Euclid as an API: The Formal-Proof Layer
Every determination our platform produces — validated, validated with conditions, not validated — is discharged as a formal derivation: definitions, then assumptions, then numbered propositions, each citing a regulation section, an evidence item, or a previously established step, terminating in Q.E.D. The format is 2,300 years old and we treat it as an interface contract, because it has a property no other prose format has ever matched: a gap in justification is structurally visible. In ordinary expert prose, a missing warrant hides behind fluency. In a numbered derivation, a proposition that cites nothing is a compile error. That single property converts review from re-derivation to verification — which is the difference between auditing a conclusion and taking it on faith.
The problem with fluent conclusions
Ask a capable LLM for a model-validation determination and you get well-organized expert prose: findings, discussion, conclusion. It reads like the work product of a senior analyst, which is precisely the problem — it inherits the weaknesses of expert prose along with the register. Prose interleaves claims and justifications in whatever order reads well. It lets a conclusion rest on an antecedent that was gestured at but never established. It buries load-bearing assumptions in subordinate clauses. A skilled human reviewer can usually reconstruct the argument’s skeleton and spot the gaps — but that reconstruction is the expensive part of review, and it gets skipped exactly when volume is high and the prose is confident. Fluency is camouflage for missing warrants. The better the model writes, the better the camouflage.
The fix is not better prose. It is a format in which the skeleton is the document.
The oldest format in production
Euclid’s Elements organized mathematical knowledge into a discipline with four moves: state your definitions; declare your assumptions (postulates — the things taken as given); advance through numbered propositions, each justified only by definitions, postulates, or previously proven propositions; and close each argument with an explicit terminator — Q.E.D., that which was to be demonstrated. The format survived twenty-three centuries not out of reverence but because it solves a permanent problem: it makes an argument checkable step by step by someone less brilliant than its author. You do not need Euclid’s insight to verify Euclid’s proof. You need only confirm, line by line, that each step cites something already on the table and uses it legitimately. Insight is required to produce the derivation; only diligence is required to check it. That asymmetry is the entire economics of auditability, and it is exactly the asymmetry a regulator, a validator, or a court needs when reviewing a decision made by a system smarter or faster than the reviewer.
The proof layer as output contract
On our platform, the reasoning graph does its work — evidence gathering, deterministic computation, adversarial challenge, revision — and then the formal-proof layer discharges the determination in Euclid’s shape. Definitions come first: the regulatory terms of art in play, pinned to their sources — what “model,” “materiality,” and “effective challenge” mean under the guidance at hand. Assumptions are declared, not smuggled: the scope of the review, the data provided, the conditions taken as given — each one visible and therefore challengeable. Then the propositions, numbered, each carrying its warrant inline: a section anchor from the citation pack (§V outcomes analysis), an evidence item from the record ([E7], the back-test block), or a prior step (from Proposition 4). The deterministic tool outputs enter as what they are — established results the derivation may cite but not restate approximately. The chain terminates in the determination, and the Q.E.D. is not decoration: it is a machine-checkable claim that every proposition’s warrants resolve to something in the record.
That machine-checkability is what makes this an API rather than a house style. A derivation is data: steps, citations, dependencies. A checker can verify — without any model in the loop — that no step cites a nonexistent evidence item, that no step depends on a later step, that no proposition floats free of warrant, that the conclusion’s dependency graph actually reaches the definitions and evidence. None of this proves the reasoning is wise — a checker validates structure, not judgment, and a human reviewer still assesses whether Proposition 6 is a fair application of §V to the evidence it cites. But the reviewer now spends attention on judgment instead of archaeology. Review becomes verification. The re-derivation tax — the reason validation teams re-do AI work by hand — disappears.
Why bother, in one examiner question
Every argument for this layer compresses into the question an examiner eventually asks: “Walk me through how the system got here.” A system that produces fluent conclusions answers with a narrative reconstructed after the fact — the same epistemic status as an employee’s recollection of a decision made months ago. A system with a proof layer answers by handing over the derivation: here are the definitions we operated under, the assumptions we declared, the twelve numbered steps from evidence to determination, the section of the guidance each step stands on, and the checker’s confirmation that the chain is closed. One of these answers survives adversarial review. The other survives until someone reads it closely. And there is a quieter benefit upstream: a model that must emit warranted, numbered steps cannot drift into confident assertion without the drift becoming visible — the format itself polices the binding between confidence and reasoning. The proof layer is where epistemic integrity stops being a score and becomes a property of the artifact.
We did not adopt Euclid’s format out of nostalgia. We adopted it because twenty-three centuries of adversarial review have failed to find a better structure for one job: making it impossible to conclude more than you have established — and obvious when you try.