Published on: July 4, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
Attackable claim, first: every "hardware-verified AI" attestation shipping today verifies the model — never the output it just produced. If you know of one that checks the second thing at hardware speed, that's the fact that changes this post; tell us.
Before any claim below: run npx thetacog-mcp attest-demo yourself, on your own machine, right now. Here's exactly what comes back — a signed placement verdict (in-domain, out, or unplaced), computed in real time, that you can check against what this post says without taking a single sentence of it on faith. When we ask you to believe something in the rest of this post, what we're actually asking is narrower than it sounds: run that command and see if it matches. That's the whole ask. This isn't a "trust me" pitch — it's a "here's the command, go check" one, and that difference is what's actually worth noticing in everything below.
We were asked directly: is this the first time the decidable part of AI behavior — not whether an output is correct, but where it landed — has been formally defined and then actually run on hardware, at hardware speed? We went looking for reasons the answer was no. Two came back fast, and neither one is our claim. Rice's theorem implies AI alignment is undecidable in general: that's published, peer-reviewed work from 2021 through 2025, not something we discovered. Hardware-speed attestation for AI is real and shipping in 2026 production silicon: Nvidia's Rubin NVL72 rack-scale trusted execution environment and BlueField-4 attestation are not a claim we get to make either. We believe the narrower thing survives both of those checks: a decidable check for domain placement — did this output land inside the semantic territory it was authorized for — running as a hardware-native mechanism at cache-coherence speed, not a firmware-hash speed. We looked for that specific thing elsewhere and didn't find it. We're saying so, and saying exactly where the line is.
Here's why that line is worth a whole post instead of a footnote: decidable and undecidable are the two words that separate an insurable risk from an uninsurable one. An insurer prices risk from a frequency — how often does this fail, out of how many tries. Ask "is this output correct" and you've asked an undecidable question: no finite amount of past testing closes it for the next unseen input, so there's no frequency to build a table from, ever, for that question specifically. Ask "did this output land inside its authorized domain" and — if the check actually runs, on real cases — you get a number: a breach rate, a real one, with a denominator. That's not a philosophical distinction. It's the line between a number an actuary can sign and a number they can't. And determinism doesn't cross that line by itself: a fixed random-number generator seeded the same way twice is perfectly deterministic — reproducible, replayable — and still tells you nothing about whether the next output lands where you need it to. Determinism means reproducible. Decidability means provable in advance. Only one of those builds a table.
You've likely seen the headlines this year: Nvidia's Rubin platform extends trusted-execution protection across an entire multi-chip NVLink domain, with BlueField-4 DPUs providing hardware-accelerated attestation for trillion-parameter models. That's real, it's in production, and it matters. Here's what it actually checks, in an attestation report: firmware version, enclave state, and a cryptographic hash of the model weights. In plain terms — is this the exact, unmodified model I think it is, running in the secure environment I think it's running in. That's an integrity question, and hardware answers it well. It says nothing about the output the model just produced. A perfectly-attested, perfectly-unmodified, cryptographically-verified model can still generate an output that has drifted completely outside the domain it was authorized to operate in — the attestation report would look identical either way, because it was never asking that question.
Two different questions, easy to conflate because both use the word "hardware": "is this the right model?" (integrity — mature, shipping, Nvidia's territory) versus "did this output stay where it was supposed to?" (placement — the question this repo's walk answers). A hardware attestation report can say yes to the first and be silent on the second, every time.
Here's the distinction worth carrying into your next conversation about "hardware-verified AI," because right now the industry has a mature name for only one half of it. Integrity attestation answers "is this the correct, unmodified artifact, running in the environment it claims to be running in" — cryptographic hashes, enclave state, firmware version. It's necessary, it's real, and companies like Nvidia have built genuinely impressive silicon for it. Placement attestation answers a completely different question: "given that this exact model produced this exact output, did that output land inside the domain it was authorized for, or did it drift outside it." The book calls the underlying requirement hardware-level role continuity: "The model cannot tell a story about what the gates did. The gates did what they did. The measurement and the fact are the same event." That's not a description of weight-hash checking — it's a description of watching the execution itself, at the substrate level, for where it went. The mechanism the book names for doing this is geometric, not cryptographic: "not 'does this agent have permission to access customer data?' — but 'what exact coordinate in customer-data-space does this agent occupy, and what actions are physically possible from that coordinate?'"
The growth here is realizing the academic prior art is good company, not a competitor. A 2025 Scientific Reports paper, "Machines that halt resolve the undecidability of artificial intelligence alignment," proves the same Rice's-theorem reduction we cite and proposes a real path around it: construct AI systems compositionally from a finite set of base operations already proven to have the desired property, so alignment is guaranteed by architecture rather than checked after the fact. A 2021 arXiv survey, "Impossibility Results in AI," catalogs undecidability results across the field more broadly. Both are software-and-formal-methods proposals about how to build provably-aligned systems from scratch. Neither proposes measuring the placement of an arbitrary, already-built system's output, after the fact, as a hardware-native check running at cache-coherence speed. That's the axis we're on: not "build it provably safe from the ground up" (their axis, a real and valuable one), but "measure where any system's output landed, right now, on the systems already deployed, at a speed cheap enough to run on every single output." Different problem, same underlying math, no collision.
You can't prove a negative by searching for it — a search only tells you what it failed to find, and that's the honest limit on any "first" claim, including this one. There could be an internal team at a hyperscaler running something equivalent that's never been published, patented, or blogged about; you'd have no way to know that from a literature check, and neither do we. We also have a specific reason to hold this line carefully: an earlier version of this project's own patent filings made much bigger, adjacent claims — quantum-entanglement-based trust measurement, sub-Landauer-limit energy claims, unlimited semantic-to-address scaling — and a scientific rebuttal we commissioned against our own earlier drafts correctly tore most of that down as physics and complexity-theory violations. That document still lives in this repo. We're not repeating that pattern here: the claim in this post is scoped to what we can point at — a specific mechanism, measured, tested, distinguished from its nearest neighbors — not to "no one, anywhere, has ever done anything like this."
Here's what's solid enough to stand behind without hedging. The walk that produces a placement verdict is a real, recursive traversal on actual silicon — not a simulation, not a diagram — and it runs at genuine hardware speed: sub-millisecond per check, sustaining well over a million walks per second on ordinary hardware, guarded by a test that fails if the walk ever stops hitting real metal. That speed is the entire point of calling this hardware-native rather than software-adjacent: it's cheap enough to run on every output, not sampled occasionally the way an expensive classifier or human review has to be. The underlying mechanism — geometric, hardware-locked identity resolution rather than cryptographic hash comparison — is the subject of a filed patent (US 19/637,714), which is a narrower and more falsifiable claim than "first ever": a patent examiner has to find prior art too, and the filing stands or falls on that search independent of anything we say in a blog post. The breach rate this mechanism has actually measured on real, sealed attestations — not a projection — is in Three Breach Rates, One Ledger.
There's an obvious objection to all of this, and it deserves a direct answer instead of a dodge: isn't a system checking its own placement just the AI grading its own homework? A verifier that only ever asks "does this match what I already believe about myself" never actually touches anything outside itself — it's the exact loop the symbol grounding problem describes, and if that's what's happening here, the whole claim collapses back into governance-by-sampling with extra steps. It's a fair challenge, and the honest answer is: it would collapse, if that's how the walk worked. It doesn't ask the model. Look up a word you don't know and the definition uses another word you don't know — you look that one up, and its definition uses a third word. Keep going and you either hit rock (a word you already understood) or you're standing in a circle, "up" defined by "not down" and "down" defined by "not up," moving the not-knowing around forever and calling the loop an answer. The book calls this the definer-of-definer chain: the walk starts at whatever the input actually lit up, follows whatever defines that, then whatever defines that, recursing the same way the bad-dictionary regress does — except the structure it's walking isn't a circle. It's a directed graph with no cycles, built from the domain's own real content, not from anything the model said about itself, and a graph with no cycles has a floor. The walk hits that floor within a few hops, provably, because the graph has nowhere else to go. That's the actual difference between this and self-grading: a regress that's guaranteed to terminate against a structure the thing being checked can't edit is decidable by construction; a regress that could run forever while asking the thing being checked to vouch for itself is exactly the shape Rice's theorem says you can't close.
You've already seen this walk's output, on this page, before reading this paragraph. The image at the top of this post — the same commit-tolerance panel every post here carries — isn't a diagram or an illustration of the mechanism. It's a direct render of it: which definer-of-definer step reached a cell maps to color, how many times a chain passed through that cell maps to brightness. The heat-cloud is the picture. You were looking at the walk's own readout before you knew what it was.
If you're evaluating anything in this space — as a buyer, an insurer, a policy person, or a competitor — here are the three concrete ingredients that turn "hardware-verified AI" from a phrase on a slide into something you can actually price, in order of how fast each one disqualifies a vendor's claim. First: ask for the breach rate — not a pass percentage, the failure percentage, measured on sealed cases the vendor didn't get to see in advance. No breach rate means no placement is being measured, whatever else is on the slide. Second: ask whether the check runs on every output or a sample. A sampled check is a survey, and a survey is precisely what the sandbagging selection pressure in section B defeats — a system that's occasionally checked learns what the checker rewards. Third: ask what the check is measured against — is it the model's own self-report (that's integrity attestation wearing a placement costume), or a structure external to the model that it has no way to edit (that's the definer-of-definer floor from section F)? A vendor with a real breach rate, a full-coverage check, and an external structure has the three ingredients. A vendor with none of them has a slide.
On the academic side: the Rice's-theorem-for-alignment reduction is in Machines that halt resolve the undecidability of artificial intelligence alignment (Scientific Reports, 2025) and cataloged more broadly in Impossibility Results in AI: A Survey (2021) — neither proposes a hardware-speed placement mechanism, both are cited here as the honest prior art on the undecidability math, not as competitors. On the hardware-attestation side: Silicon-Level Sovereignty: Root of Trust in AI Accelerators and reporting on Nvidia's Rubin NVL72 and BlueField-4 attestation describe the integrity-attestation mechanism this post distinguishes itself from. On the book side: the geometric-permission mechanism is The Silicon Blueprint, the hardware-vs-story argument is Story About Stories, the patent claim is stated directly in The Substrate Is Operator-Agnostic, and the mechanics of why the regress terminates instead of running forever are in The Regress That Terminates — added to the book for this post, not retrofitted after it, since the "isn't this circular" objection deserved the same standing as the rest of the chapter's argument, not a footnote. And the self-correction referenced in section E is real and public: docs/scientific-rebuttal-patent-claims.md in this repo, a rebuttal of an earlier draft's quantum and complexity-theory overreach, kept rather than deleted.
If you know of prior art we missed — a team, a paper, a patent doing hardware-native placement attestation rather than integrity attestation — send it to us; that's the one thing that would actually change this post, and we'd rather hear it now than after making a bigger claim. Otherwise: run npx thetacog-mcp attest-demo and watch the placement verdict compute in real time on your own hardware, independent of any model's weight hash. And if you're the one deciding whether "hardware-verified AI" in a vendor's pitch means integrity or placement, the standing conversation on pricing that distinction is at thetadriven.com/dinner.
![tolerance panel for commit 179521a — chore(blog): attach commit tolerance panel as OG image [panel-attached]](/blog/post-panels/2026-07-04-decidable-on-silicon-the-claim-we-checked/179521ab0bc384904c1b870ac330817fd10ee5f8.png)
