Kalai, A. T., Nachum, O., Vempala, S. S., & Zhang, E. (2025). Why Language Models HallucinatearXiv:2509.04664.

The mechanism: models are optimised to guess rather than abstain, so basis-free assertion is by design. Read copy

Groot, T., & Valdenegro-Toro, M. (2024). Overconfidence is Key: Verbalized Uncertainty Evaluation in Large Language and Vision-Language ModelsarXiv:2405.02917.

Confidence is poorly calibrated; used, then set aside as the argument does not depend on calibration. Read copy

Hicks, M. T., Humphries, J., & Slater, J. (2024). ChatGPT is BullshitEthics and Information Technology 26(2):38.

The philosophical adjacency: assertion with no regard for truth, at the level of the speech act. Read copy

Yeom, S., Kim, M.-G., & Park, J. H. (2026). Understanding nursing handoff errors in clinical practiceBMC Nursing 25:359.

Handover loses information; it does not evidence loss of basis, which remains this work to argue. Read copy

(2013). PROV-DM: The PROV Data ModelW3C Recommendation.

Provenance can be used to form assessments; the assessment is placed outside PROV itself.

OpenSSF (2023). Supply-chain Levels for Software Artifacts (SLSA), v1.0 SpecificationOpen Source Security Foundation.

Read in full (spec + levels). SLSA attests HOW something was built (build provenance, integrity, origin), across incremental levels; it explicitly does not certify the artifact behaviour, fitness for use, or absence of vulnerabilities. Integrity of a declared build, not admissibility of a claim.

(2013). Constraints of the PROV Data ModelW3C Recommendation.

Validity means internal consistency, explicitly not truth or reliability.

Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust ArchitectureNIST Special Publication 800-207.

Read in full (tenets). ZT = accurate, least-privilege, per-request access decisions; trust never implicit, every request evaluated on identity/privilege/need-to-access. Evaluates AUTHORISATION of a request, not whether the content that flows is well founded. The per-request-evaluation move, applied to access not basis.

(2013). PROV-O: The PROV OntologyW3C Recommendation.

The OWL encoding; no classes for authorization or admissibility.

Newman, Z., Meyers, J. S., & Torres-Arias, S. (2022). Sigstore: Software Signing for EverybodyACM CCS 2022 (CC-BY).

Read in full. Keyless signing (Fulcio) + transparency logs (Rekor) binding signatures over artifacts to OIDC identities; signers "vouch for authenticity", verifiers check content is "authentic". Establishes who signed and non-tampering (provenance/integrity), not that content basis is sound. Graceful degradation = separation instinct.

(2013). PROV-OverviewW3C Working Group Note.

Confirms assessment is a potential use by external parties, not a function within PROV.

CISA, NSA, et al. (21 agencies) (2025). A Shared Vision of Software Bill of Materials (SBOM) for CybersecurityCISA/NSA joint international guidance.

Read in full. 21-agency joint guidance: SBOM = "list of ingredients", value = visibility; a user can "determine whether a given component is present" - presence, not fitness; the vulnerability/exploitability judgement (CSAF/VEX) is downstream. Log4Shell as the case. Corroborates the NTIA-limit point with international authority.

Gao, J., Chen, M., Xiang, L., & Xu, C. (2024). A Comprehensive Survey on Evidential Deep Learning and Its ApplicationsarXiv:2409.04720.

Read in full (authors CORRECTED from erroneous "Ulmer et al."). Evidential DL via subjective logic/Dirichlet "explicitly includes uncertainty mass to convey I do not know"; vanilla EDL uncertainty "pertains to epistemic uncertainty" - a model-ignorance signal, still distributional, not a per-claim basis. Confirms the trustworthy-ML thread.

Open Policy Agent — Documentationopenpolicyagent.org.

A general-purpose policy engine: accepts arbitrary structured data, decouples decision from enforcement, supplies no model of the input.

Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., & Thompson, M. (2023). Guide to Operational Technology (OT) SecurityNIST Special Publication 800-82r3.

Read in full (exec summary + IT/OT differences + segmentation). OT logic "has a direct effect on the physical world"; OT prioritises integrity and availability, then confidentiality, with SAFETY overarching (fixes the confidentiality-first debt). Names "inaccurate information sent to operators to cause inappropriate actions" = conveyed-state-acted-upon, in an official list. DMZ segmentation = compartmentalisation convergence.

Rego — Policy Language Referenceopenpolicyagent.org.

Domain-agnostic; no built-in notion of evidence, basis, or fitness-for-action. The user must define and supply them.

(2021). Vulnerabilities and Attacks Against Industrial Control Systems and Critical InfrastructuresarXiv:2109.03945.

Read in full. Purdue/DMZ zoning + full ICS attack catalogue (Stuxnet, Ukraine, Triton). Scaffolds the compartmentalisation convergence.

(2013). eXtensible Access Control Markup Language (XACML) 3.0OASIS Standard.

The older attribute-based access-control lineage: evaluates supplied attributes without defining what they mean.

in-toto Attestation Framework: Specificationin-toto project.

Authenticated metadata: the predicate carries arbitrary claims but in-toto does not validate their truth. Transport, not model; its intended consumers are policy engines.

(2023). Supply-chain Levels for Software Artifacts (SLSA): Threat ModelOpenSSF.

Entirely adversary-framed; makes no claims about whether an artifact is correct, true, or fit for purpose. False Determinism is outside its threat model by construction.

Guo, C., Pleiss, G., Sun, Y., & Weinberger, K. Q. (2017). On Calibration of Modern Neural NetworksICML 2017 (arXiv:1706.04599).

Modern networks are poorly calibrated, but temperature scaling largely fixes it post hoc. That a one-parameter fix works shows calibration is not the deep issue.

Huang, L., et al. (2023). A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open QuestionsACM TOIS (arXiv:2311.05232).

The mainstream, peer-reviewed view: hallucination is mitigable, not inevitable. Cited as the countervailing position the mechanism argument must accommodate.

Geifman, Y., & El-Yaniv, R. (2019). SelectiveNet: A Deep Neural Network with an Integrated Reject OptionICML 2019 (arXiv:1901.09192).

Selective prediction / reject option: a model may abstain, trading coverage for a bounded error rate on what it answers. The ML register of "not every claim should be acted on."

Mozannar, H., & Sontag, D. (2020). Consistent Estimators for Learning to Defer to an ExpertICML 2020 (arXiv:2006.01862).

Learning to defer: the model hands off based on the DOWNSTREAM expert's expected accuracy, not its own uncertainty. Action-relative admissibility, reached independently by ML.

Zhang, Y., et al. (2023). Siren's Song in the AI Ocean: A Survey on Hallucination in Large Language ModelsarXiv:2309.01219.

Second hallucination survey, read in full. Independent taxonomy (input/context/fact-conflicting) and the same life-cycle causal account as Huang; same mitigation stance. Triangulates the mainstream view.

Okafor, C., Schorlemmer, T. R., Torres-Arias, S., & Davis, J. C. (2024). SoK: Analysis of Software Supply Chain Security by Establishing Secure Design PropertiesSCORED (arXiv:2406.10109).

Systematizes supply-chain security into transparency / validity / separation. Confirms integrity establishes an unchanged, authorized artefact, not correctness or fitness of what it does.

INL / DOE CyOTE (2022). Case Study: TRITON Malware Attack Against Petro RabighINL/RPT-22-67981.

The canonical intrusion-to-safety-controller case. Contains a documented False Determinism event: engineers diagnosed an attacker-caused SIS trip as a mechanical error and resumed operations.

MITRE ATT&CK for ICS: Triton (S1009)MITRE ATT&CK.

Confirms Triton targeted Triconex SIS controllers and could reprogram SIS logic to allow unsafe conditions to persist.

(2025). Cyber Security of OT Networks: A Tutorial and OverviewarXiv:2502.14017.

OT security field anchor: IT-vs-OT priority inversion (safety/availability first), Purdue model, IEC 62443 zones/conduits, and the irreversibility of physical actions.

Hawkins, R., Paterson, C., Picardi, C., Jia, Y., Calinescu, R., & Habli, I. (2021). Guidance on the Assurance of Machine Learning in Autonomous Systems (AMLAS)Univ. of York / arXiv:2102.01564.

The hardest test of the safety-assurance exclusion. Assures the ML component at design time; presupposes evidence standing; names automation bias but hands it on. Confirms it consumes admissibility judgements rather than producing them.

Torres-Arias, S., et al. (2019). in-toto: Providing farm-to-table guarantees for bits and bytesUSENIX Security 19.

Primary in-toto paper, read in full. Threat model is adversarial and about process integrity (layout/artifact-flow/step-authentication); a step by the authorized functionary is trusted in its output. Verifies custody and sequence, not content correctness. Read copy

Kelly, T. P., & Weaver, R. A. (2004). The Goal Structuring Notation: A Safety Argument NotationDSN 2004 Workshop on Assurance Cases.

GSN foundational paper, read in full. A safety argument structures the connection between a top claim and its supporting evidence (goals, strategies, context, solutions); it organises reasoning over evidence whose standing is presupposed. Read copy

Moreau, L. (2010). The Foundations for Provenance on the WebFoundations and Trends in Web Science 2(2-3).

The canonical provenance survey, read in full. Provenance is a logbook: it offers the means to decide whether data can be trusted, but the decision is made by a separate reasoner. Grew from closed database/workflow systems; Web provenance was built precisely to cross the handover boundary this work adjudicates. Read copy

Mitchell, M., et al. (2019). Model Cards for Model ReportingFAT* 19.

Documentation, not adjudication (read in full). Describes a model in general, intended use and out-of-scope uses, for a human reader at design time. Gestures at fitness-for-purpose but does not represent an individual output's basis or adjudicate at runtime.

Gebru, T., et al. (2018). Datasheets for DatasetsarXiv:1803.09010.

Documentation of a dataset at creation time for humans (read in full). Records recommended/proscribed uses as guidance, not binding runtime constraint. Same kind as provenance: record, not permission.

Simmhan, Y. L., Plale, B., & Gannon, D. (2005). A Survey of Data Provenance TechniquesIndiana Univ. TR IUB-CS-TR618.

Second canonical provenance survey (e-science/workflow). States the boundary: provenance backs a history "that will allow the user to apply their own metrics to determine if the data is acceptable." Record informs; user decides. Read copy

Alam, M. M., & Wang, W. (2021). A Comprehensive Survey on the State-of-the-art Data Provenance Approaches for Security EnforcementJ. Computer Security 29(4) / arXiv:2107.01678.

The nearest-to-adjudication provenance strand, and it still separates record from decision: provenance is captured; a separate analyzer, invoked by users, determines attack behaviour. Forensic/retrospective. Its reference-monitor triad (tamperproof, complete-mediation, verifiable) = the admissibility-gate requirements, reached independently. Read copy

NIST (Hu, V. C., et al.) (2014). Guide to Attribute Based Access Control (ABAC)NIST SP 800-162.

The ABAC standard. The mechanism decides and enforces; policy is authored separately. Content-neutral. The metaattribute passage (an assurance score MAY feed the decision, if supplied) confirms ABAC is ready to evaluate a basis model it does not produce. Read copy

Alam, M. M., & Wang, W. (2021). A Survey on Data Provenance Approaches for Security EnforcementJ. Computer Security / arXiv:2107.01678.

Nearest-to-adjudication provenance strand, still separating record from decision (capture vs. a separate analyzer). Its reference-monitor triad mirrors the admissibility-gate requirements. Read copy

Parasuraman, R., & Riley, V. (1997). Humans and Automation: Use, Misuse, Disuse, AbuseHuman Factors 39(2):230-253.

The seminal automation-trust taxonomy. Misuse = overreliance, failing to monitor. Catalogues CFIT and autopilot accidents where crews acted on conveyed state indistinguishable from correct. Read copy

Mehrotra, S., et al. (2023). A Systematic Review on Fostering Appropriate Trust in Human-AI InteractionarXiv:2311.06305.

Carries classic trust-in-automation into the AI era. Names automation bias, blind reliance, and appropriate-trust/calibration (reliance matched to capability, requiring purpose/process/performance = basis). Read copy

Lee, J. D., & See, K. A. (2004). Trust in Automation: Designing for Appropriate RelianceHuman Factors 46(1):50-80.

Read in full (no longer at one remove). Seminal appropriate-trust model: "Trust guides - but does not completely determine - reliance"; trust is an attitude, reliance a behaviour (belief->attitude->intention->behaviour). Misuse = inappropriate reliance. A320 / Royal Majesty as fatal miscalibration. Grounds the receiver-acts-on-conveyed-output premise directly.

Leonard, N. (2021). Epistemological Problems of TestimonyStanford Encyclopedia of Philosophy.

The bounded coda anchor. Transmission-vs-generation debate = whether authority can grow across the speaker-hearer boundary. The persistent-believer case (hearer justified where speaker was not) = the promotion this work names; philosophy has the case but no name for the elevation itself.

Kendall, A., & Gal, Y. (2017). What Uncertainties Do We Need in Bayesian Deep Learning for Computer Vision?NIPS 2017 / arXiv:1703.04977.

Aleatoric (irreducible observation noise) vs epistemic (model ignorance, reducible). Confidence conflates two things, neither is evidence a claim holds. Opens with the first assisted-driving fatality. Read copy

Angelopoulos, A. N., & Bates, S. (2021). A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty QuantificationarXiv:2107.07511.

The most rigorous UQ rung: distribution-free prediction sets. But coverage is MARGINAL (averaged over the distribution), not a per-claim warrant. Read copy

Conti, M., Donadel, D., & Turrin, F. (2021). A Survey on Industrial Control System Testbeds and Datasets for Security ResearcharXiv:2102.05631.

Scaffolds the CIA-inversion claim: OT ranks availability/safety above confidentiality, so acting on a wrong value is physical harm not disclosure. Conti-2021-ICS-testbeds-datasets. Read copy

Humayed, A., Lin, J., Li, F., & Luo, B. (2017). Cyber-Physical Systems Security: A SurveyarXiv:1701.04525.

Scaffolds the boundary claim: the cyber/cyber-physical/physical decomposition names the point computation becomes physical action = where the gate sits. Humayed-2017-cyber-physical-systems-security. Read copy

Bhamare, D., et al. (2020). Cybersecurity for Industrial Control Systems: A SurveyComputers & Security / arXiv:2002.04124.

Scaffolds the why-now claim: automation is already an OT attack vector (SCADA brute-force), so probabilistic AI intensifies an existing exposure. Bhamare-2020-cybersecurity-for-ICS. Read copy

Li, Y., Wu, S., & Pan, Q. (2023). Network Security in the Industrial Control System: A SurveyarXiv:2308.03478.

Scaffolds the positioning claim: characterises the defence-in-depth paradigm that admissibility is ORTHOGONAL to (authorised transit != sufficient basis). ICS-network-security-survey-2023. Read copy

NIST (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0)NIST AI 100-1.

AI-gov block. Four functions (Govern/Map/Measure/Manage); "valid and reliable" as the foundational trustworthiness characteristic, accountability and transparency as distinct ones. Frames admissibility vs process-accountability.

European Union (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 13Official Journal of the European Union L 2024/1689.

AI-gov block. Art.13: high-risk systems must be transparent enough for the deployer to interpret output and "use it appropriately". Transparency owed TO the receiver; law names the handover, does not specify a per-output basis representation.

Raji, I. D., Smart, A., White, R. N., Mitchell, M., Gebru, T., Hutchinson, B., Smith-Loud, J., Theron, D., & Barnes, P. (2020). Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic AuditingFAT* 2020; arXiv:2001.00973.

AI-gov block. Auditing is process/lifecycle accountability: checks the development process was done, not that a particular output basis suffices for a particular act. Description-vs-adjudication line in the governance register.

Doshi-Velez, F., & Kim, B. (2017). Towards A Rigorous Science of Interpretable Machine LearningarXiv:1702.08608.

AI-gov block. Interpretability serves auxiliary goals (trust, fairness, causality) that "evaluation metrics cannot capture" - the field admits its quality measures do not certify soundness. Interpretability is not admissibility.

OECD (2019). Recommendation of the Council on Artificial Intelligence, Principle 1.3 (Transparency and explainability)OECD/LEGAL/0449.

AI-gov block. Principle 1.3: provide meaningful information to enable those affected to understand and to challenge the output. Explanation owed so a decision can be contested; receiver needs the basis. Accountability Principle 1.5 text not yet read, not cited.

NIST (2024). Artificial Intelligence Risk Management Framework: Generative AI ProfileNIST AI 600-1.

AI-gov block, strongest official witness. Names "Confabulation" (confidently stated but erroneous content by which users may be misled) and "Human-AI Configuration" (automation bias, over-reliance) as official GAI risk categories, plus content provenance as a core consideration.

Mittelstadt, B., Russell, C., & Wachter, S. (2018). Explaining Explanations in AIFAT* 2019; arXiv:1811.01439.

AI-gov/xAI keystone. LIME and gradient/linear methods are simplified models that approximate the true criteria ("all models are wrong, but some are useful"), give "false assurances", and "do not provide evidence of the trustworthiness or acceptability of the model overall".

Bhatt, U., Xiang, A., Sharma, S., Weller, A., Taly, A., Jia, Y., Ghosh, J., Puri, R., Moura, J. M. F., & Eckersley, P. (2020). Explainable Machine Learning in DeploymentFAT* 2020; arXiv:1909.06342.

AI-gov empirical witness. ~50 interviews at ~30 orgs: explainability as deployed serves internal ML engineers, not the affected end users - "a gap between explainability in practice and the goal of transparency". Governance mandate failing in the field.

Wachter, S., Mittelstadt, B., & Russell, C. (2018). Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPRHarvard Journal of Law & Technology 31(2); arXiv:1711.00399.

AI-gov flagship legal remedy. Counterfactuals "do not attempt to convey the logic involved" and bypass the internal workings; authors doubt human-comprehensible meaningful information about a particular decision can ever exist. Three receiver-side aims: understand, contest, alter.

Selbst, A. D., & Barocas, S. (2018). The Intuitive Appeal of Explainable MachinesFordham Law Review 87(3):1085-1139.

AI-gov 10th. Inscrutability (what the rules are) vs nonintuitiveness (why the rules are appropriate) are distinct: a description of the rules does not justify them. Making a model interpretable may not help if the goal is to assess whether the basis for decision-making is normatively defensible. Explanation-as-action takes decisions as given and shifts responsibility to those affected.

Umer, M. A., Junejo, K. N., Jilani, M. T., & Mathur, A. P. (2022). Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and RecommendationsarXiv:2202.11917.

OT/AI boundary. ML intrusion/anomaly detection in ICS at network level (packets) and physical-process level. Detected anomalies are reported to plant engineers expected to take appropriate actions - the handover. Behaviour-based ML detection carries zero-day and false-alarm problems.

Luo, Y., Xiao, Y., Cheng, L., Peng, G., & Yao, D. (2021). Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and OpportunitiesACM Computing Surveys; arXiv:2003.13213.

OT/AI boundary. Taxonomy of DL anomaly detection in CPS by threat model, detection strategy, and anomaly scores. Explicitly discusses deficiencies of DL approaches. The learned boundary monitor emits a score, not a basis - ties to the UQ thread.

Anthi, E., Williams, L., Rhode, M., Burnap, P., & Wedgbury, A. (2020). Adversarial Attacks on Machine Learning Cybersecurity Defences in Industrial Control SystemsJournal of Information Security and Applications; arXiv:2004.05005.

OT/AI boundary, fatality of the method. ML-based IDS at the ICS boundary evaded by adversarial samples (JSMA): Random Forest and J48 accuracy decreased by 16 and 20 percentage points under attack, diverting malicious data past the detector. The learned firewall can be crossed by design.

Sayghe, A., Hu, Y., Zografopoulos, I., Liu, X., Dutta, R. G., Jin, Y., & Konstantinou, C. (2020). A Survey of Machine Learning Methods for Detecting False Data Injection Attacks in Power SystemsIET Cyber-Physical Systems; arXiv:2008.06926.

OT/AI boundary. ML detectors guarding power-system state estimation against false data injection. FDIAs can bypass residual-based Bad Data Detection; ML detectors adopted for speed and accuracy but are themselves learned classifiers over the boundary.

Bui, V.-H., Das, S., Hussain, A., Hollweg, G. V., & Su, W. (2024). A Critical Review of Safe Reinforcement Learning Techniques in Smart Grid ApplicationsarXiv:2409.16256.

OT/AI decision-making. DRL makes control decisions in power systems but often falls short in guaranteeing safety, a critical concern in critical infrastructure; safety issues always receive top priority while DRL may not meet operators safety requirements. Priority inversion applied to a learned controller.

Irfan, M., Sadighian, A., Tanveer, A., Al-Naimi, S. J., & Oligeri, G. (2023). False Data Injection Attacks in Smart Grids: State of the Art and Way ForwardarXiv:2308.10268.

OT/AI decision-making. FDI corrupts the internal state-estimation process that feeds control, able to bypass conventional Bad Data Detection. The decision input the controller acts on can be falsified stealthily - basis is corruptible at source.

Kushwaha, A., Ravish, K., Lamba, P., Kumar, P., & Mahajan, A. (2026). A Survey of Safe Reinforcement Learning and Constrained MDPs: A Technical Survey on Single-Agent and Multi-Agent SafetyarXiv:2505.17342.

OT/AI decision-making. CMDP formalism for constraining a learned policy actions. Constrained approaches bound risk probabilistically rather than guaranteeing safety absolutely; industrial process control where exceeding a limit once can be catastrophic.

Cummins, L., Sommers, A., Bakhtiari Ramezani, S., Mittal, S., Jabour, J., Seale, M., & Rahimi, S. (2024). Explainable Predictive Maintenance: A Survey of Current Methods, Challenges and OpportunitiesIEEE Access; arXiv:2401.07871.

OT/AI decision-making. ML predicts optimal maintenance time, driving actions. As methods are adopted for potentially life-threatening applications, human operators need to trust the predictive system, so XAI is introduced to amplify trust - the explanation-vs-basis gap, in OT maintenance decisions. Ties to the AI-gov block.

Bezold, V., Wagner, P., Hofmann, J., Huber, M., & Sauer, A. (2025). Trustworthy and Explainable Deep Reinforcement Learning for Safe and Energy-Efficient Process Control: A Use Case in Industrial Compressed Air SystemsarXiv:2512.18317.

OT/AI decision-making, the foil. A DRL agent emits compressor setpoints (a physical control action) with a SHAP/gradient-sensitivity explainability pipeline claiming trustworthiness. Uses exactly the post-hoc explanation methods the AI-gov entry showed are approximations, not evidence of basis.

Hendrycks, D., & Gimpel, K. (2017). A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural NetworksICLR 2017; arXiv:1610.02136.

TML/OOD. Softmax classifier probabilities are not directly useful as confidence estimates: random Gaussian noise into an MNIST classifier gives 91% predicted class probability. A confident output on an input unlike anything in training - the wrong-category claim demonstrated. Max-softmax is a useful OOD baseline but poor as a confidence signal.

Lakshminarayanan, B., Pritzel, A., & Blundell, C. (2017). Simple and Scalable Predictive Uncertainty Estimation using Deep EnsemblesNeurIPS 2017; arXiv:1612.01474.

TML/epistemic UQ. Deep ensembles as a non-Bayesian alternative for predictive uncertainty. Key: a prediction may be accurate yet miscalibrated, and vice versa (calibration orthogonal to accuracy). Even improved methods only express higher uncertainty on OOD - still a distributional signal, not a per-claim basis.

Sensoy, M., Kaplan, L., & Kandemir, M. (2018). Evidential Deep Learning to Quantify Classification UncertaintyNeurIPS 2018; arXiv:1806.01768.

TML/evidential UQ (Dempster-Shafer/subjective logic). Places a Dirichlet over class probabilities to represent evidence and I-do-not-know. Diagnoses softmax as not capable of inferring predictive-distribution variance; the distance of the predicted label is not useful for the conclusion. Still yields an evidence-mass distribution, not a per-action warrant.

Ovadia, Y., Fertig, E., Ren, J., Nado, Z., Sculley, D., Nowozin, S., Dillon, J. V., Lakshminarayanan, B., & Snoek, J. (2019). Can You Trust Your Model's Uncertainty? Evaluating Predictive Uncertainty Under Dataset ShiftNeurIPS 2019; arXiv:1906.02530.

TML capstone/calibration-under-shift. Large-scale benchmark: traditional post-hoc calibration does indeed fall short under dataset shift. The calibration reassurance (Guo) evaporates exactly when inputs move away from training - i.e. exactly when stakes rise. Uncertainty quality and accuracy both degrade under shift.

Nixon, J., Dusenberry, M., Jerfel, G., Nguyen, T., Liu, J., Zhang, L., & Tran, D. (2019). Measuring Calibration in Deep LearningCVPR Workshops 2019; arXiv:1904.01685.

TML/calibration critique. Expected Calibration Error, the most popular calibration metric, has numerous flaws; rank ordering of recalibration methods is drastically impacted by the choice of measure. The yardstick the field reassures itself with is itself unreliable.

Minderer, M., Djolonga, J., Romijnders, R., Hubis, F., Zhai, X., Houlsby, N., Tran, D., & Lucic, M. (2021). Revisiting the Calibration of Modern Neural NetworksNeurIPS 2021; arXiv:2106.07998.

TML/calibration, interrogates Guo (2017) already in review. The modern-nets-are-miscalibrated trend is less pronounced in recent architectures; the most recent models are among the best calibrated. Complicates the calibration story rather than confirming it - the entry holds both.

Gal, Y., & Ghahramani, Z. (2016). Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep LearningICML 2016; arXiv:1506.02142.

TML/epistemic UQ (MC-dropout). The wrong-category claim from the most-cited UQ method: softmax outputs are often erroneously interpreted as model confidence; a model can be uncertain in its predictions even with a high softmax output. Read directly rather than via secondary mention.

Gawlikowski, J., Njieutcheu Tassi, C. R., Ali, M., Lee, J., Humt, M., Feng, J., Kruspe, A., Triebel, R., Jung, P., Roscher, R., Shahzad, M., Yang, W., Bamler, R., & Zhu, X. X. (2021). A Survey of Uncertainty in Deep Neural NetworksArtificial Intelligence Review (2023); arXiv:2107.03342.

TML capstone survey. The field’s own comprehensive survey: basic NNs do not deliver certainty estimates or suffer over/under confidence; estimating predictive uncertainty is NOT sufficient for safe decision-making. Names inability to distinguish in- vs out-of-domain and to give reliable per-decision uncertainty.

NTIA (2021). The Minimum Elements for a Software Bill of Materials (SBOM)U.S. Department of Commerce (pursuant to EO 14028).

SBOM canonical definition: a formal record of components and supply-chain relationships. Minimum elements = inventory (supplier, component, version, deps, author, timestamp; SPDX/CycloneDX). Self-stated limit: "will not solve all software security problems, but will form a foundational data layer" - inventory feeding a downstream judgement, not the judgement.

Xia, B., Bi, T., Xing, Z., Lu, Q., & Zhu, L. (2023). An Empirical Study on Software Bill of Materials: Where We Stand and the Road AheadICSE 2023; arXiv:2301.05362.

First empirical SBOM study (17 interviews + 65 survey, 15 countries). Concerns cluster as trustworthiness, usability, suitability: practitioners uncertain whether an SBOM can be relied upon, is complete, or is tamper-resistant. The transparency the supply chain provides is itself contested.

CISA (2023). Minimum Requirements for Vulnerability Exploitability eXchange (VEX)Cybersecurity and Infrastructure Security Agency.

VEX indicates a component is or is not affected by a vulnerability - the closest SBOM-world gets to use-relative judgement. But it is an authored, signed assertion of status ("author is responsible", identity cryptographically associated with signature), explicitly may be incomplete, and conveys status not basis. A conveyed claim backed by provenance, not an adjudication - the thesis object.

Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007). A Design Science Research Methodology for Information Systems ResearchJournal of Management Information Systems 24(3):45-77.

READ in full. The DS spine: six activities, four entry points; this work is problem-centred, which the review discharged. Artefacts are "constructs, models, methods, or instantiations" - the typing the composition is read off into. Activity 5 evaluates by "comparing the objectives of a solution to actual observed results", so objectives precede observation: scenarios-before-design in DSRM's own terms. Evaluation admits "any appropriate empirical evidence or logical proof".

Gettier, E. L. (1963). Is Justified True Belief Knowledge?Analysis 23(6):121-123.

READ in full (3pp). Breaks justified-true-belief. Both cases are INFERENCE FROM A JUSTIFIED FALSE BELIEF, on two premises: one can be justified in believing a falsehood, and justification survives valid deduction. (The stock stopped-clock case is Russell's, not Gettier's.) Bears on RQ2: this is laundering through derivation, 1963. A defective basis passes a VALID deduction and emerges warranted-looking, justification preserved but severed from what makes the conclusion true.

Halpern, J. Y., & van der Meyden, R. (2002). A Logical Reconstruction of SPKIJournal of Computer Security 12(1); 14th IEEE CSFW. arXiv:cs/0208028.

READ (pp.1-6). Opened under gate two of the record reading, on the single question: does the record's authority field need the internal structure of a delegation chain, or is an identifier enough for the independence test the record must support? ANSWER: identifier is enough. SPKI's delegation apparatus governs AUTHORIZATION flow (may this key act) and not evidential corroboration (are these two supports the same origin); the latter is simply not SPKI's question, which confirms on the field's own account that shared authority is not shared evidence. BUT the field corrected the record on a point reasoning had missed: a vouching carries a validity interval and is revocable, so authority is not monotonic in time. The record's authority field therefore carries {identifier + validity status}, parallel to freshness. The judgement on stale authority defers to the admissibility method; the revocation machinery (k_r, CRLs) is instantiation and out of scope.

Steele, K., & Stefansson, H. O. (2020). Decision Theory (Stanford Encyclopedia of Philosophy)Stanford Encyclopedia of Philosophy.

READ (ss.1, 5.2, 5.3) for the admissibility combination question. FINDING: the scalar is not forced. Completeness is an axiom widely held not to be rationally required; drop it and preferences are represented by SETS of probability-utility pairs, decided by a choice function returning an admissible SUBSET under constraints such as EU-non-dominance. Combination without collapse to one number. Also Maxmin-EU, which the field itself calls 'arguably much too cautious'.

Zadeh, L. A., & Ralescu, A. (1987). On the Combinability of Evidence in the Dempster-Shafer TheoryUAI 1987 / arXiv:1304.3119.

READ in full. Gate-two answer for the origin set. KEY: 'the only essential restriction on the validity of the rule of combination is that the sources of evidence must be statistically independent.' Independence is a PRECONDITION Dempster-Shafer requires and does not supply; this paper exists because deciding whether two sources may be combined is itself hard. So the origin set does not reinvent DS, it answers what DS presupposes: detection is upstream of combination.

Rendsvig, R., Symons, J., & Wang, Y. (2024). Epistemic Logic (Stanford Encyclopedia of Philosophy)Stanford Encyclopedia of Philosophy.

READ (ss.1, 2.5, 5) against the verdict question. OUTCOME: checked, not needed. Epistemic logic models what an agent KNOWS, a modality over propositions, and its central open problem is logical omniscience: standard semantics closes knowledge under entailment, and impossible-worlds and awareness logics exist to escape that idealisation. The verdict is not a modality; it evaluates a basis against an act's demand. The field's hard problem is not this method's.

Fletcher, S. C. (2024). Reproducibility of Scientific ResultsStanford Encyclopedia of Philosophy.

READ (intro, meta-science section) for the pre-registration claim. Supports the TIMING half: the reproducibility crisis rests partly on questionable research practices that inflate false positives, and public pre-registration is the reform aimed at them. Notably it addresses WHEN choices are fixed, not WHO fixes them, which is the authorship gap the methodology chapter names separately.

Mandl, M. M., Becker-Pennrich, A. S., Hinske, L. C., Hoffmann, S., & Boulesteix, A.-L. (2024). Addressing Researcher Degrees of Freedom Through minP AdjustmentarXiv:2401.11537.

READ (abstract, method) for researcher degrees of freedom. 'Substantial flexibility in researchers' analytical choices' combined with selective reporting 'may lead to an increased rate of false positive and overoptimistic results'. Formalises the flexibility as a multiple-testing problem. Grounds the claim that fixing choices in advance is a real safeguard, and that it is a safeguard about timing.

Eppinger, S. D., Whitney, D. E., Smith, R. P., & Gebala, D. A. (1994). A Model-Based Method for Organizing Tasks in Product DevelopmentResearch in Engineering Design 6:1-13.

READ (pp.1-8) against the claim that the artefact's parts being rigid against each other forces dependency-ordered construction. SUPPORTS the ordering half: tasks are dependent (series), independent (parallel), or interdependent (coupled), and the first step of design structure analysis is to find a sequence making the matrix lower triangular, so that each task 'can be executed only after it receives all the information it requires from its predecessors', at which point 'no coupling remains in the design problem'. CORRECTS it: that 'rarely happens'. Real matrices come out block-lower-triangular, with coupled blocks on the diagonal that must be performed simultaneously and iterated. Applied to this artefact: record -> methods -> instantiation is largely sequential, but the record and the admissibility method proved coupled, since the SPKI reading added authority validity to the record after the admissibility requirements were written, and decision theory changed what a verdict may be after the record was fixed. Cited in the design-method section for both halves.