State OS: Concept and Architecture

How to read this paper

State OS is a research project. This paper describes a design and the first prototype of it. To keep the two apart, statements are worded in one of four ways:

• Fact: an external claim with a numbered source. Each source was opened on 4 October 2026, and each quotation and figure was compared with the source again on 5 October. The source list says where only an abstract or an official summary could be read.
• Official statement or press report: what an institution or a newspaper says, attributed as such.
• Our proposal: a design choice. It can be argued with, but it is not a claim about the world.
• Hypothesis: something the project is built to test and has not yet shown.

Four words describe the stage of any part of the project: concept (written down), prototype (code that runs locally), pilot (operation with real editors and outside verifiers), and live deployment (public operation). Section 12 says where each part stands. In short: the concept and specification are written, a research prototype exists and runs locally, and there is no public software release, no pilot and no live deployment.

1. The problem

Governments analyse their decisions, and a good deal of that analysis is public. What is published arrives in pieces, from different bodies, at different times and in different formats.

The Netherlands is a clear example. The Council of Ministers publishes a decision list after its meetings, described on the government site as an overview of all decisions taken, with a brief explanation of each [1]. A Dutch parliamentary news service reported in April 2021 that the Council had agreed to make its agenda and decision list public [3]. Statistics, consolidated legislation and parliamentary records are each available from their own machine-readable services [47][48][49]. The CPB, the Dutch economic policy analysis bureau, publishes macroeconomic projections [5]. Elsewhere, New Zealand's official guidance says that Cabinet papers are to be published no later than 30 business days after final Cabinet decisions, unless there is good reason not to [4].

What the public record does not usually keep is one structured, time-stamped object that links, for a single decision:

evidence → assumptions → alternatives considered → forecasts → decision → outcome.

For a given decision, a later reader typically cannot recover:

1. the evidence as it stood at the time, since official statistics are revised and a later reader sees later versions;
2. which alternatives were considered, and under which values each would have been preferred;
3. what was expected to happen, in a form that can be scored afterwards;
4. whether the analysis came from people, from models, or from both;
5. what happened next, measured against what was expected.

The fourth gap is growing. The Associated Press reported in 2023 that a city ordinance in Porto Alegre, Brazil, had been drafted with ChatGPT and passed by the council without that being disclosed [8]. In September 2026 Gulf News reported that the UAE Cabinet had approved a system of 32 specialised AI assistants to analyse policies and legislation and to provide recommendations to ministers [9]. The report says nothing about whether their outputs will be published.

The problem is narrow. It is not that governments lack analysis, and it is not that decisions are secret. Some confidentiality is lawful and deliberate. The problem is that the links between the pieces are not recorded as one checkable object, and nobody binds expectations to a decision before the outcome is known. Without that, "we would have done better" can always be argued after the fact. Registering a plan before the results are in is the standard defence against hindsight [44].

2. The proposal

State OS is our proposal for a public shadow infrastructure. It has no governmental authority and claims none. It would run beside the observable decisions of one real government and keep a persistent, checkable record of each covered decision.

The research question is:

Can a public shadow infrastructure, with no governmental authority, produce a persistent, verifiable and comparable record of a real government's decisions, one that is complete under a fixed coverage rule, verifiable by outsiders, honestly scored where scoring is possible, and not mistaken for authority?

The name is a project name and is used the same way throughout. It does not describe an operating system for a state, and the project does not claim that a state can or should be run by software.

3. What State OS is not

The project began from a broader idea and was narrowed by a review of the evidence. Each exclusion below binds the design.

Not a digital twin of a country. No integrated, validated socio-economic model of a state was found. A study of CovidSim, an epidemiological model on which the UK government relied in part in early 2020, found that of 940 input parameters, the output was most sensitive to a subset of 19, that uncertainty in those inputs was magnified by up to 300%, and that the model showed substantial bias against observed data [10]. The component is therefore called a data platform with scenario models (section 6).

Not an executable constitution. Germany's debt brake is among the most arithmetic of constitutional rules. In 2023 the Federal Constitutional Court declared a supplementary budget act void, on grounds that included a missing factual connection between the declared emergency and the measures taken, and a breach of the principle of annual budgeting [11]. No arithmetic check would have caught either. The Dutch parliamentary inquiry into the childcare-benefits affair found legislation that was "spijkerhard" (rigid) and lacked a hardship clause [12]. A faithful encoding of that law would have reproduced the rigidity. State OS therefore never outputs "constitutional" or "unconstitutional".

Not a synthetic stand-in for citizens or parties. Studies of language models asked to answer as demographic groups report less variation than real surveys and results that shift with prompt wording and over a three-month period [13], substantial misalignment with the views of US demographic groups [14], and a tendency to "misportray and flatten" identity groups [15]. The alternatives in a State OS record are therefore authored position models. They are not the voice of any party or constituency.

No automatic legitimacy. A cross-national experiment found that transparency had "a subdued and sometimes negative effect on trust in government" [16]. Another study called the idea of a straightforward positive link between transparency and legitimacy "naïve" [17]. State OS keeps transparency as an accountability duty. It does not treat transparency as a source of trust.

No clean line between human and machine. The Court of Justice of the EU held that producing an automated probability score is itself automated decision-making where a third party "draws strongly" on it [18]. In the UK Post Office litigation, the High Court found the original Horizon system "not remotely robust" [19]; the people who relied on its output were formally the decision-makers throughout. Human authority is never cleanly separate from machine analysis. State OS proposes to measure the human contribution instead of asserting it (section 9).

No claims about what would have happened. The effect of a policy that was not enacted is never observed: both potential outcomes cannot be seen on the same unit [20]. State OS never states that an alternative "would have worked" or "would have been better".

Other exclusions. State OS is not a government-in-waiting, a virtual president, a voting aid or a campaign tool, and it does not output a single recommended option. It produces no outputs about individuals. Our proposal is that it takes no government or party money. These limits are also legal ones: the EU AI Act lists as high-risk any AI system intended to influence the outcome of an election or the voting behaviour of natural persons [21]. The paper makes no claim about the legality or wisdom of running such a system inside a government.

4. The Decision Record

The atomic object is the Decision Record: an append-only, time-stamped document about exactly one official decision. It records what was decided; on what evidence, as it stood then; under which encoded legal constraints; which authored alternatives were constructed on the same evidence; the strongest case against each option; what is forecast on the path actually taken; who reviewed the record and what they changed; and, later, how the forecasts resolved.

The form borrows from software practice. In Architecture Decision Records, a reversed decision is kept and marked as superseded, not deleted [22]. Every individual field in a Decision Record has a precedent somewhere. What we have not found is a precedent that binds all of them into one object per decision.

4.1 Seven labels

Every statement in a record carries exactly one label. The labels decide what can be checked and how.

4.2 Main fields

Three rules follow from this layout. The real decision appears first, in the government's own words. Every alternative carries its framework version and a fixed disclaimer. Only enacted-path questions have resolution rules, because only they can be scored.

5. Architecture

5.1 State Git: the provenance layer

State Git is our name for a Git-based record that is signed, mirrored and externally witnessed. It holds mirrored official sources, Decision Records, snapshot manifests, model and prompt manifests, dissent and retrospectives. It is a ledger of what was recorded and when. It is not a mechanism by which law changes. Consolidated EU legal texts carry a standard notice that they are "purely … a documentation tool" with "no legal effect" [23], and State Git makes the same disclaimer about itself: in State OS, a merge means "recorded", never "adopted".

Three design points matter.

Two time axes. Every mirrored text and data point carries a valid time (when a rule applied, or which period a statistic describes) and a record time (when State OS retrieved it). A record must be judged against what was knowable on the decision date.

Detection, not prevention. The Certificate Transparency standard states that its logs "do not themselves prevent misissuance" but let interested parties detect it [24]. On GitHub, branch protection rules do not by default apply to repository administrators [25]. State OS therefore never says "history cannot be rewritten". It says that rewrites are detectable by outside witnesses, which holds only if someone is actually watching. Integrity is also not correctness: a perfectly logged record can still be wrong.

Honest reproducibility. One published test ran the same prompt 1,000 times at temperature zero and obtained 80 distinct outputs; with batch-invariant inference all 1,000 were identical [26]. A separate study found accuracy varying by up to 15% between runs under nominally deterministic settings [27]. Providers also retire models, after which requests to them fail [28]. So the design promises three levels: artefact integrity for all records; statistical re-execution where a model is still served or open-weights; bitwise re-execution only on a pinned open-weights path.

The integrity tools are existing ones, used as they are: Git commit signing with Sigstore and its Rekor transparency log [29], OpenTimestamps [30] and RFC 3161 time-stamping [31]. A signature shows who recorded something and when. It does not show that the content is true or lawful.

5.2 State Data Platform and scenario models

The State Data Platform is the ingestion layer for official data. Every item carries its source, version, retrieval time, hash and licence. Our proposal is that it holds no personal data beyond the names of public officials acting in office, and builds no composite "state health" index.

Scenario models produce the SIMULATION and COUNTERFACTUAL content. The rule is reuse before build. Open tax-benefit microsimulation already exists, including PolicyEngine [32], OpenFisca [33] and EUROMOD [34]. Whether any of them offers a usable Dutch model is an open dependency and is not assumed. Where no established model exists, the fallback is a simple documented model with stated assumptions and ranges, or a qualitative estimate. Whether integrated state-level modelling adds anything beyond sectoral models is a hypothesis the first version does not assume.

5.3 The Shadow Analysis Cabinet

The analysis is divided among six portfolio agents (fiscal and economy; labour and social affairs; health and care; housing, infrastructure and climate; education; justice and interior) and five function agents:

Scoring is not done by an agent. It is a separate, open, deterministic procedure run by a person who does not configure the forecasting.

These agents are not ministers and the set is not a cabinet in any constitutional sense. They hold no authority, nobody delegated anything to them, and their outputs are inputs to a human-edited record. The design uses no ministry titles, state insignia or ministerial personas.

Two things about such agents are unresolved, and the project claims neither: whether portfolio agents produce alternatives that experts find useful, and whether machine-written dissent makes analysis more robust. The best-documented public-sector evaluation we found, of the UK government's Consult tool, reports that its themes matched human reviewers' exactly for 60% of responses, against 62% agreement between two human reviewers in the team's earlier internal testing, and that reviewers added themes 1,671 times and removed them 763 times [35]. That shows logging of human intervention is practical. It does not show that the approach transfers to policy alternatives.

Agents that read outside documents are exposed to prompt injection. OWASP states that it is unclear whether fool-proof prevention exists [36], and one published attack reached a 90% success rate with five malicious texts per target question [37]. In the design, agents that read untrusted text have no tools and no write access, and retrieved passages are quoted verbatim.

6. Authored Value Frameworks

The alternatives are the most distinctive output of State OS and the one with no source of legitimacy. This is the project's largest unsolved problem, and the paper states it plainly:

• They cannot be validated by outcomes, because the counterfactual is never observed [20].
• Nobody authorised them. The OECD's principles for independent fiscal institutions say such bodies "should be precluded from any normative policy-making responsibilities to avoid even the perception of partisanship" [7].
• They borrow no consent. The CPB's comparison of Dutch election manifestos rests on parties choosing to take part: the CPB states that participation is voluntary and that the publication "is not a voting guide" [5]. A framework written for a political tradition by an outside team has no such consent.

The design response is to make authorship explicit. Each alternative is written under one of four Authored Value Frameworks: social-democratic, liberal, conservative, and technocratic (cost-effectiveness). They are analytical models. They are not named after, attributed to or endorsed by any real party.

Each framework is a versioned document with named authors and declared interests, weights over a fixed list of value dimensions, ordered priority rules, red lines, scope notes, and a review by at least two external people who identify with that tradition. All frameworks work on the same snapshot, the same models and the same budget constraint. When two alternatives differ, the record must say whether the difference comes from values, model, forecast or facts. An unexplained difference is a defect.

Even with outside reviewers, "the conservative framework" is always someone's conservatism. Until independent bodies author or own the frameworks, the alternatives remain the founders' analysis, transparently recorded, and the design requires the site to say so.

7. The Constitutional Clerk

The constitutional layer is not a "superprompt". As designed it has four parts: a knowledge base of provisions in their official text; a test suite of regression cases; a narrow formal layer limited to procedure, deadlines, eligibility, numeric fiscal rules and competence; and human-review triggers for every interpretive clause.

The Clerk emits exactly one of three outputs per rule:

The main risk is false reassurance. The design answers it with mandatory historic test cases. One is the German budget ruling above [11]. Another is the Dutch SyRI case, in which the District Court of The Hague declared risk-profiling legislation to have no binding effect as contrary to Article 8 of the European Convention on Human Rights [38]; the correct Clerk output for such a case is HUMAN_REVIEW_REQUIRED. The design also requires publishing the rate of false reassurance on historic cases and measuring agreement with a blinded panel of lawyers. Neither measurement has been made.

8. The forecast ledger and the counterfactual boundary

Of everything State OS would produce, only forecasts of observable events on the enacted path can count as evidence of skill. A scoring rule is "proper" if the forecaster maximises the expected score by reporting their true belief [39]. Our proposal is that every forecast is fixed before its outcome with an exact resolution rule, time-stamped, and later scored beside a naive baseline and, where one exists for the same variable and horizon, an official forecast. The published object is a table of all forecasters on identical questions. There is no leaderboard.

Three limits are built in.

A null result is the likely outcome. By our own estimate, detecting a realistic difference in skill needs from about 150 to several thousand independent forecasts, and a first year would produce on the order of 60 to 150 correlated ones. Twelve months could show calibration, bias and integrity. It could not show superiority over official forecasters. The project commits to publishing a null result.

Historical replays are not evidence. Language models memorise economic data from before their training cutoff, and neither instructions nor masking prevent recall; in the authors' words, forecasting ability "is non-identified when the model has seen the realized values" [40]. Any replay of past decisions is a pipeline test and is labelled as contaminated.

Forecasts can move outcomes. Predictions that support decisions may influence what they predict [45]. The design publishes forecasts only after the official decision, keeps the question list fixed, and publishes no aggregate credibility score.

The counterfactual boundary is the firmest rule in the project. The following are forbidden as outputs, metrics or dashboard elements: any "win rate against the government"; any share of cases where an alternative "would have been better"; simulated outcomes of alternatives presented as results; any single recommended option.

9. The human editor

The editor is a component of the system. There are two reasons.

The first is legal. Under Article 50(4) of the EU AI Act, AI-generated text published to inform the public on matters of public interest must be disclosed as such, unless it has undergone human review or editorial control and a natural or legal person holds editorial responsibility for publication [21]. Our proposal is to do both: disclose and name an editor.

The second is that "a human in the loop" proves little. One set of experiments found that AI explanations increased the chance that people accepted an AI recommendation "regardless of its correctness" [41]. A review concluded that automation bias "cannot be prevented by training or instructions" [42]. Three experimental studies in the Netherlands tested both automation bias and selective adoption of algorithmic advice that matches stereotypes [43]. They found no automation bias. They found selective adoption in one study and not in a later one with civil servants, and where they found it, it was no stronger for algorithmic advice than for a human expert's. The evidence is mixed. Rubber-stamping and selective acceptance are both risks to measure; neither is an established effect.

So the design measures the loop. For every section of every record the editor chooses accept, modify or reject and gives a reason. The hashes of the machine draft and the published text are both stored. Known, harmless errors are seeded into drafts at a pre-registered rate and the catch rate is published. A sample goes to blind second review.

10. Who controls State OS

In a first version, the founding team does. It writes the constitutional tests, the frameworks, the coverage rule and the interface, and holds the keys. No design for a team of a few people removes this. The aim is to make that control visible, logged, constrained, contestable and forkable.

The proposed controls include: protected branches with no bypass; two reviewers on protected paths; outside mirrors and external time-stamps; a published, mechanical coverage rule with a ledger of skipped items; a scorer separate from the forecaster; separate model lineages for proposers, dissent and the Clerk; a pause-only kill switch with no delete path; no personal data; and a public role registry.

What these controls do not buy should be said as clearly. With a small team, "two approvals" means two of the same people. A patient insider is not reliably detectable. And nothing technical prevents a government or a party from citing a record to lend neutral-looking support to a decision it had already taken.

The honest claim for a first version is that the founders' control would be visible and forkable. It would not be plural. Plural control (keys held across independent institutions, an external scorer, frameworks owned by independent bodies) is written down as a later stage so that failure to reach it is visible.

11. Why the Netherlands, and what we found

The choice of reference country is technical only. It is not a judgment about Dutch politics or government. The Netherlands was chosen because every data layer a Decision Record needs could be retrieved from primary sources. The weekly decision list is the decisive asset, since it maps directly onto the reality field.

In late September 2026 the project re-tested access and measured real volume. These are the project's own results. They have not been independently replicated, and the volume coding was done by machine without human double-coding.

• Access. Every intended source answered in machine-readable form. No bot protection was met and none was bypassed.
• A correction. The decision list is served as a PDF through the government's open publication platform [2], not as a web page as the specification had assumed. That platform's robots file disallows general crawlers and no terms for automated use of its interface were found. Our position is that scheduled automated retrieval needs written confirmation from the publisher first. That confirmation has not been obtained.
• Volume. 48 decision lists from 29 August 2025 to 18 September 2026 contained 2,030 items, with a median of about 40 per list. Under the project's coverage rule, roughly 900 a year are in scope, a median of about 18 per working week. That is about double the planning assumption, so a capacity limit with pre-registered random sampling would apply in most weeks.
• What cannot be known at decision time. In a four-item test, the budget envelope was unknowable a week after each decision, and bill texts were not yet public. A record made at that point can document only the Council's stated intent and needs a mandatory later revision.
• Statistics versions. The statistics service returns current versions only [47]. Evidence "as it stood then" can be guaranteed only from data the project has itself stored going forward.
• Forecast questions. No sub-annual budget-execution series was found, so that question class must be dropped or redefined. The official projections are annual, so there is no official baseline for monthly questions.
• Elections. The Dutch Electoral Council gives 17 March 2027 for the provincial elections and 24 May 2027 for the Senate election [46]. Our recommendation is not to begin public operation before the latter date.

Known limits of the choice: only the Dutch text is authoritative, so translation is a logged step and a tracked source of error; the decision lists go back only to 2021; and the Netherlands has no national policy rate.

12. What exists today

The prototype run. On 2 October 2026 the pipeline ran end to end on eight real decisions taken from the Council of Ministers lists of 28 August, 4 September and 11 September 2026. According to the run output, it produced eight draft Decision Records, each of which passed the project's own automated schema and consistency checks. Each draft contains six options, dissent against all six, Clerk outputs and registered forecast questions.

The eight records are draft outputs of that one run. A record that passes the checks has the required fields, cites only sources in its snapshot and is internally consistent. Passing says nothing about whether its legal flags are correct, whether the analysis is sound, or whether a record of this kind would work in use. The specific limits are these:

• No draft has been read by a human editor. All eight are held at the review gate. The translations have not been checked by a person.
• No record can be published as it stands. Three independent conditions block it and are enforced in the code: there is no named editor; every value framework is a draft with no reviewers; and nothing has been externally time-stamped.
• All eight are marked unstable. Repeated generation on identical inputs gave different outputs each time. The stability rule did its job by flagging this.
• Input data. The models received published documents only: the decision texts from the Council's lists [2], the constitutional text from the official repository [49], and aggregate statistics from the CBS open-data service [47]. No personal data were used beyond the names of ministers as they appear in those documents. The eight decisions are real; none is synthetic. The Clerk calls no model. Its regression suite holds five short test descriptions written by the project, three modelled on historic cases and two synthetic controls.
• Model providers. The specified configuration did not run. A first attempt on OpenAI models stopped during the third record when the account's credit ran out; its two completed drafts are kept separately and are not among the eight. The completed run used the two providers that were available that day on the project's existing access: a Yandex model for the portfolio, alternatives and forecast roles, and Google Gemini models for dissent. Two lineages therefore ran, but the run does not show that using several model lineages improves anything.
• Open questions about those providers. The Gemini endpoint was a free-tier service, and the project's own assessment is that its data terms do not suit unpublished drafts. According to the project's access notes, the Yandex service processes requests outside the EU. The data sent were public, so the project rates the data risk as low. The governance question is separate and is undecided: whether a transparency record about Dutch government decisions should depend on a provider based in Russia at all. A pilot would need a decision on that, and a configuration that a named editor and outside reviewers accept.
• The forecasts are not yet evidence of anything. They were registered in a local hash chain only. Without an external time-stamp, a local chain cannot show that it was not built afterwards.
• Residual leakage. The decision texts and the constitutional text were fixed as of each decision date. Statistics were filtered to that date but served at today's version, so later revisions of earlier periods may be present. Each draft records this.
• The budget envelope was unknown for seven of the eight.

The run shows that the record format can be produced mechanically from real Dutch decisions, and that the publication gates hold. It does not show that the records are accurate, legally correct, useful or fair, and it is not evidence that the design works in practice.

13. How the first version would be judged

Seven objectives are fixed in advance. The thresholds are proposals; several await measurement before they are registered.

At a twelve-month evaluation the project would publish the conclusion that State OS does not work if coverage fails, if integrity fails, if honest scoring fails, if human judgment turns out not to be real, if readers take it for authority, or if the record can only be sustained by effort beyond pre-registered time and cost limits. If the frameworks fail (P4), the alternatives layer is withdrawn and the system continues as a provenance and forecast record. If the Clerk fails (P5), it is withdrawn until redesigned.

Three things are declared in advance not to count as failure, because the project never claimed them: no forecasting advantage over official or naive baselines; no evidence that trust increased; no uptake by government. One result counts as inconclusive: if no outside party verifies any record during the year, the claim that rewrites are detectable was untested, not passed.

14. Prior work and what is new

State OS invents none of its components. Credit belongs to the institutions and projects that built them.

Not new: analytical agents organised by portfolio; open policy engines; law text under version control; signed records; a human authority layer; evaluating forecasts against outcomes; comparing programmes on a common model.

The candidate contribution is integrative and procedural: one publicly witnessed, pre-registered record per real decision, binding evidence, models, authored alternatives, dissent, enacted-path forecasts, human review and two-axis provenance, kept in shadow mode beside a real government. We found no precedent that combines all of these. That is a statement about what our review found, not a claim of priority.

Two cautions go with it. The most distinctive element, the alternatives, is the one that cannot be scored. And novelty justifies a research prototype. It does not justify talk of a new form of government.

15. Conclusions and practical implications

1. The useful unit is the decision. Most of what is needed to audit a decision is already published somewhere. What is missing is the binding. A per-decision record is a smaller and more testable goal than a model of a state.
2. Pre-registration is the part that cannot be added later. Evidence snapshots and forecasts have value only if they are fixed, and witnessed, before the outcome. A system that starts recording afterwards is commentary.
3. Alternatives need authors. Machine-written options "for" a political tradition have no consent behind them. Any project that publishes such alternatives should name who wrote the framework, who reviewed it, and who can correct it.
4. Flag and cite; never rule. A constitutional check that can say only "no flag on the rules we encoded" is honest about its reach. One that says "constitutional" is not.
5. Measure the editor. A named human signature is a legal requirement in some settings. Whether that human exercised judgment is an empirical question, and it can be instrumented.
6. People are the binding constraint, not code. The prototype was built in days. The editor, the framework authors and reviewers, the independent scorer, outside mirror operators and legal counsel are what a real pilot waits on.
7. For public bodies considering AI-assisted analysis, the transferable parts are the record format, the labelling of what can and cannot be scored, and the logging of human changes. None of these needs a shadow system to adopt.

16. Limitations and open questions

Limitations of this paper. It was drafted with AI assistance and has not been peer reviewed. The evidence review behind it was also AI-assisted and has not been audited by anyone independent of the project. The external facts cited here were re-opened on 4 October 2026. On 5 October each quotation and figure was compared with its source again, this time against the full text wherever an open copy exists. Three wordings were corrected as a result (sources 10, 35 and 43). Two works could be read only as abstracts (17 and 42), one only as an official summary (35), and some facts rest on press releases or press reports; these are worded accordingly. The prototype results are the project's own and unreplicated. Passing automated checks says nothing about whether a record is accurate.

Limitations of the project. No record has been reviewed, witnessed or published. No role other than the founder's is filled. The value frameworks have no authors or reviewers. No forecast has resolved and no scoring has been done. The model configuration that ran is not the one specified, and model plurality is unvalidated. The publisher's confirmation for automated retrieval is outstanding. Dutch legal questions (editorial responsibility, defamation under a no-delete design, election-period rules, data protection for named persons) are unanswered.

Open questions that only operation can answer.

1. How much editorial time does one record need, and what weekly capacity follows?
2. Do editors' modify and reject rates and seeded-error catch rates hold up over months, or does acceptance become selective?
3. Do people who hold a tradition recognise the framework written for it?
4. Do domain experts find the alternatives complete and useful?
5. Do the targets of dissent recognise it as the strongest case against their position?
6. How well does the Clerk agree with lawyers, and how often does it falsely reassure?
7. How large are the breaks in forecast records when a model is replaced?
8. How often do translation errors change a flag, a premise or a forecast?
9. Do outside mirror operators and verifiers actually watch?
10. Which interface elements reduce confusion about authority?
11. Should a record be kept per list item or per legal instrument, given that the same instrument returns to the Council at several stages?

Disclosure

This paper and the documents it is adapted from were drafted with AI assistance (Claude, a model made by Anthropic). The author holds editorial responsibility for the published text. Anthropic is one of several candidate model providers for State OS, which is a conflict of interest; in the prototype run described in section 12, no Anthropic model was used. State OS has no governmental authority, no government or party funding, and no partnership or affiliation with any public body, including those whose data and publications are cited here.

Sources

All sources were opened on 4 October 2026 and checked again on 5 October 2026. Each entry says so where less than the full text was read.

1. Rijksoverheid. "Besluitenlijst ministerraad 17 april 2026." https://www.rijksoverheid.nl/documenten/2026/04/17/besluitenlijstministerraad17april2026
2. open.overheid.nl. Publication platform of the Dutch government; search results for "besluitenlijst ministerraad" (PDF documents published by the Ministry of General Affairs). https://open.overheid.nl/overheid/openbaarmakingen/api/v0/zoek?zoektekst=besluitenlijst%20ministerraad
3. Parlement.com. "Agenda en besluitenlijst ministerraad worden openbaar." 9 April 2021. https://www.parlement.com/nieuws/202104/agenda-en-besluitenlijst-ministerraad-worden-openbaar
4. Te Kawa Mataaho Public Service Commission (New Zealand). "Proactive release." https://www.publicservice.govt.nz/guidance/official-information/proactive-release
5. CPB Netherlands Bureau for Economic Policy Analysis. "Charted Choices 2027–2030." https://www.cpb.nl/en/publication/charted-choices-2027-2030 ; projections listed at https://www.cpb.nl/en
6. CPB. "Publications related to the Tweede Kamerverkiezingen." https://www.cpb.nl/en/timeline-elections
7. OECD. Recommendation of the Council on Principles for Independent Fiscal Institutions, OECD/LEGAL/0401 (2014), principle 2.1. https://legalinstruments.oecd.org/api/print?ids=301&lang=en
8. Associated Press (Jeantet and Savarese), via KSAT. "Brazilian city enacts an ordinance that was secretly written by ChatGPT." 30 November 2023. https://www.ksat.com/tech/2023/11/30/brazilian-city-enacts-an-ordinance-secretly-written-by-a-surprising-new-staffer-chatgpt/
9. Gulf News. "UAE launches AI Cabinet adviser as Sheikh Mohammed bin Rashid sets priorities for new government season." 2 September 2026. https://gulfnews.com/uae/government/uae-launches-ai-cabinet-adviser-as-sheikh-mohammed-bin-rashid-sets-priorities-for-new-government-season-1.500661016
10. Edeling, W. et al. (2021). "The impact of uncertainty on predictions of the CovidSim epidemiological code." Nature Computational Science 1, 128–135. https://www.nature.com/articles/s43588-021-00028-9
11. Bundesverfassungsgericht. Press Release No. 101/2023, "Second Supplementary Budget Act 2021 is void" (2 BvF 1/22), 15 November 2023. https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/EN/2023/bvg23-101.html
12. Parlementaire ondervragingscommissie Kinderopvangtoeslag. Verslag "Ongekend onrecht", 17 December 2020. https://www.tweedekamer.nl/sites/default/files/atoms/files/20201217_eindverslag_parlementaire_ondervragingscommissie_kinderopvangtoeslag.pdf
13. Bisbee, J., Clinton, J. D., Dorff, C., Kenkel, B., Larson, J. M. (2024). "Synthetic Replacements for Human Survey Data? The Perils of Large Language Models." Political Analysis 32(4). Read as the authors' open preprint; the published abstract matches. https://doi.org/10.1017/pan.2024.5
14. Santurkar, S. et al. (2023). "Whose Opinions Do Language Models Reflect?" https://arxiv.org/abs/2303.17548
15. Wang, A., Morgenstern, J., Dickerson, J. P. "Large language models that replace human participants can harmfully misportray and flatten identity groups." https://arxiv.org/abs/2402.01908
16. Grimmelikhuijsen, S., Porumbescu, G., Hong, B., Im, T. (2013). "The Effect of Transparency on Trust in Government: A Cross-National Comparative Experiment." Public Administration Review 73(4). Read as the authors' repository copy. https://doi.org/10.1111/puar.12047
17. de Fine Licht, J., Naurin, D., Esaiasson, P., Gilljam, M. "When Does Transparency Generate Legitimacy? Experimenting on a Context-Bound Relationship." Governance 27. Abstract only. https://doi.org/10.1111/gove.12021
18. Court of Justice of the European Union. Judgment of 7 December 2023, Case C-634/21 (SCHUFA Holding). https://publications.europa.eu/resource/celex/62021CJ0634
19. Bates & Ors v Post Office Ltd (No 6: Horizon Issues) [2019] EWHC 3408 (QB). https://www.judiciary.uk/wp-content/uploads/2019/12/bates-v-post-office-judgment.pdf
20. Holland, P. W. (1986). "Statistics and Causal Inference." Journal of the American Statistical Association 81(396). https://doi.org/10.1080/01621459.1986.10478354
21. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 50(4) and Annex III point 8(b). https://publications.europa.eu/resource/celex/32024R1689
22. Nygard, M. (2011). "Documenting Architecture Decisions." https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions
23. EU Publications Office. Consolidated text 02016R0679-20160504, standard notice on consolidated texts. https://publications.europa.eu/resource/celex/02016R0679-20160504
24. Laurie, B., Messeri, E., Stradling, R. RFC 9162, "Certificate Transparency Version 2.0." https://www.rfc-editor.org/rfc/rfc9162.txt
25. GitHub Docs. "About protected branches." https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches
26. Thinking Machines Lab (2025). "Defeating Nondeterminism in LLM Inference." Lab blog; not peer reviewed. https://thinkingmachines.ai/blog/defeating-nondeterminism-in-llm-inference/
27. Atil, B. et al. "Non-Determinism of 'Deterministic' LLM Settings." https://arxiv.org/abs/2408.04667
28. Anthropic. "Model deprecations." https://docs.anthropic.com/en/docs/about-claude/model-deprecations
29. Sigstore. gitsign, https://github.com/sigstore/gitsign ; Rekor overview, https://docs.sigstore.dev/logging/overview/
30. OpenTimestamps. https://opentimestamps.org/
31. Adams, C. et al. RFC 3161, "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)." https://www.rfc-editor.org/rfc/rfc3161.txt
32. PolicyEngine. policyengine-uk repository. https://github.com/PolicyEngine/policyengine-uk
33. OpenFisca. https://openfisca.org/en/
34. European Commission, Joint Research Centre. "EUROMOD." https://joint-research-centre.ec.europa.eu/euromod_en
35. Incubator for AI (UK). "Evaluating Consult: An AI Tool for Enhanced Public Consultation Analysis." Official summary only; the full report was not read. https://ai.gov.uk/blogs/evaluating-consult-an-ai-tool-for-enhanced-public-consultation-analysis/
36. OWASP. Top 10 for LLM Applications 2025, LLM01 Prompt Injection. https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/blob/main/2_0_vulns/LLM01_PromptInjection.md
37. Zou, W. et al. "PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models." https://arxiv.org/abs/2402.07867
38. Rechtbank Den Haag, 5 February 2020, ECLI:NL:RBDHA:2020:1878 (SyRI), English translation. https://data.rechtspraak.nl/uitspraken/content?id=ECLI:NL:RBDHA:2020:1878
39. Gneiting, T., Raftery, A. E. (2007). "Strictly Proper Scoring Rules, Prediction, and Estimation." Journal of the American Statistical Association 102(477). https://sites.stat.washington.edu/raftery/Research/PDF/Gneiting2007jasa.pdf
40. Lopez-Lira, A., Tang, Y., Zhu, M. "The Memorization Problem: Can We Trust LLMs' Economic Forecasts?" https://arxiv.org/abs/2504.14765
41. Bansal, G. et al. (2021). "Does the Whole Exceed its Parts? The Effect of AI Explanations on Complementary Team Performance." https://arxiv.org/abs/2006.14779
42. Parasuraman, R., Manzey, D. (2010). "Complacency and Bias in Human Use of Automation: An Attentional Integration." Human Factors 52(3). Abstract only. https://doi.org/10.1177/0018720810376055
43. Alon-Barkat, S., Busuioc, M. "Human–AI Interactions in Public Sector Decision Making: 'Automation Bias' and 'Selective Adherence' to Algorithmic Advice." Journal of Public Administration Research and Theory. https://arxiv.org/abs/2103.02381
44. Center for Open Science. "Preregistration." https://www.cos.io/initiatives/prereg
45. Perdomo, J. C., Zrnic, T., Mendler-Dünner, C., Hardt, M. "Performative Prediction." https://arxiv.org/abs/2002.06673
46. Kiesraad (Dutch Electoral Council). Provincial elections, https://www.kiesraad.nl/verkiezingen/provinciale-staten ; Senate election, https://www.kiesraad.nl/verkiezingen/eerste-kamer
47. CBS (Statistics Netherlands). Open data service, table 86141NED (consumer prices). https://opendata.cbs.nl/ODataApi/odata/86141NED/TableInfos
48. Tweede Kamer. Open data service, Besluit entity. https://gegevensmagazijn.tweedekamer.nl/OData/v4/2.0/Besluit?$top=1
49. Dutch official publications repository. Manifest for the Constitution (BWBR0001840). https://repository.officiele-overheidspublicaties.nl/bwb/BWBR0001840/manifest.xml