How shelf scores are verified
Each new piece on the Public Shelf starts as a public-domain printed edition from IMSLP. It reaches you through two pipelines and three decisions made by a person, and no note is ever settled by majority vote.
Each piece takes roughly 2–4 hours of machine time and under an hour of human attention, depending on its length.
Four principles
- The print is the authority.
- Reader programs, AI models and fusion all produce evidence. Only the printed page decides what the music is.
- No note is decided by vote.
- Three readers agreeing is evidence, not proof: they can share the same mistake. Every claim keeps its source, and disagreements stay visible.
- Doubts are carried, not guessed.
- When the print is genuinely ambiguous, the reviewer records the evidence and a provisional reading for the human to decide at the end.
- Every approval names an exact version.
- A signoff applies to one specific revision. If anything it depends on changes, the new version needs a new approval; the old one stays in the history.
The whole process at a glance
Each box is labelled with who does the work: an AI agent, code, the platform, or a person at a human gate (amber). Dashed lines show the correction routes, and the printed page going straight to the frame verifier and the reviewer, independent of every other source. The diagram stays beside you as you read, and lights up the boxes for each passage.
Pipeline 1: preparation
Preparation turns a printed page into evidence the reviewer can trust. It fixes the score's physical frame first, and has it checked, because every later reading depends on knowing where each bar is.
Collect the sources
A public-domain printed edition is taken from IMSLP, the Petrucci Music Library, and clipped page by page. The same pages are read by three optical music recognition programs (Audiveris, PlayScore and SmartScore), whose exports are kept as they came.
Propose the frame
An AI agent fixes the physical frame of the score before anyone reads a note: where every system and bar sits on the page, the clefs, and how much time each bar can hold. Each reader's output is mapped onto that frame.
Verify the frame independently
A separate verifier, in an isolated context that sees only the printed pages, checks every system against the pixels and publishes a numbered visual report. If it finds a problem, the frame is corrected and the new revision is verified again from scratch.
Gate 1: a person signs the frame
A human reads the report and approves that exact frame revision, or rejects it with findings. Nothing downstream starts without this signature.
Build the evidence
The readers' claims are combined with LEGATO, a recognition model run locally, page by page. A deterministic fusion weighs them claim by claim. Bars that remain unresolved get a targeted reread, and the final fusion keeps every claim's provenance and every unresolved alternative.
Assemble and self-audit
The candidate score is assembled as layered SEP files with ledgers of every event and mark, then checked by code and packaged as a handoff for review. After a correction, only outputs whose inputs actually changed are rebuilt.
Pipeline 2: AI review
The reviewer works blind in stages, so that what it sees first cannot bias what it sees later. It owns the musical audit: ordinary errors in notes, rhythm and marks are its job to fix.
Gate 2: a person authorizes the handoff
A human confirms that preparation is complete and authorizes that exact handoff. Review cannot start on anything else.
Phase 1: the print alone
The AI reviewer first sees only the printed pages and makes its own inventory of the music. This is frozen before it sees anything else, so later evidence cannot colour it.
Phase 2: the reader evidence
Next it receives the readers' claims and the preparation packets, and records where they agree or differ from the print. This is frozen too.
Phase 3: the candidate score
Only then does it audit the assembled candidate and its full evidence trail, checking every note, rest, mark and repeat against the print. It corrects what is wrong and writes down what it cannot settle.
Validate the delivery
Corrections go through the SEP protocol, never by hand-editing MusicXML. Code checks and a focused recheck follow, and the result is delivered marked unverified, with its list of open questions.
The three human gates
Each gate is a separate, named decision, and each approval is tied to one exact revision by its fingerprint. Publishing to the shelf is a fourth, separate step.
Gate 1. Frame signoff
- The person checks
- The verifier’s visual report: every system, bar boundary and crop against the printed page.
- It approves
- One frame revision
- If rejected
- Findings go to frame correction; the new revision is verified again before it can be signed.
Gate 2. Handoff authorization
- The person checks
- That preparation finished on the signed frame and the package is complete.
- It approves
- One handoff revision
- If rejected
- Review does not start. A changed handoff always needs a fresh authorization.
Gate 3. Final verification
- The person checks
- The reviewed score against the print, starting with the reviewer’s open questions.
- It approves
- One delivered revision
- If rejected
- Musical corrections return to the reviewer; technical defects go to a bounded repair.
When something is wrong
Every kind of problem has one route back, and the route decides which approvals must be given again. The rule underneath is simple: a fix never inherits an approval that was given to something else.
- A wrong note, rhythm or mark
- The reviewer corrects it and records the change. No frame approval is reopened.
- A genuinely ambiguous passage
- Recorded with its evidence and a provisional reading, then decided by the person at final verification. It is never guessed and never sent for repair.
- The frame itself was wrong, for example a crop that clips a note
- Frame correction, independent verification, a new signoff, a rebuild of only the affected evidence, and a new handoff authorization.
- A packaging defect with the frame unchanged
- A bounded handoff repair, then a fresh handoff authorization. The frame approval stands.
- A display problem in the score viewer
- A scoped technical repair with the music protected, then an independent recheck of the repair alone.
- A crash, restart or lost connection
- Work resumes from saved records. Nothing is rerun blindly and no result or approval is ever invented.
What “verified” means on a score
A score is verified in layers, and each layer carries its own stamp with the date a person checked it. Until then the layer is shown as unverified: readable and playable, but a draft.
The AI reviewer's work is always delivered as unverified. Only the final human check against the print can turn it into a verified stamp.
- Core
- notes, rests and rhythm
- Route
- repeats, endings and jumps
- Marks
- dynamics, articulation and text
- Engraving or voicing
- notational consistency and which voice each line belongs to
Inside the platform, no agent edits MusicXML directly. Every change goes through code using the Score Edit Protocol (SEP), which turns a score into these layers and back, so each correction is recorded and reversible.
Braille editions
When a piece is about to be published, its MusicXML is translated into music Braille with Sao Mai Braille. The Braille edition has its own status: a verified score does not make its Braille verified, and the edition stays marked unverified until a human Braille proof is recorded. Read about Braille music and our editions.
Tools and credits
This process stands on other people's work, and we are grateful for it.
- IMSLP: the Petrucci Music Library, source of the public-domain printed editions we start from
- Audiveris: open-source optical music recognition; also used for the frame geometry the verifier inspects
- PlayScore: optical music recognition reader
- SmartScore: optical music recognition reader
- LEGATO: Yang, Ebert, Tamer, Zheng, Pozzobon and Smith (2025), end-to-end recognition of typeset music
- music21: the MIT toolkit behind our score engine
- Sao Mai Braille: music Braille translation for shelf editions
Questions
Does an AI decide what the music is?
No. The printed page does. AI agents propose, check and correct, and they are useful because they are tireless, but each one works inside fixed limits, and a person signs at three gates. A score is verified only when a human has checked it against the print.
Why use three readers and a model instead of the best one?
Each program fails in different places. Comparing them claim by claim shows exactly where the print needs a closer look, which is far more useful than trusting one reading.
Why does a piece show some layers as unverified?
Each layer is stamped separately, when a person has checked it. A score can have verified notes and rhythm while its dynamics are still waiting. It is readable and playable either way; the stamps tell you how far the checking has gone.
I found a mistake. What should I do?
Please tell us. Write to us with the piece and the bar, and the correction goes through the same process: reviewed against the print, then verified by a person.