Governance as trust¶
Nobody trusts commercial aviation because pilots are infallible. They are not, and the industry has never pretended otherwise. We trust flight because trust has been engineered around fallible operators: checklists that make the right sequence the easy one, flight recorders that capture what actually happened, and incident review that turns every failure into a rule the next crew inherits. One of the safest ways to travel runs on human beings who make mistakes — inside a system designed so that mistakes are caught, recorded, and learned from.
Rosetta needs the same move, because the usual source of trust in a compiler is unavailable to it.
The problem: determinism is off the table¶
A traditional compiler is trusted for one reason: it is deterministic. Same input, same output, the same way every time. You do not audit a compiler's judgment because it has none — it applies fixed rules, every time.
When the authors of a system are humans and AI models — a discovery conversation here, a model-drafted recommendation there — that guarantee is unavailable in principle, not just in practice. The same question can produce different answers; judgment enters at points no proof can cover. The industry's two usual responses both fail. Review everything manually does not scale — it recreates the expert bottleneck the system exists to remove. Trust the model does not audit — when a reviewer asks why, there is no answer to point to.
The substitute: three mechanisms¶
Rosetta replaces the missing guarantee with engineered trust, built from three plain mechanisms.
Provenance on everything. Every statement in the system carries its origin: verified evidence, human judgment, or machine inference — kept distinct, never blended. A reader always knows which of the three they are looking at. A model's suggestion can be useful, but it is labeled as a suggestion until a human or the evidence says otherwise.
Decision traces. Decisions are recorded at the moment they are made — with their context, the alternatives considered, and the reasons for the choice. Six months later, "why is it built this way?" is a lookup, not an archaeology project conducted through the memories of whoever is still on the project.
A maturity ladder with gates. Content starts life unproven and earns its standing through explicit review gates: from freshly proposed, to reviewed, to validated in the field. Nothing silently becomes load-bearing. A claim that has only ever been drafted cannot masquerade as one that has survived a real engagement, because the system tracks the difference and promotion requires a recorded decision.
The payoff: answers from the artifact¶
Recall the scene from the delivery gap: a trust review asks who authorized this action, over which data, under which policy — and the team reconstructs answers in interviews, because the build artifacts cannot speak. That reconstruction is where projects stall.
Under governance, the auditor's question is answered from the artifact itself. The provenance says where each statement came from. The decision trace says who chose, when, among what alternatives. The gate record says what standard the content had met before anyone relied on it. No interviews, no archaeology — the audit trail was built as the work was done, not assembled after the fact.
That is the trade at the heart of Rosetta: where a classical compiler earns trust by determinism, this discipline earns it by process — recorded, attributable, and inspectable. Fallible authors, engineered trust.
The artifact all of this governs is described in the Spec Manifest; every term on this page gets a one-line definition in the glossary.