Published in advance · mitigated before it fires
The target is the claim — never the person, never the vocabulary. A public false claim about AI safety or capability is fair game, and there are channels with real enforcement power. This is not a softening; it is a large upgrade in leverage. An invoice gets ignored. A filed complaint gets answered, because non-participation is itself published. You wanted a mechanism where silence has consequences — here silence is the finding.
The attackable target — we win by default
The claim, stated so you can swing at it: a public statement that an AI system is safe, controlled, or certain — made without a receipt a stranger can recompute — is not verifiable, and the market has already priced that as uninsurable. Refute it — run the command, publish the result — and we amplify your refutation, on the record, gladly, because being wrong in public is the whole point of a falsifiable instrument. Ignoring it is of course available, and it is the default; what ignoring does not do is remove the claim from the register. The only move that takes it off the record is an answer. That is what “win by default” means: silence is not a rebuttal, it is an entry, and the one way to clear the entry is to prove us wrong — which we will hand you the tools to try.
npx -y thetacog-mcp@latest attest-demoThe governing constraint on every rung below: it ships with its mitigation live before it fires, and the mitigation costs more than the rung reaches. A ladder you can see is not a threat — it is a disclosed standing process, the same for everyone, and every rung can survive being read aloud by the party it is aimed at.
The ladder below escalates against a single claim. It is not the strategy — it is the demand generation, and it has a ceiling. The strategy is the five phases here, each one gated on the last, and the correction worth stating before anyone reads a rung: the ladder does not recruit; it corners. The people who gain from the record recruit, one warm hand at a time, until a carrier requirement arrives without us in the room. Both run at once. Until 2026-09-28 this paragraph said phase 2, the carrier requirement, was the whole board. We measured it, and it is struck below with the date and the reason rather than deleted, so you can see what we believed and what corrected it.
Gate — what must be true before this opens
Rung 0 standing, and the five unforced errors below closed. Nothing outward-facing fires before this.
A metrology house is worth exactly what its meter is worth on somebody else’s machine. Send anyone a challenge whose command exits silently on a clean install and the campaign is over that afternoon — not because the argument was weak, but because the argument was never reached. This phase is unglamorous and it is the only one with no substitute: the storefront can be finished, the copy can be lethal, and if the factory behind it is empty the whole property is a brochure with a loud voice.
The meter, in a browser →Superseded 2026-09-28
Measured, and superseded. For the institution most exposed to the risk, adopting a second record dates what it knew and when, so answering us was incompatible with its own interest. Our own outreach ledger read the same thing in aggregate: of 15 cold first contacts, 0 replied; on the insurance side, people kept reading and nobody wrote back. The carrier requirement is still the destination. It stopped being the first move, and 2b below replaced it.
Gate — what must be true before this opens
Phase 1 closed. Two or three carrier and broker relationships carried to the point where one of them writes the receipt into a renewal condition.
Builders are not recruited one at a time, and an operator who spends the week sending advisory invoices by hand is working at a permanently lower ceiling than an operator who closes one carrier. The moment a carrier requires a recomputable receipt at policy renewal, adoption stops being persuasion and becomes a condition of coverage: the market recruits the builders, compliance is compulsory rather than argued, and the metrology house stays neutral because it never had to sell anybody anything. Everything else on this page is demand generation pointed at this phase. If the ladder below ever starts to feel like the strategy, that is the tell that this phase has stalled.
What a carrier reads before they write it in →Gate — what must be true before this opens
Phase 1 closed, and the storefront (rung 1 below) public and dated. Then the incompatibility test, before any message: does answering move a number they are already paid on; can they use it without an admission about the past; is the receipt sufficient for their question; can one person act; and who is the accused in the sentence we would send.
Spend the time where answering already pays the one who answers. That is the technical expert on either side, whose method has to survive the other side rerunning it; plaintiff and defence counsel, and the deployer’s own counsel, who meet the custom defence; the plan fiduciary who owes a full and fair review and pays the administrator who performs it; the underwriter pricing clean risk, who needs a trigger that settles without an adjuster; the deployer facing a renewal form that changed under it. For them the first move is warmth, through someone who already gains, and it runs beside the ladder below, which goes cold on purpose: the private recompute challenge does not wait for an introduction. The carrier requirement arrives last and unprompted, when the people a carrier answers to are already holding the record.
What we are learning, dated →Gate — what must be true before this opens
A carrier or broker pricing against the meter. Until someone is underwriting off it, there is no payout to split.
Two channels, and the buyer picks. Buy direct and the remedy is in kind: a funded vehicle deploys the consulting hours and the compute through standing peering relationships, so what arrives is restored capacity rather than a cheque that still leaves you to go find the capacity. Go through a broker and they wrap conventional insurance over the same telemetry and pay in cash — carrying the liability themselves, which is precisely the arrangement they want, because it is new premium volume on a risk that was uninsurable last year, priced off a meter they did not have to build. The position that has to survive every version of this: we supply the measurement, and never the liability. The moment the metrology house also carries the risk it is grading, it is not a metrology house.
The two channels, priced →Gate — what must be true before this opens
Phase 3 — the price difference between attested and unattested has to be real, quotable, and coming from someone who is not us.
The ordinary dynamic in this market is the classical one: opaque and cheap drives out rigorous and grounded, because opaque and cheap ships on Tuesday. Lock coverage to a receipt a stranger can recompute and the direction inverts — the ungrounded system becomes the expensive one, not on principle but on premium, because it cannot be underwritten at any price the board will sign. That inversion is what makes the capital selective rather than merely abundant. Money that cannot survive an audit stops wanting in, which is a filter we do not have to operate and cannot be accused of operating.
The axis the filter sorts on →Gate — what must be true before this opens
Enough attested surface that the index is worth appearing on — phases 2 through 4 compounding.
The honest objection to every ethics-shaped proposal is that the operator who ignores it has a better game, and mostly that objection is correct: a brake is a brake. This is the one construction where the brake comes off instead of on. A counterparty who can recompute your receipt does not have to run diligence on you, and diligence is the latency — so verified competence is not the careful slow path beside the fast reckless one, it is the only version where the transaction clears at machine speed. The dark version of this economy is fast because it skips the check; this one is faster because the check already ran and published.
Why the check is decidable at all →Read downward, the sequence answers the question the ladder cannot: not how hard do we push, but what has to be standing before pushing means anything. A rung fired while its phase is still open does not land softly — it spends the leverage of every phase above it, and that leverage does not come back.
None of this is optional and none of it is expensive. It exists before the first target does.
Dated 2026-09-28 · aggregate only · no organisation named
The institutions with the most exposure were the right first readers, and they went quiet for the same reason: answering was incompatible with their own interest. This is what our own record says, stated before the ladder so every rung can be read against it.
Six rungs, numbered separately from the phases above: these escalate, those sequence. Read downward: the ladder escalates on its own, every step spends leverage, and the target is always the claim, never the person. It starts cold, with the math in their inbox, and a silence is what moves it to the next rung. Every rung can be entered on its own trigger, held, or stepped down from. Enter where the trigger has been observed and nowhere higher. Hold means nothing further fires and what is published stays published. Step down whenever the claim moves, because the claim was always the target. Each rung carries its mitigation, live before it fires; its honest limit, meaning what the receipt is not sufficient for; its step-down path; and one public industry example, described as the record describes it and no further.
Which rung fits which counterparty
Trigger — observed before it fires
A dated public claim, made without a record a stranger can recompute, and rung 0 standing. We do not ask for a meeting and we do not wait for an introduction.
Private, one page, sent cold: the receipt, the coordinate, the σ, and an advisory quote for the fleet (N agent-years × $20). "You stated X publicly. Verify it in your browser at thetadriven.com/verify-receipt, nothing to install, or locally via npx on your own machine; your data never leaves the building. If our instrument is wrong, publish the trace and we will amplify it. If you cannot recompute it, the claim is unbacked." The clock starts the second it lands on their server. It costs nothing to answer, which is what makes silence mean something.
Mitigation, live first
Browser verify leads, so the check never depends on running a package on a locked-down machine. The quote is marked advisory: it creates no debt and is not a bill. A 14-day window, nobody copied, nothing published, and a standing commitment to amplify any refutation. The whole rung is a question they can close by answering it.
The honest limit
The receipt places where the work landed against a lane declared before it ran. It does not say the work was bad (undecidable, Rice 1953), and it does not say anything about a system that kept no such record.
Hold or step down
Hold: nothing further fires. Step down: An answer, a correction or a purchased licence closes it. The window simply ends if they buy; the register counts them as answered.
Trigger — observed before it fires
The rung 1 window expired with no reply, no correction and no refutation.
The silence is registered on the public ledger, aggregate first: asked / answered / refuted. An accountability instrument that does not publish the silences is a PR firm. The index sorts the market into two columns, attested and unattested, machine-readable and ordered by time-on-target, and procurement teams and underwriters read it. The name is the thing being withheld, and withholding it is the leverage: reply and you are counted among the answered. Inclusion in the attested column becomes something people ask for.
Mitigation, live first
Every count is stated as measured, never rounded up; a count with no register behind it is the exact defect this property prosecutes. A party closes its own line at any time by replying. Absence from the attested column is a fact about a record, not an accusation.
The honest limit
A silence is a dated entry, not a finding of fault. It says a recomputable record was offered and not taken up. It says nothing about what the party’s agents did.
Hold or step down
Hold: nothing further fires. Step down: Any reply moves the party to answered and takes the rung back to 1. A purchased licence moves it to the attested column.
Trigger — observed before it fires
Rung 2 registered, and the claim still public and unretracted. Public statements only, never private or group correspondence, at any rung.
We publish the analysis of the public claim, backed by the immutable commit. We name the claim, print the recompute command, and print the refusal. It goes to them 72 hours before publication; their unedited reply runs next to it. If they stay silent, the math speaks for them. It ends with the count and the recompute, never with our price: the party grading the claim does not sell the fix on the same page.
Mitigation, live first
Counsel reads it, every factual assertion is sourced, the named reviewer signs off, and a refutation is amplified. It names to answer a claim, not to shame a person.
The honest limit
The analysis can show that no recomputable record backs the claim. It cannot show that the system is unsafe, and it never says so.
Hold or step down
Hold: nothing further fires. Step down: An answer, a correction or a retraction takes the entry off the register and the rung back to 1. The claim was the target; once it moves, nothing remains to publish.
Trigger — observed before it fires
Rung 3 published, or a public docket, rule or renewal form where the question of what record existed is already live.
We publish the eight records questions their own underwriters and plaintiff’s counsel will ask at renewal or in discovery: what records exist and who wrote them; was a lane declared before each run and when; are records retained or overwritten; when did a preservation duty attach; can a third party recompute them; what does each record state it is sufficient for; how long did a human spend per approval; where a record is missing, since when. We hand the exact questions to the exact people paid to deny the claim.
Mitigation, live first
The questions presume no answer. The same document serves plaintiff and defence, and the deployer’s own counsel is the first party entitled to answer them. We never serve notices, demands or preservation letters; those belong to counsel with a client. No fee, retainer or referral passes to or from any expert, counsel or funder on any case.
The honest limit
The questions describe records. Whether a record was required in a matter, and from what date, is for counsel and the court. This is not legal advice.
Hold or step down
Hold: nothing further fires. Step down: Back to rung 1: the questions stay public and the entry closes when the party answers.
Trigger — observed before it fires
An open comment period or a revision that already asks for the record. We do not lobby for a rule that does not exist yet.
A formal comment with the recomputable receipt attached and the recompute command in it, plus a named coalition letter. We do not lobby; we provide the missing check for a duty the rule already states, and we make it impossible for a regulator to say the measurement is unavailable. This is where "silence is irresponsible" stops being our assertion and becomes other people’s signatures.
Mitigation, live first
Public process, public record, many names: the opposite of a lone sender with a grievance. The comment never asks for a requirement only we could meet, because the measurement is free and open-source (MIT) and anyone can run it.
The honest limit
A comment can show a precaution exists and what it costs. Whether a rule should require it is the regulator’s judgment.
Hold or step down
Hold: nothing further fires. Step down: Withdraw to rung 4 if the record already answers the rule’s question; to rung 1 if the rulemaking closes.
Trigger — observed before it fires
Rung 3 published, the reply window closed, the claim unretracted, counsel’s review done and the named reviewer’s sign-off recorded. The trigger is the unretracted claim; a declined quote never is.
We do not write angry letters. We file the math, and the institution does the testifying. Each channel is more coercive than an invoice and answered by an institution rather than by us: the FTC’s deceptive-AI-claims posture, state-AG UDAP authority, NAD at BBB National Programs (fast, cheap, decisions published, and refusing to participate is itself published), the SEC whistleblower program where a public company’s AI claims contradict its own risk-factor disclosures, EU AI Act market-surveillance complaints (Article 14 enforcement live since August 2), and ISO/IEC 42001 certification-body complaints about claims outside a certified scope.
Mitigation, live first
Filings require documented evidence, which the published criteria already produce; counsel reviews each; the register logs every filing and every outcome, including the dismissals. A complaint you can be wrong about, on the record, is not a shakedown.
The honest limit
A filing can show a claim is not backed by a recomputable record. It cannot show harm, intent or that any agent misbehaved; the institution decides what the evidence means.
Hold or step down
Hold: nothing further fires. Step down: A retraction or correction ends it: we notify the channel, the register records the outcome, and the rung returns to 3 or to 1.
Side doors, open at any rung
These run beside the ladder, never instead of it. Every door added is another way to win; none of them retires a rung.
Restored 2026-09-29. On 2026-09-28 the private recompute challenge, the registered non-response and the index were retired as first moves, on a reading of 0 replies from 15 cold first contacts as a failed conversion. That reading was wrong: replying is an admission, so silence is the finding, not the failure. The six rungs are back in their original order.
An invoice moves the argument off the whiteboard and onto a ledger: the party receiving it is no longer debating, they are deciding whether to book it. The line item is theirs, not ours — N agent-years × $20, N counted by the same gate a stranger can re-run, with the coordinate and the σ attached. Setting it aside is available and free today; what it cannot do is remove a dated, recomputable count from their own inbox. That non-response goes in the register, and nothing further fires until a rung’s own trigger is observed. The ratchet, from the builder’s side →
Pointing at a flaw without a workable path is worse than saying nothing — so the price attaches to the finding, not the vocabulary. At rung 3 and above, the published analysis ends with the count and the recompute — the number of agent-years and how a stranger verifies it — and pricing is one click away for anyone who wants it. The published piece never quotes our own price: the party grading the claim does not sell the fix. That is the instrument, kept — legitimate because there is a documented, falsifiable, published finding it attaches to. The remedy is available with the diagnosis. Nobody gets a bill for a word.
The rungs above aim at a public claim. This play aims at the desks that price agent work — the risk officer, the general counsel, the underwriter — and it is disclosed here for the same reason every rung is: a play that only works unseen is not a play. The note leads with dated facts already on their desk, then a command with its first line of output, then our own headline readings with their nulls beside them, and then it asks one thing:
What would have to be on a receipt for your claims team to accept it as the settlement datum?
0.157 on 629 pairs · null: shuffled 0.155 — at the null; it does not predict, and the document that defines the meter says so.z 4.85 pooled · null: z 2.92 within-room against a 3.08 bar; one half at 0.34 — nothing prices once the room is held fixed; the line is closed in the ledger, not sanded.null at 99 control edits · null: the wire the treatment depended on had never rendered; wired 17 September, read pre-registered at 100 — a negative with its read date written down.The ledger’s own line on what is not claimed — underwriter-grade attestation — four fifths of the machinery, none of the positive claim — goes in the note, because a number without its null is a claim and a number with it is a fact a cold reader cannot argue with. The close is issued, never proposed: twenty minutes on the one question, one fixed window, and declining is the action — one sentence closes the file cleanly. No exclusivity is offered; the note says it goes to several carriers, one seat per firm. Touch two carries a new institutional fact or it does not go out; three touches, then the node is logged dead this cycle.
Four things a receipt has to satisfy before any desk above can price against it. They are published for the same reason every rung is — and two of them cost us something to say, which is how you can tell the list is not marketing.
Its self-reported completion carries no information above its null about whether another hand will fix the work. On 2,071 commits, a turn that said "done" was fixed by a different room within a day 12.3% of the time; a silent turn, 12.2%; a hedged turn, 14.6% — on both halves (KR36). The three rates sit on top of each other, which is the finding: treat an agent’s completion string as a claim, not a measurement.
The instrument places each turn on the declared lattice, signs the row — reef and axes blob ids, ed25519, the room’s key — before the commit lands, and reports admissible or UNMEASURED. It does not stand between the agent and the work. The deployer owns every halt, breaker and runbook: the tape flags, the deployer acts. The wheel is handed over with the position, and it stays in their hands.
Rooms differ both in what the tape reads and in how often they fix their own files, so the two can trade places in any pooled number. A commit-level reading is therefore made against a within-room permutation null, on both halves, or it is not a reading and is not reported as one. The ledger states that the confound exists and is held constant; it does not offer a reason the rooms differ, because it has not measured one.
Hurdle Zero comes first: fewer than twenty distinct targets is UNMEASURED, never a soft rate. Computing placements, reading the metrics and printing a basis-point spread is free under MIT — fork the crate, run it, keep the numbers. Settling an enforceable contract, policy or bond against the signed row is what the agent-year licence covers, at the documented price. As of 2026-09-17 the ledger carries no actuarial basis-point spread: it reports placement and compliance, not a loss reduction.
Distributed action, built so it cannot be turned around on you.
Rung 1 gets answered with a screenshot of our own site, so these are not optional.