The signed authority that Trustfall Lite checks against and that Trustfall Deep is anchored to.
This page displays a compact index derived from the canonical signed registry. The canonical authority remains attest.fallrisk.ai/registry.json; verify any record there against the published JWKS.
| Model | Family | Arch | Evidence | Enrolled | Status |
|---|
The Fall Risk registry does not treat all evidence as interchangeable. A structural-evidence record and an artifact-identity record answer different questions. Structural evidence supports claims about which model was measured. Artifact identity supports claims about which bytes match a signed record. Both are useful. They are not the same claim.
This distinction follows the evidence-class framework introduced in What Counts as Proof? Admissible Evidence for Neural Network Identity Claims. Each signed record carries an explicit evidence_class field so consumers can match the claim they make to the evidence the record carries.
Each registry version is audited when it lands. Current state is reported in the strip above; the per-version audits below are the historical record of how each lane was validated at deploy time.
165 Hugging Face records · audit completed May 2026
Across 54,120 same-seed cross-model pairwise comparisons in the 165-record Hugging Face structural-evidence lane, zero observed pair distances fell below ε = 1.003 × 10-4. The closest pair, Starling-LM-7B-beta and OpenChat-3.5-0106, was separated by 9.82× ε. Both are Mistral-7B fine-tunes in the OpenChat training lineage — the expected hard case for sibling-model separation.
The observed cross-model distance range spans roughly 6,475× between the closest and farthest pairs. This audit covers the structural-evidence lane only. It is an empirical registry audit result, not a formal proof that true FAR is zero.
46 Ollama records · audit completed May 2026
The Ollama artifact-identity lane passed uniqueness and integrity checks across 46 signed records. Model IDs, artifact manifest digests, and evidence digests were unique. Unauthorized artifact-hash collisions: zero.
One full-registry artifact-hash collision is documented and authorized: google/gemma-3n-E2B-it and google/gemma-3n-E4B-it share an artifact hash because Gemma 3n uses a MatFormer nested architecture. Artifact identity does not claim runtime structural identity, upstream provenance, or model behavior. Trustfall Lite uses these records to verify local artifact bytes against the signed registry; runtime structural identity is the Trustfall Deep path.
A registry record does not say a model is safe. It says the claim is signed.
Two products. One escalation path.
Lite verifies what model artifact you have on disk. Deep verifies which model is actually computing at runtime. Both anchor to the records on this page.
Trustfall Deep conversations route through integrations@fallrisk.ai. Trustfall Lite ships as an open-source client; no contact needed.
model_id, evidence_digest, and evidence_class. Sensitive fields (fingerprint vectors, thresholds, prompt bank, hooking sites) are never included in the public record. Verify the JWS against attest.fallrisk.ai/.well-known/jwks.json.
default allow = false allow { input.attestation.model_id == input.anchor.model_id input.attestation.status == "active" input.attestation.issuer == "https://attest.fallrisk.ai" }
permit( principal, action == Action::"inference", resource ) when { context.attestation.model_id == context.anchor.model_id && context.attestation.status == "active" };
Your policy engine already knows what to do.
Three commands cover the canonical authority chain: inspect a signed record, check the manifest digest the API serves, and inspect the derived index this page renders from. All three should agree on the manifest digest byte-for-byte.