05 — Evaluation & Validation: Earning 99.9%#

Part of Agentic-Native SDLC for Regulated Medical Device Engineering. Status: Reference baseline — May 2026. Thresholds shown are org-set placeholders pending QMS ratification. Audience: engineering, quality/QA, regulatory affairs, validation (CSV/CSA) owners. Cross-references: 01-requirements.md, 02-maturity-model.md, 03-reference-architecture.md, 04-model-strategy-and-finetuning.md, 06-agentic-workflows.md, 07-security-and-compliance.md, 08-token-and-gpu-economics.md, 09-adoption-roadmap.md.

This document is the core of the 99.9% argument. Everything else in the program — the model fleet, the harness, the maturity ladder — exists to feed and be governed by the evaluation and validation system described here. The thesis is Principle P1: 99.9% is a system property, not a model property. No open-weight model, fine-tuned or otherwise, will be claimed to be 99.9% correct. Instead we engineer a pipeline — Generate → Verify → Repair → Gate — whose aggregate release-gate correctness reaches the target, and we prove it with deterministic, recorded, reproducible evidence (P2, P4, P7).

1. Reframing the 99.9%: what number are we actually defending?#

The single most common error in agentic-SDLC programs is conflating three different quantities under one "99.9%" banner. They are measured differently, owned differently, and validated differently.

State plainly: we do not promise model accuracy (a). We engineer system correctness (b) and we drive down escape-rate (c). A model that is only 92% accurate but abstains or fails loudly on the other 8% can feed a 99.9% system, because the system never admits the bad 8% — it routes it to repair, escalation, or human control. Conversely, a 99% model with weak gating can have a worse escape-rate than a 90% model with strong gating. The model is a generator; the gate is the guarantee.

1.1 Metric definitions (precise)#

Let the unit of evaluation be a change-set (a PR-sized artifact) or an eval item (a single golden task). Define a "correct" outcome against the deterministic ground truth for that item.

A critical conceptual rule, established here and enforced throughout: precision and escape-rate are the safety metrics; recall and FPY are the economic metrics. When the two trade off, safety wins — we prefer a system that abstains and escalates (lower FPY, higher cost) over one that admits a marginal artifact (higher FPY, higher escape-rate). This is a direct expression of risk-proportional autonomy (P3).

2. The assurance pipeline#

Every artifact produced by an agent — code, test, spec, config, document fragment — flows through the same assurance pipeline before it can become evidence or be released. Determinism dominates the critical path (P2): probabilistic checks may inform and escalate, but they may never be the sole admit/reject decision for Class B or Class C work.

flowchart TD
    A[Intent / Spec<br/>requirement, Gherkin, ticket] --> B[Generate<br/>model fleet S/M/L/V/E<br/>constrained + spec-conditioned decoding]
    B --> C{Deterministic<br/>Verify Layer}
    C -- fail --> D[Repair Loop<br/>bounded budget K<br/>feed verifier output back]
    D --> B
    C -- pass --> E{Eval Gate<br/>golden suites + thresholds<br/>statistical acceptance}
    E -- below threshold --> D
    E -- secondary signal only --> F[LLM-as-judge / rubric<br/>NON-gating for B/C<br/>escalation trigger only]
    F --> G
    E -- pass --> G{HITL<br/>risk-proportional<br/>Class C = dual control}
    G -- changes requested --> D
    G -- abstain / IDK --> H[Escalate to human owner]
    G -- approved --> I[Release Record<br/>signed evidence bundle<br/>traceability + Part 11 audit]
    D -- budget exhausted --> H
    I --> J[(Production / DHF / DHR<br/>regulated artifact)]
    J -. production failures captured .-> K[Regression Capture<br/>new golden items -> §8]
    K -. closed loop L5 .-> E

3. Deterministic verification layer (the workhorse)#

This layer is why the program works. Principle P5: the harness is the product. Each verifier is a deterministic function verify(artifact, context) → {PASS, FAIL(diagnostics)} that is reproducible (P7), versioned, and recorded. They compose: an artifact is admitted only if it survives the conjunction of all applicable verifiers for its class.

3.1 How composition drives escape-rate down#

Verifiers are arranged as a defense-in-depth conjunction, ordered cheap-to-expensive so that most bad artifacts are killed early at low cost (P6). If verifier i has independent miss-probability mᵢ (it lets a defect through), and a defect must evade all of them to escape, the residual escape probability is bounded by the product ∏ mᵢ — provided the verifiers are sufficiently independent (catch different defect families). Independence is the design objective: type checkers catch interface defects, property tests catch invariant violations, mutation testing catches weak tests, SAST catches vulnerability patterns. Correlated verifiers (e.g., two SAST tools sharing a ruleset) do not multiply their protection, and we do not claim they do (§6.1, §11). The Eval Owner (§8) maintains a documented defect-family-to-verifier coverage matrix so that the independence claim underlying the math is auditable rather than assumed.

4. Generation-time techniques that raise first-pass yield#

These raise FPY and cut repair cost (an economic win, P6/08). They are not a substitute for the gate — they make the generator produce gate-passable artifacts more often.

Selection rule (load-bearing): when using N-sample self-consistency, the selector is the deterministic verifier suite, not an LLM majority vote. Self-consistency raises the chance a good candidate exists; determinism decides which one is admitted. This keeps P2 intact even while exploiting probabilistic breadth.

5. Probabilistic evaluation (secondary, never sole gate)#

Probabilistic evaluation has real value for coverage of qualities deterministic checks cannot express (clarity of a rationale, plausibility of a design narrative, reasonableness of a trajectory). It is admitted only under strict containment.

Gating rules (binding):

1. For Class B and Class C, every admit decision must rest on a deterministic verdict. Probabilistic signals may only block (raise concern → escalate) or inform; they may never admit (P2).
2. LLM-as-judge is never the sole gate for B/C, full stop. Where used, the judge model, prompt, rubric, and version are recorded as part of the evidence and are themselves subject to drift monitoring.
3. An LLM-as-judge disagreement with a deterministic verdict resolves in favor of the deterministic verdict, and the disagreement is logged for Eval Owner review.

6. The math of 99.9%#

6.1 Composing imperfect independent checks#

Suppose a generated artifact is defective with prior probability p_def. It must pass n independent verifiers to be admitted; verifier i misses a defect with probability mᵢ. The probability a defect escapes the gate is bounded by:

P(escape) ≤ p_def · ∏(i=1..n) mᵢ

With three genuinely independent checks each missing 10% of defects (mᵢ = 0.1) and a 20% defect prior, P(escape) ≤ 0.2 · 0.001 = 2e-4 — already below a 1e-3 ceiling. Add the bounded repair loop: each repair iteration re-subjects the artifact to the full conjunction, compounding the protection on the retained (repaired) artifacts. The headline number — release-gate correctness ≥ 99.9% — is therefore (b) precision achieved by composition, not by any single model or check.

The independence caveat is the whole ballgame. The product rule holds only to the degree verifiers catch different defect families. We do not claim multiplicative protection for correlated checks; the Eval Owner's coverage matrix (§3.1) documents which mᵢ are credibly independent. Treating correlated checks as independent is the central statistical lie of "eval theater" (§11) and is explicitly disallowed.

6.2 Statistical acceptance by safety class#

We never assert 99.9% from a point estimate. We require a lower confidence bound from a sample of sufficient size, scaled by safety class (risk-based, per CSA/GAMP 5).

To demonstrate a true rate ≥ 99.9% with a 95% lower confidence bound and zero observed failures, the rule-of-three approximation requires roughly n ≈ 3 / (1 − 0.999) ≈ 3000 independent passing items; any observed failure raises the required n substantially. Sample-size targets per suite are recorded with the eval suite version (§8). These are gate thresholds; they do not replace required human review.

6.3 Why Class C still needs human sign-off regardless of score#

A 99.9% gate is a statistical statement about a population. A single Class C artifact may be the 1-in-1000 that the population statistics tolerate but a patient cannot. IEC 62304, ISO 14971, and CSA intended-use logic all require human judgment proportional to harm. Therefore dual human control on Class C is independent of the eval score — even a hypothetical 100% historical pass-rate does not waive it (P3). The eval score informs the reviewers; it never replaces them.

6.4 Abstention as a yield lever#

A model that can say "I don't know" and escalate (per the fleet design in 04) converts a potential false pass into an honest escalation. Mathematically, abstention removes the hardest, least-certain items from the admitted population, which raises precision (b) and lowers escape-rate (c) at the cost of throughput (FPY) and human effort. We therefore treat a calibrated abstention-rate as a feature to tune, not a failure to suppress. Suppressing abstention to inflate FPY is an anti-pattern (§11).

7. Validation under FDA CSA / GAMP 5 / IEC 62304#

The agent and its harness are production/quality-system software that must be validated — not merely a developer convenience. We apply FDA Computer Software Assurance (risk-based assurance, intended use, recorded evidence), GAMP 5 (2nd ed) risk-based CSV, IEC 62304 V&V activities, and ISO/IEC 42001 for the AI management system.

7.1 Revalidation triggers#

Validation is a state, not an event. Any of the following triggers risk-assessed revalidation, scoped by impact:

• Model change — new fine-tune, base-weight update, quantization, or decoding-config change (ties to 04).
• Harness change — new/updated verifier, gate-threshold change, repair-budget change, orchestration change (06).
• Eval-dataset change — new golden items, rubric change, contamination remediation (§8).
• Drift — behavioral/score drift past a control limit in production (§9).
• Regulatory/process change — change in intended use, standard revision, or risk-file update (14971).

Each trigger, the affected scope, and the revalidation outcome are recorded; the traceability graph identifies the blast radius automatically.

8. Eval suites as controlled artifacts#

Eval suites are controlled, validated artifacts with the same rigor as the software they judge — because under CSA they are quality-system software.

• Versioned & signed — each suite has a semantic version, content hash, and a Part 11 signature; gate runs record exactly which suite version produced the verdict (P7).
• Owned — an explicit Eval Owner role is accountable for suite integrity, the defect-family coverage matrix (§3.1), sample-size adequacy (§6.2), and contamination control. The Eval Owner is segregated from the model-training function (segregation of duties, policy-as-code enforced — §3, 07).
• Contamination control vs fine-tuning data — golden eval items are held out of, and continuously diffed against, fine-tuning corpora (ties to 04). Any leakage invalidates the affected results and triggers re-curation. Provenance and hashes of eval vs train sets are recorded so contamination is detectable, not merely asserted.
• Regression capture — every production escape becomes a new golden item (the closed loop in §2). This is the mechanism by which the system learns from failures and is the L5 "self-optimizing" behavior in 02 — but the new item enters the controlled suite through the same versioning/sign-off, never silently.

9. Continuous evaluation & monitoring in production#

A gate that is only run pre-merge cannot detect post-deployment drift. Continuous evaluation closes the loop (PQ analog, §7).

Expensive deterministic checks are scheduled risk-proportionally: always-on for Class C critical paths, sampled or nightly for lower-risk surfaces, so assurance scales without unbounded GPU/compute cost (08).

10. Worked example: a Class B code change through every gate#

A change-set modifies a Class B data-formatting routine. It is dispatched to a mid-tier (M) model with a constrained, spec-conditioned prompt.

Had any deterministic gate failed, the diagnostics would feed the bounded repair loop; on budget exhaustion the item would abstain and escalate, never force-pass. Had this been Class C, step 8 would require dual human control and step 6 would add formal/specification checks regardless of the eval score (§6.3).

11. Anti-patterns#

Summary#

We do not sell a 99.9% model; we engineer a 99.9% system. Deterministic verifiers on the critical path, composed for independence and proven with statistical acceptance, produce the headline release-gate correctness and the low escape-rate. Probabilistic evaluation stays strictly secondary, abstention is a deliberate yield lever, human control scales with IEC 62304 risk, and every verdict is signed, traceable, reproducible evidence under CSA / GAMP 5 / Part 11. The eval system itself is validated, owned, and version-controlled — because in a regulated medical-device SDLC, the harness is the product (P5), and its evidence is the validation.