Published on: June 29, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
We believe the reason AI feels uninsurable is a category error, and naming it correctly is worth real money to you. The standard story says: you can never prove an AI did a good job, so you can never price the risk of trusting it. That is true — and it is the wrong conclusion. The undecidability of "is this work good" is not a wall that ends the conversation. It is the exact substrate that every insurance market in history has been built on. Insurance is the business of monetizing what you cannot decide but can measure the frequency of. You cannot decide whether your house will burn down. The actuary does not try. They measure how often houses like yours burn, and sell you a number. Computer science just handed us a new thing that cannot be decided — and therefore a new thing that can be insured. The undecidable is not the bug. It is the asset.
A risk is not something you failed to eliminate. A risk is a financial primitive — the raw material of a premium. The same theorem that says "you can't guarantee the AI is good" is the theorem that says "here is a frequency worth pricing." If you have been treating your AI exposure as a problem to be solved, you have been leaving the asset on the floor.
On the June 2026 episode of Reid Hoffman's Possible, Kanjun Qiu — founder of Imbue, and, not incidentally, someone who paid her way through MIT writing high-frequency trading algorithms — lays out the demand for what we build with more precision than any pitch deck we could write. She wants AI you can deeply trust, not be fooled into trusting: "the system is set up such that it is deeply trustworthy" — a systemic property, "not because someone kind of convinced you that they were a trustworthy entity." She wants the black box opened enough to inspect. She wants software to move from a "renter's economy to an owner's economy," operating locally, on your own data, so you are never locked in and quietly extracted from. Every one of those is a requirement we satisfy by construction. She is describing the customer.
Then, asked about the economy of all this, she does something rare and honest. She says: "I think I personally am most confused about the economic aspect of this entire situation." And — drawing on her trading past — she names the specific worry: that "a lot of our financial returns are disconnected from real production." She knows the trust architecture she wants. She cannot see the financial mechanism that would pay for it without becoming another extractive layer. That confession is the blank. This post fills it. The mechanism is a risk market whose premium is written on a signed record of real production — work that actually stayed where it was hired to stay. It is the opposite of a return disconnected from value. It is a return that exists only because the value was measured.
Here is the computer science, stated plainly so you can carry it. Rice's theorem says that any non-trivial property of what a program does — its semantic behavior, including "is this output correct" or "is this work good" — is undecidable. There is no general algorithm that takes an AI's work and returns a guaranteed verdict on its quality. This is not an engineering gap that a bigger model closes. It is a proof, in the same family as the halting problem. Anyone selling you a guarantee that their AI is correct is selling you a solved halting problem, which is to say, selling you nothing.
Most people read that proof as a tombstone. The actuary reads it as a market. Because insurance never required deciding the outcome — it required measuring the frequency of the outcome. No underwriter can decide whether your specific building floods next year; flooding is, for the individual case, undecidable in the only sense that matters to you. They price it anyway, off a flood-map and a hundred years of claims. The undecidability of the single case is precisely what makes the aggregate worth paying to offload. If outcomes were decidable, there would be no risk to transfer and no premium to collect. So the move is not to defeat undecidability. It is to find the measurable shape next to it. CS handed us an undecidable thing — AI quality. The question is whether there is a measurable shape sitting right beside it that an underwriter can price. There is.
You will never get a proof that your agent did a good job — Rice forbids it. You do not need one. You need a decidable quantity sitting next to the undecidable one, and a lived history of how often that quantity breaks. That pair — a measurable boundary plus a measured frequency — is the entire actuarial requirement. It has been the requirement since the first marine insurance contract.
So here is the decidable shape, and here is exactly where our promise begins and ends. We do not promise the surgeon's work was good. Whether the incision was wise, whether the diagnosis was right, whether the patient should have been operated on at all — that is the undecidable part, the part Rice owns, the part we will never sell you a guarantee on. What we promise is narrower and provable: the surgeon never left the operating room to go fix the hospital's plumbing. That a piece of work stayed inside the domain it was hired for — a radiologist did radiology and not cardiac surgery, an agent asked for a CSS fix did not silently rewrite your auth layer — is a placement question. It asks where the work landed on a fixed map of competence, not how good it was. And where two finite texts land on a finite grid is decidable: recomputable by anyone, with no model in the loop, in milliseconds.
This is the whole boundary of the product, and stating it plainly is what makes it trustworthy — the same decidable slice the companion piece on alignment carves from the larger, undecidable question. A doctor who declines to operate is still practicing medicine — deciding not to act is not leaving the domain; it is a competent in-lane move. But a "surgeon" found re-plumbing the building has committed a category breach that no quality check can see, because the plumbing might be excellent. That is the lethal, invisible failure: capable work, done well, in the wrong pixel. The undecidable "is it good" check is structurally blind to it. The decidable "is it in lane" check is built for exactly it. We sell the second one and we are loud about not selling the first.
The catastrophe is not the agent that does your task badly — you will catch that in one read and reverse it in one edit. The catastrophe is the agent that does a different task excellently. Only the coordinate reveals it. Pricing "good" would miss the very failure that bankrupts you; pricing "in lane" catches it. We promise the boundary, not the goodness — and the boundary is the one that was going to hurt you.
This is the part that liberates you from the whole "but is it good" debate, so sit with it. An underwriter does not care whether your AI is good. They have never cared whether anything they insure is good. They do not assess whether your building is beautiful or your ship well-captained. They ask one question: can I get a measured frequency of the loss event, tight enough to write a number against? "Good" is undecidable and irrelevant to them. Frequency is decidable-in-aggregate and the only thing they buy. The entire reason AI has been excluded from coverage is not that it is risky — everything insurable is risky. It is that no one carved out a loss event that could be measured, so there was no history, so there was no premium. The exclusion was a measurement gap masquerading as a risk judgment.
Which leaves exactly one condition, and it is the hinge of the business: the history can be written as a premium if, and only if, the measurement is possible. Lane-departure is the loss event. The drift receipt is the measurement. Run the instrument on real work, over and over, and the breaches accumulate into a frequency — and a frequency is a premium. This is the move that converts AI from an excluded peril into an underwritable one — the same rhyme Black-Scholes ran on volatility, one layer up. Not by making the AI safer. By making one decidable thing about it countable, then counting it on real production until the number stops being a guess. The undecidable goodness stays undecidable forever. It was never the thing standing between you and a policy. The missing measurement was — and it is no longer missing.
You should not take any of this on faith, and you do not have to — the loop is on disk, named, and runnable. The walk: every commit in this repository runs a compression walk that places its own stated intent against what was actually delivered, on a fixed 144-node competence lattice, and emits an ed25519-signed receipt of coordinates — about 14 milliseconds, no model on the path, sealed locally. Because the receipt carries coordinates and one-way hashes, the underlying work never leaves the machine: it is an oracle, not a host. The ledger: those receipts accumulate. As of this writing, data/pmu/measure-history.ndjson holds 200 measured rows (177 priceable, 23 excluded as ingest-suspect), and the signed mesh ledger under .thetacog/mesh/ledger/ holds 66 settled events — a measured record of how often autonomous work left its lane, not a prediction of it.
The price: scripts/pmu/calibration-premium.mjs reads that history and prices it. Right now it reports an empirical breach rate of 14.1% with a 95% Wilson confidence interval of roughly 10% to 20% — the loss event defined as a drift past 4.67% off the contracted coordinate. That interval is tight enough to write a policy against, and it tightens every time the instrument runs on real work. Note what kind of fact this is: the instrument is used, all day, on its own author — the thing measuring AI drift is itself AI work being measured. The breaches are lived, not modeled. That is the actuarial input Kanjun could not see a source for: a financial return wired directly to a record of real production, the precise opposite of the disconnected returns she worried about as a trader.
Decidability gives you the coordinate. Lived use gives you the frequency. Skip the second and you have a beautiful measurement and an empty premium. "We ran it on ourselves" is not a humility note — it is the only place the 14% came from.
Believe it because it is built to be checked, not trusted. The connection to your reality is direct: you already delegate work to agents you cannot fully verify, and you already feel the unmeasured liability of that — this gives the liability a coordinate and a number, the same way a flood-map gave a coastline a price. The contribution is yours, not ours: a signed drift history is something you can hand to a counterparty, a board, or a carrier as proof of how your autonomous work behaves — you become the party who can demonstrate competence boundaries instead of asserting them. That is who you get to become in an owner's economy of AI: not a renter hoping the platform is honest, but the holder of your own provable record, on your own hardware, that no one can edit without breaking the signature.
And believe it because of what it refuses to claim — that is the certainty under the uncertainty. We do not tell you your AI is good; Rice says no one can, and anyone who does is bluffing. We tell you, with a recomputable signature, whether it stayed in its lane, and how often work like it has not. The honest line between this is measurable and this is undecidable is not a limitation we apologize for. It is the asset. An instrument that abstains on what it cannot grip is the only kind an underwriter can trust on what it can — the inverse of the 2008 lesson, where everything was rated AAA and nothing was honestly fenced. The significance is yours to claim: you stop being exposed to a risk you cannot name, and start holding a priced one you can transfer.
Everything above reduces to one question you can actually get an answer to. Not "is my AI good" — that one has no answer, by proof. The one that does: are you in your pixel? Is the work landing where it was hired to land, and how often does it stray? That question is decidable, signed, and recomputable, and it is the one the insurer was always going to ask. The undecidable part — the goodness — you keep, because it was always yours and the human's to own. The measurable part — the boundary — is what turns AI from an excluded peril into a market you can stand inside of.
See the instrument that answers it, and watch it run on its own author: Are you out of your pixel? → /pixel. Then come find the table where the first carriers and challengers are being handed this standard at once: /dinner.
Kanjun named the demand and the blank in the same breath: deeply trustworthy systems, in an owner's economy, paid for by returns connected to real production. The blank is a risk market built on the one thing about AI that computer science guarantees stays undecidable — and the one decidable shape sitting right beside it. The undecidable is the asset. The measurement is the key. You hold both.
![tolerance panel for commit c332795 — chore(blog): attach commit tolerance panel as OG image [panel-attached]](/blog/post-panels/2026-06-29-undecidability-is-the-asset/c332795a15fc015d7c252c85d6e8585ac0650ec6.png)