Disagreement is the signal

A single model gives you a number. Several orthogonal judges give you a number and a shape: how much they agree, and where they part ways. Ward³'s mediator is built around that second thing.

Consensus, and a fail-closed edge

When the judges align, the mediator emits a consensus verdict. When their pairwise gap exceeds a threshold, it fails closed and raises XAI_DIVERGENCE_HIGH — a state that says, in effect, “something here is inconsistent, treat it as suspicious.”

A stealthy attacker who fools one judge rarely fools all of them in the same direction, so evasion tends to widen divergence rather than hide inside it. The attack becomes visible not because one judge is always right, but because the judges stop telling the same story.

From divergence to a learned consensus

Divergence is the safety net; the day-to-day verdict comes from a calibrated meta-consensus — a small, inspectable model over the judges' scores and a graph embedding of the host's neighbourhood. It is fitted, validated for feature order at load, and kept honest by the same conformal calibration as the judges it reads.

The result is a verdict that is both learned and bounded: it weighs the judges together, but it can never quietly drift past the false-positive budget it was given. Learned where learning helps, constrained where a guarantee matters.

Why single-model NDR can't do this

A single model has no one to disagree with. Its uncertainty is a property of one viewpoint, so a confident mistake looks exactly like a confident hit. Divergence needs at least two genuinely different readers of the same traffic — which is why criterion 2 of ANM depends on criterion 1. You cannot measure disagreement you did not build the capacity to have.