Published in advance · mitigated before it fires
The target is the claim — never the person, never the vocabulary. A public false claim about AI safety or capability is fair game, and there are channels with real enforcement power. This is not a softening; it is a large upgrade in leverage. An invoice gets ignored. A filed complaint gets answered, because non-participation is itself published. You wanted a mechanism where silence has consequences — here silence is the finding.
The attackable target — we win by default
The claim, stated so you can swing at it: a public statement that an AI system is safe, controlled, or certain — made without a receipt a stranger can recompute — is not verifiable, and the market has already priced that as uninsurable. Refute it — run the command, publish the result — and we amplify your refutation, on the record, gladly, because being wrong in public is the whole point of a falsifiable instrument. Ignoring it is of course available, and it is the default; what ignoring does not do is remove the claim from the register. The only move that takes it off the record is an answer. That is what “win by default” means: silence is not a rebuttal, it is an entry, and the one way to clear the entry is to prove us wrong — which we will hand you the tools to try.
npx -y thetacog-mcp@latest attest-demoThe governing constraint on every rung below: it ships with its mitigation live before it fires, and the mitigation costs more than the rung reaches. A ladder you can see is not a threat — it is a disclosed standing process, the same for everyone, and every rung can survive being read aloud by the party it is aimed at.
The ladder below escalates against a single claim. It is not the strategy — it is the demand generation, and it has a ceiling. The strategy is the five phases here, each one gated on the last, and the correction worth stating before anyone reads a rung: the ladder does not recruit anyone. A carrier requiring a recomputable receipt at renewal recruits everyone, at once, without us in the room. Phase 2 is the whole board. Every other phase either makes it possible or compounds it.
Gate — what must be true before this opens
Rung 0 standing, and the five unforced errors below closed. Nothing outward-facing fires before this.
A metrology house is worth exactly what its meter is worth on somebody else’s machine. Send anyone a challenge whose command exits silently on a clean install and the campaign is over that afternoon — not because the argument was weak, but because the argument was never reached. This phase is unglamorous and it is the only one with no substitute: the storefront can be finished, the copy can be lethal, and if the factory behind it is empty the whole property is a brochure with a loud voice.
The meter, in a browser →Gate — what must be true before this opens
Phase 1 closed. Two or three carrier and broker relationships carried to the point where one of them writes the receipt into a renewal condition.
Builders are not recruited one at a time, and an operator who spends the week sending advisory invoices by hand is working at a permanently lower ceiling than an operator who closes one carrier. The moment a carrier requires a recomputable receipt at policy renewal, adoption stops being persuasion and becomes a condition of coverage: the market recruits the builders, compliance is compulsory rather than argued, and the metrology house stays neutral because it never had to sell anybody anything. Everything else on this page is demand generation pointed at this phase. If the ladder below ever starts to feel like the strategy, that is the tell that this phase has stalled.
What a carrier reads before they write it in →Gate — what must be true before this opens
A carrier or broker pricing against the meter. Until someone is underwriting off it, there is no payout to split.
Two channels, and the buyer picks. Buy direct and the remedy is in kind: a funded vehicle deploys the consulting hours and the compute through standing peering relationships, so what arrives is restored capacity rather than a cheque that still leaves you to go find the capacity. Go through a broker and they wrap conventional insurance over the same telemetry and pay in cash — carrying the liability themselves, which is precisely the arrangement they want, because it is new premium volume on a risk that was uninsurable last year, priced off a meter they did not have to build. The position that has to survive every version of this: we supply the measurement, and never the liability. The moment the metrology house also carries the risk it is grading, it is not a metrology house.
The two channels, priced →Gate — what must be true before this opens
Phase 3 — the price difference between attested and unattested has to be real, quotable, and coming from someone who is not us.
The ordinary dynamic in this market is the classical one: opaque and cheap drives out rigorous and grounded, because opaque and cheap ships on Tuesday. Lock coverage to a receipt a stranger can recompute and the direction inverts — the ungrounded system becomes the expensive one, not on principle but on premium, because it cannot be underwritten at any price the board will sign. That inversion is what makes the capital selective rather than merely abundant. Money that cannot survive an audit stops wanting in, which is a filter we do not have to operate and cannot be accused of operating.
The axis the filter sorts on →Gate — what must be true before this opens
Enough attested surface that the index is worth appearing on — phases 2 through 4 compounding.
The honest objection to every ethics-shaped proposal is that the operator who ignores it has a better game, and mostly that objection is correct: a brake is a brake. This is the one construction where the brake comes off instead of on. A counterparty who can recompute your receipt does not have to run diligence on you, and diligence is the latency — so verified competence is not the careful slow path beside the fast reckless one, it is the only version where the transaction clears at machine speed. The dark version of this economy is fast because it skips the check; this one is faster because the check already ran and published.
Why the check is decidable at all →Read downward, the sequence answers the question the ladder cannot: not how hard do we push, but what has to be standing before pushing means anything. A rung fired while its phase is still open does not land softly — it spends the leverage of every phase above it, and that leverage does not come back.
None of this is optional and none of it is expensive. It exists before the first target does.
Six rungs against one public claim, numbered separately from the five phases above — these escalate, those sequence. This is the demand-generation instrument, and it runs inside phase 2 rather than instead of it.
Private, one page. "You stated X publicly. Verify it in your browser — thetadriven.com/verify-receipt, nothing to install — or, if you run packages, locally via npx on your own silicon, your data never leaves the building. If our instrument is wrong, publish the trace and we will amplify it. If you cannot recompute it, the claim is false." Aggressive, falsifiable, and it costs nothing to answer — which is what makes non-response mean something.
Mitigation, live first
Browser verify leads, so the proof does not depend on running a package on a locked-down machine (the failure mode error #1 names). A 14-day window, nobody copied, no publication, and a standing commitment to amplify any refutation. The whole rung is a question they can close by answering it.
The public register increments — aggregate only, no name. The format it prints is "asked / answered / refuted us", and the honest state of it today is 0 asked, 0 answered, 0 refuted, because the register is not built and rung 1 has never fired. Once it runs, every reader wonders whether they are in the count, and the party closes their line any time by replying.
Mitigation, live first
That zero is stated rather than rounded up to a plausible number, because a count with no register behind it is exactly the defect this whole property prosecutes — a proxy standing in for a measurement. The register ships before rung 2 does; until then this rung is described, not available. The name is the thing being withheld, and withholding it is the entire leverage: reply and you are counted among the answered.
A published analysis of the public claim, with evidence — standard research practice. Public statements only, never private or group correspondence, ever, at any rung. This is the first rung that names, and it names to answer a claim, not to shame a speaker.
Mitigation, live first
The piece goes to them 72 hours ahead; their reply publishes simultaneously and unedited; counsel reads it; every factual assertion is sourced. And it ends with the count and the recompute — the number of agent-years and how to verify it — not with our price. Pricing is one click away for anyone who wants it; the party grading the claim never quotes the fix, because a grader who sells the fix is the exact conflict we enforce against elsewhere.
We do not write angry letters. We attach the cryptographic proof of semantic drift to the specific enforcement channels already hunting for it — the math does the testifying. Each is more coercive than an invoice and answered by an institution rather than by us: the FTC’s deceptive-AI-claims posture, state-AG UDAP authority, NAD at BBB National Programs (fast, cheap, decisions published, and refusing to participate is itself published), the SEC whistleblower program where a public company’s AI claims contradict its own risk-factor disclosures, EU AI Act market-surveillance complaints (Article 14 enforcement live since August 2), and ISO/IEC 42001 certification-body complaints about claims outside a certified scope.
Mitigation, live first
Filings require documented evidence, which the published criteria already produce; counsel reviews each; the register logs every filing and every outcome, including the dismissals. A complaint you can be wrong about, on the record, is not a shakedown.
Attested versus unattested, published, machine-readable, sorted by time-on-target. Procurement teams and underwriters read it. Absence from an index is not actionable — and inclusion becomes something people ask for.
Mitigation, live first
Nobody is compelled onto it; the pull is that buyers and carriers start to require it. The instrument sells itself by being useful to the people who hold the money.
A formal comment on live rulemaking with the instrument attached, plus a named coalition letter. This is where "silence is irresponsible" stops being our assertion and becomes other people’s signatures.
Mitigation, live first
Public process, public record, many names — the opposite of a lone sender with a grievance. The leverage is that the argument now belongs to a room, not to us.
Pointing at a flaw without a workable path is worse than saying nothing — so the price attaches to the finding, not the vocabulary. At rung 3 and above, the published analysis ends with the count and the recompute — the number of agent-years and how a stranger verifies it — and pricing is one click away for anyone who wants it. The published piece never quotes our own price: the party grading the claim does not sell the fix. That is the instrument, kept — legitimate because there is a documented, falsifiable, published finding it attaches to. The remedy is available with the diagnosis. Nobody gets a bill for a word.
Distributed action, built so it cannot be turned around on you.
Rung 1 gets answered with a screenshot of our own site, so these are not optional.