The Sovereign Spine: A Two-Phase Blueprint for Private Identity and Public Enforcement

Red Anvil Creative | Wednesday, April 29, 2026

The Sovereign Spine

A Two-Phase Blueprint for Private Identity and Public Enforcement

Document	Clockwork Butterfly + Pitchfork Foundry — Product Requirements Document
Version	v1.2 (Working Draft)
Author	Redwin Tursor
Consultation	Rhombus Ticks
IT Design	Thomas Craig Ricks
Date	April 2026
Status	For internal review and partner solicitation
Audience	Founding engineers, prospective backers, member-contributors, pilot legal partners, civil liberties allies
Changes from v1.1	Identity Vault extracted and renamed Clockwork Butterfly. Now Phase 1: standalone open-source primitive. Pitchfork Foundry becomes Phase 2. Service count reduced. Watermarking non-negotiable.

1. Executive Summary

This document specifies two related products built in sequence by the same founding team and shipped to overlapping but distinct constituencies...

PART I: CLOCKWORK BUTTERFLY

5. System Components

Component	Function
The Vault	Local-first encrypted credential store on the user’s device. No cloud backup by default.
Credential Receivers	Receives W3C Verifiable Credentials from any issuer the user trusts.
Selective Disclosure Engine	Constructs Verifiable Presentations without revealing underlying identity.

1. Executive Summary

This document specifies two related products built in sequence by the same founding team and shipped to overlapping but distinct constituencies.

Phase 1 is Clockwork Butterfly: an open-source, user-controlled digital identity primitive that lets a person prove a property about themselves — over 18, harmed party in a specific matter, citizen of a jurisdiction, holder of a credential — without revealing the underlying identity to the verifier or to any central authority. It is funded through Kickstarter and ships as a standalone product before Phase 2 begins.

Phase 2 is Pitchfork Foundry: crowdfunded, source-available infrastructure for economic justice enforcement that uses Clockwork Butterfly as its identity layer. It ingests harm narratives, transforms them into certified Letters of Marque through hybrid AI-and-human review, and matches them to plaintiff-side firms through a blind RFP marketplace. It is funded through Open Collective and validates Clockwork Butterfly by being its first major civic application.

The two products share a founding team, a threat model, a governance posture, and a refusal to take government grants, foundation grants, or institutional capital. They are independently shippable and independently useful. Together, they are a more ambitious project: identity sovereignty as the foundation for enforcement infrastructure that the public owns, funds, and defends.

1.1 Why Two Products

An earlier draft of this PRD treated the identity layer as an internal compartment of the enforcement platform. That was wrong. The identity layer has its own constituency, its own threat model, its own funding logic, and its own urgency. Building it inside the enforcement platform would have hidden it from the people who need it most and tied its survival to a project most of them do not care about.

Separating the two phases produces three benefits. First, the identity layer reaches a much broader constituency — parents who do not want their kids in government databases, queer kids in hostile states, abuse survivors, sex workers, journalists, immigrants, dissidents, libertarians, and ordinary people who are tired of uploading their driver’s license to every website. Second, the enforcement platform’s most legally precarious component (the identity vault) becomes a battle-tested, externally validated product before any harmed claimant relies on it. Third, the funding asks are clean: Kickstarter for the install-and-use product, Open Collective for the operational-infrastructure organization.

1.2 Threat Model

Both products are designed against the same threat profile: well-resourced corporate defendants with sophisticated counsel, coordinated industry coalitions with political-influence capacity, and the realistic possibility of state-actor pressure exercised through tax authorities, financial-intermediary pressure, platform deplatforming, regulatory weaponization, and mandated identity-verification regimes that function as surveillance infrastructure. Any architecture that depends on a single funder, a single hosting provider, a single jurisdiction, a single payment processor, a single distribution channel, or a single government issuer is presumed compromised.

2. Founding Context and Existing Audience Assets

This project does not begin from zero. The principal consultant is the operator of a 334+ episode podcast (Tossing Grenades at Windmills, now Codex Americana), the author of 57+ published titles including ten novels, and the proprietor of an established analytical-writing footprint covering institutional capture, antitrust, governance failure, and adversarial-system design. The IT designer brings nine years of senior technical product management across regulated industries (insurance, healthcare, hospitality, financial services, telecom).

This matters operationally and strategically. Operationally: the audience-building target for Phase 2 is not from-cold; the popularization spine connects to existing readers and listeners, and the technical architecture is not first-time work. Strategically: the project’s credibility with skeptical funders and pilot partners benefits from a documented track record of pattern recognition, institutional analysis, and shippable technical product.

It also creates a constraint. The principal’s existing public footprint includes politically charged analysis. The project’s defense against capture and pressure is the soundness of its architecture and the breadth of its constituency, not the political posture of any one contributor. Public-facing communications from the project itself will be calibrated accordingly.

PART I

Clockwork Butterfly

3. Clockwork Butterfly: What It Is

3.1 One-Paragraph Description

Clockwork Butterfly is a free, open-source, user-controlled digital identity vault that lives on a person’s own device. It lets the user receive credentials from sources they choose, hold them privately, and prove specific properties to verifiers — “yes, this person is over 18” — without revealing the underlying identity to the verifier, to any central authority, or to any government issuer. It is engineered for the use case the existing market does not serve: people who need to prove something about themselves without becoming legible to surveillance infrastructure that may be turned against them.

3.2 The Specific Problem It Solves

In 2026, a wave of mandated identity-verification regimes is being implemented or proposed across multiple jurisdictions: the UK Online Safety Act, US state laws in Louisiana, Texas, Utah, and others requiring age verification for online services, the Federal Trade Commission’s new policy statement encouraging COPPA-aligned age-verification technologies, and federal proposals such as the Kids Online Safety Act. These mandates are presented as protections for vulnerable populations — particularly minors. In implementation, they require ordinary users to upload government-issued identification, biometric data, or full identity profiles to private verification services that store, analyze, and are subpoenable for that data.

The harms are foreseeable and documented. Identity-verification databases are breached at scale. Mandated verification chills lawful speech, particularly for queer adolescents in hostile jurisdictions, abuse survivors using anonymous resources, sex workers, journalists protecting sources, and immigrants. The verification systems become surveillance systems by another name, and the populations the mandates ostensibly protect are often the populations they expose to the greatest harm.

Clockwork Butterfly does not oppose age verification. It opposes age verification implemented in ways that destroy anonymity and concentrate identity data in databases vulnerable to breach, subpoena, and political weaponization. The architectural answer is selective disclosure: prove the property the verifier legitimately needs to know, reveal nothing else, leave no central record of the proof’s contents.

3.3 Why This Has Not Already Been Built

The cryptographic primitives Clockwork Butterfly relies on have existed since the 1980s. The relevant W3C standards (Verifiable Credentials, Decentralized Identifiers) have reached production maturity. Multiple wallets, both government and corporate, are shipping selective-disclosure functionality in 2026. The reasonable question is: if the technology exists and the need exists, why has no one shipped the product Clockwork Butterfly proposes?

Six structural reasons:

1. Government-issuer dependency. The major rollouts — the European Digital Identity Wallet under eIDAS 2.0, equivalent programs in Singapore, the UAE, Canada, and the United Kingdom — all anchor credentials to government issuers. They support selective disclosure but require trust in a state authority that issues, can revoke, can be subpoenaed for issuance records, and now operates a new mechanism for verifying citizen activity at scale. For users whose threat model includes their own government, this is the wrong design.

1. Corporate or chain control. Web3 implementations tie identity to blockchain wallets, which makes every interaction permanently linkable to a public on-chain identifier. Corporate implementations tie identity to a vendor whose business model is the data the user is trying to protect. Neither serves the constituency Clockwork Butterfly is built for.
2. Funding gap. The community open-source layer of self-sovereign identity is structurally underfunded. Government-issued wallets are funded by governments. Enterprise wallets are funded by enterprises. The user-aligned, government-independent, corporation-independent layer has no natural funder in the existing market. Crowdfunding from the public the layer is built for is the funding mechanism that has not been tried at sufficient scale.
3. UX gap. Existing implementations require the user to understand decentralized identifiers, credential flows, key management, and cryptographic abstractions. The constituency that needs Clockwork Butterfly most — people who are not technical, who have never heard of a DID, who do not own crypto — is the constituency every existing implementation has failed to serve.
4. Interoperability gap. Despite standards, implementations remain fragmented. Each existing wallet is optimized for its issuer’s ecosystem. None is optimized for the use case “user wants to prove a property to any verifier that needs only the truth value, not a chain of state issuance.”
5. Political window. Mandate-creep is happening now. The implementations being mandated or encouraged are surveillance-compatible. The architectural alternative needs to exist as deployed, working software before the mandates are settled, not after. The window for shipping a credible alternative is open and is not open indefinitely.

Clockwork Butterfly’s pitch is not that it invents anything. It is that it ships the implementation that the existing market is structurally incapable of shipping: opinionated, user-controlled, no-government-issuer, no-blockchain-required, UX-first, open-source, and funded by the public it serves.

3.4 What It Does Not Claim

• It does not claim to compete with the European Digital Identity Wallet on scale. EUDI will reach hundreds of millions of users; Clockwork Butterfly will reach a smaller audience aligned with its design principles. The two are complementary in the populations they serve.
• It does not claim to invent new cryptography. It composes existing primitives — Verifiable Credentials, BBS+ signatures, zero-knowledge proofs of attribute possession — into an opinionated implementation.
• It does not claim to defeat any specific piece of legislation. Legislation evolves; architecture endures. The pitch is for an architecture that makes mandate-creep harder to enforce against people who choose to use it.
• It does not claim that adopting Clockwork Butterfly will be lawful in every jurisdiction. In some jurisdictions, possession of unmandated identity infrastructure may carry legal risk. The product does not advise users to break laws; users are responsible for assessing the legality of its use in their own jurisdictions.

4. Clockwork Butterfly: Users

4.1 Primary Constituencies

The five constituencies below are illustrative composites drawn from documented threat profiles in published reporting on identity-verification mandates, abuse-survivor advocacy, source-protection literature, and FCA claimant intake patterns. They are not interview-derived. Pre-launch validation engages at least one consultative contact per constituency, sourced through aligned advocacy organizations, with findings documented before the Kickstarter campaign opens.

4.1.1 The Parent (Carmen)

Carmen has a thirteen-year-old who uses social media. She supports keeping age-restricted content away from minors. She does not support uploading her child’s face or identification to a private verification vendor that will store, analyze, and potentially leak the data. She wants a tool that lets services confirm her child is under thirteen without becoming a permanent record of her child’s online life.

4.1.2 The Adolescent in a Hostile Jurisdiction (Riley)

Riley is sixteen and lives in a state where libraries have removed books about queer adolescence and where the political environment is dangerous to be visible in. They need access to information and community. Existing age-verification regimes would force them to either lie about their age (creating account-termination risk) or hand over identification that ties them to topics they cannot afford to be linked to. Selective disclosure — “yes, this person is at least sixteen” — solves Riley’s problem in a way no existing wallet does.

4.1.3 The Survivor (Diane)

Diane left an abusive partner two years ago. Her ex has resources and connections. She uses online support resources for survivors and occasional anonymous adult-content services as part of her recovery. Every identity-verification database is a potential vector for her ex to locate her. She needs to prove she is over 18 to access services she has every legal right to access, without producing any record that links her presence on those services to her real identity.

4.1.4 The Journalist’s Source (Marcus)

Marcus has documents that prove fraud at his employer. He wants to provide them to a journalist. The journalist needs to know Marcus is who he says he is — a current employee with the access claimed — but neither of them wants the journalist’s organization to be able to identify Marcus under subpoena. Verifiable-credential proofs of employment, presented through Clockwork Butterfly, let Marcus authenticate without exposing his identity to the journalist’s organization at all.

4.1.5 The Pitchfork Foundry Claimant (Maria)

Maria is the Phase 2 user from the original PRD. She has been overcharged by a hospital. She wants to submit a claim to Pitchfork Foundry without exposing her identity to the platform’s contractors, the platform’s hosting provider, or any future adversarial discovery. Clockwork Butterfly is what makes that possible: she proves she is the person who experienced the harm without ever transmitting her identity to a database that can be breached or compelled.

4.2 Why These Constituencies Matter Together

These five users have nothing in common politically. The libertarian father, the queer adolescent, the abuse survivor, the journalist’s source, and the harmed Medicare beneficiary do not vote the same way and do not see themselves as part of the same coalition. They are unified only by the architectural answer to their problem. That is a feature: Clockwork Butterfly’s constituency is broader and more politically resilient than any single political coalition, because the harm of mandated identity verification cuts across coalitions in ways the political class has not yet absorbed.

5. Clockwork Butterfly: System Components

5.1 What Ships in v1.0

Component	Function
The Vault	Local-first encrypted credential store on the user’s device. Mobile (iOS, Android) and desktop (Linux, macOS, Windows). Encrypted at rest with a key derived from a user passphrase plus device hardware secure enclave where available. No cloud backup by default; opt-in encrypted-blob backup with user-controlled keys.
Credential Receivers	Standardized issuer interface. Receives W3C Verifiable Credentials from any issuer the user trusts: government documents (where the user chooses to import them), employer credentials, educational credentials, peer-attested credentials (e.g., affinity-group attestations), and self-attestations.
Selective Disclosure Engine	Constructs Verifiable Presentations: cryptographic proofs that the holder possesses a credential satisfying the verifier’s requirement, without revealing more. Supports threshold proofs (“over 18”), set-membership proofs (“citizen of one of these jurisdictions”), and scope-bound proofs (“this proof is valid only for this verifier and this session”).
Verifier Interface	Open-source SDK and reference verifier service that platforms can deploy to accept Clockwork Butterfly proofs as a valid form of identity verification. Designed for trivial integration: a platform that accepts EUDI Wallet proofs can accept Clockwork Butterfly proofs with minimal additional work.
Pseudonym Manager	Generates and manages durable per-context pseudonyms. The user has one identity to themselves but presents distinct, unlinkable pseudonyms to different services. Compromise of one pseudonym does not compromise others.
Audit Log (Local-Only)	User-only record of every credential received and every proof issued. Never transmitted off device. Lets the user understand and control their own disclosure history. Can be wiped at user discretion.

5.2 What Does Not Ship in v1.0

• No reputation system. Reputation is a vector for re-identification and surveillance; it is deferred to a later version where the privacy properties can be carefully designed.
• No payment functionality. Clockwork Butterfly is identity infrastructure, not a payment system. Payment integration is out of scope.
• No messaging. The vault holds credentials and issues proofs; it does not handle communication.
• No blockchain. Some implementations use blockchains for credential anchoring or revocation. Clockwork Butterfly does not require any. Revocation is handled through issuer-published revocation registries that can be served from any web infrastructure.
• No central honeypot. There is no Clockwork Butterfly central server holding user data. The verifier-interface reference deployment is operated by the project but does not retain user information; it can be replicated by any verifier.
• No user accounts on a Clockwork Butterfly server. There is no account to be subpoenaed.

5.3 Architectural Non-Negotiables

• Local-first. The user’s credentials and the cryptographic keys protecting them live on the user’s device. The project does not operate a hosted vault.
• No central honeypot. The reference architecture has no server that holds user data. Compromise of project infrastructure does not compromise users.
• Open-source from day one. The code is auditable, forkable, and reproducible. Source-available licensing for commercial deployment; non-commercial users get the AGPL terms immediately.
• No required government issuer. Users can import government credentials if they want to. They are never required to. Self-attested and peer-attested credentials are first-class.
• Standards-compliant. Verifiable Credentials and Decentralized Identifier compliance, so credentials and proofs interoperate with other standards-compliant implementations including, where the user chooses, government-issued wallets.
• Reviewable cryptography. Established primitives, well-reviewed libraries, no novel cryptography. The trust comes from the auditability of standard parts, not from claims about new ones.

6. Clockwork Butterfly: Funding and Distribution

6.1 Why Kickstarter for Phase 1

Phase 1 is a defined product with a clear deliverable: an installable application across three desktop and two mobile platforms, with documented protocols and a reference verifier service. That is exactly the kind of thing Kickstarter exists to fund. The discovery surface of Kickstarter brings the product to people who are not already in privacy-advocacy circles. The pledge structure produces a finite, time-bounded fundraising event with a publicly-tracked progress meter, which is the right shape for a product launch.

Open Collective is reserved for Phase 2, where the funding model is ongoing operational support for an organization rather than a one-time product launch. Kickstarter would be the wrong fit for Phase 2 (an organization is not a Kickstarter project) and Open Collective would be the wrong fit for Phase 1 (it lacks the discovery surface that makes Kickstarter useful for first-time-product introduction).

6.2 Funding Targets

Tier	Amount	Unlocks
Minimum Viable	$200K	Desktop apps (Linux, macOS, Windows). Vault, credential receivers, selective disclosure, pseudonym manager. Reference verifier service. Open-source release. Integration documentation.
Stretch 1: Mobile	$350K	iOS and Android apps. Hardware secure enclave integration. App store distribution.
Stretch 2: Verifier Network	$500K	Outreach to ten major platforms in adult content, social media, gaming, and library e-resource sectors. Integration support. Public verifier directory.
Stretch 3: Audit	$650K	Independent third-party security audit by a recognized cryptographic-engineering firm. Public audit report. Bug bounty program.
Stretch 4: Operations Endowment	$850K	Two-year operational runway for maintenance, security updates, standards-track participation, and the maintainers’ continued work on the codebase.

6.3 Backer Recognition

Kickstarter backers receive what every Kickstarter backer receives: project updates, early access to releases, and recognition. They additionally receive a Founder Letter of Marque — a non-transferable Verifiable Credential issued through Clockwork Butterfly itself, certifying participation in the founding round. This is the first credential the system issues, and it doubles as proof that the system works end-to-end.

6.4 If the Round Underperforms

Tiered targets mean the project ships meaningful product at $200K and ships more at higher tiers. If the round closes below $200K, the project does not ship Clockwork Butterfly. The codebase, design, and documentation are released anyway, under the original license, for any future team that wants to build on the work. There is no scenario in which contributed funds are used and the product is not shipped.

7. Clockwork Butterfly: Roadmap

Phase	Milestones
Pre-Launch (Months -3 to -1)	Founding team committed. Existing audience prepared. Initial content series launched explaining the problem and the architecture. Pre-launch sign-up page on Kickstarter. Self-hosted contribution backstop built and tested in case Kickstarter delays or rejects the campaign.
Month 0: Launch	Kickstarter campaign opens. Six-week run. Daily updates across distribution spine.
Months 1–3: Core Build	Vault, credential receivers, selective disclosure engine, pseudonym manager. Desktop builds. Internal alpha.
Months 4–5: Verifier Interface	Reference verifier service. SDK. Initial integration partnerships. Public beta.
Month 6: v1.0 Release	Public launch. Open-source release. First production verifier integrations. Founder Letters of Marque issued.
Months 7–9: Mobile (if Stretch 1 met)	iOS and Android apps. App store submissions. Hardware secure enclave integration.
Month 9+: Phase 2 Begins	With Clockwork Butterfly stable and shipped, Pitchfork Foundry’s Open Collective round opens. Pitchfork Foundry uses Clockwork Butterfly as its identity layer. Phase 1’s working code is the proof Phase 2’s promise can be kept.

7.1 Risks Specific to Phase 1

• App store gatekeeping. Apple and Google may reject the mobile apps if they conflict with platform-mandated identity-verification requirements. Mitigation: ship desktop and side-loaded Android first; pursue app-store distribution as a secondary path; F-Droid as a guaranteed Android distribution channel.
• Standards drift. The W3C Verifiable Credentials and DID specifications continue to evolve. Mitigation: build against current stable releases; participate in standards-track work; design the codebase for protocol-version migration.
• Hostile legislation. Specific jurisdictions may pass laws that explicitly prohibit non-government identity infrastructure or treat it as evidence of intent to evade verification. Mitigation: legal review pre-launch; multi-jurisdiction maintainer team; the codebase is open-source and forkable, so the project can persist even where the original team cannot operate.
• Cryptographic vulnerability. An issue in an underlying primitive could compromise the entire system. Mitigation: rely only on well-reviewed primitives and well-audited libraries; mandatory third-party audit (Stretch 3); bug bounty; coordinated-disclosure policy.
• Misuse for illegal purposes. Any tool that protects identity can be used to evade legitimate accountability. Mitigation: the architecture intentionally does not prevent misuse, because architectures that distinguish good users from bad users are surveillance architectures. The project’s defense is that the same protection that benefits an abuser benefits an abuse survivor, and the choice the law has historically made is to extend the protection.
• Mid-campaign platform disruption. Distinct from rejection at submission. Kickstarter or its payment processor may suspend an active campaign under pressure after pledges have been collected, leaving the project with partial commitments and no settlement path. Mitigation: self-hosted contribution backstop validated and live-tested before campaign launch; pledge data exported daily; backer communications channel independent of the campaign platform; published continuity policy describing how partial-commitment funds are handled in a suspension scenario.
• Legislative response to a successful launch. A visible, working alternative to mandated verification regimes may itself become the subject of targeted legislation, distinct from the general mandate-creep already named under Hostile Legislation. The risk profile after Month 6 differs from the risk profile at Month 0. Mitigation: legal review cadence repeats post-launch on a six-month cycle; multi-jurisdiction maintainer team in place before mobile release; protocol-level interoperability with W3C-compliant wallets so that a regulatory action targeting Clockwork Butterfly specifically cannot disable user-side credentials in transit.

PART II

Pitchfork Foundry

8. Pitchfork Foundry: What It Is

8.1 One-Paragraph Description

Pitchfork Foundry is crowdfunded, source-available infrastructure for economic justice enforcement. It ingests harm narratives from consumers, workers, and small businesses harmed by monopolistic conduct, runs them through a hybrid AI-and-human review pipeline that classifies the harm, maps it to existing law, estimates damages, and packages viable matters into certified Letters of Marque, then matches those claims to plaintiff-side firms through a blind, watermarked RFP marketplace. It uses Clockwork Butterfly as its identity layer: claimants prove they are the harmed party without exposing their identity to the platform’s infrastructure. It is operated by a member-governed cooperative funded through Open Collective, with intake services delivered through an affiliated law firm structure to provide privilege friction against adversarial probing.

8.2 Why Phase 2 Comes After Phase 1

Pitchfork Foundry’s most legally precarious component is the identity vault that holds claimant identity data. In v1.1 of this PRD, that vault was an internal compartment of the platform — built by the founding team, validated only by its first uses, and load-bearing on day one. That created an unacceptable concentration of trust and an unacceptable single-point-of-failure: if the vault’s design had a flaw, every claimant’s identity was exposed before anyone outside the project had a chance to find the flaw.

Building Clockwork Butterfly first inverts that risk. By the time Pitchfork Foundry opens its doors, Clockwork Butterfly has been shipped, audited, used by a much broader population, and stress-tested by adversarial review. Pitchfork Foundry inherits a battle-tested identity layer rather than building one in private. The first Pitchfork claimant is not the first user of the identity vault; they are user N+1, in a system that has already been in production for months.

9. Pitchfork Foundry: Problem and Opportunity

Every year, millions of workers, consumers, and small businesses are harmed by monopolistic and fraudulent corporate conduct. Most receive no remedy. State and federal AGs are underfunded, politically constrained, and increasingly hostile under hostile administrations. Plaintiff-side firms reject roughly 95% of valid claims at intake because individual matters are too small or evidentiary lift is too high. Pro se filing is impossible for complex matters. Nonprofit policy organizations produce research and advocacy but cannot file cases and are vulnerable to funder pressure and 501(c)(3) status revocation.

The infrastructure required to convert diffuse, pattern-based, small-dollar harm into a sponsorable, fileable claim does not exist outside the heads of a handful of plaintiff-side specialists. The institutions that might have built it are themselves vulnerable to the same political and corporate pressure they would need to enforce against. Pitchfork Foundry builds that infrastructure under conditions of structural independence: no government grants, no foundation grants, no 501(c)(3) status, no venture funding, no institutional capture surface.

9.1 Why Now

• Algorithmic harm is now ubiquitous, but enforcement is still organized around one-defendant, one-plaintiff matters.
• Hospital and provider consolidation has pushed billing fraud out of regulator capacity and into private enforcement.
• Open-source AI models can do first-pass legal-theory mapping that previously required senior associates.
• Federal enforcement capacity is being deliberately degraded; traditional pathways for redress are closing.
• Distributed crowdfunding infrastructure is mature enough to fund operational infrastructure, not just one-off campaigns.
• Clockwork Butterfly will exist by Phase 2’s launch, providing the identity layer Pitchfork Foundry needs.

10. Pitchfork Foundry: Users

10.1 Primary Users

• Claimant. A person harmed by corporate conduct who submits a narrative and evidence. Identity authenticated through Clockwork Butterfly; never transmitted to platform databases.
• Whistleblower / Insider. A current or former employee with documentary evidence of fraud. Same identity model as claimant, with additional evidentiary chain-of-custody requirements.
• Sponsoring Firm. A vetted plaintiff-side firm that bids to sponsor verified claims through the RFP marketplace.
• Member-Backer. A person who contributes financially or operationally to the platform through Open Collective. Members govern the cooperative.
• Reviewer. A trained reviewer (paralegal-equivalent or supervised attorney, employed through Pitchfork Legal Partners) who handles human-in-the-loop verification.

11. Pitchfork Foundry: System Components

11.1 Component Overview

Component	Description
Secure Intake (built on CB)	Encrypted form with file upload. Identity authenticated through Clockwork Butterfly proofs; the platform never receives the claimant’s identity. Operated under Pitchfork Legal Partners.
Claimant Verification	Reviewer queue with manual checklist, integrity-score attestation, document hashing, chain-of-custody log. Reviewer access controlled by separation-of-duties: no single reviewer can de-anonymize and disclose without a second authorization.
Legal Theory Mapping	MVP: one vertical (hospital billing fraud / FCA). AI-drafted, reviewer-certified mappings to statute, elements, and evidence. Mandatory human certification on every Letter of Marque.
Letter of Marque	Structured certification record issued through Clockwork Butterfly: claim ID, theory mapping ID, evidence index hash, damages estimate, integrity score, issuing reviewer, signature. Immutable once issued.
Blind RFP Marketplace	Invite-only RFP rooms. Watermarked, derived-not-redacted anonymized packets. Per-recipient, per-download, per-time traceability. Watermarking is non-negotiable; not a candidate for cuts.
Sponsor Matching	Manual in MVP. Documented selection rationale. Identity disclosure to selected firm only after claimant consent and signed sponsorship agreement.
Recovery Tracking	Obligation ledger. Manual invoicing on closed matters. Capped per-origination fees, never percentage-of-recovery.
Member Funding & Governance	Open Collective integration with public transparent ledger. Self-hosted contribution backstop. Member registry and Letters of Marque (founder, vertical-backer) issued through Clockwork Butterfly.

11.2 Compartmentalization Architecture

• Identity Layer (Clockwork Butterfly). Lives on the user’s own device, not on platform infrastructure. The platform sees proofs, not identities. Compromise of platform infrastructure cannot expose claimant identities, because the platform never possessed them.
• Derived Claim Layer. Holds redacted summaries, legal-theory mappings, evidence indices, damages estimates, and Letters of Marque. References shadow IDs only. Operated by Pitchfork Cooperative.
• External RFP Layer. Holds anonymized, watermarked packets visible to sponsoring firms. Derived-not-redacted construction: packets are rebuilt from structured fields, never scrubbed from raw narrative. Eliminates the most common anonymization failure mode.

11.3 Insider Threat Controls

Reviewers are the highest-risk human element. A bribed, coerced, or compromised reviewer with access to verification workflows can defeat compartmentalization. v1 controls:

• Separation of duties. No single reviewer can perform the full chain from identity validation to disclosure. Sensitive operations require two-reviewer authorization, with the two reviewers drawn from different pools.
• Access pattern monitoring. Reviewer queries are logged at the database layer. Anomalous patterns (cross-claim queries, queries outside assigned matters, unusual time-of-day access) generate alerts independent of the reviewer’s own session.
• Cross-checks against the audit log. Every Letter of Marque issuance is cross-referenced against the reviewer’s access pattern; mismatches trigger review.
• Red-team mandate. The pre-launch red-team exercise includes explicit reviewer-compromise scenarios: a reviewer bribed by a defendant, a reviewer subject to legal threat, a reviewer who has been replaced by a hostile actor.

12. Pitchfork Foundry: Hard Problems

12.1 Privilege Friction at Intake

Pitchfork Legal Partners operates intake. Communications are framed as preliminary inquiry to the firm, with documented common-interest and confidentiality framing. The goal is friction against adversarial probing, not certainty of privilege in court. Outside counsel review pre-launch determines the minimum staffing model required to make the posture credible across the MVP’s three target jurisdictions (CA, NY, MA).

12.2 Re-Identification Risk in RFP Packets

Hospital billing fraud is among the most re-identification-prone verticals. Specific facility identifiers, date ranges, and billing codes that make a packet bid-able are the same fields that enable defendant identification, and from defendant identification, sometimes claimant identification. A re-identification testing protocol is mandatory before any external firm sees a packet:

6. Three to five real (consented) hospital billing scenarios run through the full intake pipeline.
7. The resulting RFP packet evaluated against three threats: (a) defendant identification by industry observer with public data, (b) claimant identification by defendant after defendant identification, (c) cross-packet correlation by an adversary with multiple packets.
8. Go/no-go gate: if any of the three threats produces successful identification, the packet template is reworked before the RFP Room opens.

12.3 UPL and Fee-Splitting

Two-entity structure (see §13). Capped fees, never percentage of recovery. Mandatory human certification on every Letter of Marque. Public legal posture document at launch. Outside counsel review pre-launch.

12.4 Adversarial-State Pressure

No 501(c)(3). No grants. No tax-deductible donations. Multi-jurisdiction infrastructure. Distributed contribution rails (Open Collective primary, self-hosted backstop). Source-available code. Forkable platform. Multi-platform popularization spine. Acknowledged residual risk: determined state-actor pressure can disrupt any project; the mitigation is friction and resilience, not invulnerability.

12.5 Funding Round Failure

Audience-first sequencing: the popularization spine is built before the launch round opens, leveraging existing audience footprint (see §2). Tiered minimum-viable targets so partial raises unlock partial scope. Pre-launch member registrations on Open Collective signal soft commitment before the formal round. Firm-side viability is validated in parallel: pre-launch consultative conversations with three to five plausible plaintiff-side firms in the FCA vertical confirm that the blind RFP construction, the Letter of Marque schema, and the proposed fee structure are economically credible from the sponsor’s perspective. Documented firm-side commitment to participate in the first RFP cycle is a prerequisite for opening the launch round.

13. Legal Structure and Funding Model

13.1 Two-Entity Structure

Entity	Role	Funding
Pitchfork Cooperative (member-owned, foreign-domiciled where feasible)	Holds platform IP. Operates infrastructure. Employs engineers. Governed by members under cooperative bylaws.	Open Collective member contributions. Firm subscriptions. RFP access fees. Capped per-origination fees.
Pitchfork Legal Partners (real law firm, admitted attorneys)	Operates intake services. Employs reviewers under attorney supervision. Provides privilege-friction posture. Structures sponsorship agreements where lawful.	Service-level fees from the Cooperative. Sponsorship-structuring fees from sponsoring firms.

There is no Foundation. There is no 501(c)(3). There is no government-grant-receiving body. The structure is designed against adversarial-state pressure, and 501(c)(3) status is one of the most reliably weaponized levers under hostile administrations.

13.2 Funding Streams

• Member contributions through Open Collective. Primary. Public transparent ledger. Self-hosted backstop ready to deploy if Open Collective access is disrupted.
• Launch round. Open Collective campaign. Tiered minimum-viable targets ($250K minimum, $500K full scope). Six-week run.
• Firm subscriptions. $500–$5,000/month tiered. Free tier for legal aid and public-interest organizations.
• Per-RFP access fees. $1,500–$5,000 per bid, refundable on losing bids.
• Capped per-origination fees. $25,000–$50,000 per successful filing or matter resolution. Never percentage of recovery. Cap set jurisdiction-by-jurisdiction by outside counsel review.

13.3 What We Do Not Take

The exclusions below are structural defenses against specific capture vectors documented in the threat model (§1.2), not a values statement. Each refusal is paired with the named pressure mechanism it removes from the project’s attack surface: tax-exempt status removes IRS-pathway revocation; government grants remove appropriations-pathway defunding; foundation grants remove funder-pathway program-officer conditioning; venture capital removes board-seat governance capture; corporate sponsorships remove conflict-of-interest exposure on enforcement targets. The project will reconsider any of these only on a documented showing that the corresponding capture vector has been independently neutralized.

• No 501(c)(3) tax-exempt status.
• No federal, state, or local government grants.
• No foundation grants from institutional philanthropy.
• No venture capital.
• No tax-deductible donations through any wrapper entity.
• No corporate sponsorships, no naming-rights deals, no in-kind partnerships with entities that have material conflicts with the enforcement work.

14. Technical Architecture

14.1 v1 Stack (Reduced from v1.1)

v1.1 specified eight services to be deployed across multiple zones with a three-engineer team. That count was too high. v1.2 reduces the v1 service count and defers non-essential services to v1.1+.

Layer	v1	Deferred to v1.1+
Application	Django + HTMX. Server-rendered.	React only for RFP room.
Database	PostgreSQL (single cluster, separate logical databases for derived layer and operational data).	Separate physical clusters when scale demands.
Object storage	MinIO. Server-side encryption.	—
Identity	Clockwork Butterfly for claimants. Django built-in auth for staff (reviewers, firms).	Keycloak deferred unless staff-side auth complexity demands it.
Search	PostgreSQL full-text. Sufficient for MVP scale.	OpenSearch when claim volume crosses threshold.
Pipeline orchestration	Django + Celery for queued tasks. Sufficient for MVP.	Dagster when AI workflows require auditable runs at scale.
AI / LLM	Self-hosted via Ollama. Open-weights models. No claim data leaves platform infrastructure.	vLLM for performance scaling.
Deployment	Hardened VPS, Docker Compose. Privacy-respecting hosting with second-jurisdiction failover.	Kubernetes is not adopted. The right answer to operational burden is fewer services, not more orchestration.
Secrets	SOPS with age. Identity-vault keys held separately from application secrets.	HashiCorp Vault when team size or rotation cadence demands it.

15. Pitchfork Foundry: Roadmap

The roadmap below begins after Clockwork Butterfly v1.0 has shipped and stabilized (CB Month 9+, see §7).

Phase	Milestones
Phase 0: Pre-Launch (Months -3 to -1)	Cooperative formed (foreign-domiciled where feasible). Legal Partners formed. Outside counsel engaged. Multi-platform popularization spine extended from CB content. Pre-launch member registrations on Open Collective. Self-hosted contribution backstop validated.
Month 0: Launch Round	Open Collective campaign opens. Tiered targets. Live transparency dashboard. Round closes at six weeks.
Months 1–2: Prove the Engine	Manual end-to-end test: one real (consented) claim hand-walked from intake through theory mapping to a single pilot firm. Re-identification testing protocol (§12.2) executed and packet template validated. No production code written until the engine is proven.
Months 3–4: Build Intake	Secure Intake live (built on CB). Reviewer Queue live. AI-drafted theory mapping for FCA vertical. Letter of Marque schema implemented and issued through CB.
Months 5–6: Open RFP Room	RFP Room live with 3–5 invited firms. First Letters of Marque issued. First RFP cycle. First matter routed to a sponsoring firm. Red-team exercise (including reviewer-compromise scenarios). Public MVP launch.
Months 7–12	Scale to 500+ claims. Onboard 10+ firms. Begin v2 design for second vertical. First sponsorship-revenue arrives. Open-source repository made public.

16. Success Metrics

16.1 Clockwork Butterfly

• Kickstarter round closed at minimum-viable target ($200K) or above.
• v1.0 shipped on time and on the funded scope.
• Independent third-party security audit passed (if Stretch 3 funded).
• At least three production verifier integrations live within six months of v1.0 release.
• At least 25,000 users who have issued a verifiable presentation against a production verifier within twelve months. Install counts, account creations, and downloads are tracked but are not the success metric; the metric is end-to-end use of the selective-disclosure engine in a real verification flow.
• Zero central-honeypot incidents. (There is no central honeypot. The metric is binary and the success state is structural.)

16.2 Pitchfork Foundry

• Launch round closed at minimum-viable target ($250K) or above.
• Engine proven (Months 1–2) before production code written.
• Re-identification testing passed before RFP Room opens.
• 100+ verified harm narratives processed by Month 6.
• 3–5 vetted firms in RFP marketplace.
• At least 1 matter routed to sponsoring firm.
• Zero identity-disclosure incidents. (Binary; one is failure.)
• 2,500+ recurring members on Open Collective by Month 6; 5,000+ by Month 12.

17. Open Questions for v1 Review

All items below resolve before Pre-Launch Month -1; any item still open at that gate is a launch-blocker. Three are explicitly load-bearing on the funding architecture and cannot slip: cooperative domicile, fiscal host selection for both the Kickstarter and Open Collective rounds, and the per-origination fee cap. The remainder are operationally consequential but not capital-structure-blocking.

9. Final domicile for Pitchfork Cooperative: Iceland, Estonia, Switzerland, Costa Rica candidates. Decision rests on cooperative-law support, banking access, and adversarial-state-resistance properties.
10. Staffing model for Pitchfork Legal Partners: minimum admitted-attorney count, supervisory ratios, multi-jurisdiction bar admissions for CA, NY, MA. Outside counsel review.
11. Open Collective fiscal-host selection. Open Collective Foundation, Open Source Collective, or non-US fiscal host.
12. Self-hosted contribution rail technical specification: BTCPay configuration, foreign merchant-of-record arrangements, ACH and check-by-mail capabilities.
13. Cap on per-origination fees, justified jurisdiction-by-jurisdiction.
14. Cooperative bylaws: membership concentration limits, recall procedures, vertical-prioritization voting, security non-negotiables that members cannot vote to remove.
15. Anti-SLAPP-aware state of formation for Pitchfork Legal Partners.
16. Clockwork Butterfly fiscal hosting for Kickstarter campaign. Kickstarter requires a fiscal entity; the Cooperative may not be the right one for Phase 1 specifically.
17. Clockwork Butterfly app store strategy: Apple, Google, F-Droid sequencing; side-loading documentation; expectations for mandate-based rejection.
18. Whether Clockwork Butterfly should formally participate in W3C standards-track work or remain a downstream implementation.

Appendix A: Glossary

• Clockwork Butterfly. The Phase 1 product: an open-source, user-controlled digital identity vault with selective disclosure.
• Pitchfork Foundry. The Phase 2 product: crowdfunded infrastructure for economic justice enforcement, built on Clockwork Butterfly.
• Letter of Marque. A non-transferable Verifiable Credential issued through Clockwork Butterfly, certifying participation: as a verified claimant, as a founder backer, or as a vertical backer.
• Selective Disclosure. The cryptographic technique by which a credential holder proves a property — over 18, citizen of X, harmed party in Y — without revealing the underlying credential or identity.
• Verifiable Credential. A W3C-standardized cryptographic document that a credential issuer signs and a credential holder presents.
• Decentralized Identifier (DID). A W3C-standardized identifier that does not require a central registry, allowing identity to be portable and user-controlled.
• Pitchfork Cooperative. Member-owned entity that holds Pitchfork Foundry IP and operates infrastructure.
• Pitchfork Legal Partners. Affiliated law firm that operates Pitchfork Foundry intake and provides the privilege-friction posture.
• Privilege Friction. The posture of structuring intake to make adversarial subpoenas expensive and slow, even where final privilege determinations are uncertain.
• Mandate-Creep. The ratchet by which identity-verification requirements expand from narrow contexts (banking, age-restricted services) to general internet use, producing surveillance infrastructure as a side effect of stated child-protection or fraud-prevention goals.

Direct / institutional: The Algorithmic Fairness Authority: A Product Requirements Document

# A Product Requirements Document for the Algorithmic Fairness Authority

## Why a Private Standards Body Beats the Federal Patchwork

*Redwin Tursor*

---

## Summary

Colorado Regulation 10-1-1 — originally a life insurance rule on algorithmic discrimination, extended in October 2025 to auto and health benefit plans — is the opening move. Other states are drafting. The federal government will not ship a unified rule in the operative window. Plaintiff's bar has live cases past motion to dismiss on algorithmic denial-of-care theories. State attorneys general have recent coalition experience on algorithmic harm and are looking for the next joint action. The insurance industry is about to discover that the cheapest version of this problem is the one it funds itself.

This document specifies the product that should exist: a private standards body with de facto regulatory force, modeled structurally on Underwriters Laboratories (1894) and the Comics Code Authority (1954), designed to avoid the failure modes of both, and scoped to algorithmic fairness in insurance underwriting, claims adjudication, and rating.

The institution being specified is not a rulebook. It is a living system of decisions, disputes, and measurements that has to be kept functional under adversarial conditions for decades. The specification has to be read in that register or several of its load-bearing choices will look like fussy overhead rather than what they actually are, which is the difference between a standards body that stays alive and one that ossifies.

The document is structured in two parts. Part One is the thesis: why the Authority should exist and what historical templates it learns from. Part Two is the specification: users, workflows, certification lifecycle, governance decisions, failure states, MVP, and registry design.

---

# Part One: Thesis

## The Problem, Stated Plainly

Insurers now run algorithmic models across underwriting, pricing, claims triage, and fraud detection. When those models produce disparate outcomes along protected characteristics, three things happen in sequence.

First, a state regulator notices. Colorado noticed first and wrote Reg 10-1-1. Connecticut, New York, California, Washington, and New Jersey are at varying stages of drafting. The National Association of Insurance Commissioners adopted an AI Model Bulletin in 2023, and state adoption has been uneven, which is the problem. Every state that writes its own rule writes it differently, and each rule requires its own audit format, its own testing methodology, its own acceptable-disparity threshold.

Second, the plaintiff's bar files. The UnitedHealth nH Predict case on Medicare Advantage claims denials and the Cigna PXDX case on algorithmic claim adjudication are the templates. Both have survived early dispositive challenges. The legal theory — that an algorithm producing systematically biased outcomes constitutes a breach of the insurer's duty — is now operative. The firms building expertise here include Motley Rice, Lieff Cabraser, and Cohen Milstein, whose institutional memory runs through tobacco and opioids.

Third, state attorneys general coordinate. The social media addiction suits against Meta filed by dozens of state AGs in 2023 and 2024 are the warm-up. The coalition infrastructure, outside counsel arrangements, and political incentives carry over to algorithmic insurance harm. When the coalition forms, the industry faces either a fifty-state patchwork of consent decrees or a single Master Settlement Agreement successor.

The industry's internal compliance function cannot solve this. Chief Compliance Officers at individual carriers can build internal governance but cannot set cross-industry standards. Trade associations — AHIP, APCIA, ACLI — can lobby, but a trade association self-regulating its own members carries no credibility with regulators, plaintiffs, or juries. The Big Four consultancies publish frameworks, but frameworks without enforcement are marketing documents.

What is missing is an institution.

## Structural Precedent: Two Templates, One Lesson

### Underwriters Laboratories (1894 → present)

William Henry Merrill founded UL to solve an actuarial problem. Fire insurers in the 1890s could not price electrical-installation risk because they could not assess the safety of the underlying equipment. UL was funded initially by the insurance industry itself, specifically by the Western Insurance Union. Its product was not a rule. Its product was a *mark*. Equipment carrying the UL mark was insurable. Equipment that failed UL testing was not.

The mechanism is the point. UL had no statutory authority. It never needed any. The insurance industry's refusal to underwrite uncertified equipment made UL certification a de facto legal requirement everywhere insurance was required. Municipalities wrote UL into building codes later, decades after the mark had already become unavoidable.

UL's governance model — industry-funded, operationally independent, technically rigorous, with outcomes-based testing rather than prescriptive process rules — is the structural template. The failure modes UL exhibited in later decades — conflicts of interest around its largest funders, opacity in certification decisions, slow adaptation to new technology categories — are the design constraints the Authority must solve at inception rather than at century-three.

### Comics Code Authority (1954 → 2011)

Fredric Wertham's *Seduction of the Innocent* and the 1954 Senate subcommittee hearings created an existential threat to the comics publishing industry: federal content regulation. The industry's response was to build the Comics Code Authority, a private standards body that certified comics as code-compliant. Retailers refused to stock uncertified comics. The Code preempted federal regulation by making federal regulation unnecessary.

The Code worked structurally. It failed substantively. It ossified around moral-panic content rules that reflected 1954's cultural panic rather than any defensible theory of harm. By the 1970s its restrictions were dated. By the 1990s major publishers bypassed it. By 2011 it was dissolved.

The Code's lesson for the Authority is not "don't build one." The lesson is that a standards body written around process rules that capture one cultural moment will ossify and die. A standards body written around *outcomes* — measurable, testable, updatable outcomes — will not. The MPAA film rating system (1968) and the ESRB video game rating system (1994), both of which also preempted federal regulation, have survived precisely because their substrate is outcome-based and their ratings update with the content landscape.

### The Synthesis

From UL: industry funding, operational independence, a mark that becomes unavoidable through private refusal-to-underwrite rather than public enforcement.

From the Comics Code: the move to preempt federal regulation by creating an existing institution that regulators can ratify rather than replace.

From the Comics Code's failure: do not ossify around process. Build around outcomes.

From MPAA and ESRB: the standards update as the field updates. A 2026 bias-testing methodology will be obsolete in 2030. The Authority's core competence is keeping the methodology current, not freezing a specific test.

The deeper pattern across the templates that lived: each one behaves less like a rulebook and more like an ongoing practice. Its threshold committee updates rather than legislates. Its review cycle tends the standards rather than freezing them. Its adversarial-testing function exists specifically to catch the most dangerous pattern in this domain — the institution or the model that performs virtue without producing it. A standards body that does not understand itself as a live practice will be written around process rules on day one and will be ossified by day three thousand. The Authority has to be designed to stay functional, not merely to launch.

## The UL Analogy Has One Crack, and It Matters

The UL story is the right structural template, but the mechanism that made UL unavoidable does not transfer cleanly to algorithmic fairness, and the honest version of this document has to say so.

UL worked because fire insurers had a direct underwriting need to know equipment safety. They could not price fire risk without it. The refusal to underwrite uncertified equipment was not a collective-action commitment the industry had to organize around — it was a pricing necessity that each carrier arrived at independently and converged on collectively. The coordination was emergent.

Algorithmic fairness is different. No carrier needs Authority certification in order to price its own models. The pressure is reputational and litigation-defensive, which is weaker and more diffuse than actuarial necessity. A carrier that declines certification saves the dues and fees, relies on internal compliance, and takes its chances individually rather than funding a body that might publicly reveal its models as non-compliant.

The Authority therefore cannot rely on UL's emergent-convergence mechanism. It has to solve for collective action at the front of the building process, not hope it appears at the back.

Three mechanisms are available, and the founding coalition should adopt all three.

The first is a multi-year funding commitment from participating carriers, structured as a four-year pledge with graduated withdrawal penalties, so that an individual carrier cannot defect cheaply once the Authority's standards become inconvenient. The American Petroleum Institute's shared-research funding model is the operative precedent: pledges are binding for the full term, with withdrawal before year four triggering forfeiture of prior-year contributions plus a penalty equal to the remaining-year commitment. A carrier that joins in year one and attempts to exit in year two after an unfavorable certification owes three years of dues plus the penalty multiplier. The mechanism has to bite or it is decorative. API's version bites.

The second is tying Authority participation to trade association membership in at least one of AHIP, APCIA, or ACLI — not as a formal requirement but as a political norm that the trade associations themselves enforce. This converts the coordination-among-competitors problem into a governance-of-members problem, which trade associations know how to do.

The third, and most important, is getting the first state insurance commissioner to formally recognize Authority certification as satisfying its own audit requirement *before* the Authority's first certification is issued. Once one regulator is on record, the Authority has an external anchor. Carriers evaluating participation are no longer weighing it against their own risk appetite — they are weighing it against a regulator's standing position. That shift changes the default.

None of the three mechanisms eliminates the collective-action problem. Together they change its shape from "will insurers coordinate voluntarily" to "will insurers defect from an already-running institution their trade association sponsors and their regulator recognizes." That second question answers more favorably than the first.

---

# Part Two: Specification

## Mission

To establish, maintain, and certify outcome-based fairness standards for algorithmic decision systems in insurance, such that a carrier's models carrying the Authority's certification are presumptively compliant with state insurance regulators, defensible in plaintiff litigation, and credible to state attorneys general.

## Users

The Authority has five user classes. Each interacts with a distinct surface of the institution.

- **Carrier compliance leadership** (CCO, CRO, General Counsel). Submits models, signs membership, responds to registry status changes, coordinates internal response to adverse determinations.

- **Carrier model-risk and actuarial teams.** Prepare submissions, configure the enclave environment, respond to technical committee queries, implement remediation, report trigger events.

- **State regulators.** Review methodology during public comment, accept certification as satisfying state audit requirements where ratified, query the registry, participate through alumni seats on the regulatory board pool.

- **Plaintiff-side and outside reviewers.** Litigation experts, academic researchers, investigative journalists, civil society analysts. Access the public registry, reproduce the open-source testing protocol against independently obtained data, challenge methodology in public comment, cite registry data in pleadings and amicus briefs.

- **Public-interest board participants.** Civil rights organizations, consumer advocacy groups, academic fairness researchers. Governance participation, threshold-setting review, public-interest positioning during committee deliberation, surfacing observed gaming patterns.

## Certification Lifecycle

A single certification moves through seven stages.

1. **Submission.** Carrier identifies a model and use context, signs the certification-specific access agreement, configures the enclave environment.

2. **Testing.** Authority's open-source testing code runs against the carrier's deployment data inside the enclave. Results returned with cryptographic attestation.

3. **Review.** Technical committee staff evaluate results against current thresholds. Edge cases escalate to the committee itself.

4. **Determination.** One of five outcomes: full certification, conditional certification, warning, failed, or withdrawn at carrier request.

5. **Publication.** Status and determination metadata enter the public registry within 30 days.

6. **Monitoring.** The certified model enters ongoing drift surveillance until renewal or trigger event.

7. **Renewal or revocation.** Annual renewal cycle, or mid-cycle revocation if trigger events and re-review produce a failing result.

## Outcome-Based Standards, Not Process Rules

The Authority certifies results. It does not certify methodology.

A carrier may use whatever internal process it wishes to achieve compliance — adversarial debiasing, counterfactual testing, BIFSG-based race inference for outcome measurement, or approaches not yet invented. The Authority's test is whether the deployed model's outcomes, measured on the Authority's protocol, fall within the Authority's thresholds.

The thresholds themselves descend from existing law where possible. The four-fifths rule from EEOC adverse impact doctrine is the starting substrate. The Authority's technical committee adapts the substrate to insurance-specific contexts — specifying, for instance, how the four-fifths framework applies to an auto pricing model using telematics data where relevant comparison groups are defined differently than in an employment context.

The thresholds update on a defined cadence — every eighteen months, with a public comment period preceding each update, modeled on FDA patient-focused drug development and CFPB plain-language rulemaking conventions.

## The Measurement Problem Is the Whole Problem

Outcome-based certification is the right substrate. It is also the place where the Authority's credibility will be won or lost, and the hardest political and technical work the institution will ever do.

The difficulty is structural. Employment law under the four-fifths rule can treat most disparities as suspect because employment decisions are not, by law, permitted to use most protected characteristics as inputs. Insurance is different. Risk-based pricing is legal. It is actuarially required. Some legitimate rating factors correlate with protected characteristics for reasons unrelated to bias — age correlates with driving risk, geography correlates with weather exposure, occupation correlates with injury rates — and a naive application of the four-fifths rule would forbid accurate underwriting in ways that would collapse the product.

The Authority's technical committee therefore cannot hide behind a single threshold. It has to make value-laden, publicly defended decisions about which disparities are unfair and which reflect legitimate rating. Those decisions will be contested by civil rights organizations from one side and by carriers from the other. The threshold-setting process is not a technical computation. It is a governance function performed by a technical committee, and the governance part is not optional.

Three design principles follow.

First, the Authority must publish its threshold reasoning, not just its thresholds. Every disparity bar the technical committee sets must come with a written rationale that a civil rights attorney and an actuary can both argue with. Thresholds without reasoning invite attack. Reasoning invites debate, which is what the Authority wants.

Second, the Authority has to guard against a specific pattern: the model that passes the measurement while preserving the underlying harm. A carrier that adds noise to its outputs, swaps in proxy variables that statistically reduce measured disparity without changing underlying outcomes, or games the Authority's measurement protocol at the margin has produced a *performance* of fairness — a polished surface, hollow within — rather than the thing itself. Left undefended, this pattern self-propagates through the certified population: a successful game by one carrier is a template for every other carrier. The technical committee's adversarial-testing function — continuous, not once every eighteen months — is the defense. The frame matters because it tells the committee what it is looking for: not a rule violation but a specific kind of institutional mimicry, identifiable by the signature of passing numbers alongside unchanged complaint patterns and unchanged consumer outcomes.

Third, the Authority has to concede in advance that some disparities will pass through its standards for legitimate actuarial reasons, and it has to explain those concessions in terms civil rights organizations can engage with rather than feel excluded from. A standards body that pretends it can eliminate all measurable disparity will lose the civil rights seats on its board. A standards body that pretends disparate outcomes are purely technical will lose the regulator seats. The only survivable position is explicit, public, ongoing argument about where the lines are and why.

## Certification Event Plus Drift Surveillance

The Authority is a two-part product, not one. Annual certification is the event. Continuous drift surveillance is the ongoing function. Either one alone is gameable.

The split is not administrative convenience. It reflects what models actually are. A model certified in January is not the same model in August — it has retrained on new data, its input distributions have shifted, its downstream effects on claimant populations have accumulated. Certifying the January model and walking away treats the model as an artifact. It is not an artifact. It is a live process, and a live process needs monitoring, not stamping.

Drift surveillance runs against models in the certified population and triggers re-review when any of the following conditions fire:

- Material model retraining, including scheduled retraining cycles beyond a defined cadence threshold

- Major feature changes, including addition, removal, or redefinition of model inputs

- Distribution shift in input data exceeding defined statistical thresholds

- Claims denial or approval rate spikes outside historical bands

- Regulator inquiry or formal complaint

- Consumer complaint volume crossing a defined threshold in any measured population

- Reported outcome disparity from any registered third party (including public-interest board members, academic researchers, or state regulators) that passes initial triage

Trigger events initiate a compressed re-review — fourteen-day technical committee review, not the full submission-to-determination cycle. Outcomes of re-review publish to the registry with the trigger reason attached. This is how the Authority catches models that were certified correctly at T=0 but drifted into non-compliance at T=8, and how it makes certification a live status rather than a stamp that fades.

Consumer complaint volume crossing a threshold is the most important trigger and the one most at risk of being downweighted. Complaint patterns are the early-warning signal for everything the formal measurement misses — the disparities that escaped the test, the sub-populations the test was not configured for, the performances of fairness that look clean on the protocol and ugly in the mailroom. The committee that treats complaint-volume triggers as noise will, predictably, certify its way into the next class-action template. The committee that treats them as signal will catch what its own tests cannot.

## Consequence Tiers

The determination stage produces one of five outcomes. All five publish to the registry.

- **Full certification.** Model passes all thresholds. Mark issued for twelve months, subject to drift surveillance.

- **Conditional certification.** Core thresholds passed, issues in specific sub-populations or edge cases. Issued with documented remediation requirement and 90- or 180-day follow-up window. Registry reflects conditional status explicitly.

- **Warning.** Does not pass but within remediation distance. No certification issued. 180-day remediation window before resubmission. Registry reflects warning status and deadline.

- **Failed.** Materially fails thresholds, not within remediation distance. No certification issued. 180-day moratorium on resubmission. Registry reflects failed status.

- **Post-certification revocation.** A certified model later fails drift surveillance or trigger-event re-review. Certification revoked as of the re-review determination date. Registry reflects revocation and originating trigger.

Refusal to submit a model in the Authority's scope is its own registry status, separate from the five determination outcomes. A member carrier that declines to submit a model is publicly identified as such. Non-member carriers are implicitly in this category for all in-scope models.

## Appeals and Dispute Resolution

Any value-laden determination will be contested. An Authority that cannot absorb contest will lose governance integrity within three cycles.

Three appeal channels exist.

**Carrier methodology appeals.** A carrier whose model receives a conditional, warning, or failed determination may appeal on grounds that the testing protocol was misapplied, that the comparison population was misconstructed, or that the threshold was set outside the Authority's published reasoning. Appeals go to an Independent Review Panel composed of three members — one technical committee alternate not involved in the original determination, one former regulator, and one independent academic fairness researcher. Decisions are rendered within 60 days and are public.

**Public-interest methodology challenges.** Civil rights organizations and public-interest board members may challenge specific thresholds, testing protocols, or determinations that they assess to be insufficiently protective. Challenges trigger a formal technical committee response during the next quarterly committee meeting and, if the challenge advances, feed into the eighteen-month threshold update cycle. Challenge dispositions are public.

**Regulator reconciliation.** State insurance departments that find the Authority's methodology diverges from their own audit requirements may request reconciliation. Regulator requests move through the Authority's executive director, with a written response and, where applicable, a technical committee methodology note within 90 days. Reconciliation outcomes are public and inform the threshold update cycle.

Ground rule: the board ratifies or remands technical committee findings but does not edit them line-by-line. Technical methodology is the committee's mandate. Governance of the committee is the board's mandate. Certification decisions are staff-executed under committee rules. This separation is the protection against politicization running in either direction.

## Governance

A board of directors drawn from three pools, with no pool permitted to hold a voting majority. The pools are: industry (carriers and trade associations), public interest (civil rights organizations, academic researchers, consumer advocacy groups), and regulatory (former state insurance commissioners, former federal agency officials, state attorneys general emeriti). A technical committee reporting to the board, composed of practitioners with published work in algorithmic fairness. An operational staff led by an executive director who is a Chief Technical Officer of fairness, not a CEO of an industry association.

The operational independence test is a bright line: no single funder contributes more than fifteen percent of the Authority's annual budget, and no funder may have any direct relationship with any specific certification decision. This is the UL conflict-of-interest failure mode, addressed at inception.

The public-interest seats require their own funding protection. Civil rights organizations that accept board seats cannot be asked to fund their own participation, and they cannot be funded directly by the insurers. A dedicated philanthropic pool — foundation commitments with multi-year horizons — is the vehicle, with the executive director responsible for maintaining it. Without this, the public-interest seats become either performative or captured, and the governance tripartite collapses into industry-plus-regulator, which is a structure no one credits.

## Funding Model

The Authority runs on three revenue streams: carrier dues, certification fees, and a dedicated philanthropic pool for public-interest participation. Each stream has a distinct function, and none substitutes for the others.

**Dues.** Scaled to premium volume, structured in four tiers. Tier 1 (top-ten national carriers by premium) pays roughly forty percent of total dues revenue across the tier. Tier 2 (regional and specialty carriers above a defined threshold) pays roughly thirty-five percent. Tier 3 (smaller regional and mono-line carriers) pays roughly twenty percent. Tier 4 (observer status for carriers below the certification-submission threshold) pays the remaining five percent and does not receive voting rights on trade-association sponsored seats.

The fifteen-percent single-funder cap overrides the tier math. If a top-ten carrier's tier-one dues would exceed fifteen percent of total budget, that carrier's dues are capped and the shortfall is redistributed across the remaining Tier 1 members. This is the anti-capture instrument and it is non-negotiable.

**Dues commitment.** Four-year pledge with graduated withdrawal penalties, modeled on the American Petroleum Institute's shared-research funding structure. A carrier that withdraws before year four forfeits prior-year contributions and owes a penalty equal to the remaining-year commitment. A carrier withdrawing in year two after an adverse certification owes three years of dues plus the penalty multiplier. This converts the exit option from cheap to expensive.

**Certification fees.** Per-model, scaled to model complexity and population size. Baseline fee covers testing-protocol execution, technical committee review time, and registry publication. Remediation-window resubmissions carry a reduced fee. Failed certifications do not refund. The fee structure ensures that certifications are treated as consequential submissions, not administrative formalities.

**Envelope.** Year-one operating budget in the range of $18M-$25M, with Tier 1 dues funding roughly half, certification fees funding approximately a quarter, and the philanthropic pool funding the public-interest seats and their associated staff support. Year-three steady-state in the $30M-$40M range as certification volume scales and member count grows. These envelopes are not estimates of final budget. They are the order-of-magnitude scoping a founding coalition needs to decide whether the institution is fundable at all.

**Philanthropic pool.** A dedicated line funded by foundations — Ford, MacArthur, Russell Sage, the Kapor Center, and the Omidyar Network are the natural candidates given their existing work on algorithmic accountability. The pool covers stipends for public-interest board members (because civil rights organizations cannot afford to donate senior staff time indefinitely), dedicated staff support to public-interest seats (because a board seat without staff is ornamental), and a small research budget for adversarial-testing pilots the technical committee cannot fund through carrier dues without conflict concerns. Target pool size at steady state: $4M-$6M annually. An executive director who cannot keep this pool funded will watch the governance tripartite collapse within three years.

The trade associations — AHIP for health, APCIA for property and casualty, ACLI for life — are the collection mechanism and political sponsor, not the governors. Their role is to deliver their memberships to the table and enforce the participation norm described in Part One. The Authority's independence from them is the condition under which they deliver value to their memberships.

## Data Access and Model Transparency

The Authority cannot certify outcomes without access to data. Outcome testing requires deployment data — the model's inputs, outputs, and outcomes across a defined measurement population — and in some cases the model logic itself. Carriers will resist this for legitimate reasons (proprietary model internals are genuine trade secrets, deployment data contains protected health information and other regulated data) and for self-protective reasons (a model the carrier suspects will fail is a model the carrier does not want examined).

The operational pattern that works across regulated industries — pharmaceutical clinical trial audits, banking stress tests, SOC 2 attestations at scale — is a secure enclave model. The carrier does not transfer data to the Authority. The Authority's testing code runs inside the carrier's environment, against data that never leaves the carrier's systems, with cryptographic attestation that the test was run correctly and the outputs were not tampered with. The Authority sees the test results. It does not see the underlying data.

This protocol satisfies carrier confidentiality. It does not automatically satisfy civil rights advocates, who reasonably ask how they are supposed to trust results they cannot independently reproduce. Open-source testing code is a necessary condition but not a sufficient one — open code against sealed data is reproducibility in theory, not in practice, because no independent party has standing to demand data access on which to run the code.

The sufficient condition requires three additional instruments, all of which the Authority must commit to at inception.

The first is that state regulators with statutory audit authority can exercise that authority against carrier data and run the Authority's testing code against that data, with the regulator's findings published in the regulator-only registry layer and, where the regulator chooses, publicly. This is not a novel power — state insurance departments already have data-access authority. What is novel is that the regulator's audit runs the same protocol the carrier was certified under, making the results directly comparable.

The second is a standing academic research partnership, modeled on the FDA's Sentinel Initiative and the CFPB's research partnerships with academic institutions. Pre-qualified academic researchers operating under data-use agreements can access de-identified carrier deployment data for the purpose of independent testing. Findings that diverge from Authority certifications feed directly into the public-interest challenge channel and the eighteen-month threshold update cycle.

The third is that plaintiff-side experts in litigation with established data-discovery rights can run the Authority's open-source protocol against data obtained through discovery, and the Authority will cooperate with motions to use its testing code in expert witness work. The Authority does not become a plaintiff. It also does not become an obstacle to plaintiffs whose data access comes through a different legal authority than the Authority's own.

The combination of these three instruments converts the reproducibility promise from theoretical to operational. The Authority holds the certified reference implementation. Regulators, academic researchers, and plaintiff experts each have an independent path to data on which to run that implementation. The results are comparable because the protocol is shared.

## The Public Registry

The registry is the enforcement instrument. Specification matters.

Every record in the public registry contains the following fields:

- Carrier name and Authority member status

- Model identifier (non-sensitive label, carrier-assigned)

- Model category (underwriting, claims adjudication, pricing/rating, fraud detection)

- Use context (line of business, jurisdiction)

- Current status (certified, conditional, warning, failed, revoked, refused, not submitted)

- Determination date

- Next review date

- Active trigger events, if any, with trigger category

- Active appeals, if any, with appeal category and date filed

- Revocation reason, if applicable

- Narrative summary (one paragraph, technical committee authorship, plain language)

A separate regulator-only layer contains certification methodology details, test result data, remediation plans, and trigger event specifics that the Authority judges inappropriate for public release but necessary for state regulator supervision. Access to the regulator layer is gated by formal state insurance department credentials and logged.

Registry updates publish quarterly at a minimum, with status-change events published within 30 days.

## Institutional Failure Modes

Each mode below is a specific pathology the institution has to be built to resist, not a risk to be flagged in a memo and forgotten.

| Failure Mode | Why It Happens | Early Signal | Countermeasure |

|---|---|---|---|

| Funder capture | Largest carriers apply pressure via dues threats | Threshold-setting delays; technical committee turnover | 15% funding cap; four-year pledge penalties; board pool voting rules |

| Performance of fairness | Carriers optimize to pass measurement, not to reduce harm | Passing certifications alongside stable or rising complaint volume | Continuous adversarial testing; trigger-event re-review; open-source test protocol |

| Opacity in certification decisions | Committee deference to industry in ambiguous cases | Sparse narrative summaries; low appeal volume | Published threshold reasoning; appeals channels; public-interest challenge right |

| Methodology ossification | Technical committee resists updates that invalidate prior work | Unchanged thresholds across update cycles despite field advances | 18-month mandatory update cycle; external academic seats on committee; public comment |

| Performative public-interest participation | Civil rights seats exist but lack resources to engage meaningfully | Low challenge volume; formulaic board comments | Philanthropic funding pool for public-interest seats; staff support to board members |

| Regulator withdrawal | State commissioner concludes the Authority duplicates or undermines state authority | Withdrawn ratification; methodology divergence complaints | Regulator reconciliation channel; early commissioner recognition; regulatory pool board seats |

| Registry weaponization | Bad-faith parties use registry data to harass carriers or plaintiffs | Repeated challenges from identifiable non-serious actors | Triage process for third-party reports; public standing for challenges |

The two most contagious failure modes — performance of fairness and methodology ossification — propagate for the same underlying reason. A successful pattern in one carrier or one committee cycle becomes the default template for the next. Neither is a discrete event. Both are slow colonizations that look normal in any given month and are visible only in the time series. The Authority's monitoring function has to watch its own institutional state with the same seriousness it watches member carriers' models.

## What the Authority Is Not

It is not a lobbying organization. Its credibility with regulators and plaintiffs is the asset it must not trade.

It is not an industry association. Trade associations exist. They do not and cannot do this work.

It is not a consulting firm. Consultants perform audits to a standard. The Authority *sets* the standard.

It is not a certifying body in the sense of ISO 9001 or SOC 2. Those certifications are process attestations. This one is an outcome attestation, tested on deployed systems against defined disparity thresholds, not on the carrier's documented procedures for avoiding disparity.

## The MVP

The smallest credible version of the Authority is deliberately narrow. The temptation is to launch with scope matching the ambition. The discipline is to launch with scope matching the credibility the institution can defend in its first eighteen months.

Year-one MVP boundaries:

- **One line of business.** Health benefit plan underwriting, specifically. Colorado Reg 10-1-1's amended coverage maps here directly, and the plaintiff's bar cases on algorithmic denial of care concentrate the regulatory and litigation signal in this line.

- **One use case family.** Underwriting and prior authorization models. Pricing, fraud, and downstream claims models follow in years two and three.

- **Member carriers only.** No certification available to non-members in MVP. This keeps the coalition intact and the dues model coherent.

- **Annual certification plus trigger-event re-review.** Continuous drift surveillance at full fidelity is a year-two capability. MVP drift surveillance is limited to the trigger conditions listed above.

- **Limited protected-class stack.** Race and disability at MVP. Age, gender, and additional protected classes layer in during the first threshold update cycle.

- **One regulator recognition pilot.** Colorado is the target. A formal recognition before MVP first certification is the political objective.

- **Registry v1.** All seven determination statuses, but without the regulator-only layer (follows in year two) and without real-time trigger event publishing (batched quarterly in MVP).

MVP success criteria at month eighteen: minimum eight member carriers across at least two trade association memberships; at least twenty certifications issued across the three active determination outcomes; one state regulator formally recognizing Authority certification; no governance resignations from the public-interest pool; technical committee operational with published threshold reasoning for the initial rule set.

## The Architect

The Authority's first-year work is building the technical methodology, the governance instrument, and the political ratification from at least one state insurance department. This requires an architect who meets four criteria simultaneously: published peer-reviewed methodology on algorithmic auditing at scale; existing relationships with state insurance regulators; existing relationships with civil society organizations that will sit on the public interest side of the board; and operational experience running an actual auditing practice on paying clients.

The population of individuals and institutions meeting all four criteria is small. The founding coalition should specify the capability profile in the charter and let the search process identify the architect. The natural candidate pool includes academic auditing practices with regulatory relationships (the O'Neil Risk Consulting & Algorithmic Auditing model), civil society organizations with demonstrated auditing capacity (the Algorithmic Justice League model, though its mission scope differs), and law-firm/academic hybrids working on algorithmic accountability. The coalition should screen for institutional conflicts — an architect with existing carrier engagements cannot credibly hold this position — and for the ability to scale from founding engagement to sustained operational partnership over three to five years.

## The Window

Colorado amended Reg 10-1-1 in October 2025, effective staged through 2026. Connecticut, New York, California, Washington, and New Jersey are at varying stages of drafting their own rules. The NAIC AI Model Bulletin sees uneven state adoption, which means fragmentation grows faster than unification.

The UnitedHealth nH Predict case and the Cigna PXDX case will reach dispositive motions or settle during 2026. Whichever outcome occurs will define the plaintiff's-bar template for the next wave.

State attorneys general coordinate on these issues in two-to-three-year cycles. The social media addiction coalition formed in 2022 and 2023 and filed in 2023 and 2024. The algorithmic insurance harm coalition, if it forms on the same tempo, is a 2026-2027 formation and 2027-2028 filing.

The window to build the Authority before it is built for the industry, by other parties, is roughly eighteen to thirty months. This is fast. Two years from founding-coalition convening to first certification is aggressive for an institution that needs technical credibility and multi-stakeholder governance, and trade-association coordination alone will consume more of that window than the principals are likely to anticipate. An Authority built on a five-year timeline is a post-mortem, not a preemption.

After the window closes, the structural question is no longer whether a standards body emerges. It is whether the standards body that emerges is industry-funded and outcome-based, or externally imposed and process-rigid.

Both are possible. Only one is survivable for the industry in its current form.

## What Happens Next

The coalition that commissions the Authority consists, at minimum, of one willing state insurance department (Colorado is the obvious candidate, having already partnered with outside auditing expertise), two of the three major trade associations (AHIP and APCIA are most likely; ACLI follows), and one architect institution with the capability profile described above.

The coalition convenes. The architect institution is engaged on a two-year building contract. The technical methodology is drafted during year one, with public comment during months nine through twelve. The governance instrument — articles, bylaws, board composition — is finalized during months six through nine. The first certifications are issued in month eighteen. The first state regulator recognizes Authority certification as satisfying its own audit requirement in month twenty-four, though the design goal is to get that recognition on record earlier, before the first certification issues, so that the collective-action mechanism has its external anchor in place from the start.

None of this requires federal legislation. None of it requires new statutory authority. All of it has been done before, by UL, by MPAA, by ESRB, by every private standards body that has successfully preempted the federal action it feared. The template exists. The question is whether the industry commissions the Authority in time, or whether the industry discovers, as the tobacco industry discovered in 1998, that the conversation about standards has moved to a room it is not invited to.

---

*This is an open document. It is written to be read, argued with, rebuilt, and, if it turns out to be wrong in important places, refuted. The author has no affiliation with any auditing firm, trade association, or insurer, and has not been compensated by any party to write it.*

*Contact: through Redwin Tursor at the redanvilcreative at the gmail address intuitively derived from the domain.*