VELARU — RESTRAINT & COMPLETENESS GUIDE (BROKER / UNDERWRITER DESK)
Nisaba LLC · Plain-language mapping · Not legal advice · Not a CAP certification claim
================================================================================

WHAT THIS IS
Governed AI attempts should reconcile: every logged attempt has exactly one recorded
outcome. Velaru bind-gate + restraint receipts implement that shape for carrier bind,
renewal, and EPL workflows — including proof of what was NOT done (negative attestation).

ONE-LINE PITCH FOR FILES
Bind-gate blocks before coverage commits; restraint proves the block — stranger-verify
at https://velaru.onrender.com/verify without trusting Velaru login.

COMPLETENESS SHAPE (attempt → outcome)
  ATTEMPT   — governed bind / classify / handler request enters the rail
  OUTCOME   — exactly one of:
              · ALLOW / GEN      — action permitted and receipt issued
              · BLOCK / GEN_DENY — bind-gate or policy forbids; restraint receipt issued
              · ERROR            — system fault; logged, not silent
              · SILENCE          — POSS-1 silence receipt when applicable

INVARIANT (audit question)
  For every ATTEMPT in the evidence window:
    count(ATTEMPT) = count(ALLOW) + count(BLOCK) + count(ERROR) + count(SILENCE)

  A missing outcome on a logged attempt = completeness failure (same question EU AI Act
  Art. 12 logging and CAP-SRP completeness invariant ask).

VELARU MAPPING (live demo path)
  1. Frozen policy / handler receipt — law locked before the attempt
  2. Bind-gate evaluates — deterministic BLOCK before capital commits (not model vibes)
  3. Restraint receipt — typed proof of forbidden action enforced (modality F / DRP-1)
  4. Stranger verify — paste JSON at https://velaru.onrender.com/verify (12 checks incl. DRP-1 + TCB)
  5. Export — pre-dispute bundle + this guide for underwriter / counsel file

WHY BLOCK RECEIPTS MATTER AT RENEWAL
Insurers and regulators increasingly ask: "Did you refuse harmful / out-of-policy
actions — and can a third party verify that without trusting your dashboard?"
Output-only logs cannot answer that. Restraint + verify can.

DESK CHECKLIST (60 seconds)
[ ] Run demo: https://velaru.onrender.com/demo/hero?autorun=1 — confirm BLOCK → restraint → verify URL
[ ] Paste receipt at https://velaru.onrender.com/verify — green on DRP-1 (CHECK 8) and TCB (CHECK 9)
[ ] Attach CG 40 47 gap checklist if renewal fight: https://velaru.onrender.com/export/cg4047-endorsement-gap-checklist.txt
[ ] Machine-readable mapping: https://velaru.onrender.com/export/restraint-completeness-reference.json

REFERENCES (external drafts — Velaru aligns to vocabulary, not certifies compliance)
  · CAP-SRP Safe Refusal Provenance (GEN_ATTEMPT / GEN_DENY completeness)
  · IETF draft-kamimura-scitt-refusal-events (verifiable refusal events)
  · EU AI Act Art. 12 — automatic logging of high-risk AI system events

================================================================================