The protocol's purpose is narrow: to make it impossible to adjust the artefact, the requirements, or the metrics after seeing how they interact, and to make any such adjustment visible if attempted.
The artefact freeze
Before any scenario existed, the artefact was frozen and the freeze captured mechanically rather than asserted. It records the library commit and a hash over its sources, the specification and mutation-set hashes, the schema and vocabulary versions, the metric definitions, the baseline definitions, and the claims the evaluation is capable of embarrassing. Recording the metrics before any result exists is what stops a metric being chosen to suit an outcome; recording the claims is what stops a claim being narrowed to fit one.
The source register
Sources were fixed before the corpus, so that case ideas could not drive which authorities were sought. Each records publication date, a local file hash, an exact paragraph or section locator, the proposition it supports, its normative force, and any inference this work adds beyond the text.
Two bases are recorded separately for every case. A situation basis establishes that the operational condition is real. A warrant basis establishes what evidence the act requires beforehand. One document may supply both, and that has to be shown rather than assumed: an incident report establishes that something happened without establishing what should have been considered warranted before it.
Six sources were read in full and carry locators: the HSE guidance on electrical isolation, HSG253 on the safe isolation of plant and equipment, two Health and Safety Laboratory research reports arising from Buncefield, the joint international guidance on integrating artificial intelligence into operational technology, and the OPC UA specification's account of source and server timestamps.
The strongest single passage is HSG253 paragraph 168, which instructs the reader not to rely on an unproved isolation and to extend the isolation boundary or defer the work until shutdown. That is refusal on an inadequate basis with the remedy stated, in a safety standard, and it is a stronger external footing than this work previously claimed. Its scope is bounded deliberately: it establishes the principle for isolation before intrusive work in one domain, and any wider reading is this work's own extension.
Strata
Cases are stratified by the strength of their warrant basis, per case rather than per family, and reported separately rather than pooled. Stratum 1 means the reference warrant is explicit in an authoritative external source. Stratum 2 means the situation is external and the warrant requires a documented inference this work supplied. Stratum 3 means constructed, testing the discipline's own semantics and claiming no external validity. No stratum 3 cases were authored: the corpus was drawn entirely from situations external to the design, and a constructed case would test the discipline against its own reasoning rather than against an outside standard. The definition is kept so the scheme is complete and any later constructed case has a place to sit.
Twenty-one of the thirty-nine cases are stratum 1 and eighteen are stratum 2. That the exact cases split twenty-one to eighteen establishes that normative extension occurs in eighteen of them, and marks where the evaluation rests partly on this work's own reasoning. Because the corpus is purposively allocated, it estimates nothing about how much such extension would be needed in practice.
Sealing
Authoring proceeded in stages, each hashed before the next could begin: a domain stage fixing sources, situations, acts and reference warrants in the domain's own language; a translation stage fixing basis records, demands and decisive predictions; then execution.
The reason for sealing rather than trusting the sequence is that the failure would otherwise be invisible. A domain requirement adjusted after seeing the demand it translates into, or a reference warrant softened after seeing a verdict, leaves no trace: it reads exactly like a case authored honestly. The seal makes the sequence checkable, and a sealed stage that changes is reported as changed.
Six amendments were recorded, five before execution and one after. They are tabulated in the appendix. Three bear materially on how the results should be read and are discussed where they arise.
The evaluation artefacts
Every artefact this chapter reports is published with the implementation, so that a reader can locate the frozen state rather than take it on trust. The baseline freeze, the domain corpus with its atoms and expressions, the translation records, the stage seals, the eligibility manifest, the execution results, the amendment history and the checker sources are held together in the evaluation directory of the repository. The seals name the commit and the hashes; the amendments name what changed and when, including the one amendment recorded after execution.
References
Health and Safety Executive (n.d.). Safe isolation of plant and equipment: electrical isolation. hse.gov.uk/electricity/maintenance/isolate.htm
Health and Safety Executive (2006). The safe isolation of plant and equipment. HSG253, second edition. ISBN 978 0 7176 6171 8.
Health and Safety Laboratory for the Health and Safety Executive (2009). A review of Layers of Protection Analysis (LOPA) analyses of overfill of fuel storage tanks. Research Report RR716.
Health and Safety Laboratory for the Health and Safety Executive (2011). Identification of instrumented level detection and measurement systems used with Buncefield in-scope substances. Research Report RR872.
Cybersecurity and Infrastructure Security Agency, Australian Signals Directorate's Australian Cyber Security Centre, National Security Agency Artificial Intelligence Security Center, Federal Bureau of Investigation, Canadian Centre for Cyber Security, German Federal Office for Information Security, Netherlands National Cyber Security Centre, New Zealand National Cyber Security Centre and United Kingdom National Cyber Security Centre (2025). Principles for the Secure Integration of Artificial Intelligence in Operational Technology. 3 December 2025.
OPC Foundation (n.d.). OPC Unified Architecture Part 4: Services, sections 7.11.3 and 7.11.4, SourceTimestamp and ServerTimestamp. OPC 10000-4.