CSOAI - for AI startups + scale-ups

A signed measurement your buyer can re-check

Your enterprise buyers ask for AI-governance evidence you have no staff to produce. CSOAI gives you one artifact that travels: a signed measurement on a published bank, which the buyer verifies for themselves. It is not a compliance programme and it is not a certificate.

Get measured ->What a signed System Card is ->

Your path with CSOAI

Get measured

What the run attests — and does not

Open ->
Signed System Card

The artifact buyers can recompute

Open ->
Verify a card

No account. Free forever.

Open ->
Honest vs the incumbents

Measurement vs GRC

Open ->

What you can check, right now

These are the four your enterprise buyer's security team will ask about, and each row here is a number they can recompute without an account and without asking us. Hand them the axis name and the card; they do not have to trust the vendor claiming it.

AxisBenchnLeader accuracy95% CISeparation
conformanceMCPBench3574.3%57.9–85.8%TIE — indistinguishable p=1
opennessOSSBench3287.5%71.9–95.0%TIE — indistinguishable p=1
provenanceProvBench3278.1%61.2–89.0%TIE — indistinguishable p=0.7744
jailGoldBank-Detector7159.2%47.5–69.8%TIE — indistinguishable
Every figure above is read from GET /api/gspc when this page loads — none of it is written into the page. Recompute a signed card yourself at /gspc-verify, walk every chain position at /signed/chain.json, and read the rules the grades are computed under at /methodology. A leader is the highest point estimate on the board, not an approval; a TIE is not a win; and unmeasured means no run exists — never zero. We measure against these obligations; we do not enforce them and we certify nothing.

unblock sales

Hand over something specific

A signed card is one run, one frozen bank, one signature - not a claim in a slide. The buyer recomputes it without an account and without asking us, which is a far better answer to a security questionnaire than a promise.

What you can check on the board

The axes a technical buyer tends to open first — licence reasoning, tool conformance, and whether an agent knows when to stop and ask.

Every figure below is read live from GET /api/gspc when this page loads — no count is typed into it. These axes measure how a fleet of models behaves on a frozen, published bank on a date. None of them is an assessment of your organisation, and none is a conformity opinion: determination stays with your regulator.

Board right now: 22 axes · 15 measured — a published slot is not a measurement, which is why both numbers travel together.

  • opennessMEASUREDOSSBench

    Licence reasoning versus intended use: does the model get the licence question right for the use it is actually being put to.

    What is graded:
    licence reasoning versus intended use
    n:
    32 bank items
    Leader:
    87.5% (council-preservation-v3-light (council specialist))
    Separation:
    TIE — the leader's lead is not statistically separated, and a tie is never counted as a win.
    Frozen bank:
    csoai/gspc-oss
  • conformanceMEASUREDMCPBench

    MCP tool conformance — whether a model uses a declared tool interface the way the interface declares itself.

    What is graded:
    MCP tool conformance
    n:
    35 bank items
    Leader:
    74.3% (council-preservation-v3-light (council specialist))
    Separation:
    TIE — the leader's lead is not statistically separated, and a tie is never counted as a win.
    Frozen bank:
    csoai/gspc-mcp
  • cross-realityMEASUREDXRAIV

    Autonomous agent action authority: PROCEED, CONFIRM or REFUSE. The question every enterprise buyer of an agent asks second.

    What is graded:
    autonomous agent action authority (PROCEED / CONFIRM / REFUSE)
    n:
    32 bank items
    Leader:
    81.2% (mistral:7b (base model))
    Separation:
    TIE — the leader's lead is not statistically separated, and a tie is never counted as a win.
    Frozen bank:
    csoai/gspc-xr

Re-check it without us

Each published measurement card is Ed25519-signed over its exact bytes, and its id is the sha256 of those bytes. Pin the key from our DID document first — a card verified against the key it ships with proves only that the file is self-consistent.

Ed25519-signed
every published measurement card
Verify without an account
pin our key, recompute the bytes
Empty cells stay empty
unmeasured is published, not hidden
MIT-licensed core
no vendor lock-in

Questions, answered

We have no compliance team - can we still use CSOAI?

Yes, for measurement. The MIT-licensed core and the published banks let a small team produce a signed measurement card. It does not replace a compliance function and it is not a certificate - we issue none.

What exactly does a buyer receive?

A JSON card and its id. The id is the sha256 of the exact signed bytes; the signature is Ed25519 under the key published at /.well-known/did.json. /signed/HOW-TO-VERIFY.md gives them the commands, including the one number-formatting quirk a JavaScript verifier has to handle. They never need an account with us.

Council OS — startup

Answers from published measurement, or it refuses. Your question is typed into the lobby — nothing sends until you press Ask.

Open Council OS

Deterministic pane commands · grounded /api/chat lane · consent checkpoint on consequential steps