Published on: September 1, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
Your agents wrote to production last night, and this morning you cannot say where the work landed. Whether that work was good is a foreclosed question, not a hard one — Rice proved in 1953 that no machine decides a non-trivial property of what another program computes, so the reviewer model somebody sold you as oversight shares the failure domain of the thing it reviews, and buying a larger one buys a better storyteller. Whether you checked is decidable, and that one swap is the audit invariant: it is the difference between a bill of twenty dollars per agent-year and eleven months of discovery against a number your carrier has already told you it will not cover. You are not being sold safety here. You are being sold the record that answers the second question, which is the cheaper thing and the only one on offer. Everything below is how that is cooked.
The second answer fails to a second theorem, and the two were proved by different people in different fields. Cover and Thomas, 1991, Theorem 2.8.1: information about a source cannot survive a chain that did not carry it, uniformly over every reconstruction anyone might invent, at any budget. Said in the register of the thing you deployed — an account of a process, produced by that process, cannot contain what the process displaced. Your agent's changelog is that account. The two results are independent, from different decades and different fields, so to reopen the question you must break two unrelated theorems, and most rooms have not noticed they are trying to break either.
Strike both and one thing is still standing. Did a record exist, written by something other than the actor, before the fact? Binary. No expert to retain, no reasonable person to imagine — whether you checked is decidable, and it is settled by a timestamp rather than by an argument. That is what separates this from a duty of care, and the separation is not one of degree: a duty of care needs a standard, a reasonable person, and a jury willing to say what that person would have done. This needs a date.
Which is also why it is the only thing here anybody can sell you. Underwriters price arguable things every day — that is what a reservation of rights is for. What no syndicate will write is a policy whose TRIGGER is settled by argument, because that is a claim paid by litigation. A parametric trigger has four requirements and no others: measured, binary, cause-blind, and settled without adjudication. The record is all four. So this is not an analogy borrowed from insurance — the audit invariant is trigger-shaped, and we are proposing it as one. Not the behaviour. The record.
And the record is your own source repository. There is no vault of ours to trust and no ledger you have to be given access to: an immutable commit is a record its author cannot revise after the fact, and the attestation is computed from it — the repo IS the attestation. That is the whole of you could have checked, and it is why the proof is a recomputation on your hardware rather than a certificate from ours.
Now the part we are usually too careful to say, and it needs one piece of precision to be worth saying at all. The verdict is decidable and binary, so it can gate anything that reads it — and because it is computed from a commit rather than from a live keystroke, the halt it wires to is a deploy gate: pre-push, pre-merge, pre-release. Not an interceptor sitting in your agent's tool call. That is a real difference and we would rather state it than let you find it. Intervention is available exactly to the extent the thing is decidable, which is why your car brakes for closing distance and has never once braked because the route was unwise. Cars got the mechanical version decades ago; what did not exist was a lane edge for meaning.
We do not sell the halt, and the reason is not modesty. The telematics dongle never stopped anybody driving off the road, and it is still the thing that moved the premium — because a policy can attach to a measurement and cannot attach to a promise. The floor this clears is that you are no longer guilty by default: you can show you could have checked, which is what a court asks a captain to produce and what an insurer prices against. Twenty dollars per agent-year, against eleven months of discovery. The falsifier is yours and it is cheap: produce a second construction that answers could anyone have checked out of a record the actor authored, and this collapses in public, on a corpus we publish.
WHAT YOU WANTED TO KNOW WHAT SURVIVES
───────────────────────── ─────────────────────────
Was the work good? ✗ Rice 1953 — undecidable
What did it actually do? ✗ Cover & Thomas 2.8.1 — unreconstructable
from the actor's own account
Did a record exist that
the actor did not write? ✓ binary · timestamped · checkable
by a stranger, offline, years later
The win condition, declared here rather than at the end: this fails if you leave nodding and succeeds only if you recompute. Eight rooms, one bottle, and every prediction it makes about you was committed to the repository before the prose existed.
The maître d', presenting: Champagne, Recently Disgorged — cold enough to fog the coupe, bread-crust and green apple on the nose, and the mousse still stinging. Turn the bottle. There is a second date on the back, in ink, stamped the morning the sediment was pulled. The wine did not write it.
Ask a bottle whether it is any good and you get a tasting note, which is the bottle's account of itself, written by people who want it sold. The disgorgement date is a different kind of object. It is stamped by a hand that is not the wine's — the cold toast tells you somebody was in the kitchen and nothing more; the champagne's second date tells you who, and when. It is stamped on a morning that either happened or did not, and a stranger in another country can read it years later without trusting anybody in the cellar. Nobody argues about a disgorgement date. They argue about the wine.
That is the whole argument, and everything below is how it is cooked. Two doors close — one in 1953, one in a textbook from 1991 — and the two results are independent, from different decades and different fields, which is what makes them expensive to attack. What survives is one question with a yes or no answer. It is not the question you wanted answered. It is the only one left, it is where the money attaches, and it is the reason a receipt is purchasable and a guarantee is not.
Don't take a sentence of it on faith. npx thetacog-mcp attest-demo is a one-minute local run on your own machine that reads nothing of yours and sends nothing anywhere; what comes back is a signed placement verdict — in-domain, out, or unplaced — computed from a commit rather than from anybody's story about one. The falsifier is cheap and it is yours: produce a second construction that answers could anyone have checked out of a record the actor authored, and this collapses in public.
The perimeter, so you can hold us to it: we never promise the agent behaves. We promise the deviation is detected, placed, priced and dispatched. The gate is open source and you can wire it to halt on a crossing if that is what you want — that is your configuration, not our undertaking. Catch us promising the agent will behave and you should discount every claim around it.
The maître d', presenting: Toast, Cold — left out overnight. The butter has gone waxy and the smell is yesterday's. It was made at three in the morning by somebody nobody remembers hiring.
Somebody sold you AI that acts on its own. It is inside now, it holds credentials, and nobody signed for what it does next — not the vendor, whose contract disclaims it; not your engineers, who did not choose it; not the model, which cannot sign anything at all. You did not decide to be in this position. You arrived in it the way you arrive at cold toast: something happened in the night and the evidence is ambiguous.
The unsigned gap is not a philosophical problem, and you already have the receipt for that. Your carrier's renewal questionnaire grew this year, and the new pages are not about your firewall. The assurance profession is being asked to sign for a class of actor whose only witness is itself, which is not a gap more diligence hours close. Somebody in an underwriting committee worked out that the exposure moved and priced accordingly, which is how you find out where risk really sits — not from a framework, from a form.
The maître d', presenting: One Spoon, Two Handles — heavy silver, warm from the pass. It is meant to be passed across the table rather than used, and it fits the other person's hand better than yours.
Here is the thing you can carry into the risk committee on Thursday, and it is deliberately smaller than the thing being sold everywhere else: you do not need the agent stopped. You need to be able to prove you could have checked. We published that sentence on 24 August, lifted near word-for-word out of chapter nine, because it has not moved and it is load-bearing.
Every vendor in this market sells the first thing — a guardrail, a boxed agent, a second model watching the first. We sell the second, and not because the first is impossible. The gate is open source, and an out-of-lane crossing can be wired to halt the run: that is a configuration, and it is yours to make. We do not sell it, because what we sell does not need it.
The OBD-II dongle in your fleet does not stop anybody driving off the road. It records how the car was actually driven, and that is what moved the premium — and in thirty years of usage-based motor insurance nobody has confused the dongle with the steering. The insurer never promised you would not crash. It made your driving countable, and countable is the precondition for accountable.
And yet the car in your driveway does step in now — automatic braking, lane keeping. Chapter twelve puts the boundary where it actually sits:
A car brakes for closing distance and for the lane edge; no car has ever braked because the route was unwise. The first is a measurement and the second is a judgment, and the machinery has never once confused them — which is why automatic braking shipped and automatic wisdom did not. What did not exist, until placement became decidable, was a lane edge for meaning. The instrument is not the brakes. It is the lane edge, and until now meaning had none.
Which is the steering wheel bolted to the tray, and it is not a figure of speech. Two objects come off the same computation and only one is for sale. The floor is the receipt — a record the actor did not write — and what it buys is the end of being guilty by default. The ceiling is whatever you wire it to, up to and including a halt, and the ceiling is yours: the coordinate is binary, it is computed before the write lands, and the gate is open source, so the switch is a hook on your side of the line, written against a verdict you can already read without asking us. We do not sell it. Not because it cannot be built — it can, and pretending otherwise to sound careful would be a lie told for the sake of modesty — but because a policy can attach to a measurement and cannot attach to a promise.
What you are handing the room is not a product. It is a question they can put to any vendor in the building, including us: show me the record my agent did not write. The ones who cannot will change the subject to alignment.
The maître d', presenting: Oysters, Nine of Them — brine, cold metal, a squeeze of lemon that makes the edges flinch. Priced by the piece, opened in front of you, and the count is not in dispute.
A parametric trigger pays on a measured index rather than on an adjudicated fault — the shape we walked through in telematics for semantics. Flight delayed more than three hours, the policy pays; nobody deposes the pilot. That structure settles in days where liability cover settles in years, and it exists wherever somebody found a number both sides agreed to read.
AI has had no such number, which is the actual reason the market has been slow rather than any shortage of appetite. A boundary crossing is a countable event and it is cause-blind by construction: a hidden trigger, a prompt injection, a hallucination and a vendor's token bias all produce the same crossing and the same tick, so nobody has to win the attribution argument first. That is the property that makes a meter possible, and a meter is what makes a market.
The economics fall out of it rather than being asserted: twenty dollars per agent-year, metered at 365 days or 10,000 attestations, whichever comes first. Installing and running the measurement is free and open source, permanently — the licence covers running agents in production, not the right to look.
Now say plainly what that is, because an underwriter reading this asks within a paragraph and the answer decides everything downstream. Twenty dollars per agent-year is a licence fee for an instrument. It is not a premium, this is not a policy, and there is no insuring agreement, no carrier of record and no payout anywhere in it. In the vocabulary that already exists for this shape, the receipt is a condition precedent — the sprinkler warranty, not the fire cover. A carrier can require it, price around its presence, and void for its absence, and none of that requires us to be an insurer or to pretend we are one.
And the distinction that decides everything is between a trigger and a rating variable, which get conflated constantly and are not the same object. A trigger is what fires a payout: it must be measured, binary and settled without adjudication, and the crossing count is exactly that — the invariant can serve as the parametric trigger today, and that is the claim. A rating variable is what sets the price, and it must correlate with loss.
That second one we do not have, and saying so is not a hedge. Cause-blindness is what makes the count usable without winning an attribution argument first, and it is also what keeps it from being a rating variable until somebody holds enough agentic loss history to test the correlation. Nobody holds that yet, us included. Anybody showing you an AI loss curve right now is showing you one they invented. The trigger is available now; the price of the risk it triggers on is what the market is about to spend three years discovering.
The maître d', presenting: A Cheese Course, Under Glass — washed rind, ammoniac at the edge, unmistakable from two tables away. The cloche is locked. The house would like you to note that you can smell it perfectly well and still not get at it.
Your organisation has two standing answers to the oversight problem and each walks into a different wall.
The first answer is a better judge. Rice, 1953: no machine decides a non-trivial property of what another program computes. A monitor asking was this output good is that machine, asking that question — a stronger reviewer model shares the failure domain of the thing it reviews, so a larger model buys a better storyteller and not a better witness.
The second answer is better logs. Cover and Thomas set it down in 1991 as Theorem 2.8.1, the data processing inequality: for a source passing through an actor and into a report, the information the report carries about the source cannot exceed what the actor carried — uniformly, over every reconstruction procedure anyone might invent, at any budget, on any hardware. In the register of the thing you deployed: an account of a process, produced by that process, cannot contain what the process displaced. The agent's changelog is an emission from inside the boundary. So is its trace, its self-evaluation, and the tidy paragraph it writes about what it just did to your database.
And the harder thing to say, because it is about the good teams. The shop with the best logging is the shop that took observability seriously. Nobody there is careless. They instrumented early, retained more than they needed, built what the auditors asked for — and the better the instrumentation, the more convincing an account that still cannot contain what it displaced. The care is real. It is aimed at a boundary it cannot cross.
The maître d', presenting: The Same Champagne, Warmer Now — the mousse has softened and the apple has gone to baked apple. Nothing about the wine is settled. The ink on the back has not moved.
Strike the undecidable question, strike the unreconstructable one, and something is still standing. Exactly one predicate survives both:
Did a record exist, written by something other than the actor, before the fact?
Not was the behaviour correct. Not what really happened in there. Only: was there a second entry — the spoon passed across the table rather than used, which is why it fits the other person's hand. Only: was there a second entry — and that question is binary, settled by a timestamp rather than by an argument, answerable by a stranger who never meets your team, about last Tuesday as easily as about this morning.
The formal version of this pair — why the two theorems are independent and why that is the asset — is in the record you evicted is unpurchasable. Luca Pacioli published Summa de Arithmetica in Venice in 1494. He did not invent double-entry bookkeeping and he did not write a sermon against fraud; he described an arithmetic in which every transaction is recorded twice, by parties who are not each other, and the books reconcile or they do not. Banking became possible because trust stopped being negotiated and started being computed. Double-entry is adversarial, not arithmetical — the second entry never made the merchant honest, it made dishonesty countable, and countable turned out to be worth more.
This is the difference between an invariant and an ethic, and it is not a difference of degree. A duty of care needs a standard, a reasonable person, and a jury willing to say what that person would have done. This needs a date. One of those resolves in a courtroom, years later, at the cost of the argument. The other resolves the moment somebody turns the bottle around.
It is also why read from the immutable commit, never the working tree is a requirement in our own codebase rather than fastidiousness: the checkpoint must read a record the actor did not author, or it is one more emission from inside the boundary wearing a different filename.
The maître d', presenting: The Kitchen Door, Propped Open — steam, scorched butter, somebody swearing at a pan. Several of them are dirty and the house would rather you saw that now than wondered later.
A court has never asked a captain whether the sea was safe. It has asked for the log. Learned Hand, 1932, in The T.J. Hooper: the tugs that lost their barges could have carried a weather radio, almost none did, and Hand refused to let an industry's own custom set the standard of care — custom is not care, which is the canonical statement of it here. For ninety years the honest answer for software was that no such device existed, and non-use was not a lag. The argument from here is ours and it is untested: no court has yet applied Hooper to an agent's audit trail, and the shield should hold only until the device exists.
The dated fact before the motive, so the motive can be judged against something: the application is US 19/637,714, filed 2 April 2026, seven provisionals behind it, claims drawn to apparatus and method — the machine, never the law. Checkable without asking us anything.
Now the ugly version, in your voice and phrased better than you would bother: "You filed a patent on the instrument and then published an argument concluding that the instrument you own is the only thing that survives two theorems. That is precisely the incentive that manufactures this conclusion, and you would have reached it either way."
Correct about the incentive, and it does not touch the argument — which is the only defence worth offering. Rice is 1953 and not ours. Theorem 2.8.1 is 1991 and not ours. Pacioli is 1494. Exactly one thing is not arguable, so exactly one thing can be underwritten, and the person that makes you is not somebody who bought safety. It is the captain who kept the log, which is the only figure in this story a court has ever been kind to.
The maître d', presenting: The Bill, Unchanged — the house's only boast: it reads the same in your handwriting as in ours.
npx thetacog-mcp attest-demo
One minute, locally, reading nothing of yours. You are probably not the person who will run it — the person is whoever owns your deploy pipeline, and the ask that works is run this and tell me whether the number reproduces, because the entire claim reduces to whether a stranger can recompute the same bits offline without trusting the team that produced them.
The sources, last and as ingredients rather than conclusions. Rice, Classes of recursively enumerable sets and their decision problems, 1953. Cover and Thomas, Elements of Information Theory, 1991, Theorem 2.8.1. Pacioli, Venice, 1494. The T.J. Hooper, 60 F.2d 737, 1932. The formal pairing — why Rice and the inequality are independent and why the pairing is the asset — is in the record you evicted is unpurchasable. The long form is chapter twelve of the book, immediately after the Hooper section; the book opens at thetadriven.com/book and the preface is public at /book/chapters/00-preface.
The win condition, and you are the one grading it. Eight rooms, eight predictions, each committed to the repository before its paragraph existed — both the objection you would arrive carrying and the thought the room was built to produce. This fails if you leave nodding. It succeeds only if you run the command, or hand it to the person who will, and find out whether the number reproduces on hardware we have never touched. Count how many of the eight fired. You are the stranger, which was always the point.