The Government Wants to Read the Model First
- NTP claim scan: All e-type claims attributed with source and confidence level per verification gate summary. Two mandatory Existence-Predication Firewall statements present. All V.E.R.A. Logic Engine architectural arguments classified n-type (derived from NTP specification, Wessel 1992). One Likely-confidence stat (Vectara 3.3% hallucination floor) carried from Ep18 with registered confidence level.
- Defence angle paragraph (Section 27): present, 147 words, opposition test passed, reasonable observer test passed. Series defence angle cut: allied versus adversary AI governance frameworks (the EO creates a verification requirement within one jurisdiction; the orbital jurisdiction gap and the question of what verification standard applies to lethal autonomous systems operating beyond that jurisdiction extends the framework into LAWS accountability territory). Per-series calibration applied: MODERATE BRIDGING REQUIRED. Signpost language used: "The implication on the governance side is worth naming directly."
[Navigation links not applicable for this series]
On 2 June 2026, the United States government issued an executive order requiring a 30-day voluntary pre-release review of frontier AI models before public deployment. The order was triggered in part by concerns about Claude Mythos, Anthropic's classified-capability frontier model, which led the government to conclude that frontier AI advancement had become a national security event, not merely a product launch. Seven days later, Anthropic filed an S-1 for a valuation exceeding US$965 billion. The model that triggered the review and the company that built it are now the same object in two different regulatory contexts simultaneously.
This is the fifth structural validation of the Te Pono V.E.R.A. Logic Engine's external verification architecture across the Coding Arc and Arc 3. Governments have arrived independently at the same architectural principle that Arc 3 has been building from first principles: trust flows from an external referent, not from the system's self-assessment.
Arc 3 Has Been Building to This Point
Episode 18 argued that frontier AI reasoning is going underground. Latent-space compression removes the internal reasoning trace that inspection-based verification depends on. Episode 19 confirmed the structural problem from a different direction: reinforcement learning training for stronger reasoning increases tool-hallucination rates proportionally to task performance gains. The models that reason hardest fabricate most confidently.
Two episodes, two structural problems, one architectural conclusion. If you cannot see inside the model, and if the model's self-assessment is corrupted by its own training objective, the only verification architecture that can still function is one that operates on outputs, not on internal state.
The US Executive Order (EO) of 2 June 2026 confirms this conclusion from the policymaker's direction. Both the internal-opacity problem (Arc 3, Episode 18) and the RL-corruption problem (Arc 3, Episode 19) lead to the same place: external output-level verification is the architecture that survives when model internals cannot be trusted or accessed.
This is the fifth structural validation of the V.E.R.A. Logic Engine's external verification architecture across the Coding Arc and Arc 3:
| Ep | Finding | Validation | Source |
|---|---|---|---|
| EP15 | KAIROS external referent architecture | "The harness cannot verify itself": external architecture confirmed | KAIROS capability framework |
| EP16 | CopyFail CVE-2026-31431 | AI discovery cost collapsed; verification cost unchanged: external referent still necessary | CVE disclosure (Confirmed) |
| EP17 | Stenberg/Mythos/curl assessment | 80% rejection rate: external referent confirmed at practitioner level | curl project (Confirmed) |
| EP18 | SInternal Framework (arXiv 2605.08930v1) | Latent-space opacity removes internal trace: output-level architecture unaffected | arXiv preprint (Confirmed) |
| EP19 | SimpleToolHalluBench (arXiv 2510.22977) | RL training degrades tool reliability: self-assessment corrupted by training objective | arXiv paper (Confirmed) |
Table 1: Five structural validations of the V.E.R.A. Logic Engine's external verification architecture across the Coding Arc and Arc 3. Each confirms from a different direction that external referents, not internal self-assessment, are the appropriate trust mechanism.
The Government Built a Layer. Here Are All Three.
The EO's 30-day pre-release review is one layer of external verification. It is not the only one, and it is not sufficient on its own. To understand where each layer operates and what each layer cannot substitute for, the architecture needs to be stated precisely.
The three layers are distinct in scope, timing, and mechanism. They are also complementary: each covers a gap the other two cannot fill.
| Layer | Mechanism | Timing | What it cannot do |
|---|---|---|---|
| Model layer: US EO 30-day review | Government assessors review model capability claims before deployment | Pre-deployment, one-time | Cannot prevent post-deployment claim fabrication in individual outputs |
| Identity layer: FIDO2 for agents | Hardware-bound attestation verifies agent identity claim before action | Pre-action, per-transaction | Cannot verify the factual content of claims the agent makes |
| Output layer: V.E.R.A. Logic Engine | NTP-grounded verification checks individual propositional claims in AI outputs against external E! Corpus | Post-generation, continuous, per-claim | Does not verify its own reasoning; does not access model internals |
Table 2: Three complementary layers of external AI verification. Each instantiates the same architectural principle: trust flows from an external referent. Sources: US Executive Order (2 June 2026), Confirmed (e-type); EA Thursday Chapter 18 FIDO2 architecture analysis; V.E.R.A. Logic Engine NTP specification (Wessel 1992).
The EO addresses the model side of the trust problem: before a model ships, an external entity reviews its capability claims. It does not address what the model produces after it ships. The hallucination floor data established in Episode 18 is relevant here: even the best commercial systems show a 3.3% hallucination floor on current benchmarks (Vectara, Likely confidence; primary benchmarks documented in Ep18 register). Capability review does not eliminate output-level fabrication.
FIDO2 hardware attestation for agents, the architecture examined in this week's EA Thursday series, addresses the identity side: before an agent acts, its identity claim must be verified externally. It does not address whether the claims the agent makes in its outputs are factually grounded.
The V.E.R.A. Logic Engine operates at the output layer. V.E.R.A. does not verify its own reasoning. It operates on outputs, checking individual propositional claims against external NTP-grounded reference data, after those outputs have been generated, claim by claim. This is not a limitation of the architecture; it is the architecture's defining property. A verification system that operates on outputs is, by definition, not dependent on model opacity.
What Implementation Actually Looks Like
This is the committed implementation anchor for Arc 3. The theoretical case is complete across two pillars. The question now is what the V.E.R.A. Logic Engine's output-layer verification looks like when it runs.
The entry point is claim extraction. Before the V.E.R.A. Logic Engine can verify anything, it needs to identify which parts of an AI output are verifiable claims, classify them as e-type (existence, occurrence, or quantity assertions) or n-type (logical inferences from established premises), and route them to the appropriate verification pipeline.
The NTP classification is the epistemological foundation. A claim can only be verified if it makes a specific, falsifiable proposition. "The Eiffel Tower is in Paris" is e-type: it asserts the existence and location of a named entity, and it can be checked against the E! Corpus. "If all models in the dataset were trained with RL, and Model X is in the dataset, then Model X was trained with RL" is n-type: it is a logical inference from stated premises, evaluated by the Krampitz Load Analyser against NTP inference rules.
A fabricated tool call, the failure mode SimpleToolHalluBench documented, is an e-type existence assertion: "Tool Y exists and is available in this context." The Krampitz Load Analyser classifies the tool call as e-type; the E! Verification Service checks whether the tool is registered in the E! Corpus for the current deployment context. If it is not, the assertion is flagged as unverified. The fabrication does not propagate to action.
The claim extraction module is the component that makes this pipeline operational. The Krampitz Analyser and Formula Parser are already complete and tested. The E! Verification Service architecture is defined, with a Wikipedia/Wikidata proof-of-concept in place. The gap is at the front end: automated extraction of structured, classifiable claims from unstructured natural language output.
The extraction problem is harder than it appears. Natural language is not structured for logical classification. A sentence can contain multiple claims of different types. Implicit existence assertions, where the model assumes a tool exists without stating the assumption explicitly, require inference about what the output is taking for granted, not just what it says directly.
The first implementation attempt targets the explicit case: extract stated claims from a known-structure output, classify each as e-type or n-type using the Krampitz rules, and route e-type claims to the E! Verification Service for a Wikipedia/Wikidata lookup. The SimpleToolHalluBench failure mode provides the calibration dataset: outputs from models that fabricated tool calls are the clearest test of whether the extraction pipeline catches what it needs to catch.
The Ffact score measures the proportion of e-type claims in a given output that receive an EXISTS verdict from the E! Verification Service. A high Ffact score means the model's existence assertions are grounded. A low score flags unverified assertions for human review. The score is not a guarantee; it is a calibrated signal. That is what external verification produces: not certainty, but a structured account of what is and is not confirmed.
Where New Zealand Sits
New Zealand has no equivalent to the EO's pre-deployment review requirement. The Public Service AI Framework requires lifecycle safeguards and human-centred principles; it does not include a pre-deployment external review gate for frontier models. That is a factual gap in the current regulatory posture.
The closest NZ instrument to the EO's external review logic is Information Privacy Principle 3A (Privacy Act 2020 amendment, effective 1 May 2026), which imposes an automated decision explanation obligation: an affected individual must be able to receive an account of how an AI system reached a decision affecting them. IPP 3A operates post-decision; the EO operates pre-deployment; the V.E.R.A. Logic Engine operates in the middle, claim by claim, before the decision is acted upon. The three instruments are not competing; they cover different points in the same chain.
The NCSC NZ / Five Country Council "Careful Adoption of Agentic AI Services" guidance (1 May 2026) establishes that allied intelligence agencies consider pre-deployment assessment of agentic AI systems a governance priority. The EO is one allied jurisdiction's policy implementation of that collective assessment. NZ architects working with agentic AI systems should read the EO as a signal about where the Five Country Council's collective thinking is heading, not only as US domestic policy.
The Gap the Executive Order Cannot Fill
The EO stops at the deployment boundary. It requires a 30-day review before a model is publicly released. It does not require ongoing monitoring of what the model produces after release. It does not reach individual outputs, individual claims, or individual fabrications.
The EO also stops at the Kármán Line.
Orbital AI inference, frontier models running on compute platforms beyond sovereign jurisdiction, falls outside the EO's reach by definition. The Planet Pelican-4 constellation and the emerging xAI compute-in-orbit architectures are not US-domiciled deployments in the conventional regulatory sense. The EO cannot require a pre-deployment review of a model that was never deployed to a US-regulated server.
The V.E.R.A. Logic Engine's output-layer architecture does not have this limitation. It is model-agnostic: it verifies the claim embedded in an output, not the capability that generated it. It is jurisdiction-agnostic: it does not require the model to be registered, reviewed, or licensed anywhere. It requires only that the output contain a claim that can be classified and checked against external reference data.
This is Arc 3's closing argument, made now in policy terms rather than theoretical ones. The V.E.R.A. Logic Engine was designed for a world where you cannot see inside the model. That world is now policy-confirmed. The architecture that operates on outputs, without requiring model access, is the architecture that still functions when the model runs where regulators cannot reach.
The V.E.R.A. Logic Engine is an external NTP-grounded verification architecture. It operates on outputs, not on the reasoning process that generated them.
Across the Series This Week
This week, the external referent principle appeared at all three layers in different series and different registers.
EA Thursday Chapter 18 examined FIDO2 hardware attestation for agent identity: before an agent acts, its identity claim is verified externally. This is the identity layer of the three-layer architecture above.
Gen AI Tuesday Part 21 analysed the concurrent EO and Anthropic S-1 from a market structure angle: the frontier capital formation and the frontier regulatory response arrived in the same week. That is not a political observation; it is a structural observation about the incentive environment in which external verification is being institutionalised.
Cyber Sunday Cyber News 7 examined the Office of the Privacy Commissioner's recommended processor direct-liability reform, which requires an external entity to see inside a chain of delegation before harm occurs. The OPC reform, the EO, and the V.E.R.A. Logic Engine are all instances of the same governance principle at different points in the chain.
The governance side of the deployment boundary
The implication on the governance side is worth naming directly. The EO establishes that allied states view pre-deployment review of frontier AI models as a national security matter. Whether that standard applies when a model operates beyond the review jurisdiction, on orbital compute infrastructure or on systems deployed by states without equivalent requirements, remains open. The ICRC's "meaningful human control" doctrine, at the centre of autonomous weapons discussions since 2013, asks whether a human being can exercise genuine oversight over a system's decisions. A system that fabricates tool calls and generates unverified existence assertions in outputs that drive action undermines meaningful human control regardless of what pre-deployment review concluded. Under the 1977 Additional Protocol I Article 36 obligation, new means of warfare must be assessed against international humanitarian law, and that assessment requires the system's behaviour to be characterised. Output-level verification provides one part of that characterisation.
Follow the Project
Te Pono V.E.R.A. is open-source under GPL-3.0 at GitHub: https://github.com/andreas-linux/vera/
If you are a policy analyst or governance professional, the three-layer architecture above is a practical framework for thinking about where different regulatory instruments and technical controls fit. The EO fills a real gap; so does FIDO2 attestation; so does output-level NTP verification. None of the three is sufficient on its own.
If you are an AI architect building systems subject to the EO's pre-deployment review or equivalent frameworks in other jurisdictions, the V.E.R.A. Logic Engine's output-layer architecture is what post-deployment output quality assurance looks like when model internal state cannot be inspected.
If you are building the claim extraction module, the implementation is the next conversation. The Krampitz Analyser and Formula Parser are ready. The E! Verification Service architecture is defined. The front end is the open problem. The SimpleToolHalluBench dataset provides the calibration cases.
The government has confirmed the architectural principle from the policy direction. The next step is to show the pipeline running.
Ita est momentum veritatis.
When you think about AI systems operating beyond the review boundary, either orbital, multi-jurisdictional, or adversarially deployed, what verification standard do you think should apply to their outputs?
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
Andreas Hamberger, M.A. Phil in Logic (Humboldt University Berlin), is a Wellington-based enterprise architect and security leader with more than 30 years of experience across New Zealand's public and private sectors. He is the founder of Te Pono Limited and creator of the V.E.R.A. Logic Engine. V.E.R.A. (Verified Existence and Reasoning Architecture) is an open-source logic engine available on GitHub.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
[1] US Executive Order on Frontier AI (2 June 2026). Public instrument. Pre-release review requirement and Treasury cyber clearinghouse. Source: US Federal Register / White House (public). Confirmed (e-type).
[2] Anthropic S-1 filing (1 June 2026). US$965 billion-plus valuation. Source: Anthropic S-1 (public). Confirmed (e-type).
[3] SInternal Framework. arXiv 2605.08930v1. Latent-space opacity and internal reasoning trace removal. Confirmed. Source: https://arxiv.org/abs/2605.08930
[4] SimpleToolHalluBench. arXiv 2510.22977. RL training and tool hallucination rates; OpenAI o3 approximately 33%, o4-mini approximately 48% on PersonQA. Confirmed. Source: https://arxiv.org/abs/2510.22977
[5] Vectara Hallucination Leaderboard 2026. 3.3% hallucination floor on best commercial systems. Likely confidence; primary benchmarks documented in Episode 18 register. Source: Vectara (2026).
[6] Information Privacy Principle 3A, Privacy Act 2020 amendment (effective 1 May 2026). Automated decision explanation obligation. Confirmed (e-type). Source: Office of the Privacy Commissioner New Zealand.
[7] NCSC NZ and Five Country Council. "Careful Adoption of Agentic AI Services" guidance (1 May 2026). Confirmed. Source: NCSC New Zealand / Five Country Council.
[8] ICRC. "Meaningful human control" doctrine on autonomous weapons systems. Source: International Committee of the Red Cross position papers on autonomous weapons, 2013 onwards.
[9] Additional Protocol I to the Geneva Conventions (1977). Article 36 weapons review obligation. Source: International Committee of the Red Cross treaty database.
[10] Wessel, H. (1992). Logik. Felix Meiner Verlag. Primary NTP source. All V.E.R.A. Logic Engine n-type arguments are derived from this specification.