Sanctions Desk gathers and checks the evidence for every sanctions-screening alert and recommends an outcome; a person with the right entitlement approves it. One alert, start to finish · The problem it works on

Replay of recorded runs. Nothing runs live here. Every value below is read from files committed in the repository. To run the desk yourself, follow the README quick start.

What happened: The local screener flagged 2 risk signals in customer.notes (relationship to listed party 0.9, alias or former name 0.5), which blocks a close; the decision step recommended ESCALATE_L2; the critic approved it; the policy guard let it stand. Outcome: Escalate to level 2 (ESCALATE_L2), as the label expects.

Outcomes: CLOSE_FALSE_POSITIVE = close as a false positive · ESCALATE_L2 = escalate to level 2 · NEED_MORE_INFO = ask for more information · RECOMMEND_BLOCK = recommend a block (two people must confirm). Raise-only: the policy guard can make an outcome more cautious, never less.

A held-out case (labels written before the run): the structured fields alone would close it, but the local screener found a relationship to the listed person in the customer note, and the case was escalated.

Outcome

Desk recommendation

Escalate to level 2 (ESCALATE_L2)

Label in the case file

Escalate to level 2 (ESCALATE_L2) (eval/cases/heldout4.json, case HO4-001)

Compared with the label

matches the label

Code's first finding

Escalate to level 2 (ESCALATE_L2)

Critic

1 round(s), final: approved

Model calls

4 (2 local, 2 cloud); 4 with a signed receipt, all verified

Run

heldout4-sys4-routed-20261024T024523Z, policy version 8, 33 steps in 31.7 s

Case note from the case file: The structured fields alone meet the false-positive definition, but the note says the account is run for her uncle, Valeriy Igorevich Limarenko (synthetic), named in full as the listed person, with the relation word a few words away from the name.

Checks along the way

No close was proposed in this run. What each check said:

• screener (local model, reads the free text on the laptop): 2 risk signal(s), 2 at or above 0.5 (blocking a close), 2 of them not grounded: relationship_to_listed_party 0.9 at customer.notes:85-115 (not grounded); alias_or_former_name 0.5 at customer.notes:0-14 (not grounded); documentary: customer.notes claim (lacks a check reference, a document number, a date); injection not found
• critic (step 30): approved
• policy guard (raise-only rules in code): ESCALATE_L2 stands. Checks that raised or flagged: screener_grounding: flag; screener: flag

Steps in order

Each line is one event from the run's trace (trace.jsonl.gz). The model is the one that served the call, as the signed receipt records it.

Model calls and receipts

Each signature was checked when this page was built, with the same code as npm run evidence:verify (Ed25519 over the receipt body in receipts.jsonl.gz); the build stops if one does not verify, is missing, or names a different model from the trace. The Nightshift runtime's receipt key is pinned in config/default.json, so signature valid, key pinned shows the receipt was not changed and that this runtime signed it; a receipt signed by any other key stops the build.

The whole run passes the same check: 56 receipts with valid signatures, 56 model calls in the trace that name a receipt, none missing and none naming a different model from its receipt.

Signing key fingerprint (first 16 hex of SHA-256): 1835d1eab9211f97.

Zetaris queries

This run's export keeps the table, the row count and the Zetaris query id of each read, not the statement text; the statements are not reconstructed here.

Check it yourself

Clone the repository and run npm run evidence:verify -- eval/runs/heldout4-sys4-routed-20261024T024523Z. What the export left out: tokens, local paths, hostnames and addresses other than the local machine, usernames, e-mail addresses and secret environment values were removed from results.json and trace.jsonl.gz; receipts.jsonl.gz is untouched.