Fifty Years of Specification Completeness: What Aviation Certification Tells AI Governance About Epoch Limits, Proof Surfaces, and the Structural Gap
Pith reviewed 2026-06-25 22:45 UTC · model grok-4.3
The pith
Aviation certification has required three structural properties in governance documents since 1992, yet no AI governance framework imposes them on individual documents.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Aviation has operationalised three structural requirements for governed software systems since 1992: structured governance linkage between governing specifications and operational evidence, context-bounded validity that triggers revalidation when operational context changes, and an objective evidence architecture that defines what proof means and what makes it sufficient. These requirements appear in DO-178C and DO-330 and are enforced through FAA and EASA certification. No existing framework requires these structural properties as intrinsic properties of individual AI governance documents.
What carries the argument
The three structural requirements from DO-178C and DO-330—structured governance linkage, context-bounded validity with revalidation triggers, and objective evidence architecture—treated as intrinsic properties that can be evaluated in the static governance document independently of the governed system.
If this is right
- AI governance documents would need explicit traceability links between policies and the evidence that supports them.
- Changes in the operational context of an AI system would require revalidation of the governing document itself.
- AI governance would have to define what constitutes objective evidence and the threshold for sufficiency.
- These document-level properties would apply even when the underlying AI system is non-deterministic.
- Frameworks such as PromptQ can embed the three requirements directly into the governance document layer.
Where Pith is reading between the lines
- The structural gap may explain why many AI governance instruments fail to provide reliable accountability when deployed.
- Treating governance documents as static artifacts with measurable completeness could allow independent auditing tools to flag incomplete policies before deployment.
- The 37 percent figure from the companion study suggests a large fraction of existing AI governance would require redesign to meet the threshold.
- Extending the same document-level checks to other high-stakes domains such as medical devices or autonomous vehicles could be tested by direct mapping of their standards.
Load-bearing premise
The governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs.
What would settle it
An AI governance document that lacks all three properties yet produces equivalent traceability, revalidation, and evidence outcomes to documents that meet the aviation requirements.
read the original abstract
Aviation software certification has operationalised three structural requirements for governed software systems since 1992: structured governance linkage between governing specifications and operational evidence, context-bounded validity that triggers revalidation when operational context changes, and an objective evidence architecture that defines what proof means and what makes it sufficient. These requirements appear in DO-178C and DO-330 and are enforced through FAA and EASA certification. No existing framework requires these structural properties as intrinsic properties of individual AI governance documents. A system prompt, an AGENTS.md file, a governance policy, or a task envelope can be deployed without satisfying any of the three requirements aviation has enforced for three decades. Aviation is the most technically rigorous instance: its standard-setting bodies have acknowledged that their frameworks break down for AI systems, yet none requires these properties of individual governance documents. Aviation's structural requirements break down at the system level because AI systems are non-deterministic, but remain transferable at the document level: the governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs. The paper maps DO-178C's traceability architecture, DO-330's requalification triggers, and DO-178C's objective evidence requirements onto three structural findings: epoch limits on governance document validity, proof surfaces as the revalidation feedback mechanism, and the absence of structural completeness requirements in AI governance instruments. An empirical companion (arXiv:2604.21090) found that 37% of AI governance documents fall below the structural quality threshold. PromptQ's seven-principle framework operationalises these requirements at the governance document layer.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper claims that aviation certification (via DO-178C and DO-330, enforced by FAA/EASA since 1992) has long required three structural properties of governed software documents—structured governance linkage (traceability between specifications and evidence), context-bounded validity (revalidation triggers on context change), and objective evidence architecture (definition of sufficient proof)—but that no AI governance instruments (system prompts, AGENTS.md files, policies, or task envelopes) impose these as intrinsic document properties. It asserts these properties break down at the non-deterministic system level yet transfer to the static document level, mapping them to 'epoch limits,' 'proof surfaces,' and a 'structural gap' in AI governance. An empirical companion paper is cited for a 37% figure on sub-threshold documents, and the author's PromptQ framework is presented as operationalizing the requirements.
Significance. If the transferability argument and absence claim hold after addressing the independence assumption, the paper would supply a concrete, standards-grounded analogy from a mature certification domain to critique the structural completeness of AI governance artifacts. This could usefully inform document-level requirements in AI systems engineering. The explicit mapping from established aviation standards provides a falsifiable starting point, and the reference to companion empirical data offers some external grounding, though overall significance is limited by the lack of internal verification of the universality claim.
major comments (3)
- [Abstract] Abstract, second paragraph: The central assertion that 'No existing framework requires these structural properties as intrinsic properties of individual AI governance documents' is unsupported by any systematic survey of AI governance instruments in the manuscript; the 37% empirical result is entirely deferred to the external companion paper arXiv:2604.21090, leaving the 'absence across all' claim without direct evidence here.
- [Transferability paragraph (post-abstract)] Paragraph beginning 'Aviation's structural requirements break down at the system level...': The load-bearing claim that the three requirements 'remain transferable at the document level' because 'the governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs' receives no argument or redefinition. Aviation traceability, requalification triggers, and objective evidence are defined relative to deterministic code-path behavior; the manuscript does not show how these apply to AI documents without statistical reinterpretation of 'evidence' or 'context,' rendering the independence assumption unexamined.
- [Mapping section] Mapping section (DO-178C traceability architecture to epoch limits; DO-330 requalification to proof surfaces): The operationalization introduces the new terms 'epoch limits' and 'proof surfaces' without demonstrating that they preserve the original aviation requirements rather than redefining them ad hoc; this weakens the transfer claim at the point where the analogy is made concrete.
minor comments (1)
- [Abstract and introduction] The abstract and introduction introduce 'epoch limits,' 'proof surfaces,' and 'structural gap' without a dedicated definitions subsection or table contrasting them to the original DO-178C/DO-330 terms; a short comparison table would improve clarity.
Simulated Author's Rebuttal
We thank the referee for the constructive comments, which help clarify the evidential basis and argumentative structure of the transfer from aviation standards to AI governance documents. We respond to each major comment below and indicate where revisions will strengthen the manuscript.
read point-by-point responses
-
Referee: [Abstract] Abstract, second paragraph: The central assertion that 'No existing framework requires these structural properties as intrinsic properties of individual AI governance documents' is unsupported by any systematic survey of AI governance instruments in the manuscript; the 37% empirical result is entirely deferred to the external companion paper arXiv:2604.21090, leaving the 'absence across all' claim without direct evidence here.
Authors: We agree that the manuscript does not contain an independent systematic survey of AI governance instruments. The absence claim is grounded in the empirical sampling and threshold analysis reported in the companion paper (arXiv:2604.21090). We will revise the abstract and the opening paragraphs to state explicitly that the claim rests on the companion empirical results rather than a comprehensive review conducted within this manuscript, thereby removing any implication of standalone verification here. revision: yes
-
Referee: [Transferability paragraph (post-abstract)] Paragraph beginning 'Aviation's structural requirements break down at the system level...': The load-bearing claim that the three requirements 'remain transferable at the document level' because 'the governance artifact is a static artifact whose structural properties can be evaluated independently of the stochastic system it governs' receives no argument or redefinition. Aviation traceability, requalification triggers, and objective evidence are defined relative to deterministic code-path behavior; the manuscript does not show how these apply to AI documents without statistical reinterpretation of 'evidence' or 'context,' rendering the independence assumption unexamined.
Authors: The manuscript asserts transferability on the basis that governance documents are static artifacts whose internal structure (linkage, validity bounds, evidence definitions) can be inspected without executing the governed system. We accept that this requires explicit justification rather than assertion. We will expand the paragraph to argue that the three properties are syntactic and semantic features of the document itself—traceability links between sections, explicit context-change triggers, and enumerated sufficiency criteria—none of which presuppose deterministic runtime behavior. This keeps the evaluation at the document layer and avoids any statistical reinterpretation of evidence or context. revision: yes
-
Referee: [Mapping section] Mapping section (DO-178C traceability architecture to epoch limits; DO-330 requalification to proof surfaces): The operationalization introduces the new terms 'epoch limits' and 'proof surfaces' without demonstrating that they preserve the original aviation requirements rather than redefining them ad hoc; this weakens the transfer claim at the point where the analogy is made concrete.
Authors: The terms are presented as direct structural analogues: epoch limits map the context-bounded validity requirement of DO-330, and proof surfaces map the objective evidence architecture of DO-178C. To make the preservation explicit rather than implicit, we will revise the mapping section to include a concise side-by-side table showing, for each aviation requirement, the corresponding document-level property retained in the new terminology. This will demonstrate continuity of intent without ad-hoc redefinition. revision: partial
Circularity Check
No significant circularity; derivation rests on external standards
full rationale
The paper derives its three structural requirements directly from the independent external standards DO-178C and DO-330 (FAA/EASA), which predate the work and are not authored by the present author. The transferability assertion at the document level is presented as a direct consequence of the static nature of governance artifacts, without any equation, parameter fit, or self-citation chain that reduces the claim to the paper's own inputs. PromptQ is introduced only as an operationalization of the already-stated requirements, not as a premise that defines them. The companion empirical paper supplies a supporting statistic but is not invoked to justify the core mapping or the independence claim. No load-bearing step matches any of the enumerated circularity patterns.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption Aviation certification frameworks (DO-178C, DO-330) have successfully enforced structured governance linkage, context-bounded validity, and objective evidence for deterministic software since 1992.
invented entities (2)
-
epoch limits
no independent evidence
-
proof surfaces
no independent evidence
Reference graph
Works this paper leans on
-
[1]
Bloomfield, R. and Bishop, P. (2010). Safety and Assurance Cases: Past, Present and Possible Future—an Adelard Perspec- tive. In: Dale, C. and Anderson, T. (eds) Making Systems Safer. Springer, London. pp. 51-67. DOI: 10.1007/978-1-84996-086-1_4
-
[2]
and Claviere, A
Damour, M., de Grancey, F., Gabreau, C., Gauffriau, A., Ginestet, J-B., Hervieu, A., Huraux, T., Pagetti, C., Ponsolle, L. and Claviere, A. (2021). Towards Certification of a Reduced Footprint ACAS-Xu System: a Hybrid ML-based Solution. Proceedings of SAFECOMP 2021. URL: https://hal.science/ hal-03355299v1/file/main.pdf
2021
-
[3]
CoDANN I: Concepts of Design Assurance for Neural Networks
EASA (2020). CoDANN I: Concepts of Design Assurance for Neural Networks. European Union Aviation Safety Agency. March 2020. URL: https://www.easa.europa.eu/en/document- library/general-publications/concepts-design-assurance-neural- networks-codann
2020
-
[4]
CoDANN II: Concepts of Design Assurance for Neural Networks
EASA (2021). CoDANN II: Concepts of Design Assurance for Neural Networks. European Union Aviation Safety Agency. May 2021 (updated January 2024 with Appendix B). URL: https://www.easa.europa.eu/en/document-library/general- publications/concepts-design-assurance-neural-networks- codann-ii
2021
-
[5]
Advisory Circular AC 20-115D: Airborne Software Development Assurance Using EUROCAE ED- 12 and RTCA DO-178
FAA (2017). Advisory Circular AC 20-115D: Airborne Software Development Assurance Using EUROCAE ED- 12 and RTCA DO-178. Federal Aviation Administration. URL: https://www.faa.gov/documentLibrary/media/Advisory_ Circular/AC_20-115D.pdf
2017
-
[6]
Pro- ceedings of ERTS 2024
Gabreau,C.,Teulières,M-C.,Jenn,E.etal.(2024).Astudyofan ACAS-Xu exact implementation using ED-324/ARP6983. Pro- ceedings of ERTS 2024. URL: https://hal.science/hal-04584782
2024
-
[7]
He, J. and Yu, D. (2026). OpenKedge: Governing Agentic Mutation with Execution-Bound Safety and Evidence Chains. arXiv:2604.08601
Pith/arXiv arXiv 2026
-
[8]
and Weaver, R
Kelly, T. and Weaver, R. (2004). The Goal Structuring Notation—A Safety Argument Notation. Proceedings of the Dependable Systems and Networks 2004 Workshop on As- surance Cases. URL: https://www.semanticscholar.org/paper/ 4983e7610482057785cdf5312b48caf28b1f69ca
2004
-
[9]
Koch, C. and Wellbrock, J.A. (2026). Beyond Task Success: An Evidence-Synthesis Framework for Evaluating, Governing, and Orchestrating Agentic AI. arXiv:2604.19818
Pith/arXiv arXiv 2026
-
[10]
Lincoln, S. (2025). DO-178 Compliance Considerations for Artificial Intelligent Software.AIAA SciTech Forum, AIAA 2025-
2025
-
[11]
https://doi.org/10.2514/6.2025-2511
-
[12]
Careful Adoption of Agentic AI Services
CISA/NSA/ASD/CCCS/NCSC (2026). Careful Adoption of Agentic AI Services. Joint guidance, 1 May 2026. URL: https://www.cisa.gov/resources-tools/resources/careful- adoption-agentic-ai-services
2026
-
[13]
Self-assessment guide for artificial intelligence (AI) systems
CNIL (2022). Self-assessment guide for artificial intelligence (AI) systems. Commission Nationale de l’Informatique et des Libertés. 24 August 2022. URL: https://www.cnil.fr/en/self-assessment- guide-artificial-intelligence-ai-systems
2022
-
[14]
Framework Act on the Development of Artificial Intelligence and Establishment of Trust
Korea (2025). Framework Act on the Development of Artificial Intelligence and Establishment of Trust. Enacted 21 January 2025, in force 22 January 2026. Source: Korean Law Information Center (Korean Ministry of Government Legislation)
2025
-
[15]
AI Guidelines for Business Ver1.2
METI/MIC (2026). AI Guidelines for Business Ver1.2. Min- istry of Economy, Trade and Industry and Ministry of In- ternal Affairs and Communications, Japan. 31 March 2026. URL: https://www.meti.go.jp/shingikai/mono_info_service/ ai_shakai_jisso/pdf/20260331_12.pdf
arXiv 2026
-
[16]
Pothon, J-C. et al. (2013). DO-330/ED-215 tool qualification document. AdaCore. URL: https://www.adacore.com/uploads/ books/do-330-ed-215-tool-qualification-document.pdf
2013
-
[17]
DO-178C: Software Considerations in Airborne Systems and Equipment Certification
RTCA (2011). DO-178C: Software Considerations in Airborne Systems and Equipment Certification. RTCA Inc
2011
-
[18]
DO-330: Software Tool Qualification Considera- tions
RTCA (2011). DO-330: Software Tool Qualification Considera- tions. RTCA Inc
2011
-
[19]
Zietsman, C. (2026). Structural Quality Gaps in AI Governance Prompts. arXiv:2604.21090. DOI: 10.48550/arXiv.2604.21090
work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2604.21090 2026
-
[20]
Zietsman, C. (2026). governance-prompts-v1: Gov- ernance Prompts Empirical Corpus. Available at: https://github.com/czietsman/nuphirho.dev/tree/dcb7036/ experiments/governance-prompts-v1
2026
-
[21]
Zietsman, C. (2026). The Specification as Quality Gate: Three Hypotheses on AI-Assisted Code Review. arXiv:2603.25773. DOI: 10.48550/arXiv.2603.25773
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.