The assurance dossier: five records that travel with the model

The dossier works by making a system legible and bounded rather than provably clean. Provably clean is not currently available for any model from any lab.