Your Build Gate Proves Your Copies Agree, Not That They Are Right

A developer who had already turned his travel site's data audit into a build step that fails when the database and any static copy of the legal-status data disagree has now added a second, separate check: a weekly scheduled job that compares database rows against a web-connected model ^[1][7]. The reason is the blind spot in the first check, described in his own write-up: the most expensive error the project found was a country whose law changed in January while the database, the data files and the search index all kept reporting the old status in perfect unison ^[3]. No diff between internal copies can catch that, because every copy is equally behind the world ^[4]. A build gate proves agreement, and agreement is not truth ^[5]. The camouflage is the consistency itself. The obvious alternative is a human audit against primary sources, jurisdiction by jurisdiction. He has run three, and his assessment is unsentimental: they are correct the morning they ship and decay from that morning on, because laws do not change on an audit schedule ^[6]. So the outside check got the same treatment as the inside one. Once a week, a script asks a model that searches and cites rather than answering from training memory for the current legal status of roughly fourteen jurisdictions, and compares each answer to the corresponding database row ^[7]. Fourteen, not all 271, because the sampling policy carries the load ^[8]. A hot list runs every time: highest-traffic pages plus jurisdictions with active legislative motion, where a month of staleness costs most ^[9]. Everything else sits on a rotating cursor, eight per run, round robin ^[10]. He puts the whole thing at about seven cents a week ^[11], which is roughly $3.64 a year ^[12]. One number deserves a closer look. Eight rotating slots times 52 runs is 416 samples a year spread across about 265 non-hot-list rows, or about 1.6 passes per row ^[13] - closer to annual coverage than the "roughly twice a year" the post claims ^[10]. Not fatal, but if you copy the design, do the division for your own row count. Two rules were inherited from the build gate. The model never writes: its answer is a tripwire, not data, and a disagreement produces a flag telling the human to verify against primary sources ^[14]. He notes that every fabricated-but-plausible value he has written about in this series was an AI-generated number that skipped exactly that step ^[15]. Second, a run that cannot check anything exits nonzero and is treated by monitoring like any other broken cron, on the grounds that "couldn't verify" reported as success is the most expensive bug a verification step can have ^[16]. Flags also fire once per claimed value, since a channel that renags weekly gets muted, and a muted tripwire is decoration ^[17]. The first live run checked thirteen jurisdictions and raised four flags ^[18]. Three claimed that states his database grades as medical, with functioning patient programs, were illegal ^[19]. All three were wrong, which is a 75 percent false positive rate on the first run ^[20][22]. The model had answered the question asked: his prompt was "what does an ordinary adult visitor face here?", and for a medical-only state the honest answer is prohibition, since a visitor has no local patient card ^[21]. The database answers a different question, namely what the jurisdiction's regime is ^[21]. Two defensible grades, two rubrics. This is the same bug he hit a month earlier, when twenty-six "conflicts" between two of his own data stores turned out to be the two stores meaning different things by the same word ^[23]. The fix both times was writing the definition down: the prompt now carries the dataset's own rules verbatim, and on a re-run the three states came back medical ^[24].