome against the recorded status. A row you cannot close is unverifiable, and unverifiable is a status in the taxonomy. It is never rounded up to verified because the rest of the ledger checked out. - Run the can-fail proof. Plant a violation of a class a gate claims to catch, and confirm the gate fails. A gate that has only ever passed proves nothing — that observation is the founding case of this entire suite. - If your number differs, the difference is the finding. Send it with your inputs and the version you ran. A confirmed discrepancy publishes as a correction appended beside the original — and the original stays exactly where it is, unedited, because the error is the part of the record that proves the discipline is real. The point of publishing this before there is anything to check: a recomputation procedure written after a result is a procedure written by someone who already knows which steps would be inconvenient. [Integrity Services instruments](https://hadalinstruments.com/suites/services/)[All seven receipt pages](https://hadalinstruments.com/methodology/) ## Cite This Article APA BibTeX HTML Hadal Instruments. (2026). Integrity Services — method and receipts. Hadal Methodology. https://hadalinstruments.com/methodology/services/ Version 9c788b2, 2026-09-14. @misc{hadal_2026_services, author = {Hadal Instruments}, title = {Integrity Services — method and receipts}, year = {2026}, url = {https://hadalinstruments.com/methodology/services/}, howpublished = {Hadal Methodology}, version = {9c788b2}, note = {Pre-launch publication; version dated 2026-09-14} } Source: Hadal Instruments, Integrity Services — method and receipts. Original Research Copy Citation **Version 9c788b2** identifies the commit that last changed this page in Hadal's content repository. That repository is not public, so the identifier does not resolve externally — it is published so a citation pins one specific state rather than a moving page. To obtain the exact version cited, use the [press and research route](https://hadalinstruments.com/press/). This page is generated from a shared template and this suite's instrument entries, so its version is the most recent change across that set — it can move when a related instrument changes even if the text here does not. --- ## Raw artifact — NOT PUBLISHED FOR THIS PAGE No downloadable artifact ships with this page. Eight published measurements do, each content-hashed so a reader can verify the figures independently. Where a measurement is published here without one, that is a gap rather than a policy, and it is stated rather than left to be noticed. [Measurements that ship their data](https://hadalinstruments.com/research/)