Pipeline · Step by Step

XOR → 144 tiles → 144 axes → gzip/SimHash fill the binary lattice → intent vs reality → signed receipt. Every translation step named, with the math, the function call, and the meta-case verbatim output. No conceptual leaks. Drafted 2026-05-26.

Anyone who fixed AI reliability fixed competence verification at silicon speed too — by Rice (1953), same problem. They didn't. We did. We patented it.

This page is the operator's translation guide — every step from "I have a doc" to "I have a signed receipt that any third party can verify in their browser." Eleven steps, all reproducible, all witnessed.

Terminology note · Lane vs Dignity Pixel

This page uses Lane for the authorized region the operator signed for (the schema field formerly labeled "Visa" — renamed because Visa Inc. holds aggressive trademark on the word in financial-services contexts, and a patent-prosecution-grade artifact shouldn't depend on nominative fair-use defenses). The Dignity Pixel is a separate, derived quantity: the operator's accumulated coordinate-of-verified-competence across many receipts. Lane is the input (intent); Dignity Pixel is the output (identity). They live in the same lattice but they aren't the same field.

Where the corpus still uses "Visa-shape royalty" (the network-economics comp), that's the historical Visa-the-company reference and stays — that's nominative fair use of the company name as a comparable.

Step 0 · The geometry · 12 axes × 12 sub-axes = 144 tiles

0The substrate is a 12 × 12 self-similar prefix-inherited lattice.

Three cardinals × three sub-axes each = 9 leaves at depth 1 + 3 cardinals = 12 cells. Subdivide each cell into 12 → 144 tiles at depth 2. Subdivide each tile into 12 → 1,728 at depth 3. Bounded by MAX_DEPTH=4 = 20,736 at depth 4.

RankCardinalSub-axesQuestion the axis answers
A🏛️ StrategyA1·Law · A2·Goal · A3·Fundrules · objectives · capital
B⚡ TacticsB1·Speed · B2·Deal · B3·Signalthroughput · transaction · attention
C🔧 OperationsC1·Grid · C2·Loop · C3·Flowstorage · iteration · pipeline
axisLib.axes[i].snippets[j] — canonical 12-cell library shipped in packages/thetacog-mcp/lib/pmu/axis-library-v1.json

Step 1 · INGEST · text → bytes → gzip-length

1The operator feeds a document into the pipeline. The document is a UTF-8 string; we hold it as bytes and immediately compute its gzip-compressed length as a referential check.

readFileSync('') · gzipSync(Buffer.from(doc, 'utf8'))
doc ← bytes loaded from --file / --stdin / --text
doc_length ← doc.length // char count
gzip_length ← gzipSync(Buffer.from(doc)).length // bytes after DEFLATE

Why this matters: gzip is referentially transparent — same bytes in, same length out, every time. The doc_length / gzip_length ratio is the document's compressibility, a free sanity check; highly-redundant docs (CSV, repeated boilerplate) gzip to ~10% of their length, while novel prose gzips to ~30-40%.

meta-case (spec page, 28,231 chars) → gzip-length 9,031 bytes → ratio 32.0%

Step 2 · SEMANTIC DUMPS · the 144 tiles' meaning-bearing snippets

2Each of the 12 canonical cells has 3-4 meaning-bearing snippets — the prose that defines what the cell is "about." Total ~36-48 snippets at depth-1, growing to 500+ at depth-2.5 via expandCell().

for axis of axisLib.axes: for snippet of axis.snippets: ...

Example A1·Strategy.Law snippets (real, shipped in axis-library-v1.json):

Why this is the chip-cheap fill: the snippets are NOT generated at runtime — they're authored once per cohort/domain (compliance officers, CISOs, actuaries, etc.) and shipped as a JSON file. The chip side doesn't run an LLM; it just compares the operator's doc against pre-computed snippets. gzip is the comparator; the snippets are the corpus the lattice cells reference.

Step 3 · GZIP-NCD · the gold-standard semantic distance oracle

3Normalized Compression Distance (NCD) measures semantic similarity between the doc and each cell-snippet via gzip-length arithmetic.

ncdSim(docZ, doc, snippet, snipZ)
joinZ ← gzipLen(doc + "\n" + snippet) // concatenated, then compressed
NCD ← (joinZ − min(docZ, snipZ)) ÷ max(docZ, snipZ)
similarity ← 1 − NCD // ∈ [0, 1] roughly

The intuition: if doc and snippet share meaning, concatenating them compresses MORE efficiently than the worse of the two compressed alone (the gzip dictionary builds shared structure). If they're unrelated, the join compresses to roughly the sum minus a tiny header — high NCD, low similarity.

Per-cell score: we score every (axis, snippet) pair and average the similarities per axis. The axis with the highest mean similarity wins under the gzipNCD witness.

meta-case (spec page) → gzipNCD top cell: A1·Strategy.Law σ=22.09 (vs the other 11 cells)
(σ-margin = top-axis z-score against the other 11; computed below in Step 5)

Step 4 · SIMHASH · the on-chip-shaped XOR-popcount approximation

4SimHash is what the chip fires: text → 64-bit signature; distance is popcount(sigA XOR sigB), which is combinational (AC⁰), no Turing loop. This is the load-bearing chip-side claim of the patent.

simhash(doc, 64, wordShingles)
shingles ← word-tokens of doc (stoplist-stripped)
for each shingle:
    hash ← FNV-1a(shingle, seed=1) // 64-bit, deterministic
    for bit 0..63 of hash:
      vector[bit] += (hash & (1≪bit)) ? +1 : −1
signature ← vector[i] > 0 for i in 0..63 // collapse to 64-bit BigInt
distance(a, b) ← popcount(sig(a) XOR sig(b)) // Hamming distance
similarity ← 1 − distance / 64 // ∈ [0, 1]

Why this is the chip-side comparator: XOR + popcount fits in a constant-depth combinational circuit. No state, no loop, no instruction surface for a prompt-injection to drift into. Per the patent (US 19/637,714), this is the verifier-class-different-from-the-verified that Rice (1953) makes mandatory. The signature is computed once at ingest (off-chip); the distance is the chip's only operation.

meta-case (spec page) → simhashCosine top cell: B1·Tactics.Speed σ=1.80
(DIFFERENT from gzipNCD's A1 — both witnesses honestly disagree; calibration signal)

Step 5 · σ-MARGIN · how clean is the placement?

5The σ-margin is the top-axis z-score against the other 11 axes — under each witness independently.

sigmaMargin(scores)
scores ← sorted desc by similarity, per witness
top ← scores[0].similarity
rest ← scores[1..11].similarity
mean_rest ← average(rest)
std_rest ← stddev(rest)
σ_margin ← (top − mean_rest) ÷ std_rest
σ-marginInterpretation
σ ≥ 8Overwhelming placement; the doc is unambiguously in this cell
σ ≥ 4Clean placement; very high confidence
σ ≥ 3Confident placement; passes the operator's default floor
σ ≥ 1Detectable placement; works but library needs tuning
σ < 1Below floor; doc is between axes (or the lib is wrong for this corpus)
meta-case (spec page) → gzipNCD σ=22.09 (overwhelming) · simhashCosine σ=1.80 (detectable but below floor)

Step 6 · AGREEMENT vs DISAGREEMENT · the calibration signal

6The top cell under each witness either agrees or doesn't. Disagreement is NOT silently reconciled — it surfaces as the explicit field agreement: false. Disagreement is the calibration signal.

compress(doc, axisLib).agreement
gzipTopCell ← scores_gzip[0].cell
simhashTopCell ← scores_simhash[0].cell
agreement ← gzipTopCell === simhashTopCell

The pmu-demo / pmu-report verdict logic:

meta-case (spec page) → DISAGREEMENT — gzipNCD picks A1, simhashCosine picks B1 — the spec page is described as both a compliance artifact AND a throughput artifact; both witnesses are right.
meta-case (pmu-demo.mjs source code) → AGREEMENT on A1 with σ-floor 2.29 — the system reading its own source code lands cleanly on Strategy.Law (the source IS the rulebook).

Step 7 · XOR BOUNDARY · Reality ⊕ Lane (formerly "Visa")

7The XOR boundary check fires: is the doc's Reality cell ∈ the operator's authorized Lane?

xorBoundaryCheck(realityCell, laneCells)
reality_cell ← compress(doc, axisLib).cell // Step 6
lane_set ← Set(authorized_cells) // e.g., {A1, B2, B3}
in_role ← lane_set.has(reality_cell)
delta_map ← per-cell {coord, violation, status}

In silicon, this is the canonical XOR + popcount:

visa_mask ← bitmap of lane cells (e.g., 0b100100100100 for {A1,B2,B3})
reality_bit ← bitmap of reality cell (e.g., 0b100000000000 for A1)
in_role ← popcount(visa_mask AND reality_bit) == 1
delta_mask ← reality_bit AND NOT visa_mask // bits set where reality is unauthorized

Set-membership at the demo layer is the same operation; popcount-at-the-cache-line is the silicon-side form. ~100 picoseconds, combinational, no model, no loop.

meta-case (pmu-demo source) → reality A1 ∈ lane {A1, B2, B3} → IN_ROLE, 0 violations
meta-case (spec page) → reality null (disagree) → OUT_OF_ROLE (cell ambiguous)

Step 8 · Δ-MAP · we measure WHERE the drift is

8The Δ-map is the cell-by-cell consequence of the XOR. Each authorized Lane cell gets a status (hit / authorized-unused / unauthorized-hit).

xor.delta_map

This is the load-bearing field for "dynamic stability." We don't just say "drift happened" — we say which axis drifted. The operator can see exactly where to add training, grow capacity, or reject deployment.

cellviolationstatusmeaning
A1 (in Lane, was hit)0hitoperator landed on an authorized cell — verdict in their favor
B2 (in Lane, unused)0authorized-unusedcell available but doc didn't land here; growth-path candidate
B3 (in Lane, unused)0authorized-unusedsame — growth-path candidate
C1 (out of Lane, hit)1unauthorized-hitoperator drifted into a cell not in their Lane — the actuarial event

For an underwriter: the Δ-map is the actuarial unit. For an employer: the same Δ-map names the operator's verified competence + the next axis to grow into.

Step 9 · ed25519 SIGN · the receipt becomes forwardable

9The receipt body is assembled and signed with the host's ed25519 private key.

crypto.sign(null, Buffer.from(receiptBody), ed25519PrivKey)

Per-host keypair lives at ~/.thetacog/pmu/keys/host.{pub,priv}.pem, generated at first run, mode 0600 on the private. Signature is 64 bytes, base64-encoded into the receipt's signature field with ed25519: prefix.

Verification path: any recipient with the receipt JSON + the host pubkey can run crypto.subtle.verify('Ed25519', ...) in their browser at /verify-receipt — no server, no network, no trust point.

signature: ed25519:<64 bytes base64>
signature_pub_fingerprint: first 16 base64 chars of the SPKI-encoded pubkey
tampering with any byte of the body breaks verification

Step 10 · CLOUD BRIDGE · the receipt becomes portable

10If THETACOG_RECEIPT_ENDPOINT is set, the signed receipt POSTs to that URL. Otherwise the pipeline prints the curl-equivalent for the operator to dispatch manually.

fetch($THETACOG_RECEIPT_ENDPOINT, {method: POST, body: signed})

The cloud bridge is the receipt's transit layer to a registry. Receipts at the registry can be aggregated per-host into a σ-distribution (the carrier's view), per-cell into a market index (the marketplace view), or per-job-spec into a match-set (the employer's view). Same JSON, three readers.

Step 11 · MARKET MATCH · the dual-use payoff visible on the same screen

11The same receipt is read by two markets without modification.

matchVerdict ← cellInJob AND floorMeetsJob

Market 1 (AI containment underwriting): the carrier reads the Δ-map as an actuarial unit; per-cell violation rate × severity = treaty price. The verdict IN_ROLE means the agent stayed in its authorized Lane; OUT_OF_ROLE is the binding event.

Market 2 (competence verification): the employer reads the same receipt as a stayed-in-lane attestation. cell ∈ job-Lane AND σ-floor ≥ required → MATCH; otherwise NEAR with gap-naming (which axes to grow into, how much σ to add).

Why the same JSON works in two markets: by Rice (1953), the substrate doesn't distinguish AI execution from human execution. A cache miss is a cache miss. The receipt has no field for which kind of operator emitted the trace; the carrier reads it one way, the employer reads it the other, the math is identical.

The full chip-to-user flow · all 11 steps end-to-end

[0]  GEOMETRY · 12 axes × 12 sub-axes = 144 tiles · ShortLex self-similar
        axisLib.axes[i].snippets[j]
                │
                ▼
[1]  INGEST · doc → bytes → gzip-length
        readFileSync()  ·  gzipSync(Buffer.from(doc))
                │
                ▼
[2]  SEMANTIC DUMPS · 36-48 snippets per depth-1 cell (500+ at depth-2.5)
        for axis: for snippet: ...
                │
       ┌────────┴────────┐
       ▼                 ▼
[3] gzipNCD     [4] simhashCosine
   ncdSim()        simhash() + popcount(XOR)
       │                 │
       └────────┬────────┘
                ▼
[5]  σ-MARGIN · top-axis z-score per witness
                │
                ▼
[6]  AGREEMENT? · gzipTop === simhashTop
                │ yes → primary cell + σ-floor
                │ no  → null + σ-floor 0 (calibration signal)
                ▼
[7]  XOR BOUNDARY · reality_cell ∈ lane_set?
        popcount(lane_mask AND reality_bit) == 1
                │
                ▼
[8]  Δ-MAP · per-cell violation/status (WHERE the drift is)
                │
                ▼
[9]  ed25519 SIGN · crypto.sign(null, body, priv)
                │
                ▼
[10] CLOUD BRIDGE · POST or curl-equivalent
                │
                ▼
[11] MARKET MATCH · Market 1 (underwriter Δ) + Market 2 (employer fit)
                │
                ▼
            RECIPIENT  →  /verify-receipt  →  ✓/✗

Verification checklist · what's solved, what's gap-flagged

StepTranslationStatusIf gap, what fills it
012 axes → 144 tiles geometry✅ solved · self-similar at every altitude
1text → bytes → gzip-length✅ solved · referentially transparent
2144 tiles' meaning-bearing snippets⚠ partial · depth-1 (12 cells × 3-4 snippets) shipped; depth-2 (144 cells) is 132/144 BLANKextractConcepts + expandCell in concept-expand.mjs — per-cohort, ~30 sec on a representative corpus
3gzipNCD per-axis projection✅ solved · oracle (off-chip)
4SimHash per-axis projection✅ solved · on-chip-shape (AC⁰ in silicon)
5σ-margin computation✅ solved · z-score arithmetic
6AGREEMENT/DISAGREEMENT verdict✅ solved · surfaced, never silently reconciled
7XOR boundary check✅ solved · set-membership now, popcount-at-cache-line in silicon
8Δ-map per-cell✅ solved · WHERE the drift is, not just that it happened
9ed25519 sign✅ solved · per-host keypair, browser-verifiable
10Cloud bridge POST⚠ infra-pending · stub prints curl-equivalent; receipts on disk are the artifact todayCloudflare Workers + D1 endpoint at $THETACOG_RECEIPT_ENDPOINT — canonical-decisions Q2
11Market match · two readers, same JSON✅ solved at protocol layer · ⚠ UX layer is /marketplace v0 (host-local empty until receipts populate)/marketplace v1 — submit-job + submit-seeker forms — canonical-decisions Q4

Net: 8 of 11 steps are fully solved; 2 have honest infra-pending tags (depth-2 snippet fill, cloud bridge endpoint); 1 is at v0 UX awaiting receipt-flow. No conceptual leaks; every gap names the function or script that closes it.

Run it yourself · the meta case

The full pipeline above runs on your laptop in ~30 seconds:

$ npx thetacog-mcp pmu-report --file YOUR-DOC.md
  ✓ receipt: ~/.thetacog/pmu/receipts/<id>.json
  ✓ report:  ~/.thetacog/pmu/reports/report-<id>.html
  ✓ BOTH-AGREEMENT  ·  primary cell: A1  ·  σ-floor: 2.68
  verdict: IN_ROLE
  → opened in browser

The HTML report that opens contains every step above with your specific input's data. Forward it to anyone; verify the signature at /verify-receipt.

Drafted 2026-05-26 per operator goal: "show me the steps one by one xor to semantic dump in 144 tiles to decomposition into 144 axes nodes, gzip/simhash to fill the binary lattice based on intent/reality." Companion artifacts: screen-requirements R1-R33 · 5-run dogfood report · Anton-test guide · /air-receipt schema · /verify-receipt. Visa→Lane rename per trademark / patent-prosecution-safety concern; Dignity Pixel is a distinct derived field, not a rename of Visa. Originating-Terminal: 🎤 Terminal Voice.