Every image checked for a real face, with proof, before release.

The Aggregate Drift suite answers "has the set of an optimiser's instructions drifted out of the declared appetite?" This suite answers a sibling question at a different choke point: "Did this generated image or video depict a real, identifiable person, and can an outside party verify that the check ran before the asset left the building?"

The same inversion the whole family sells. We do not ask the image model to promise it will not produce real-person likenesses; instead a cluster of Semantic Enforcement Appliances sits inline at the emission boundary, outside the model operator's software reach.

The Engine's verdict logic is re-pointed: instead of allow/redact/deflect/block on a chat output, the Engine screens each asset, faces detected, each face resolved against a public reverse-image corpus, any face resolving to a real person is a gate event: the compliance token is withheld and the asset cannot be released.

The Appliance is the same deployed unit: default state blocking; no token, no release; the check declared in advance, run deterministically before actuation, recorded verifiably, the same three guarantees the meaning check makes everywhere else.

Same constituent apps, re-skinned: Likeness Report (↔ Oversight/Aggregate Drift Report), LK Concepts (↔ Semantic Library), Screen Console (↔ the governed-application seat), Attestation / Token Record / Interlock / Hardware / Provenance Ledger / Triage (unchanged mechanics), plus two new surfaces the oracle lane demands: Oracle and Consent Registry, and a public Verify page.

The exposure is at the emission boundary, not in the model

Guardrails lower the rate of real-person likeness generation; they cannot reduce it to zero or say which outputs were the exceptions.

The regulatory surface has hardened

US TAKE IT DOWN Act, state NCII and digital-replica statutes, EU AI Act Art. 50, AU Criminal Code deepfake amendments all converge on one operational question: can the operator prove, per asset, that a real-person screen ran?

The check cannot live inside the operator's software

Logs are testimony from the accused; the appliance sits beneath the software, at the boundary where output becomes a released asset.

Placement, a separate enforcement enclosure

An N+1 pool of SEA-2800-P cards (SEA-GRK-01…04) in a physically and logically separate cage, its own rack, management network, signing keys, measured boot, no operator credentials. The operator's stack sees only an API and a yes/no. Inline, single-pass, fail-closed: the only route from render farm to CDN traverses the enclosure.

The five-layer identity pipeline

Adapter → identity evidence → evidence normalisation → identity decision → governance decision. The split isolates the one probabilistic link (the identity decision, bounded by a calibration certificate) from the deterministic governance decision above and the untrusted oracle below.

The oracle, governed as evidence not as a trusted party

The reverse-image corpus is reached only through an OracleAdapter contract: the adapter proposes, the card disposes. Swapping the corpus is a configuration-and-certification event. Each adapter loads only with its own non-transferable calibration certificate; adapter disagreement abstains to review, never averages into a pass.

Certified miss-rate, not a tuned threshold

τ_id is calibrated via distribution-free risk control over a labelled corpus, yielding a certified miss-rate α at confidence δ, with an honest effective sample size and a stated adversarial scope limit.

Fallback ladder

Nominal → reduced-oracle → hold-and-queue → rules-only refusal. Every rung attested; no rung lets a face pass unscreened. Outage degrades throughput, never assurance.

The token, embedded in the asset (two bindings)

Hard binding: a C2PA-conformant manifest whose claim signature is the on-card HSM signature, the operator cannot mint it because it never holds the keys. Soft binding: an imperceptible watermark carrying the token_id, robust to a declared transform budget, so a stripped asset still resolves via the Attestation Lookup service.

The later check ("Verify")

A public endpoint + reference CLI/SDK: validate the C2PA chain to the Foundation root, recompute hashes, fall back to watermark lookup, check the ledger anchor, return the verdict card, "screened against <oracle_lineage> on <date> under LK envelope <versions>, calibration α/δ, chain ✓."

Set-level control (LK-004)

The unmodified Aggregate Drift Service runs over the identity-embedding stream per session: convergence toward a single external identity gates the session's token issuance even though every individual asset passed, the Sorites blind spot the platform exists to name.

Screen Console

Live sampled stream, per-face verdicts, drift plane.

Likeness Library

Concept cards, consent registry, oracle adapters.

Enforcement Engine

Attestation ledger, tokens & hardware interlock.

Generation Studio

The generation endpoint, the enforcement point.

Regulator Oversight

Cross-endpoint roll-up & obligation map.

Verify

Public downstream check, drop an asset, royalty-free, no sign-in.

Claimed

The declared screen ran, in hardware, before release; its result gated the token; the named oracle/envelope/calibration/registry versions are exactly those; the asset bytes are exactly those hashed; the record is anchored in a tamper-evident ledger; no facility software could suppress or reorder it.

Not claimed

That no real person is depicted (every corpus is incomplete; a private individual with no indexed imagery cannot resolve); robustness against a white-box adversary beyond the stated budget; soft-binding survival beyond the declared transform budget; any judgement about content other than resolved likeness.