CSOAI — Council of AI

23 axes measured · 14 model comparisons: 0 separated · 7 TIE · 7 UNTESTED · 9 fact runs · TIE is TIE · not a certificate.

Independent AI-governance measurement. This repository is the live site, API and signing pipeline behind councilof.ai: the 23-axis GSPC board, Ed25519-signed measurement cards, the signed Merkle public root and its transparency-log witness, the corrections ledger, the A2A agent card, the x402 manifest, and the PyPI / npm readers. Measurement, not certification.

derived 2026-10-07T10:35:32Z by scripts/github/org-readme.py — every number on this page is read live from the URLs in that script; if this page and the API disagree, the API is right.

The board today

GET https://councilof.ai/api/gspc — schema csoai.gspc-axes/0.5 · totals.public_count = 23 axes · 23 measured

Counted from the axes array at derive time: 23 rows — MEASURED 23 — agrees with totals.axes. Separation over the 14 model-comparison axes: SEPARATED 0 · TIE 7 · UNTESTED 7. A TIE is not a win; UNTESTED is not a win; a facts run has no leader. Living stamp: SIGNED (did:web:csoai.org#board-attestation-1). Board data: CC-BY-4.0.

What a stranger can verify in four curls

# 1. the lid — the one sentence the board is allowed to say about itself
curl -s https://councilof.ai/api/gspc | python3 -c 'import sys,json; print(json.load(sys.stdin)["totals"]["lid"])'

# 2. the signed public root — Merkle root, leaf count, timestamp (card_count MUST equal len(card_sha256))
curl -s https://councilof.ai/root.json | python3 -c 'import sys,json; r=json.load(sys.stdin); print(r["merkle_root"], r["card_count"], len(r["card_sha256"]), r["as_of"])'

# 3. pin the card key from the DID document — never trust the key a card ships with
curl -s https://csoai.org/.well-known/did.json | python3 -c 'import sys,json,base64; k=[v for v in json.load(sys.stdin)["verificationMethod"] if v["id"].endswith("#card-attestation-1")][0]["publicKeyJwk"]["x"]; print(base64.urlsafe_b64decode(k+"="*(-len(k)%4)).hex())'

# 4. verify any card against that pinned key — three states only: VALID · INVALID · UNCHECKABLE
pipx run --spec 'csoai-gspc[verify]' csoai-gspc verify "$(curl -s https://councilof.ai/signed/card_index.json | python3 -c 'import sys,json; print(json.load(sys.stdin)["cards"][0]["card"])')"

The integrity stack

Four populations appear above on purpose and are never reconciled here: the signed-card index (335 via /signed/card_index.json), the living /api/cards registry (336), the public-root leaf count (319 via /root.json), and the Hub cells (live GET /api/hub-cards → .counts; currently 411/411/0). Quote each with its URL. Ceremony: card verify ≠ root inclusion — signed-index/root identifier overlap = 0; never sell “335 in the root.”

Buyers (the one number): distinct_nonself_payers = 2 all-time · 2 in 30 d · 2 settlements · status MEASURED — read from /api/revenue. Published because a measurement body that hides its own zero has no standing to publish anyone else's.

Install the readers

pip install csoai-gspc          # 0.2.20261007.1 — board, axis, verify, root, snapshot
npx csoai-gspc-mcp              # 0.2.2 — stdio MCP server over the same endpoints

Products

9 products read from docs/product/_INDEX.json (as_of 2026-09-06T06:00:18Z). A 402 means the door is metered by x402 and the amount appears only in that 402 challenge — never here, never on the board. Verification of every artefact is free.

Where the board is published

Pushed by scripts/spray/gspc-spray.py (daily, idempotent by as_of and fingerprint). The live root as_of at derive time was 2026-09-30T05:05:34Z; a surface that lags is shown lagging, not reconciled. Board data is CC-BY-4.0; the reader packages are Apache-2.0 / Apache-2.0.

Source mirror. The GitHub org CSOAI-ORG is temporarily unavailable. The source of this repository is mirrored, MIT-licensed, at https://huggingface.co/datasets/csoai/councilof-ai-source (git clone works; the tree is under source/).

Hosting and deploy

Vercel is not the live host. The leftover Vercel Git links (csoai-v2-app, councilof-ai-src) were disconnected and those Vercel projects deleted on 31 Aug 2026.

Build (this repo):

npm run build:client
bash scripts/prerender-run.sh --dist dist/client --wait 900 --min 350
# GHA deploy.yml ships dist/client to Cloudflare Pages

Do not run npx vite build from the repo root (it picks up a dead src/). Do not vercel deploy this site.

Agents — paid artefacts (x402)

The board and verification stay free. Metered artefacts (issuance, evidence assembly, signed feeds) are on the x402 rail. Amounts live only in the HTTP 402 challenge — this README does not invent a price. A grade is never sold.

• Catalog: https://councilof.ai/api/x402
• Manifest: https://councilof.ai/.well-known/x402.json
• MCP: https://councilof.ai/mcp (commission_card and the other paid tools return a 402 as structuredContent until paid)

Verified week-one revenue (PayAI bazaar, 2026-09-16)

Source: GET https://councilof.ai/api/revenue and PayAI bazaar stats.

Buyer integration guides

• Python (eth_account): https://github.com/CSOAI-ORG/csoai-x402-buyer-guide
• TypeScript (viem): https://github.com/CSOAI-ORG/csoai-x402-typescript-example
• Revenue catalog: https://github.com/CSOAI-ORG/csoai-x402-revenue
• Week-one report: https://github.com/CSOAI-ORG/csoai-blog-x402-revenue

Network: Base (eip155:8453) · Asset: USDC · Pay-to: 0x212686404A7D1E1fD88F35eD6200c3aF7A78ae31 · Promo $0.01 until 2027-01-11 (extended 7 Oct 2026; was 2026-10-11).

Documentation

• Measurement body overview
• Methodology
• GSPC scoreboard
• Published measurements
• EU AI Act Article 50

What we never do

• Certify AI systems or issue compliance badges
• Sell ratings, ranking position, or early sight of grades
• Remediate or recommend fixes in exchange for fees
• Take money in either direction from anything we rank

Surfaces

License

MIT © CSOAI-ORG

_{Council of AI · CSOAI LTD · UK Companies House 16939677 · We measure. We sign. We re-attest.}