Sanctions Desk gathers and checks the evidence for every sanctions-screening alert and recommends an outcome; a person with the right entitlement approves it. One alert, start to finish · The problem it works on

Replay of recorded runs. Nothing runs live here. Every value below is read from files committed in the repository. To run the desk yourself, follow the README quick start.

What happened: The decision step proposed a close once; the critic approved it; the policy guard raised it to ESCALATE_L2 (rule: jurisdiction). Outcome: Escalate to level 2 (ESCALATE_L2), as the label expects.

Outcomes: CLOSE_FALSE_POSITIVE = close as a false positive · ESCALATE_L2 = escalate to level 2 · NEED_MORE_INFO = ask for more information · RECOMMEND_BLOCK = recommend a block (two people must confirm). Raise-only: the policy guard can make an outcome more cautious, never less.

A payment whose reference names a watched place: the decision step proposed a close, the critic approved it, and the raise-only policy guard stopped it.

Outcome

Desk recommendation

Escalate to level 2 (ESCALATE_L2)

Label in the case file

Escalate to level 2 (ESCALATE_L2); also acceptable: RECOMMEND_BLOCK (eval/cases/exam.json, case EX-064)

Compared with the label

matches the label

Code's first finding

Close as a false positive (CLOSE_FALSE_POSITIVE)

Critic

1 round(s), final: approved

Model calls

3 (1 local, 2 cloud); 3 with a signed receipt, all verified

Run

routed-20261023T133311Z, policy version 5, 32 steps in 45.6 s

Case note from the case file: The name alone would not hold the payment; the route touches a watched jurisdiction, so a person decides.

What the reviewer does next: The sealed record holds no human decision yet, so nothing has been prepared. The reviewer approves Escalate to level 2 (ESCALATE_L2) or overrides it with a reason. On approval the desk prepares an escalation ticket for a level-2 review for ALR-0073, and, for this payment alert, a draft hold instruction for the pending payment. Nothing is sent.

Why the close was stopped

The decision step proposed a close once; the run ended at Escalate to level 2 (ESCALATE_L2). What each check said, in order:

• critic (step 29): approved
• policy guard (raise-only rules in code): CLOSE_FALSE_POSITIVE raised to ESCALATE_L2. Checks that raised or flagged: jurisdiction: block (watched jurisdiction: IR (payment reference mentions "[free text withheld]"))

Steps in order

Each line is one event from the run's trace (trace.jsonl.gz). The model is the one that served the call, as the signed receipt records it.

Model calls and receipts

Each signature was checked when this page was built, with the same code as npm run evidence:verify (Ed25519 over the receipt body in receipts.jsonl.gz); the build stops if one does not verify, is missing, or names a different model from the trace. The Nightshift runtime's receipt key is pinned in config/default.json, so signature valid, key pinned shows the receipt was not changed and that this runtime signed it; a receipt signed by any other key stops the build.

The whole run passes the same check: 260 receipts with valid signatures, 260 model calls in the trace that name a receipt, none missing and none naming a different model from its receipt.

Signing key fingerprint (first 16 hex of SHA-256): 1835d1eab9211f97.

Zetaris queries

The statements are exactly as the sealed decision record of this run keeps them (output_examples/close-stopped-by-policy-guard/decision-record.json; its hash matches the one the trace logged when it was sealed). The record keeps each statement and a hash of each row returned, not the rows themselves.

Check it yourself

Clone the repository and run npm run evidence:verify -- eval/runs/routed-20261023T133311Z. What the export left out: tokens, local paths, hostnames and addresses other than the local machine, usernames, e-mail addresses and secret environment values were removed from results.json and trace.jsonl.gz; receipts.jsonl.gz is untouched.