Published on: June 25, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
We believe the strongest thing that can be said about an instrument is not a forecast about it — it is that it runs on its own author, all day, and the failures it records are lived, not modeled. That belief has a sharp edge for you: the reason your AI risk feels unpriceable is not that it is unmeasurable in principle. It is that no one carved out the part that can be measured and then actually used the measurement enough to learn its frequency. Black-Scholes did not make options safe by changing the underlying stock — it changed nothing about the company. It supplied the equation that priced the stock's volatility, and in doing so it converted a guessing game into a market. We make the parallel move one layer up: we never open the language model's black box to judge whether its work is good. We place a rigid geometry around the output and price the drift — where the work landed versus where it was hired to land.
You do not need the model to be transparent to price its risk — any more than an options desk needs to audit a company's strategy to price its stock's volatility. You need a decidable thing to measure, and a lived record of how often it breaches. That is the whole game, and both halves now exist.
It helps to see the lineage you are standing in, because each milestone solved a different trust problem and none of them solved yours. Double-entry bookkeeping solved internal accounting trust: it proved a ledger balanced, recording what had already happened inside one organization. Decentralized ledgers solved decentralized transaction trust: they proved a digital dollar was not double-spent without a central bank to vouch for it. Black-Scholes did something else entirely — it priced the future. Before 1973, the risk of future volatility was treated as mathematically unquantifiable, so options trading ran on instinct. Black-Scholes made the unquantifiable decidable, and the modern derivatives market was born from that single act of pricing.
Your problem is none of these three. It is not accounting, it is not double-spend, and it is not a stock's volatility. It is the behavioral risk of an autonomous agent — and the milestone that rhymes with it is Black-Scholes, not the other two. The work here sits adjacent to Black-Scholes: take an undecidable, excluded risk, carve a decidable slice out of it, and supply the equation that prices that slice. The artifact that comes out the other end is a new primitive — a drift receipt — and it prices autonomous competence the way Black-Scholes priced volatility.
The thing worth internalizing about Black-Scholes is what it refused to do. It did not try to predict whether a stock would go up. It did not model the company's management or its products. It bounded the question to one decidable quantity — volatility relative to a strike — and priced exactly that. The genius was the boundary, not the bravado.
Our instrument keeps the same discipline, and you can feel where it draws the line. It does not care how the agent solved your problem, and it does not judge whether the solution is wise — that is the model's job and the human's, and it is undecidable in the deep sense. It cares only where the solution landed. It runs a compression walk on a fixed 144-node competence lattice — about 14 milliseconds, no model in the loop, sealed locally on your own hardware — and reads the Chebyshev (king-move) distance between where the work landed and where the spec asked for it. If an agent hired for plumbing drifts into brain surgery, that distance crosses the fence, and the fence triggers — even if the sutures are immaculate. Because it emits an ed25519-signed receipt of coordinates and one-way hashes, the underlying work product never leaves your machine. It is an oracle, not a host: cryptographic proof of where you stayed, without ever custodying what you made.
This is the property that lets a carrier touch it at all. An insurer can price your peril off a signed receipt of coordinates without ever seeing — or being liable for — a single byte of your intellectual property. Change one field and the signature breaks; anyone recomputes it offline.
The first thing you get is decidability, and it is load-bearing. Whether the work is good — correct, wise, what-you-really-meant — runs into Rice's theorem and the value-loading problem; it is undecidable in general, which is exactly why it cannot be guaranteed or priced. But where the work landed — which actor-and-patient region of a fixed lattice it occupies — is a placement of two finite texts on a finite grid, recomputable by anyone, with no model in the loop. That is the decidable slice, and it is the subject of the companion piece on alignment: a smaller question than "is it aligned," and one that actually has an answer.
But here is the honest limit, and it is the hinge of this whole post: decidability gives you a coordinate, not a price. Knowing precisely where a piece of work landed tells you nothing, by itself, about how often work like it breaches the lane — and frequency is what a premium is made of. A coordinate is a measurement. A price is a measurement plus a lived distribution. The first leg gets you the first half. It is necessary. It is not enough.
This is the part that is easy to miss, so sit with it: the price stays undecidable until the instrument is actually run on real work. Not undecidable in the Turing sense — that is the first leg, the decidable WHERE we already have. Undecidable in the empirical sense: a premium needs a realized breach frequency, and a frequency does not exist until something generates a stream of real measurements to count. Black-Scholes the equation is inert without a volatility number to feed it; our equation is inert without a lived rate of lane-departures to feed it. Use is the missing input. The act of running the instrument on genuine work is what collapses the unpriceable into a number.
There is a hard-won lesson sitting underneath this, learned at great expense one technology over. A decidable primitive — even an elegant one — is worthless until it is bound to a real job that needs exactly it and nothing more. A great deal of capital was lit on fire discovering that a beautiful decentralized primitive, never mapped to an application that needed precisely that property, is just a clever solution in search of a problem. The lesson is not that decidable primitives are useless. It is that they stay inert until used for the one job that needs them. Drift placement is a decidable primitive. Underwriting autonomous work is the job that needs exactly it. Self-use is the bridge between them — and it is why the order matters: build the instrument, then use it on yourself, and the price falls out of the usage rather than out of a forecast.
Decidability is leg one: you can locate the work. Lived use is leg two: you can price how often it strays. Skip leg two and you have a beautiful coordinate and an empty premium. That is why "we ran it on ourselves" is not a humility note — it is the actuarial input.
You asked how anyone would know the position is real rather than asserted. The answer is that the loop is on disk, named, and runnable — so here is exactly what fires, and you can check each piece yourself. The slurp: scripts/cog/context-ingest.mjs reads this very working session's Claude Code transcripts — the raw ~/.claude/projects/<repo>/*.jsonl files — backwards and newest-first into a local SQLite store (data/thetacoach.db, the tc_context table plus a full-text index). The work and the record of the work are the same artifact. The walk: every commit runs the compression walk against its own stated intent and emits a signed drift receipt — the spec-versus-delivery placement, in milliseconds, no model on the path. The ledger: those receipts accumulate. As of this writing, data/pmu/measure-history.ndjson holds 200 measured rows and the mesh ledger under .thetacog/mesh/ledger/ holds 110 settled, signed events — not a forecast of how often agent work leaves its lane, a measured history of it. The price: scripts/pmu/calibration-premium.mjs reads that history and prices it, landing near a 9% breach rate (95% CI roughly 6–15%) — tight enough to write against.
The first user being us is not a weakness in the pitch — it is the asset. It means the breach frequency is real, the premium is calibrated on lived data, and the entire loop — spec, delegate, do the work, measure where it landed, receipt it — is observable end to end, on a laptop, in twenty minutes. If a skeptic asks what is actually running, the honest answer is the strong one: it is running here, on us, right now, and you can recompute every number it produces.
Here is why this matters to you specifically if you carry, deploy, or insure agentic work. Right now the enterprise herd and the insurance industry treat AI risk as an uninsurable peril, and a thoughtful skeptic will tell you exactly why: you cannot put a credible number on a catastrophic, irreversible AI failure, and any nonzero probability of an irreversible loss is unacceptable. That reasoning is correct — and it is precisely why the unmeasurable gets excluded rather than priced. A carrier who cannot measure a peril does not underwrite it; they carve it out. Our move is not to argue that frightening number down. It is to make a different, decidable peril measurable — did the agent stay in the lane it was hired for — so the part that can be priced stops being lumped with the part that cannot.
That single separation is what shifts the industry from exclusion to underwriting, and it does so in a definite order. A peril you can measure is a peril you can price; a peril you can price is one you can underwrite; a peril you can underwrite settles into receipts you can eventually trade. The lived loss ratio is the exact data structure a carrier needs to comfortably write a general-liability line on an agentic fleet. Once the line is written and the risk is insured, the settled receipts become a new asset class — capital markets can trade options on competence itself. The instrument does not wait for a customer to make it real. It becomes real by being used, and the usage is the evidence — every task is one more data point in the book that prices the thing.
Why there is no conventional alternative. Every classic approach to AI assurance targets the undecidable whole — is the system good, is it aligned — and a property that is undecidable in general (Rice, 1953: any non-trivial semantic property of a program's behavior is undecidable) cannot ship a guarantee, so it cannot ship a price. Pricing has always required first restricting to a decidable quantity: Black & Scholes (1973, Journal of Political Economy) priced volatility precisely because they refused to predict the stock. The decidable-slice approach is the only one in the family that bounds the question small enough to have an answer.
Why it is not too good to be true. Because the fences are stated, not hidden. The instrument prices a decidable peril — lane departure — and is explicit that it does not touch the undecidable one (catastrophe, value-alignment, "is it good"). The premium is advisory and pre-calibration; the breach rate is reported with its interval, not as a point oracle; the surface-robustness and out-of-sample calibration are named open inches, not papered over. An instrument that told you it priced everything would be the thing to distrust.
Why nobody else has it. Because it takes both legs at once, and most efforts have only one. Plenty of work measures placement (interpretability, embeddings) without a lived loss ledger; plenty of insurance instinct exists without a decidable, model-free, recomputable measurement to feed it. The standard-of-care logic that reinsurers ultimately enforce (the T.J. Hooper principle: an industry cannot exempt itself from a precaution that becomes available and reasonable) only bites once a measurable standard exists — and the measurable standard is exactly what self-use brings into being.
There is nothing to push or explain — the instrument is already running, and your next move is small and concrete. Locate yourself: claim your coordinate at /pixel — the decidable spot where your work, in your lane, is yours to stand on. Recompute the number: the breach rate and the receipt are not asserted; install the instrument, run it on your own work, and watch the lived ledger fill — the price falls out of the usage, exactly as it does here. Then read the slice: the decidable-slice companion shows the WHERE-not-WHETHER boundary in full, and the manifesto places it in the larger risk-market frame.
The takeaway is one sentence, and it is yours to carry: the price of AI risk looked undecidable because no one had used the instrument long enough to learn its frequency — and the moment it runs on real work, the excluded peril becomes an underwritable one, with you holding the receipt that proves where you stood.
![tolerance panel for commit aced789 — chore(blog): attach commit tolerance panel as OG image [panel-attached]](/blog/post-panels/2026-06-25-black-scholes-didnt-touch-the-stock/aced789da63f4fc0fe474ccedd635bd890970836.png)