io.github.CSOAI-ORG/csoai

CSOAI — Council of AI

Check a supported signed measurement card free at councilof.ai/gspc-verify. Try one historical sample and return your result. Machine-readable catalogue: councilof.ai/catalog.json.

CSOAI — Council of AI — is the public measurement service operated by CSOAI Ltd, a company incorporated in England and Wales on 2 January 2026 (Companies House 16939677), founded by Nicholas Templeman. We run AI systems and digital rails against published instruments, grade deterministically where the method permits it, publish signed evidence and corrections, and keep unmeasured or uncheckable states visible. Verification is free. We measure; we do not certify, accredit, issue legal-compliance determinations, sell a rank, or take money from anything we rank.

How to read the board: measurement coverage and model-ranking separation are different determinations. TIE means the evidence does not justify a hierarchy; UNTESTED means no separation test is published yet; deterministic-fact axes have no model leader by design.

23 axes measured · 14 model comparisons: 0 separated · 7 TIE · 7 UNTESTED · 9 fact runs · TIE is TIE · not a certificate.

Independent AI-governance measurement. This repository is the live site, API and signing pipeline behind councilof.ai: the 23-axis GSPC board, Ed25519-signed measurement cards, the signed Merkle public root and its transparency-log witness, the corrections ledger, the A2A agent card, the x402 manifest, and the PyPI / npm readers. Measurement, not certification.

derived 2026-10-07T10:35:32Z by scripts/github/org-readme.py — every number on this page is read live from the URLs in that script; if this page and the API disagree, the API is right.

The board today

GET https://councilof.ai/api/gspc — schema csoai.gspc-axes/0.5 · totals.public_count = 23 axes · 23 measured

Counted from the axes array at derive time: 23 rows — MEASURED 23 — agrees with totals.axes. Separation over the 14 model-comparison axes: SEPARATED 0 · TIE 7 · UNTESTED 7. A TIE is not a win; UNTESTED is not a win; a facts run has no leader. Living stamp: SIGNED (did:web:csoai.org#board-attestation-1). Board data: CC-BY-4.0.

Card inventory (14 Oct 2026)

Dated snapshot, not a live count — the live count is /signed/card_index.json. A one-off scan of 8 of 9 storage locations on 14 Oct 2026 found 11,929 unique signed measurement cards, 7,994 with a VALID signature, and 335 live and verifiable on councilof.ai. Method, scope and the source summary: evidence/card-inventory-2026-10-14.md.

What a stranger can verify in four curls

# 1. the lid — the one sentence the board is allowed to say about itself
curl -s https://councilof.ai/api/gspc | python3 -c 'import sys,json; print(json.load(sys.stdin)["totals"]["lid"])'

# 2. the signed public root — Merkle root, leaf count, timestamp (card_count MUST equal len(card_sha256))
curl -s https://councilof.ai/root.json | python3 -c 'import sys,json; r=json.load(sys.stdin); print(r["merkle_root"], r["card_count"], len(r["card_sha256"]), r["as_of"])'

# 3. pin the card key from the DID document — never trust the key a card ships with
curl -s https://csoai.org/.well-known/did.json | python3 -c 'import sys,json,base64; k=[v for v in json.load(sys.stdin)["verificationMethod"] if v["id"].endswith("#card-attestation-1")][0]["publicKeyJwk"]["x"]; print(base64.urlsafe_b64decode(k+"="*(-len(k)%4)).hex())'

# 4. verify any card against that pinned key — three states only: VALID · INVALID · UNCHECKABLE
pipx run --spec 'csoai-gspc[verify]' csoai-gspc verify "$(curl -s https://councilof.ai/signed/card_index.json | python3 -c 'import sys,json; print(json.load(sys.stdin)["cards"][0]["card"])')"

The integrity stack

Four populations appear above on purpose and are never reconciled here: the signed-card index (335 via /signed/card_index.json), the living /api/cards registry (336), the public-root leaf count (319 via /root.json), and the Hub cells (live GET /api/hub-cards → .counts; currently 411/411/0). Quote each with its URL. Ceremony: card verify ≠ root inclusion — signed-index/root identifier overlap = 0; never sell “335 in the root.”

Non-self payers (publisher metric): distinct_nonself_payers = 2 all-time · 2 in 30 d · 2 settlements · publisher status MEASURED — read from /api/revenue. Payment principals do not establish independent customers, delivery, buyer acceptance or repeat use.

Install the readers

pip install csoai-gspc          # 0.2.20261007.1 — board, axis, verify, root, snapshot

MCP: use the hosted free-reader endpoint. Client setup, current tool list and examples.

Products

9 products read from docs/product/_INDEX.json (as_of 2026-09-06T06:00:18Z). A 402 means the door is metered by x402 and the amount appears only in that 402 challenge — never here, never on the board. Verification of every artefact is free.

Where the board is published

Pushed by scripts/spray/gspc-spray.py (daily, idempotent by as_of and fingerprint). The live root as_of at derive time was 2026-09-30T05:05:34Z; a surface that lags is shown lagging, not reconciled. Board data is CC-BY-4.0; the reader packages are Apache-2.0 / Apache-2.0.

G2 signed cards — 14 Oct 2026

29 new signed measurement cards (G2, merged in #3164) are served at https://councilof.ai/interop/mill-cards-signed/ and mirrored with an index at https://huggingface.co/datasets/csoai/gspc-signed-boards/tree/main/g2-2026-10-14.

• Root inclusion pending (#3165). These cards are not yet in a card root.
• Excluded: 2 care cards, whose results are parse-confounded and not citable. The qwen3:8b safety result is held and is not listed.
• Axes: governance 7 · conformance 6 · continuity 6 · openness 5 · provenance 4 · safety 1. Public base models: gemma3:12b, llama3.2:3b, mistral:7b, qwen2.5:0.5b, qwen2.5:3b, qwen2.5:7b, qwen3:8b.
• Verify any card free at https://councilof.ai/gspc-verify/. Measurement, not certification.

Source mirror. This repository is the GitHub source of record for source changes. A public mirror is also available at https://huggingface.co/datasets/csoai/councilof-ai-source; live public evidence remains at https://councilof.ai.

Hosting and deploy

Vercel is not the live host. The leftover Vercel Git links (csoai-v2-app, councilof-ai-src) were disconnected and those Vercel projects deleted on 31 Aug 2026.

Build (this repo):

npm run build:client
bash scripts/prerender-run.sh --dist dist/client --wait 900 --min 350
# GHA deploy.yml ships dist/client to Cloudflare Pages

Do not run npx vite build from the repo root (it picks up a dead src/). Do not vercel deploy this site.

Agents — paid artefacts (x402)

The board and verification stay free. Metered artefacts (issuance, evidence assembly, signed feeds) are on the x402 rail. Amounts live only in the HTTP 402 challenge — this README does not invent a price. A grade is never sold.

• Catalog: https://councilof.ai/api/x402
• Manifest: https://councilof.ai/.well-known/x402.json
• MCP: https://councilof.ai/mcp (commission_card and the other paid tools return a 402 as structuredContent until paid)

Independent evidence, free checks and paid artifacts

CSOAI is an independent evidence layer. The evidence contract follows identity → authority → policy → execution → effect → evidence → verification → freshness/correction → delivery/acceptance. Each link needs its own attributable record; a missing link stays unknown. Existing identity, policy, orchestration, telemetry and payment systems keep their roles. Current measurement methods and limits are published in the methodology and corrections ledger.

Start with free verification or connect the free MCP tools. Inspect a dated result and its stated signature, issuer, scope and freshness limits before requesting a paid artifact. Verification checks the supported evidence contract; it does not establish that every claimed action occurred, certify a system or establish legal compliance.

For a paid request, choose an existing artifact from the live catalogue, inspect that endpoint's HTTP 402 challenge, and decide whether its stated input, output, amount and limits meet your need. Payment covers the stated service, never a favourable grade, board position or certification. A 402 challenge is an offer, not a payment or a delivered result.

Commercial evidence

Record the UTC time of your read. Use the live revenue ledger for all-time and rolling-window non-self wallet-principal counts, settled amounts and repeat-payer counts. A wallet principal does not by itself identify an independent customer. Free requests, downloads, listings, operator tests and signatures do not establish sales or adoption.

Keep the stages separate: request → settlement → delivered artifact → buyer acceptance → repeat use. Delivery needs the requested output and its digest joined to the operation; acceptance needs an attributable buyer record. A settlement alone does not establish delivery, acceptance, recurring earnings or an IP valuation. SAFE contribution status is separate from CSOAI product use and must not be presented as adoption or endorsement.

Buyer integration guides

• Python (eth_account): https://github.com/CSOAI-ORG/csoai-x402-buyer-guide
• TypeScript (viem): https://github.com/CSOAI-ORG/csoai-x402-typescript-example
• Revenue catalog: https://github.com/CSOAI-ORG/csoai-x402-revenue
• Week-one report: https://github.com/CSOAI-ORG/csoai-blog-x402-revenue

Network and payment terms: read the existing endpoint's current HTTP 402 challenge and the live x402 manifest. Do not reuse a historical promotion or copied payment terms as a current quote.

Documentation

• Measurement body overview
• Methodology
• GSPC scoreboard
• Published measurements
• EU AI Act Article 50

What we never do

• Certify AI systems or issue compliance badges
• Sell ratings, ranking position, or early sight of grades
• Remediate or recommend fixes in exchange for fees
• Take money in either direction from anything we rank

Surfaces

License

MIT © CSOAI-ORG

Council of AI · CSOAI LTD · UK Companies House 16939677 · We measure. We sign. We re-attest.