The Witness.
A hosted AI tool is a black box you are still on the hook for. The Witness fingerprints every tool in your fleet, lifts raw transcript events into provenance-aware memory evidence, and the instant a vendor swaps the model or the behavior drifts, it raises the change — and seals it into a record you can't be talked out of.
You can't supervise what you can't measure.
You licensed a legal-AI tool on the strength of a demo. Between that demo and the deposition, the vendor can swap the model behind the endpoint and never tell you. It can degrade quietly. A citation it used to ground can come back hollow. None of it shows on a status page — and when opposing counsel, a malpractice carrier, or a judge asks how you knew the tool was reliable, "they assured us" is not an answer.
The duties don't move to the vendor. ABA Rule 5.3 says you supervise non-lawyer assistance — and a model is non-lawyer assistance. Rule 3.3 says a hallucinated cite is candor you owe the tribunal, not the vendor's problem. FRE 702 (and proposed 707) asks whether the AI-assisted work was reliable enough to come in at all. Every one of those duties needs a measurement — taken on your fleet, repeatable by an adversary — not a screenshot and not a marketing page.
A black box you can't measure is a black box you can't supervise. The duty is yours either way.
It sees. It records. It refuses to silence.
The Witness owns one axis of the four-axis battery: drift. The day you admit a tool, it takes a behavioral fingerprint (the differential signature) and seals it as the baseline. From then on it recomputes that fingerprint on every later run and compares. Same tool, same behavior → it holds. The fingerprint moves → a model was swapped or the tool degraded, and the Witness raises it.
The raw transcript is only a 1D collapse observable: prompt order, token load, cache ratio, and burstiness on a line. Memory Lift adds the relational graph the line cannot carry by itself — channel identity, instance provenance, recurrence, citations, witness edges, and file/tool references — so separator growth becomes evidence instead of a token-count proxy.
artifact_id = drift_diff · NIST AI RMF MEASURE · ISO/IEC 42001 §8.2 → §8.3That is how you satisfy Rule 5.3 supervision and FRE 702 reliability on a tool whose insides you will never see: not by trusting the vendor, but by holding the tool to the baseline it was admitted on and catching the moment it stops matching.
Proof for every output — and nothing privileged leaves.
On a mismatch the divergence is written into a signed, Merkle-rooted evidence record. The grade recomputes on your own hardware and a third party can reproduce it byte-for-byte from the published algorithm — yet not one privileged document, and no model weights, ever cross the boundary. The record crosses; the matter never does.
That record distinguishes proven, measured, and proposed evidence: the 1D interval-graph collapse theorem is proven; local cache/novel token metabolism is measured; lifted memory-graph separator growth is the benchmark surface Planisphere can compute and attest when the graph exists.
Because the Witness produces one record per output, your compliance evidence accrues with usage instead of with a quarterly audit. That is the operational-monitoring and record-keeping evidence the EU AI Act expects of deployers — Article 26 (keep a high-risk system under human oversight) and Article 12 (automatic logging) — ready before the high-risk obligations phase in. The signed record evidences that confidentiality stayed intact while the obligation was met.
Other tools alert you that a model drifted. The Witness hands you a record you can put in front of a tribunal.
Where the Witness runs.
Law
FRE 702 · ABA 5.3Defense
NIST AI RMF · DoW RAIMedicine
HHS §1557 · FDA PCCPEducation
Title VI · FERPAMichael is the canonical mark for this capability · taxonomy entry at /corpus/michael.
Catch the swap before opposing counsel does.
First evidence record within 21 days of access · re-runs in a single business day.