The deterministic envelope is the first compliance artifact in the field that resolves to the same number across two independent reviewers. Auditability has lived inside documentation discipline: technical files, log archives, attestations, severity scores, questionnaire responses. The engineering surface produced by KAIROS makes auditability a measurement discipline, with the same epistemic standing as a thermometer reading or a load cell.
The Instrument Problem
Compliance evidence is subjective at the seam where two reviewers must agree. Two notified bodies reading the same Annex IV technical documentation can reach different conclusions about the adequacy of a risk management system. Two CSIRT analysts replaying the same kill chain can produce different 72-hour incident reports. Two ICT auditors reviewing the same DORA register can score the same third-party arrangement at different risk tiers.
The disagreement is structural. Each artifact is a description authored by a human, scored by a human, and interpreted by a human. The instrument that produces the evidence is itself part of the evidence chain, and instruments authored in prose drift between reviewers. The compliance industry has absorbed this drift by adding more reviewers, more reviews, and more documentation. The geometry of the problem is unchanged.
A measurement carries different epistemic weight. A load cell reading of 2.4 kN does not require a panel of reviewers. A bridge stress test does not produce subjective evidence. The reading is the artifact, and the artifact is reproducible by anyone with access to the same instrument.
What Measurable Means Here
KAIROS produces a CyberSignalEnvelope per defended zone, per tick. The envelope contains a stability score, a gate verdict, an evidence trail, and a Kairos margin. The numbers are computed by the deployed Rust engine against a signed calibration artifact and a signed deployment policy. Identical inputs produce identical outputs to a determinism tolerance of ε = 10⁻⁶.
The provenance is anchored cryptographically. Each envelope is hash-bound to six artifacts:
- A SHA-256 over the calibration document, computed at parse time.
- The OCSF 1.x release tag and commit hash, pinned.
- A SHA-256 over the OCSF aggregation map.
- A SHA-256 over the canonical-JSON event budgets.
- A SHA-256 over the per-zone snapshot NDJSON, sorted.
- A whole-tree fingerprint restricted to the listed zones.
Two independent runs on the reference seed produce byte-identical reports. A determinism test in the orchestrator suite enforces the property; a manual cmp between consecutive runs confirms it. The reference run currently covers 5,184,000 snapshots across 60 zones across a 60-day window. Reproducibility lives in CI.
Confidence as a Calibration Property
Calibration anchors carry their own provenance. The 144 reference cells used to drive the engine’s distributions each carry a confidence tag: strong where two or more independent public references converge, moderate where one good reference exists, weak where only analogous evidence is available, and synthesised where no citation exists and a stated reasoning chain is recorded.
Every reported rate carries a Wilson 95% confidence interval. The interval is computed from the actual sample. The methodological lineage is the Engelen et al. 2021 critique of CICIDS-2017: most cyber benchmarks suppress per-feature provenance. KAIROS surfaces it.
An auditor reading a KAIROS envelope can resolve the confidence tag of the reference cell that drove a given verdict. A regulator can require a re-run with stricter anchors. The instrument is transparent about its own calibration.
The Kairos Margin
The deployed state gate is gate_breached ⇔ gamma < gamma_floor. The envelope emits a normalized stability scalar: (gamma − gamma_floor) / gamma_floor. The Kairos margin extends the surface with a signed buffer-units residual: K_gate = gamma − gamma_floor.
The signed scalar carries strict gate-equivalence:
gate_breached ⇔ K_gate < 0
The number answers the operational questions a binary verdict cannot. The headroom the system held against the policy floor. The clustering of windows near the threshold. The policy floor that would have changed the verdict. The action classes that pushed the residual toward the boundary.
Three display regimes classify the margin for operator presentation:
Plastic:K_gate > +ε. Above the floor with headroom.Kairos:|K_gate| ≤ ε. At the threshold.Locked:K_gate < −ε. Past the floor with margin.
The display tolerance ε is policy-configurable and operator-facing. Control decisions read gateBreached. The display regime is presentation. The two are deliberately distinct fields in the envelope schema, and the strict gate state is the load-bearing one.
What an Auditor Receives
The artifact a notified body, a CSIRT, or an ICT regulator receives from a KAIROS deployment is a reproducible reading. Two reviewers loading the same envelope, the same calibration artifact, and the same deployment policy compute the same gate verdict. The same K_gate. The same display regime. The same hash chain.
Disagreement collapses to a question of inputs, and the inputs are signed. The compliance question moves from “do the reviewers agree” to “do the inputs justify the verdict.” The first depends on judgment. The second depends on data.
The regulatory implications differ by regime. The EU AI Act Article 11 technical documentation acquires a measurement layer the conformity assessment can replay. The NIS2 Article 23 incident cascade acquires reconstruction discipline a CSIRT can validate against the operator’s original report. The DORA major incident report acquires the kind of evidence the 2026 supervisory shift toward proof over paperwork is asking for.
These three regimes are the subject of the next three articles in this series.
Limits Worth Stating
The deterministic envelope is an instrument reading. Engineering judgment, regulatory interpretation, and operator review remain necessary. The envelope asserts that the deployed control, given the supplied calibration, produced a specific structural margin against a specific policy floor. The envelope does not assert that the control was correctly designed.
The calibration itself is open to challenge. Roughly 46 percent of the v1 cells are synthesised. No public citation exists for those cells, only a stated reasoning chain. The concentration sits in the near-miss profiles and in exploit-sophistication mappings where no public technique-to-[0,1] mapping currently exists. Replication is invited. Failed replications and drift findings on the calibration anchors are themselves citable artifacts.
What the envelope eliminates is reviewer drift on identical inputs. Reviewer drift on the interpretation of the inputs remains. The instrument moves the disagreement to the place engineering can address it.
Direct Next Steps
Read the calibration debrief that grounds the cyber adapter’s numbers: Calibrating the Cybersecurity Adapter.
Read the formal validation that backs the gate semantics: CI-Gated Proof of Correctness.
The three regulatory articles in this series follow: structural conformance under the EU AI Act, incident reconstruction under NIS2, and the DORA evidence standard.