The settings that produced the valuation may no longer exist.
Semafide is exploring how a lender could preserve an inspectable record of which provider-held AVM configuration was in force when a valuation was produced, rather than trying to reconstruct that configuration after it has changed.
A lender gets a number from a provider. Months later the cascade, the confidence thresholds, or the model pin has changed. The lender has the output. The provider has today’s settings. Unless the provider keeps versions against runs, neither file is the configuration that was in force.
That gap only matters when somebody asks. A repurchase review can ask, after the fact, how the valuation was produced. The AVM rule requires controls against data manipulation but no record of what a given run used.1
Semafide is built to preserve evidence of how an automated valuation was configured when it ran.
It reports a closed set of independent results: Precedence, Witness, Recipe, Reproduction, and Execution. One result is whether a commitment appears on the chain before the seal. Another is whether a party other than the operator attested to the capture. A yes on one does not establish another.
- Input
- What was submitted. Usually held by the lender.
- Configuration
- The cascade order, thresholds, decision rules, and model pins in force. Usually held by the AVM provider, and often overwritten.
- Output
- The number that came back. The lender still has this.
- Run
- The specific run that consumed the input under that configuration and returned the output, if it was captured at the time.
The lender often retains the input and the output. The provider holds the configuration, and may not keep the version that shaped the number. If that configuration cannot be exposed at execution time, the proposed product cannot apply.
Secondary
Whether the set was whole is a different question.
Seal five runs, disclose three, and every disclosed record can still verify. That is an examiner’s question about the set, not a fact this instrument reports as Completeness. The verifier reports it separately, as Disclosure, and only against a custodian checkpoint. Completeness in the verifier is whether one supplied chain is whole. Configuration is the lender’s question: they hold an output whose configuration they can no longer show after the provider’s settings changed. The investigation starts with configuration.
What Semafide is not
Semafide reports what the evidence establishes about a run. Judgments about the valuation itself belong to the appraiser, the reviewer, and the regulator. It is not a valuation product, not a model explainer, and not a compliance certificate. The AVM rule creates quality-control expectations. It does not require an independent custody product.
A later matching rerun does not prove the original run happened. A chain does not prove every relevant run was captured. A timestamp does not reconstruct the configuration that has since been overwritten.
Where this actually stands
- Built
- A verifier, signed sequenced records, proposition logic, and public specifications. One hundred and ninety-six tests, four formal specifications.
- Thesis
- Operator-controlled logs are weaker under later review than evidence captured at the time and evaluated independently.
- Hypothesis
- Someone who later has to reconstruct a valuation will pay, before the loss, to keep the configuration that produced it.
- Open
- Whether providers can expose a configuration digest at execution. Whether a capture boundary can be established. No production capture. No customers. No mandate. I expect some of what is still open to fail.
Who
Built by Eli Besser.
The verification core is public. Whether this is a category, or a feature of someone else’s product, is the question I am testing.
- 1 Quality Control Standards for Automated Valuation Models, 89 Fed. Reg. 64538 (7 August 2024), effective 1 October 2025. Covered institutions must maintain quality-control standards for AVMs they use. The rule requires controls designed to protect against the manipulation of data. It does not require a record of what a given run used.