Pricing Independence: Fidelity SLAs as Witness Contracts

Two contracts can read identically and buy you completely different assurance. Here are the two, side by side.

Contract A: every production-bound work product gets a secondary review from a peer model session before merge.

Contract B: same — except the secondary review comes from a different model family, and there is a separate review of whether the result fits what the organization actually values.

Count the reviews and they're equal: one secondary review apiece. But the witness you've purchased is not remotely equal. Contract A buys you one reviewer's pass, possibly the same kind of reasoner that produced the work, asking the same kind of question. Contract B buys you a genuinely independent reasoner and a genuinely different question. If you priced these the same because the review-count matched, you overpaid for A or underpaid for B, and either way you don't actually know what assurance you bought. "A review" is not a unit. Independent witness along a named axis is the unit.

That's the trap this is the prescription for. The previous pieces in this series diagnose it; this one is the contract you actually sign.

Write it in four lines

A cognitive-fidelity SLA — call it a Witness Contract — is a contract for a witness-accumulation rate along two independent axes: the model-axis (independent reasoners) and the facet-axis (independent kinds of question). The unit of purchase is N along each axis. Write the contract in exactly four lines, and don't collapse them, because every collapse re-opens the trap.

1. Axis declaration. State a target N for the model-axis and a target N for the facet-axis, separately. The moment you write a single aggregate number — "three reviews" — you've re-entered the trap, because the aggregate cannot tell Contract A from Contract B. Two axes, two targets, named apart. (For the service-management reader: each axis is just another SLA line item — only the unit isn't tickets-closed or reviews-run, it's independent witness along one dimension.)

2. Witness-class allowlist. Say what actually counts toward each axis. A different model family earns model-axis N; a same-model rerun earns none — it's one witness repeated, not two. A machine certification earns facet-axis N on one facet; a human interpretive judgment earns it on a different facet. The allowlist is what stops "we ran it again" from masquerading as independent confirmation.

3. Cadence. Witness accumulates at a rate, not as a one-time stamp. So price it per-work-product, per-cycle, or per-release. A contract that buys independence once and assumes it holds forever is buying a snapshot and reporting it as a stream.

4. Price. Independence costs something — cycles, dollars, or human attention — and you name the cost out loud, per axis. Pricing it explicitly is the single thing that makes the SLA honest rather than aspirational. An unpriced fidelity commitment is a wish; a priced one is a contract someone has to fund.

The facet-axis is the line where you contract the external attestor that stands across the partition the system's own machinery can't close — the slot we have been naming "the human-at-the-loop." But that the external attestor is the human is an interpretive naming, not a proved requirement — and pricing it on the facet-axis line does not change that. You're contracting for an external, non-derivable judgment on that facet; calling the supplier "the human" is your operational choice, inherited as an open question from the rest of this series, not strengthened into a claim here.

What's proved, what's a framework

The two-axis decomposition underneath — that the axes are non-collinear and non-aggregatable — is proved upstream, as abstract structure. That part is machine-checked. That they must therefore be priced separately in any honest contract is the framework we lay on top — and the projection of all of it onto cognitive-fidelity SLA pricing, the contract grammar above, is demonstrated, not proved at the level of the contract. The math is a theorem; the contract that instantiates it is a framework we generate and label as one.

With that register pinned, here is the payload:

Cognitive Service Management is the discipline of pricing and provisioning cognitive-fidelity contracts across an algebraic partition the system's own algebra cannot internally close. That sentence is a framework we're proposing, labelled Predicted: the partition it names is the proved part, and the pricing-and-provisioning discipline laid over it is the part we're asking you to test.

That name has a lineage; it is a named synthesis, not a cold mint. The model-axis carries the same structural motion as N-version programming and the lesson the Knight–Leveson experiment (1986) taught it: counting independently developed versions does not confer independence — those versions failed dependently, their errors concentrating on the same hard inputs — so independence has to be declared, engineered, and measured rather than assumed from a count. That is exactly why the contract names witness classes and not a "three reviews" aggregate; even distinct model families can share a common-mode channel, and Knight–Leveson is the lineage's own demonstration that the aggregate number is the trap. The facet-axis generalizes the verification-versus-validation distinction — conformance to spec versus fit to intent, canonically non-interchangeable — extended from software artifacts to claims.

Priced, graded reviewer-independence is not new either: IEC 61508 grades assessor independence by criticality, escalating it from independent person to independent department to independent organization, and DO-178C requires verification performed "with independence" — the verifier not the developer of the item — at its highest assurance levels; in both regimes, independence is already a costed line item. And the partition exhibits the same boundary those regimes impose when they forbid self-certification at high criticality by rule; what they impose by rule, the previous piece's worked case exhibits as a machine-checked structural necessity — for that algebraic case, the system provably cannot close its own attestation (that every such system carries the partition remains the Predicted framework, not the theorem). Moored to that lineage, the name carries exactly one genuinely new pair of anchors: the per-axis decomposition (model × facet) with explicit per-axis pricing, and that — for the worked case — the partition the independence requirement guards is machine-proved rather than imposed by regulation or learned from failure data.

You're not buying "reviews." You're buying independence, by the axis — declared, allowed, paced, and priced — and someone has to fund it.

A fidelity SLA isn't "how many reviews" — it's how much independent witness you buy along each axis, priced and provisioned; that discipline is what we're calling cognitive service management.

Proofs for this series: github.com/field-effect-institute/witness-independence-proofs

Piece 3 of 3 | Series introduction: “To Figure Out How Humans and AI Should Work Together, We Had to Ask a Simpler Question First”
Previous: “Human-at-the-Loop: Naming the External Axiom the Algebra Requires”