The central insight of this case is structural, not algorithmic. You might think that three differently-prompted agents—a bear looking for downside risks, a bull seeking signs of resilience, and a geopolitical analyst scanning for state-actor exposure—would disagree enough to surface ambiguous evidence. But they don't, because they're all reading from the same upstream evidence pool. When Pinecone returns a misleading article about supply-chain congestion to one agent, it returns it to all three. When a news story confidently states something false, all three stance-prompted readers incorporate the same error. The judges aggregate three readings that look like independent signals but are correlated failures stemming from a single upstream confounder: the retrieved documents D. This is why the guardrail layer is not optional. It's the system's only remaining safeguard against shared misreading.

Supply chain risk is both high-consequence and hard to predict. A single disruption—a factory fire, a port closure, a sudden tariff—can cascade through a firm's operations in weeks. Yet traditional risk disclosure in SEC filings is backward-looking and abstract. The question this system asks is whether public evidence available today—10-K filings, trade news, logistics reports—contains enough signal to forecast elevated short-term risk. The asymmetry matters: missing a real disruption costs far more than flagging a firm incorrectly. An early warning system, even an imperfect one, creates value by shifting the cost curve. The Supply Chain Risk Monitor treats this as a measurable problem: can we extract latent risk from public documents through multi-agent reasoning?

The system rests on a latent variable R: the true short-term supply-chain risk state of a firm at a given moment. This state is unobserved. It exists in the combination of the firm's supplier concentration, transportation dependencies, regulatory exposure, and the current state of global logistics. No single number captures it; no published metric measures it cleanly. Yet evidence about R leaks into the public record—through the firm's own 10-K disclosures about supplier concentration and geopolitical risk, through news coverage of logistics disruptions, through trade data and tariff announcements. The task is to infer R from these signals. The challenge is that the signals are noisy, sometimes contradictory, and always incomplete. A firm's 10-K says it has mitigated supply-chain risk; a news report suggests otherwise. Whose reading is right? The system's answer is: treat both as noisy measurements and aggregate them.

The measurement architecture is a directed acyclic graph. At the root sits R, the latent risk. Three analyst agents—each reading the same retrieved evidence D but prompted with a different stance—produce noisy estimates Ê_bear, Ê_bull, and Ê_geo. These flow to a judge node J, which aggregates them into a structured JSON object containing an integer risk score from 0 to 100, weighted by the judge's assessment of which analyst the evidence best supports. The judge's output then flows to a guardrail G, which performs citation grounding: it checks whether each claim in J's output maps to actual statements in retrieved documents, assigns a trust score, and flags potential hallucinations. The final reported value Y is G's filtered version of J. This architecture makes explicit what traditional single-agent scoring hides: the intermediate noisy readings and the assumptions about how they combine.

Here is the central confounder: all three analysts draw from the same retrieved document set D. D is populated by querying Pinecone with the firm's name and supply-chain-related keywords, pulling from SEC EDGAR 10-K filings, a curated set of five RSS feeds covering trade and logistics, and NewsAPI headlines. When D contains an accurate signal about supply-chain risk, all three analysts read it. When D is missing a signal—because the news hasn't broken yet or because Pinecone ranked it below the cutoff—all three miss it. When D contains a false claim stated with high confidence, all three read it and incorporate it. The errors in Ê_bear, Ê_bull, and Ê_geo are therefore not independent given R. They are correlated through D. This is not a flaw in the design; it's a structural fact. Acknowledging it is the first step to defending against it.

The system attempts to manufacture conditional independence through stance prompting. The bear analyst is prompted to look for downside signals: supplier concentration, geopolitical exposure, transportation dependencies, regulatory risks. The bull analyst is prompted to look for resilience: diversification, hedging strategies, past recovery from disruption. The geopolitical analyst focuses on state-actor exposure: tariff changes, sanctions regimes, trade policy shifts. All three read the same evidence D, but they are asked to highlight different aspects. The hypothesis is that genuine ambiguity in the evidence will produce disagreement: where evidence is genuinely unclear, the bear and bull will reach different conclusions. But this rests on a subtle assumption: that ambiguity is distributed in the evidence itself, not created by D's upstream selection. If D has selected only documents supporting a false claim, no amount of stance prompting will produce disagreement. All three will agree that the claim is true.

The judge node reads all three stance-conditioned estimates and produces a single aggregated score. It doesn't just average them. Instead, it produces a structured JSON object that includes the risk_score from 0 to 100, weighted by the judge's assessment of which analyst's reading the evidence supports. The judge's job is interpretive: it must decide whether the bear's reading or the bull's reading is more compelling, and to what degree the geopolitical analyst's signals move the needle. This is not a formula; it's a reasoning task. The judge is itself a GPT-4o agent, reading the same documents and the three analyst outputs, making a holistic judgment. The judge's output is structured—JSON, not free text—so that downstream code can parse it, extract the risk score, and track which analysts most influenced the final judgment. This structure also makes the judge's reasoning auditable.

The guardrail performs a separate check on the judge's output. It takes each central claim in the JSON—say, 'supplier X is concentrated in region Y'—and queries the retrieved Pinecone documents to find supporting evidence. It scores citation grounding: does the claim appear in the documents, or is it an inference the judge made? It emits a structured dict with a trust score and hallucination flags. The guardrail is the system's falsifiability layer. It cannot prevent the judge from making errors, but it can flag when the judge's output is not grounded in retrieved evidence. This is crucial because hallucinations—confident false claims that sound plausible—are the failure mode when multiple agents read the same misleading evidence. The guardrail's report is structured, not free text, so downstream code can decide what to do with low-trust outputs or high hallucination-flag counts.

The input pipeline feeds three document streams into a single retrieval system. SEC EDGAR 10-K filings supply the firm's own disclosures about supply-chain risk, supplier concentration, and geopolitical exposure. A curated set of five RSS feeds—targeting trade, logistics, and supply-chain coverage—provides ongoing news. NewsAPI supplies broader headline flow. All three are embedded using OpenAI's text-embedding-3-small model and stored in Pinecone for retrieval. The choice of embedding model is a cost decision: citation grounding is the falsifiability lever, not embedding fidelity. When the analyst agents query for supply-chain risk signals related to a given firm, Pinecone returns top-ranked documents from all three sources. The architect's assumption is that the combination of EDGAR (firm-reported), RSS (expert coverage), and NewsAPI (broad news) creates enough signal diversity to flag most near-term supply-chain risks. The next experiment will measure whether that assumption holds.

The identification strategy rests on two claims. First: stance-prompted agents reading shared evidence can produce partial conditional independence if the evidence is genuinely ambiguous about the underlying risk state. Second: when that assumption fails—when the shared evidence is misleading—citation grounding can catch the failure. These claims are not symmetric in strength. The first is a hope; the second is a safeguard. The identifying assumption is conditional independence: given R, the three analysts produce errors at least partially independent. Stance prompting is the lever supposed to create that independence. But it only works when evidence is ambiguous. When evidence is unambiguous in a misleading direction, all three agents will fail in the same way. Guardrail citation grounding is the only remaining defense. To ship this as a published case, assumptions would need validation against held-out data: historical disruption events labeled before the system sees the firm, hallucination-flag rates validated by hand, and analyst-disagreement variance checked for correlation with actual disruptions.

The central claim is that multi-perspective ensembling with a citation-grounded guardrail can produce a calibrated estimate of latent short-term supply-chain risk despite confounding from shared upstream evidence. The claim is not that stance-prompted agents are fully independent—they are not. The claim is that their partial disagreement, filtered through citation grounding, surfaces real risk signals that a single agent would miss. The second connected claim is that falsifiability is structural, not optional: without citation grounding, the system is vulnerable to shared hallucinations. The third is that this architecture is measurable: we can run it end-to-end, produce a risk score, and validate it against labeled disruption events. None of those labels exist yet. But the framework is clear. The day-one scaffold is wired end-to-end, every named file builds and imports, the Postgres DDL applies cleanly, and the GitHub Actions deploy pipeline targets Cloud Run. What remains unmeasured is precision and recall against historical events, hallucination-flag rates, and analyst-disagreement variance. Those are the next experiments.