01 · The breakthrough
Ask an AI agent what it did and you get its own account: words defined by more words. We put a floor under it.
The record stops at an address computed from the bytes the agent changed, not from its story. Rerun it yourself; the address does not move.
02 · What we did
Harnad's symbol grounding problem (1990) is a regress: words defined by words, forever. We end it on a closed floor. Twelve lanes of work, taken four deep, make 20,736 places, each owned by exactly one term of (A₁ + … + A₁₂)⁴, remainder zero. The walk across that floor only steps forward, so every definition stops by construction, within eight steps, at the same address on any machine. That is why the record we keep is a second set of books: today the only record of what an AI agent did is the agent's own log, which is letting it mark its own homework.
Meaning, here, is not a feeling. It is what you declared. The lattice is pulled from your own repository, so a change written in your specification's terms lands on your specification's address. A word you never declared has no address yet. That is not a failure of meaning; it is an undeclared term, and the receipt says UNMEASURED instead of guessing.
Two ways to prove us wrong, both public: find a definition on the floor that does not stop, or a change written in your own specification's terms that lands outside its lane. Measured on every placement so far: the same bytes land on the same address on every machine (rerun distance 0 across 150 commits).
Our view: AI doesn't get past the pilot stage until someone can insure it. The market agrees. Since January 1, 2026, the standard liability forms let insurers exclude generative AI outright (ISO CG 40 47, CG 40 48, CG 35 08). They won't carry what they can't count. If it's debatable, it's not insurable. We sell the count. Mapping a specification onto what was meant, and a new domain's terms onto the floor (software today; medicine, law and underwriting next), is the work we are scaling.
We detect, place, price and dispatch. You hold the wheel: the halt is yours to wire. Try it: npx -y thetacog-mcp@latest attest-demo. The proof and the runs are below, and one command away.
03 · Why you should care
Your agents already write code, move money and answer customers. When one does something expensive, the board asks what it did, and the only witness on record is the agent.
Whether it was good is undecidable (Rice, 1953). What it actually did cannot be reconstructed from its own account (the data processing inequality). The only remaining move is to read a record the actor did not write. That record is what we make, and it is what an underwriter can price.
04 · Why it is investable
Every market that ever financed a risk opened with a count. Double entry (1494) never asked a merchant to be honest. Lloyd’s Register (1764) never promised a hull would float. The Hartford inspectors (1866) never promised a boiler would hold. Each made deviation countable, and the capital came after.
The measurement is free and open-source (MIT), and stays that way. The underwriting layer is licensed, patent pending (US 19/637,714). The word for the licence is rent.
Do you worry about $1.2B in AI liability?
a number we can call — or an email, or an idea
Know anyone who should?
If the property is trivial, software can check it — and why are you paying to check trivial properties? If it isn’t trivial, Rice’s theorem says nobody can. So we fixed the math.
What follows is rendered by this repository's last commit · the same bytes a stranger recomputes
Trust Physics · Patent Pending · US 19/637,714
Most decks sell a feeling about AI — the human-in-the-loop slide, the safe dinner-party talk. This page doesn't perform. It dares you to run one command, and a stranger gets the same bytes you do:
The fourth trust primitive
Double-entry. Blockchain. Black-Scholes. This.
Each of the first three made an unpriceable risk priceable, and the capital followed. AI risk is the casino the fourth walks into — the fastest-growing exposure on every book, riding as an exclusion because no one could price it. The incumbents hold that casino together by performance: human and compute energy burned simulating competence without a floor. Vast, unpriced, leaking alpha. The receipt below is the missing variable — and it stops the drain.
Underneath it, one engineering fact: every proof that a machine did what was meant carries a footnote in invisible ink — assuming a human is watching — and the human reads at the speed of a human. We moved the meaning into the silicon instead: position is meaning; drift is a signed, recomputable, physical event. Semantic = Physical = Hardware.
This is the Black-Scholes moment of AI · the others built the room; this is the floor
These are live — rendered by the last commit made to this repository. Come back tomorrow and they will have changed, because the work changed. What was asked, what actually happened, where they differ, what stayed in tolerance, and the exception — located and circled. Hallmarks, not alerts. Every panel links straight into the open-source measurement; recompute any of them, byte-for-byte, on your own hardware.
↓ the definer-of-definer walk — each lit anchor resolved by what defines it, recursively, on-chip · the region below is the meaning
Why this grounds when nothing else does: a word is defined by other words — ask what defines the definer and language regresses forever. That regress is why every other measure of meaning bottoms out in someone's dictionary. The leaf walk ends it in physics: each lit anchor is resolved by walking to the anchors that define it, and the anchors that define those — recursive, on-chip, finite by construction, so it halts instead of deferring. Define the definer until the definitions run out of room to defer, and meaning stops being a chain of symbols: it becomes a located region on the lattice. That is grounding — and it is why the panels above are measurements, not opinions.
① INTENTwhat was asked — walked
② REALITYwhat happened — walked
③ DELTAwhere they differ
④ TOLERANCEwhat stayed in-lane
⑤ ENCIRCLEDthe exception, locatedhallmark: the last commit to this repository
the measurement is open (MIT) — github.com/wiber/thetacog-mcp — you license the financialization, not the math
The underwriter's translation
The receipt reads like a claims file because it is one. Green: the covered lane held. Red: the boundary crossing that triggers the clause — and the circle around it is the strike, drawn. An adjuster reads the five panels in the order they already read losses: what was asked, what happened, where they differ, whether the boundary held, where the exception sits. The same five attach to a D&O or Cyber policy as the exhibit — the drift event, timestamped, signed, recomputable by opposing counsel. No information geometry required.
The equation · five inputs · all logged
Volatility lacked a bounding equation, so no one could price the risk — until someone delivered the equation. The receipt above is that variable for AI: a decidable placement, per agent, per pixel, with a public history a stranger can audit. Map them and the casino becomes a market:
The exclusion becomes a line. Drift contained is a coverable event; drift uncontained is a decidable failure. You underwrite the boundary crossing, not the vibe.
A strike on the lane boundary. A tight cluster of in-pixel placements is cheap to insure; an ungrounded model is not. Fair pricing becomes arithmetic.
Pooled, rated, tradable — priced off the public ledger of receipts. Deployers stream the receipt inside reinsurance packages as the insurability signal.
What the stack unblocks is capital: the pools that have been waiting, unpriced, at the door of the agentic economy. Insurance admits the risk, options price its boundary, bonds carry it to market — and the same receipt underwrites all three.
We do not write the options. We license the toll road that calculates the strike.
The restriction is the point. If anyone could hoard and resell licenses, they would be worth nothing — so resale is reserved for designated brokers, who carry the license and the know-how of the harness, place it onto the balance sheets that hold the risk, and keep ninety percent of what they place. Marsh can resell — because Marsh is Marsh. The ruler stays neutral either way: the measurement is open, the financialization is licensed.
The unit itself anyone can hold: $20, frozen forever. The term each license covers shrinks going forward — not as a sales device, but because it is a budget of insurable events and the market's tempo is accelerating. Deployers buy them inside reinsurance packages and stream the receipt as the insurability signal — that is what turns AI from uninsurable into insurable → options → bonds.
The arithmetic is short: the exposure is already on every book as an exclusion. A recomputable placement converts the exclusion into a line — and ninety points of every conversion belong to whoever placed it.
No countdown, no discount, no urgency theater. The unit is a budget of insurable events and the market's tempo is accelerating, so the clock shrinks the term whether anyone buys or not — physics, not pricing. Later simply covers less.
Lock in agent-years →designated brokers — apply to enforce →
The competence coordinate — where your judgment is load-bearing, and what it means to be out of it.
/pixel →Tesseract Physics — Fire Together, Ground Together. The argument, in full voice. The insider's manual.
/book →Dispatches from inside the pixel. Each post a measured edit, panels attached.
/blog →Evidence — ingredients, not a conclusion
Run it, no install: npx thetacog-mcp prove-rice --check (exit 0)
The receipt is signed and public — recompute a real commit: thetadriven.com/commit
The legal spine: The T.J. Hooper, 60 F.2d 737 (2d Cir. 1932) — the standard of care is what is available
Patent US 19/637,714 · Track One · filed April 2, 2026
Fake-it-till-you-make-it is the business model of an ungrounded model: a performance, token by token, burning compute to hold the act together — and nothing that holds an act stays healthy. The receipt retires the performance. It locates the upstream error, at its exact coordinate, and the energy stops leaking there.
What it does — decidable
Locates the upstream error so your stack stops leaking energy — a compass, not a club. A grounded placement of where the work landed against the lane it was given, on a scale-invariant lattice, the semantic bleed measured in Chebyshev king-moves. Not a meaning oracle: a signed coordinate a stranger recomputes byte-for-byte. Deterministic. No model in the verdict.
What it never claims — undecidable
Not whether the output is correct, good, or safe — that is mathematically undecidable, and the vendors who claim it are the tell. The honest soft edge, stated plainly: a bad action reworded to sound compliant can still read in-lane roughly a third of the time. That frontier is why there is a game left to play.
Past the bonds there is a further economy — zero-latency, labour subdivided without limit, every judgment load-bearing at its own coordinate. It is not explained here.
The question below is not an accusation. It is a structural alert — the sound of a system refusing to burn payroll, compute, and alpha on a misaligned trajectory.
are you out of your pixel?
