pith. sign in

arxiv: 2606.25120 · v1 · pith:TRVSE57Pnew · submitted 2026-06-23 · 💻 cs.SE · cs.CY

Fifty Years of Specification Completeness: What Aviation Certification Tells AI Governance About Epoch Limits, Proof Surfaces, and the Structural Gap

Pith reviewed 2026-06-25 22:45 UTC · model grok-4.3

classification 💻 cs.SE cs.CY
keywords AI governanceaviation certificationspecification completenessDO-178Cgovernance documentsstructural requirementsepoch limitsproof surfaces
0
0 comments X

The pith

Aviation certification has required three structural properties in governance documents since 1992, yet no AI governance framework imposes them on individual documents.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that aviation standards like DO-178C and DO-330 enforce structured linkage between specifications and evidence, context-bounded validity that triggers revalidation on changes, and an objective evidence architecture defining what counts as sufficient proof. These properties have been operational for decades in safety-critical software but are absent from AI governance artifacts such as system prompts, policy files, or task envelopes. A sympathetic reader would care because this creates a structural gap where AI governance can be deployed without the completeness checks that aviation treats as mandatory. The requirements are transferable at the document level even though AI systems are non-deterministic, and the paper maps them to epoch limits on validity, proof surfaces as feedback, and the lack of completeness rules in current AI instruments. An empirical companion study found 37 percent of AI governance documents fall below the threshold these properties define.

Core claim

Aviation has operationalised three structural requirements for governed software systems since 1992: structured governance linkage between governing specifications and operational evidence, context-bounded validity that triggers revalidation when operational context changes, and an objective evidence architecture that defines what proof means and what makes it sufficient. These requirements appear in DO-178C and DO-330 and are enforced through FAA and EASA certification. No existing framework requires these structural properties as intrinsic properties of individual AI governance documents.

What carries the argument

The three structural requirements from DO-178C and DO-330—structured governance linkage, context-bounded validity with revalidation triggers, and objective evidence architecture—treated as intrinsic properties that can be evaluated in the static governance document independently of the governed system.

If this is right

  • AI governance documents would need explicit traceability links between policies and the evidence that supports them.
  • Changes in the operational context of an AI system would require revalidation of the governing document itself.
  • AI governance would have to define what constitutes objective evidence and the threshold for sufficiency.
  • These document-level properties would apply even when the underlying AI system is non-deterministic.
  • Frameworks such as PromptQ can embed the three requirements directly into the governance document layer.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The structural gap may explain why many AI governance instruments fail to provide reliable accountability when deployed.
  • Treating governance documents as static artifacts with measurable completeness could allow independent auditing tools to flag incomplete policies before deployment.
  • The 37 percent figure from the companion study suggests a large fraction of existing AI governance would require redesign to meet the threshold.
  • Extending the same document-level checks to other high-stakes domains such as medical devices or autonomous vehicles could be tested by direct mapping of their standards.

Load-bearing premise

The governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs.

What would settle it

An AI governance document that lacks all three properties yet produces equivalent traceability, revalidation, and evidence outcomes to documents that meet the aviation requirements.

read the original abstract

Aviation software certification has operationalised three structural requirements for governed software systems since 1992: structured governance linkage between governing specifications and operational evidence, context-bounded validity that triggers revalidation when operational context changes, and an objective evidence architecture that defines what proof means and what makes it sufficient. These requirements appear in DO-178C and DO-330 and are enforced through FAA and EASA certification. No existing framework requires these structural properties as intrinsic properties of individual AI governance documents. A system prompt, an AGENTS.md file, a governance policy, or a task envelope can be deployed without satisfying any of the three requirements aviation has enforced for three decades. Aviation is the most technically rigorous instance: its standard-setting bodies have acknowledged that their frameworks break down for AI systems, yet none requires these properties of individual governance documents. Aviation's structural requirements break down at the system level because AI systems are non-deterministic, but remain transferable at the document level: the governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs. The paper maps DO-178C's traceability architecture, DO-330's requalification triggers, and DO-178C's objective evidence requirements onto three structural findings: epoch limits on governance document validity, proof surfaces as the revalidation feedback mechanism, and the absence of structural completeness requirements in AI governance instruments. An empirical companion (arXiv:2604.21090) found that 37% of AI governance documents fall below the structural quality threshold. PromptQ's seven-principle framework operationalises these requirements at the governance document layer.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 1 minor

Summary. The paper claims that aviation certification (via DO-178C and DO-330, enforced by FAA/EASA since 1992) has long required three structural properties of governed software documents—structured governance linkage (traceability between specifications and evidence), context-bounded validity (revalidation triggers on context change), and objective evidence architecture (definition of sufficient proof)—but that no AI governance instruments (system prompts, AGENTS.md files, policies, or task envelopes) impose these as intrinsic document properties. It asserts these properties break down at the non-deterministic system level yet transfer to the static document level, mapping them to 'epoch limits,' 'proof surfaces,' and a 'structural gap' in AI governance. An empirical companion paper is cited for a 37% figure on sub-threshold documents, and the author's PromptQ framework is presented as operationalizing the requirements.

Significance. If the transferability argument and absence claim hold after addressing the independence assumption, the paper would supply a concrete, standards-grounded analogy from a mature certification domain to critique the structural completeness of AI governance artifacts. This could usefully inform document-level requirements in AI systems engineering. The explicit mapping from established aviation standards provides a falsifiable starting point, and the reference to companion empirical data offers some external grounding, though overall significance is limited by the lack of internal verification of the universality claim.

major comments (3)
  1. [Abstract] Abstract, second paragraph: The central assertion that 'No existing framework requires these structural properties as intrinsic properties of individual AI governance documents' is unsupported by any systematic survey of AI governance instruments in the manuscript; the 37% empirical result is entirely deferred to the external companion paper arXiv:2604.21090, leaving the 'absence across all' claim without direct evidence here.
  2. [Transferability paragraph (post-abstract)] Paragraph beginning 'Aviation's structural requirements break down at the system level...': The load-bearing claim that the three requirements 'remain transferable at the document level' because 'the governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs' receives no argument or redefinition. Aviation traceability, requalification triggers, and objective evidence are defined relative to deterministic code-path behavior; the manuscript does not show how these apply to AI documents without statistical reinterpretation of 'evidence' or 'context,' rendering the independence assumption unexamined.
  3. [Mapping section] Mapping section (DO-178C traceability architecture to epoch limits; DO-330 requalification to proof surfaces): The operationalization introduces the new terms 'epoch limits' and 'proof surfaces' without demonstrating that they preserve the original aviation requirements rather than redefining them ad hoc; this weakens the transfer claim at the point where the analogy is made concrete.
minor comments (1)
  1. [Abstract and introduction] The abstract and introduction introduce 'epoch limits,' 'proof surfaces,' and 'structural gap' without a dedicated definitions subsection or table contrasting them to the original DO-178C/DO-330 terms; a short comparison table would improve clarity.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive comments, which help clarify the evidential basis and argumentative structure of the transfer from aviation standards to AI governance documents. We respond to each major comment below and indicate where revisions will strengthen the manuscript.

read point-by-point responses
  1. Referee: [Abstract] Abstract, second paragraph: The central assertion that 'No existing framework requires these structural properties as intrinsic properties of individual AI governance documents' is unsupported by any systematic survey of AI governance instruments in the manuscript; the 37% empirical result is entirely deferred to the external companion paper arXiv:2604.21090, leaving the 'absence across all' claim without direct evidence here.

    Authors: We agree that the manuscript does not contain an independent systematic survey of AI governance instruments. The absence claim is grounded in the empirical sampling and threshold analysis reported in the companion paper (arXiv:2604.21090). We will revise the abstract and the opening paragraphs to state explicitly that the claim rests on the companion empirical results rather than a comprehensive review conducted within this manuscript, thereby removing any implication of standalone verification here. revision: yes

  2. Referee: [Transferability paragraph (post-abstract)] Paragraph beginning 'Aviation's structural requirements break down at the system level...': The load-bearing claim that the three requirements 'remain transferable at the document level' because 'the governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs' receives no argument or redefinition. Aviation traceability, requalification triggers, and objective evidence are defined relative to deterministic code-path behavior; the manuscript does not show how these apply to AI documents without statistical reinterpretation of 'evidence' or 'context,' rendering the independence assumption unexamined.

    Authors: The manuscript asserts transferability on the basis that governance documents are static artifacts whose internal structure (linkage, validity bounds, evidence definitions) can be inspected without executing the governed system. We accept that this requires explicit justification rather than assertion. We will expand the paragraph to argue that the three properties are syntactic and semantic features of the document itself—traceability links between sections, explicit context-change triggers, and enumerated sufficiency criteria—none of which presuppose deterministic runtime behavior. This keeps the evaluation at the document layer and avoids any statistical reinterpretation of evidence or context. revision: yes

  3. Referee: [Mapping section] Mapping section (DO-178C traceability architecture to epoch limits; DO-330 requalification to proof surfaces): The operationalization introduces the new terms 'epoch limits' and 'proof surfaces' without demonstrating that they preserve the original aviation requirements rather than redefining them ad hoc; this weakens the transfer claim at the point where the analogy is made concrete.

    Authors: The terms are presented as direct structural analogues: epoch limits map the context-bounded validity requirement of DO-330, and proof surfaces map the objective evidence architecture of DO-178C. To make the preservation explicit rather than implicit, we will revise the mapping section to include a concise side-by-side table showing, for each aviation requirement, the corresponding document-level property retained in the new terminology. This will demonstrate continuity of intent without ad-hoc redefinition. revision: partial

Circularity Check

0 steps flagged

No significant circularity; derivation rests on external standards

full rationale

The paper derives its three structural requirements directly from the independent external standards DO-178C and DO-330 (FAA/EASA), which predate the work and are not authored by the present author. The transferability assertion at the document level is presented as a direct consequence of the static nature of governance artifacts, without any equation, parameter fit, or self-citation chain that reduces the claim to the paper's own inputs. PromptQ is introduced only as an operationalization of the already-stated requirements, not as a premise that defines them. The companion empirical paper supplies a supporting statistic but is not invoked to justify the core mapping or the independence claim. No load-bearing step matches any of the enumerated circularity patterns.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 2 invented entities

The central claim rests on the assumption that aviation standards supply transferable structural templates and on the introduction of two new conceptual entities without independent falsifiable tests.

axioms (1)
  • domain assumption Aviation certification frameworks (DO-178C, DO-330) have successfully enforced structured governance linkage, context-bounded validity, and objective evidence for deterministic software since 1992.
    Invoked in the opening paragraph as the source of the three requirements.
invented entities (2)
  • epoch limits no independent evidence
    purpose: To encode context-bounded validity that triggers revalidation when operational context changes.
    Mapped from DO-330 requalification triggers; no independent evidence supplied beyond the mapping.
  • proof surfaces no independent evidence
    purpose: To serve as the revalidation feedback mechanism defined by objective evidence architecture.
    Mapped from DO-178C objective evidence requirements; no independent evidence supplied beyond the mapping.

pith-pipeline@v0.9.1-grok · 5832 in / 1383 out tokens · 27149 ms · 2026-06-25T22:45:02.682077+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

21 extracted references · 4 canonical work pages · 1 internal anchor

  1. [1]

    and Bishop, P

    Bloomfield, R. and Bishop, P. (2010). Safety and Assurance Cases: Past, Present and Possible Future—an Adelard Perspec- tive. In: Dale, C. and Anderson, T. (eds) Making Systems Safer. Springer, London. pp. 51-67. DOI: 10.1007/978-1-84996-086-1_4

  2. [2]

    and Claviere, A

    Damour, M., de Grancey, F., Gabreau, C., Gauffriau, A., Ginestet, J-B., Hervieu, A., Huraux, T., Pagetti, C., Ponsolle, L. and Claviere, A. (2021). Towards Certification of a Reduced Footprint ACAS-Xu System: a Hybrid ML-based Solution. Proceedings of SAFECOMP 2021. URL: https://hal.science/ hal-03355299v1/file/main.pdf

  3. [3]

    CoDANN I: Concepts of Design Assurance for Neural Networks

    EASA (2020). CoDANN I: Concepts of Design Assurance for Neural Networks. European Union Aviation Safety Agency. March 2020. URL: https://www.easa.europa.eu/en/document- library/general-publications/concepts-design-assurance-neural- networks-codann

  4. [4]

    CoDANN II: Concepts of Design Assurance for Neural Networks

    EASA (2021). CoDANN II: Concepts of Design Assurance for Neural Networks. European Union Aviation Safety Agency. May 2021 (updated January 2024 with Appendix B). URL: https://www.easa.europa.eu/en/document-library/general- publications/concepts-design-assurance-neural-networks- codann-ii

  5. [5]

    Advisory Circular AC 20-115D: Airborne Software Development Assurance Using EUROCAE ED- 12 and RTCA DO-178

    FAA (2017). Advisory Circular AC 20-115D: Airborne Software Development Assurance Using EUROCAE ED- 12 and RTCA DO-178. Federal Aviation Administration. URL: https://www.faa.gov/documentLibrary/media/Advisory_ Circular/AC_20-115D.pdf

  6. [6]

    Pro- ceedings of ERTS 2024

    Gabreau,C.,Teulières,M-C.,Jenn,E.etal.(2024).Astudyofan ACAS-Xu exact implementation using ED-324/ARP6983. Pro- ceedings of ERTS 2024. URL: https://hal.science/hal-04584782

  7. [7]

    and Yu, D

    He, J. and Yu, D. (2026). OpenKedge: Governing Agentic Mutation with Execution-Bound Safety and Evidence Chains. arXiv:2604.08601

  8. [8]

    and Weaver, R

    Kelly, T. and Weaver, R. (2004). The Goal Structuring Notation—A Safety Argument Notation. Proceedings of the Dependable Systems and Networks 2004 Workshop on As- surance Cases. URL: https://www.semanticscholar.org/paper/ 4983e7610482057785cdf5312b48caf28b1f69ca

  9. [9]

    and Wellbrock, J.A

    Koch, C. and Wellbrock, J.A. (2026). Beyond Task Success: An Evidence-Synthesis Framework for Evaluating, Governing, and Orchestrating Agentic AI. arXiv:2604.19818

  10. [10]

    Lincoln, S. (2025). DO-178 Compliance Considerations for Artificial Intelligent Software.AIAA SciTech Forum, AIAA 2025-

  11. [11]

    https://doi.org/10.2514/6.2025-2511

  12. [12]

    Careful Adoption of Agentic AI Services

    CISA/NSA/ASD/CCCS/NCSC (2026). Careful Adoption of Agentic AI Services. Joint guidance, 1 May 2026. URL: https://www.cisa.gov/resources-tools/resources/careful- adoption-agentic-ai-services

  13. [13]

    Self-assessment guide for artificial intelligence (AI) systems

    CNIL (2022). Self-assessment guide for artificial intelligence (AI) systems. Commission Nationale de l’Informatique et des Libertés. 24 August 2022. URL: https://www.cnil.fr/en/self-assessment- guide-artificial-intelligence-ai-systems

  14. [14]

    Framework Act on the Development of Artificial Intelligence and Establishment of Trust

    Korea (2025). Framework Act on the Development of Artificial Intelligence and Establishment of Trust. Enacted 21 January 2025, in force 22 January 2026. Source: Korean Law Information Center (Korean Ministry of Government Legislation)

  15. [15]

    AI Guidelines for Business Ver1.2

    METI/MIC (2026). AI Guidelines for Business Ver1.2. Min- istry of Economy, Trade and Industry and Ministry of In- ternal Affairs and Communications, Japan. 31 March 2026. URL: https://www.meti.go.jp/shingikai/mono_info_service/ ai_shakai_jisso/pdf/20260331_12.pdf

  16. [16]

    Pothon, J-C. et al. (2013). DO-330/ED-215 tool qualification document. AdaCore. URL: https://www.adacore.com/uploads/ books/do-330-ed-215-tool-qualification-document.pdf

  17. [17]

    DO-178C: Software Considerations in Airborne Systems and Equipment Certification

    RTCA (2011). DO-178C: Software Considerations in Airborne Systems and Equipment Certification. RTCA Inc

  18. [18]

    DO-330: Software Tool Qualification Considera- tions

    RTCA (2011). DO-330: Software Tool Qualification Considera- tions. RTCA Inc

  19. [19]

    Zietsman, C. (2026). Structural Quality Gaps in AI Governance Prompts. arXiv:2604.21090. DOI: 10.48550/arXiv.2604.21090

  20. [20]

    Zietsman, C. (2026). governance-prompts-v1: Gov- ernance Prompts Empirical Corpus. Available at: https://github.com/czietsman/nuphirho.dev/tree/dcb7036/ experiments/governance-prompts-v1

  21. [21]

    Zietsman, C. (2026). The Specification as Quality Gate: Three Hypotheses on AI-Assisted Code Review. arXiv:2603.25773. DOI: 10.48550/arXiv.2603.25773