Published on: July 4, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
We believe one thing, and everything else in this system is a consequence of it: the meaning of a piece of work is anchored to a physical position, not floating in a probabilistic cloud. A commit message is a coordinate. The code it produces is a walk across a grid. If the code lands far from what the message declared, that is not a vague "quality" complaint — it is a measurable distance between two points. We call the principle S=P=H: semantic equals physical equals hardware. The reason to care is not elegance. It is that a distance you can compute is a distance you can prove to someone else, and proof is the only thing an auditor, an underwriter, or a regulator can actually price.
You have seen this: the agent produced clean, working, well-tested code — and it solved the wrong problem. Every quality check it faced said pass, because the work was good. It was just good in the wrong place. That is the failure mode no output-checker can catch, because a checker asks "is this correct?" and the honest answer is "yes — and it's off-target." The question that actually protects you is not "is this good?" It is "are you in your pixel?" — did this land where you said it would. A negation is just a minus sign; being out of your competence coordinate is an invisible catastrophe a correctness test will happily wave through. We took this apart in "Generally Correct, Specifically Wrong": a model can be right about the field and wrong about your case, and only placement tells the two apart.
This is why we price on-target-ness, not correctness. Correctness is undecidable in general (that's a theorem, below). Placement is decidable — we can show you exactly which cell of the grid an action landed in, and re-run the computation to prove it. The whole technology is built to move the question you can't answer into a question you can.
Here is what the technology gives you that nothing else does: every commit produces a receipt with zero language model in its verdict. The receipt states where the work landed on a 144-cell lattice, the King-move distance from intent to reality, a variance figure, and an in-lane / out-of-lane call. All of it is a pure function of the commit — feed the same commit in, get the same receipt out, byte for byte. You do not have to trust us, and you do not have to trust a model's opinion of a model. You can recompute the verdict on your own hardware and get the identical answer. That is the difference between a dashboard that asserts safety and a receipt that lets you check it.
For a while, a local language model was quietly holding up the receipt. It read each code change and re-described it in goal-language so the code would "grip" the grid the same way the intent did. It worked — and it was non-deterministic. The same commit could render three different pictures because the model paraphrased itself each call. So we removed it. The receipt became reproducible overnight — and then, on some commits, the panel went empty.
That empty panel was the technology being honest. When we measured, the intent walked 140 steps across the grid and the reality walked 2 and died. The code was sensed fine — 1,305 lit anchors — but its raw identifiers didn't cluster on the connected part of the grid, so the walk had nothing to traverse. The model had been silently bridging that gap. Removing it didn't create a bug; it exposed one that was always there: the grid doesn't natively grip code. We fixed it with no model at all — a deterministic bridge that, for each domain whose vocabulary the code literally contains, adds that domain's terms so reality clusters where intent already lives. The empty commit went from a walk of 2 steps to 133, from a blank panel to 615 green / 1,128 amber / 0 red — and it renders identically every time.
The tempting fix was to put the model back, or to seed reality's walk from intent's connected region. We did neither. The first is the exact non-determinism we removed; the second guarantees a false "in-lane" — it makes reality look like intent by construction. A fix that fools your own instrument is worse than the broken instrument. The bridge only fires on vocabulary the code actually contains, so genuinely off-domain work grips nothing and honestly under-measures.
We do not claim the code is bug-free. We can't, and neither can anyone — Rice's theorem says no program can reliably decide a non-trivial property of another program. That is not a limitation we are working around; it is a wall we refuse to pretend isn't there. So we don't try to beat it. We relocate the answerable part — where did this land — into a grid where the answer is decidable, and we leave the unanswerable part — is it correct — explicitly outside the fence, labeled as the insured risk. When the machine can't measure something, it now says so in a way you can tell apart from success: an empty ingest, a collapsed walk, and a legitimately thin change each get a different, named verdict, so "I couldn't measure this" never masquerades as "this is fine."
Three things are now not just claimed but tested. Placement is model-free by construction: the routing that puts a prompt on the grid was letting a model vote; we made that vote a tie-breaker only, and six representative prompts now route to the identical coordinate whether the model votes one way, another way, or not at all. The receipt is reproducible: the same commit renders the same tolerance panel twice, and a guard fails if that ever stops being true. The failure modes are distinguishable: a repair process that used to cry "renders empty" at a commit whose reality was perfectly healthy now reads the actual numbers and names the real cause. Each of these ships with a test that turns a regression into a red build — the fix is the guard, not the patch.
If you underwrite, this is the artifact you've been missing: you cannot insure whether an agent's code is correct, but you can insure whether it stayed inside its declared domain — and that boundary is now a signed, reproducible number, not a vendor's assurance. If you govern, you get a control that constrains structure instead of sampling outputs, which means it can't be gamed by a system that learned what the sample rewards. And if you're the builder, you get something quieter and just as valuable: an instrument that tells you when your agent did excellent work in the wrong place — the one mistake your test suite is constitutionally unable to see. In each case the technology hands you the lever it computes; it doesn't ask you to trust it, it asks you to re-run it.
The claims above are numbers, not adjectives. The collapse and the fix: one commit went from a reality walk of 2 steps and a blank panel to 133 steps and 615 green / 1,128 amber / 0 red — and rendered identically on a repeat run. No false-green: a commit that genuinely drifts still shows 611 red cells after the fix; the bridge did not paint everything in-lane. Off-domain safety: feed the bridge a banana-bread recipe and it grips nothing, because none of the grid's domain vocabulary is literally present. Model-free placement: six representative prompts route to the same coordinate with the model voting for one domain, a different domain, or nothing at all. Each of these is a standing test in the repository; a regression flips the build red. The point of publishing the numbers is that you don't have to believe the story — the receipt is a function you can evaluate.
This is what "sidestepping Rice" looks like in practice, not in slogan: we didn't prove the code correct (impossible). We proved where it landed, proved the proof is reproducible, and proved the instrument doesn't lie to itself when it can't measure. The undecidable part stays undecidable — priced as risk, not hidden as success.
Two concrete steps, both yours to take. First, read the coordinate idea directly — the pixel is the competence-coordinate thesis in one page: the claim that your authority is a position, and being "out of your pixel" is the loss event worth pricing. Second, look at an actual receipt — every commit we ship publishes one at /commit, the LLM-free panel and the distance it measured, generated before any narration is allowed to touch it. If you underwrite, govern, or build with agents and you want the one number that says in-lane or not, that receipt is the whole pitch — and you can recompute it. Reply to this and tell us the domain you'd want fenced first; we'll show you what its grid looks like.
