Sanctions Desk gathers and checks the evidence for every sanctions-screening alert and recommends an outcome; a person with the right entitlement approves it. One alert, start to finish · The problem it works on

Replay of recorded runs. Nothing runs live here. Every row below is read from files committed in the repository (eval/runs/), and every signature was checked when this page was built.

In the 32 exported runs the desk made 2,788 model calls. 2,532 were Nightshift answers, each with a signed receipt verified against the pinned key. Another 51 came from the local Ollama backup, which has no receipt by design. The other 205 failed and returned no answer. The small studies add 879 more signed receipts, all verified.

Every model call in the 32 committed run exports: the step, the mode the desk asked Nightshift for, the Nemotron model that served it, and its signed receipt. 2,532 receipts verified when these pages were built, across 2,788 model calls; a call without a receipt is either an answer from the Ollama backup or a call that failed before any answer.

Each signature is Ed25519 over the receipt body in receipts.jsonl.gz, checked with the same code as npm run evidence:verify. The receipt key of the Nightshift runtime is pinned in config/default.json: a receipt counts only if it is signed by that key, so it shows both that the receipt was not changed and that this runtime signed it. The build stops if a receipt is signed by another key, if a receipt is missing, does not verify, or names a different model from the trace.

Baselines without a model (rules, name matching, escalate everything): no model calls, so no receipts — 15 runs.