In a medical AI pipeline, the reliability question is not only “is the model good enough?” but “is the failure you care about visible to the check you deployed?” Trust Topology makes that question precise. It treats each intermediate artifact as a verification surface — the representation a stage exposes together with the deterministic checks writable over it — and gives a constructive rule: when a target is invisible at one surface, more zero-false-positive gates over that same artifact cannot verify it; the remedy is to expose a new surface carrying the missing signal. Reliability then composes across stages by conditional escape: each verifier acts on the cases that survived earlier verifiers, so narrow checks with low-overlap rejection sets can still shrink total pipeline escape.
We work this rule end to end on prostate MRI, liver CT, and kidney CT segmentation. Phase 1 restricts verification to a mask-only channel: binary gland and lesion masks plus eleven learning-free anatomical predicates. This channel is strong artifact QA. On calibration-tail failures, every rejection is a true envelope violation and every violation is caught. Across stages, rejection sets are nearly disjoint, with pooled overlap 1.49% (95% CI [0.51%, 4.30%]), so cross-stage portfolios eliminate failures that same-stage budgets miss.
The same channel then hits its limit. Clinically significant prostate cancer is not encoded in mask geometry alone; its ground truth comes primarily from pathology and mpMRI signal. Anatomical gates enrich the flagged cohort but do not verify csPCa: Stage-2 gates catch 15/425=3.5% of positive cases, Stage-2∪Stage-4 gates catch 63/425=14.8%, and Stage-2 decision-curve net benefit is negative across the threshold grid.
The constructive test is the payoff. Guided by this diagnostic null, Phase 2 adds one literature-derived ADC intensity surface over the joint mask–intensity representation. Held-out csPCa+ coverage rises from 4.5% with mask gates alone to 29.5% for the combined gates+ADC+C1 stack. The joint C1 predicate fires on six held-out test cases, all csPCa-positive, catching 6/44 positives with 0/108 false positives; four of those cancers are missed by both marginal surfaces. This is a finite-sample pilot, not a validated detector. Its purpose is to demonstrate the engineering loop: characterize what escapes, add a surface that exposes the missing signal, measure the new residual, and repeat.
Binary masks plus eleven learning-free anatomical predicates. On calibration-tail failures, every rejection is a true envelope violation and every violation is caught — interpretable, model-agnostic, no learned parameters.
Pooled cross-stage overlap 1.49% (95% CI [0.51%, 4.30%]) across prostate MRI, liver CT, and kidney CT. Portfolios of narrow checks eliminate failures that same-stage budgets miss.
Clinically significant prostate cancer is not encoded in mask geometry. Anatomical gates catch only 3.5% of positives (14.8% pooled with a later stage) and Stage-2 net benefit is negative. More gates on the same surface cannot fix this — the rule says expose a new one.
Adding one ADC intensity surface over the joint mask–intensity representation lifts held-out csPCa+ coverage from 4.5% to 29.5%. The joint predicate fires on six held-out cases, all cancer-positive: 6/44 positives at 0/108 false positives, four missed by both marginal surfaces. A finite-sample pilot demonstrating the loop, not a validated detector.