GKOS: AI governance specification and assurance engineering
Status: Public developmental specification; executable mechanism-level checks available. Complete profile qualification and independent interoperability validation remain outstanding.
- Problem
- When an AI system recommends or takes an action, ordinary logs show that a call happened. They rarely show which evidence it used, what context it saw, who had authority to approve it, or how the result can be challenged and replayed.
- My part
- I drafted the specification (with AI drafting assistance) and lead its design: provenance, deterministic validation, reproducible context, bounded delegation and records of decisions and actions. I direct the schemas, fixtures and conformance runner and approve each published edition.
- Exists now
- Published edition v0.82.1 (25 September 2026) with 62 permanent requirements and 28 gate codes, JSON schemas, a requirements registry, and an adapter-neutral conformance runner. CI runs the runner on Linux and Windows with Node 22 and 24.
- Results
- Mechanism-level checks pass, including a clean-process context replay and a mutation corpus that covers all 28 gate codes. The executable suite covers only part of the profile catalogue, so no conformance profile is qualified yet.
- Limits
- No qualified profile, no public second implementation, and no independent interoperability validation. Proposed NIST, ISO and EU AI Act mappings are informative drafts under review, not established alignment.
Evidence GKOS specification repository; GKOS v0.82.1 release (developmental specification, public working draft); GKOS master specification at commit b308ff7; GKOS conformance mechanisms at commit b308ff7; GKOS conformance-claims policy at commit b308ff7; GKOS canonical serialization and context-replay contracts at commit b308ff7; GKOS concept DOI (all versions, Zenodo)