# Models Propose, Oracles Dispose

## A generated claim is a proposal. Nothing a model produces becomes evidence until something the model does not control has had its chance to say no.

*Zain Dana Harper, July 2026*

## 1. The rule

The rule fits in four words: models propose, oracles dispose. Everything else I have to say is commentary on where those four words draw the line.

A model may draft, translate, summarize, and search. All of that is welcome in my shop, and none of it is evidence. Between a model's output and the evidence layer, the layer where results live, where claims get cited and built on and trusted without being re-checked, there has to stand an independent check, and the check has to be the kind of thing that can say no. Not a reviewer skimming for tone. Not a second model agreeing, because a second model agreeing is a second proposal. A mechanism the proposer does not control, whose refusal actually stops the claim at the door, and whose refusal is written down when it happens.

The phrasing sits deliberately close to the old proverb, man proposes, God disposes, because the structure is the old structure. The proposer can be brilliant, tireless, and right most of the time, and the disposition still belongs to something else. What changed is not the structure but the economics. Proposals used to be scarce, so treating a confident one as halfway to a finding was survivable. Machines made proposals nearly free, and a discipline calibrated for scarce proposals fails quietly under abundant ones.

An evidence layer is any place downstream work trusts without re-checking. That is what makes it a layer instead of a pile. The moment a generated result lands there on its own authority, every later consumer inherits a claim nobody disposed of, and the inheritance compounds. So the rule holds at the door, structurally, not as a request that everyone be careful.

## 2. A receipt that re-derives

The place I hold this line hardest right now is a compiler. A program built with it does not just print results; it can emit a receipt, a sealed record of what ran, what came out, and which invariant the run was checked against. The verifier's job is not to read that record and nod. Its job is to re-derive: whatever can be recomputed from the sealed facts gets recomputed and compared, the invariant is checked again, the sealed exit of the run is checked against a re-run. Agreement is a verdict, not a formality. One schema holds this shape across five kinds of computation, from fully deterministic runs and closed-form probability through seeded randomness to sampled estimates and budgeted search, and the sampled cases carry their sample counts inside the seal, because an estimate without its denominator is a mood.

Some facts cannot be re-derived exactly, and the honest move there is not to fake it. Wall-clock time is the plain example: the verifier re-measures, then reports the sealed value and the fresh one side by side without forcing them to agree, because pretending a re-measurement is a re-derivation would be the exact overclaim this whole apparatus exists to refuse. A receipt states what was checked and how, and nothing stronger. The nulls stay honest. It is slower than trust and more annoying than confidence, and that is not the price of the discipline, it is the discipline.