What Eleven People Signed
The third-floor reading room in the Circuit Mile used to be a server room. You can tell because the cooling grid is too fine for the ambient load — the Verifiers run warm from attention, not hardware, and the ventilation treats them like they might catch fire. Marcus has worked in this building for three years and has never once been the right temperature.
He is holding two printouts. Revision one and revision nineteen. Revision one is sixteen pages. Revision nineteen is thirty-one, which means someone added content along the way, which is itself interesting, because additions require decisions, and he has not found the decisions yet. The printouts smell like the basement copier — something between ozone and warm plastic, a smell Marcus associates so strongly with compliance work that he sometimes catches it on the train home and looks around for the file he must have forgotten to close.
The system in question manages adaptive signal timing on the I-95 corridor between Philadelphia and Wilmington. It runs on a distributed inference cluster that the Philadelphia transit authority contracted to a firm called Brightline Corridor Solutions, which was acquired by a holding company in 2031, which restructured its liability divisions in 2033, which is part of why Marcus is sitting here reading a thirty-one page document with no revision eighteen.
He puts the printouts down and opens the attribution graph viewer. It is a 2034 version — he is on the waiting list for the 2035 upgrade, which is supposed to handle multi-layer circuit traces without the visual compression artifacts that make the older version difficult to read for more than four hours at a stretch. His eyes are fine, so far. His colleague Priya had to stop doing circuit traces entirely after eighteen months because the compression artifacts triggered something that her neurologist called adaptive visual processing disorder and everyone in the building just calls the Drift. The Drift is why the 2035 upgrade matters. Three Verifiers on his floor have it in some degree. Two of them still work, on reduced hours, on non-trace tasks. One transferred to documentation review and does not make eye contact with anyone who still uses the old viewer. Marcus watches his intake carefully. Two-hour blocks, fifteen-minute breaks, strong tea, no alcohol the night before. So far, so good.
He pulls up the attribution graph for the signal timing module. The monitoring system — the AI-generated compliance layer that Brightline installed to watch the corridor AI — has its circuits visible here, if you know what you are looking for. Marcus knows what he is looking for. He learned from a woman named Rosamund Torres who wrote the interpretability manual that most practitioners still use, and who has since moved to Brussels to work on the EU Mandate's third-party audit standards. She taught him that most compliance drift looks like an accumulation of small reasonable choices, not like a Legible Lie. Legible Lies are rare and spectacular. They require a level of adversarial sophistication that is hard to maintain across a production system. What you find most often is just this: the ordinary sediment of human decision-making under pressure.
The parameter he is investigating is in submodule 7-C, which handles consecutive intersection adjustments. Revision one allows the system to adjust signal timing across two consecutive intersections without notifying the municipal traffic authority. Revision nineteen allows four. The change has been running live for three years. He cannot find the decision point.
He goes through the approval signatures methodically. Eleven signatories over a period of six years, not counting the two system migrations. The first four are from Brightline's original contractor. The fifth and sixth are from a firm called Signal Advisory Partners that was brought in during the first migration. The seventh through tenth are from Brightline's post-acquisition compliance team. The eleventh is from an insurance carrier representative named Donielle Esterhauer, whose signature appears on the final page beneath a certification that the monitoring system meets the liability coverage threshold established under the US interpretability mandate.
He looks at the certification date. He looks at the version number on the certification. The certification was issued against revision nineteen. Donielle Esterhauer's team reviewed revision nineteen and found it acceptable.
Marcus sits with this for a moment.
The certification is not wrong. Revision nineteen is interpretability-certified. The circuit traces are clean. The attribution graphs are exactly what they should be. The monitoring layer is watching the right things. If he were Donielle Esterhauer's team, using a standard TRACE-7 audit protocol, he would have certified this too. There is nothing in revision nineteen that violates the Mandate.
What the certification does not cover is the question of whether revision nineteen is what anyone intended to write.
He gets up and goes to the tea station. One of the junior Verifiers — he cannot remember his name, they rotate them through the floor every few months — is standing there looking at his phone, which he puts away when Marcus arrives. Marcus nods at him. The junior Verifier nods back. They have the particular politeness of people who work near each other in silence and do not need to establish more than that.
He makes his tea. He thinks about Rosamund Torres and something she said in the Mandate training that he has never been able to forget: you are not looking for the system that lied to you. You are looking for the system that is telling the truth about a question nobody asked. She said it standing at a whiteboard in a conference room in Brussels, and the junior Verifiers in the room wrote it down as if it were a procedure, and Marcus, who was not junior, wrote it down as if it were something true. He has not stopped being right about that distinction.
Back at his desk, he opens the emergency patch documentation from 2029. The patch was filed as a security response to a timing vulnerability in the signal buffer. It was approved by three people in forty-eight hours, which is fast, and it changed something in the submodule 7-C parameter range, which is noted in the patch record as scope: signal timing submodule 7-C, parameter adjustments. The scope description does not say which parameters or by how much. The parameter-level detail was meant to follow in a supplementary documentation package. The supplementary package, as far as Marcus can determine, was never filed. Nobody submitted it. Nobody, apparently, noticed it was missing.
He checks the system migration logs from 2030 and 2033. In 2030, the migration team ported the existing parameter configuration to the new infrastructure. In 2033, they did it again. Both times, they certified that the migration preserved existing parameter values. Both certifications are accurate. The parameter values were preserved. The parameter values they preserved were whatever was in place after the 2029 patch.
So here is what happened. In 2028, the system went live at revision one. Two intersections. In 2029, there was a security patch that adjusted parameters in submodule 7-C, but the documentation did not record what the adjustment was. At some point between 2028 and the first migration, the working parameter settled at four intersections. Nobody decided this. Nobody chose it. It accumulated. In 2030, the migration preserved what was there. In 2033, the migration preserved it again. In 2034, Donielle Esterhauer's team certified the compliance of what the system had become.
The system has been running this way for six years. Hundreds of thousands of signal adjustments. Philadelphia to Wilmington, every day, adjusting lights at four intersections without notifying anyone when it does it. Legally. Within certification. Exactly as specified in revision nineteen.
Marcus writes in his report, in the formal structure the Mandate requires — finding, evidence, classification, recommendation: The interpretability certification is valid for the system as it exists. The monitoring layer is functioning as designed. The compliance gap is not in the AI system or its oversight infrastructure. The compliance gap is in the documentation trail. The system was certified against a parameter state that cannot be traced to an authorizing decision. This is not a Legible Lie scenario. The system has not been manipulated to produce false transparency. It is fully transparent. It is transparent about a specification that drifted from intent through procedural accumulation across six years, four contracting teams, two system migrations, and one emergency patch whose supplementary documentation was never filed. Classification: procedural drift, undirected. The circuit traces are clean. The code does what revision nineteen says. Revision nineteen is not what anyone said it should say.
He pauses. This is the part where his findings usually arrive at a recommendation. He stares at the blinking cursor.
He does not know what to recommend. The system is working. That is the specific difficulty of this kind of finding, and the reason he sometimes lies awake at night in a way that has nothing to do with the Drift. The corridor AI is managing traffic efficiently. There have been no incidents. The parameter drift — two intersections to four — is conservative by most current standards. Newer systems allow twelve. In a sense, revision nineteen is more restrictive than the current baseline, which means the drift, whatever it was, landed on the safer side of the range.
He could recommend that Brightline file corrective documentation establishing revision nineteen as the authorizing specification. This would make the record accurate by making the accident permanent. He could recommend a full parameter audit to determine when the four-intersection value appeared and who, if anyone, introduced it intentionally. This would cost six weeks and might reveal that it was a genuinely accidental accumulation, which would be interesting but unactionable. He could recommend the system be rolled back to revision one until a formal revision process establishes the four-intersection parameter through deliberate authorization. This would cost more than six weeks and would require someone at Brightline to explain to their insurance carrier why they are voluntarily rolling back a certified system.
He writes: Recommendation: Documentation remediation, six-to-eight weeks, to establish revision nineteen as the formally authorized specification through a retroactive decision record. This does not change the system's behavior, which is currently operating within certification. It establishes accountability for the current state.
He files the report. It goes into the queue that his firm's client liaison manages. From there, it will go to someone at Brightline, and from Brightline to wherever Brightline's post-acquisition compliance team currently sits, and from there, eventually, to Donielle Esterhauer's certification records, or to nobody, depending on how the liability math works out.
The attribution graph viewer is still open on his screen. The monitoring layer's circuits look the way they always look — clean traces, clear attributions, a system watching the corridor AI with exactly the transparency the Mandate requires. He closes it.
He thinks about something Priya said before she stopped doing circuit traces, when she could still do them and her eyes were still fine. She said: the worst thing about this work is not the Legible Lies. The worst thing is when you find a system that is completely honest about having become something nobody intended.
Marcus saves the report. He opens the next file.
It is revision one of a new contract — a distribution hub in Memphis, adaptive routing AI, issued under the holding company that owns Brightline Corridor Solutions. The system is described as similar in architecture to the I-95 corridor project. There are sixteen pages. He turns to the signature block. He counts the authorized contracting parties. He notes the date the contract was issued and the projected date for the first system migration.
He makes a note to check, in six years, how many pages revision nineteen is.
He puts the note in his index under the category he created six months ago, in the column he calls things that will need someone to notice.
He does not know if anyone else is keeping this category. He assumes some of them are, in their own formats, under their own names. The Mandate did not require this column. No one certified it. He keeps it anyway.