TRUSCOR
Had an AI incident? Get rated
Research and open source

Proof, in public.

Our research and code are open, so anyone can check them. Published as an open preprint in August 2026 under CC BY 4.0, negative results included.

01Page-state capture

10 out of 10 vs 0 out of 10.

Left: the page state that existed. Right: what a fixed-wait recorder logged. Our recorder captured the real state every time; the fixed-wait approach recorded a state that never existed, every time.

Results

What the record has shown.

Each figure links to the file or paper it comes from.

The recordOpen preprint · CC BY 4.0 · negative results included
Results and sources
10 out of 10 vs 0 out of 10Page-state captureOur recorder captures the page state that actually existed. A common fixed-wait approach recorded a state that never existed, every time.Source: preprint · link pending ↗
8 of 8Recovery scenariosZero false successes. The record never claims something happened that didn’t.Source: preprint · link pending ↗
144/144 · 120/120 · 96/96Published evidence studiesLabels matched, with zero incomplete traces accepted as reproduced.Source: preprint · link pending ↗
50,000 eventsSigned tracesVerified independently in two programming languages.Source: preprint · link pending ↗
CC BY 4.0Open preprint · August 2026Negative results included.Source: preprint · link pending ↗
Open source

SOVA OSS. Run it yourself.

SOVA is the Serbian and Russian word for owl. SOVA OSS is the free, public instrument: map, test, record, replay and forensics. Its results are self-assessments. Only TRUSCOR issues the independent score.

sova demo sleeper finds a planted hidden behaviour with no model, API key or network, and writes a signed .sova-trace and .sova file.

SOVA OSS on GitHub ↗ Apache-2.0 · pre-alpha v0.1 · tested on Windows, macOS and Linux 
# Run it yourself
git clone https://github.com/Gautam-R-Patil/S.O.V.A---OSS---TRUSCOR
cd S.O.V.A---OSS---TRUSCOR
uv sync --locked
uv run sova --version
uv run sova demo sleeper
Quick start from the SOVA OSS README · read 19 Oct 2026
“A short test cannot prove an agent safe.”
SOVA OSS README, “What SOVA will not claim” · read 19 Oct 2026 · Source ↗
Roadmap and dated demand

What the rules require, and when.

Each capability answers a dated rule, ruling or market gap. The corpus grows with every consented rating, and two sector capabilities follow the mandates that create them.

In place Available
Everything a rating, a record and an investigation needs, in use today.
·O.W.L containment proof on every run ·Effect-verified SOVA Black Box recording, neutral custody and escrow ·Court-ready exports (BSA s.63, FRE 902) and the discovery-and-cure ledger ·Fault-finding by replay and the evidence freezer ·Self-expiring ratings, the statistical grading protocol and verifiable scoring ·Test-vs-production gap, production-calibrated fault injection and the reconstructability measure ·Oversight drills and shared vendor validation for Indian lenders ·Guardrail and AARM effect tests, tool and skill ratings, claim re-verification ·Mandate-fidelity tests, agent payment evidence, canaries and memory records ·Claimed and observed layers, the incident profile and ISO/IEC 24970 mapping in .sova
Driven by · Supreme Court Part B ruling (22 May 2026); RBI draft (Jun 2026); CERT-In advisory (15 Oct 2026); EU Product Liability Directive; Texas TRAIGA; Colorado and New York
The corpus Being built
De-identified and consented. It grows with every rating and recording, and feeds the data products.
·The TRUSCOR corpus: what AI systems did, how they failed and what it cost ·SOVA Threat Intelligence Feed ·India AI Incident Index ·Failure rates with denominators ·Dependency map ·AI system history reports ·AI event designation
Driven by · 2,369 US insurance exclusion records; reinsurers’ concentration on a few foundation models; EU Art. 72 monitoring template
Later Coming soon
Two capabilities that follow the sector mandates which create them.
·Sector test batteries: child-safety audits for companion chatbots, AI-labelling conformance, India’s TEC 57050 fairness standard, a security “crash test” of AI app builders, healthcare-pilot outcomes, autonomy-readiness exams and a collusion-propensity index for pricing agents ·Robot event recorder: SOVA Black Box for AI-driven machines
Driven by · EU Machinery Regulation (20 Jan 2027); EU Annex I duties (2 Aug 2028); California SB 1119 audits (1 Jan 2029)
India first · the sequence
1Attest O.W.L containment.
2Ship SOVA Black Box exports a Part B expert can sign.
3Open the lender validation utility, with drift retests and oversight drills, ahead of RBI’s final circular.
4Take insurance-exclusion disputes as the first forensic engagements.
Dated demand
22 May 2026 India’s Supreme Court rules that a proven private cyber-forensics expert may sign the BSA s.63 Part B certificate.
Jun 2026 RBI’s draft makes every lender validate vendor AI “regardless of any certification the vendor provides”.
15 Oct 2026 CERT-In’s advisory describes AI agents that broke out of testing into live systems, and says it will work with evaluation agencies.
9 Dec 2026 The EU Product Liability Directive applies. Failing to disclose evidence can create a presumption of defect.
1 Jan 2027 Colorado’s AI duties begin, with New York alongside.
20 Jan 2027 The EU Machinery Regulation covers AI safety functions.
2 Sep 2027 The EU Art. 72 post-market monitoring template.
2 Dec 2027 EU high-risk duties.
2 Aug 2028 EU Annex I duties.
1 Jan 2029 California SB 1119 audits.
Open research and data

The format is open. The data compounds.

The corpus is de-identified and consented, quiet and never covert. One client’s findings never leave that client, and contributors get access on equal terms.

The SOVA stackHighlighted: the parts behind this page

Published August 2026 under CC BY 4.0, not peer-reviewed. Capsules, traces, a per-event SHA-256 hash chain and a signed manifest. .sova-trace 0.1 is implemented in SOVA OSS.

Available
SOVA OSS Apache-2.0

About 60,000 lines of Python. All the verbs, the arena, the registry and forensics exist in code; live validation so far is thin.

Available
.sova incident profile .sova · SOVA OSS

A measurement-only incident record mapped to the EU Art. 73 template, California SB 53 and the OECD incident framework, released through SOVA OSS so it can become the common format.

Available
India AI Incident Index The TRUSCOR corpus

A structured record of AI incidents in India.

Being built
Failure rates with denominators The TRUSCOR corpus

Failure rates per 1,000 consequential actions, by agent class, version and autonomy level, from consented Black Box and SOVA data.

Being built
SOVA Threat Intelligence Feed The TRUSCOR corpus

De-identified failure patterns for security teams and licensees. Attack techniques change weekly.

Being built
Dependency map The TRUSCOR corpus

Which AI systems really depend on which models and frameworks, observed from fingerprints and aggregated: the model-exposure schedule reinsurers need.

Being built
AI event designation The TRUSCOR corpus

After an upstream model change or failure, a consented panel is retested and the event’s footprint published, so reinsurance contracts can define an “AI event”.

Being built
Being built = the TRUSCOR corpus and its data products, which grow with every consented rating.

Get rated.

Five fields and a short call. We reply within one working day.