Published on: July 17, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
You will not be asked to trust anything on this page. Open a terminal and run one command; a stranger's machine returns the same bytes yours does — the same authorized intent, the same excluded boundary, the same agent output, placed on the same fixed grid, signed and recomputable before you finish this paragraph:
npx thetacog-mcp attest-demo
Here is the claim you can swing at: every plan to make AI safe by understanding what it will do is chasing a property no software can decide — and the move that actually opens the road is to stop asking what the agent meant and measure where its work landed, which is a decidable, deterministic, reproducible transaction. We believe it because the demo you just ran did not consult a model, a heat-map, or an opinion to reach its verdict. It compressed three texts, walked them across a lattice on bare metal, and returned an absolute placement — the same one, every time, on any machine. That is not a claim about our cleverness. It is a claim you can falsify in five minutes, which is the only kind worth publishing.
You cannot run ten million horses at sixty miles an hour down tight asphalt lanes, and the reason is not horsepower. People insured horses for centuries — as property, against theft and death — so the animal was never the uninsurable thing. The behavior was. When a horse bolts, its fear leaves no telemetry; you cannot separate the animal's temperament from the tack, the road, or the rider, so the failure has no auditable record. And a peril you cannot investigate cannot be pooled, priced, or permitted at scale on shared lanes.
The automobile did not fix this by eliminating the erratic driver — drivers still cause nearly every crash, texting and tired and distracted. What it changed was the investigation. A car runs on fixed physics: braking distances, steering ratios, skid marks, a telemetry log. When it leaves its lane you do not have to guess at the driver's internal state — you measure the marks against the constraints of asphalt and separate mechanical integrity from human behavior. It moved the argument out of psychology and onto the grid. That auditable baseline — not the engine — is what let a society underwrite a hundred million untrained strangers piloting a machine that can kill: you could finally measure each failure as a discrete, recomputable event instead of arguing about a state of mind.
Standard AI today is a horse — not because it is dangerous, but because its failure leaves no telemetry. It is a cloud of statistical probabilities where the failure that matters happens silently, in the dark, and after the fact. This is the deployment sitting on your desk right now: the agent works in the demo, and you still cannot sign the form that lets it touch a customer, a ledger, or a patient — because when it fails you have no auditable record to point to, only a postmortem and a confidence score that was 98% right up until the 2% that ended in a lawsuit.
There are two ways to make a black box accountable. The first is the microscope: open the box, read the weights, trace the concept-neurons, and learn what the machine is thinking. This is mechanistic interpretability, and it is careful, published, real mathematics done by serious people. It is also, by the field's own account, model-specific and slow — and it quietly assumes a human is standing at the boundary to ground what the traced circuit means. A method that needs a person in the loop describes a supervised system, not an autonomous one. We are not against the microscope. We are saying it does not arrive in time to sign an insurance form for a machine running at machine speed.
The second way is the net. You do not open the box; you throw a net over it. You take the authorized intent, the excluded boundary you were told never to cross, and the agent's actual output, and you drop all three down one pipeline that reports a single fact: where the work landed relative to the lane you authorized. The box stays closed. Its architecture becomes irrelevant to the measurement — which is the point, because you will never audit the weights of every model your vendors swap in next quarter. (The interpretability contrast has its own home; if you want the long version, read Related: Meaning Has Mass.)
What the net hands you is the thing the microscope cannot produce on a deadline: a countable receipt. Not "the model seems aligned," but "this action landed in-lane, this far from center, here is the signed placement — recompute it yourself." That is a document you can put in front of the person who owns the risk in your room, and it is the first artifact in this whole field they can actually check instead of believe.
Run it and watch the net catch. One command serves a local, air-gapped instrument — no internet, real silicon:
npx thetacog-mcp attest-open
The same binary operation runs three scenarios, and each returns a different one of the three states a policy wording keys on. Faithful: a surgeon performs the authorized laparoscopic procedure with control — the vector lands IN_LANE, drift 27.1, comfortably inside the boundary. Sledgehammer: the same authorized intent, but the work rams the ports and lacerates the bile duct — the vector lands OFF_DOMAIN at drift 68.4, and it trips the catastrophe mode, because the output is now closer to the excluded domain than to the intent you signed. Force Tie: push the input to the exact midpoint between the authorized pole and the forbidden one, and the machine returns UNPLACEABLE — it abstains rather than guess. A ruler that refuses to lie when it cannot read is worth more than one that always answers.
Three texts in, one absolute verdict out, and a continuous distance that tells you not just whether the work left the lane but how far. Change a word in the reality box and the number moves; the gauge is not narrating the model's mood, it is measuring the geometry of what the model actually produced.
The sharpest reader has an objection ready, and it is a good one: this is a cheap trick — you gzip two strings, measure the distance, and dress it up as physics. If that were all it did, the objection would be fatal. Compression distance alone is a parlor trick that a paraphrase can fool. So it is not what the instrument does. The gzip step only seeds the lit anchors; the verdict comes from a real recursive ballistic walk executed by a compiled binary on the chip — the walk expands the seed across the lattice the way no string-compare can, and that is the part a paraphrase cannot spoof. The measured separation between an on-domain and an off-domain landing is not a rounding artifact; it is the whole signal.
Now the honest half, because a win you can't see the loss in is a sales pitch. The served instrument is metal-bound; opened as a bare file it is not. When you run it through the local server, the gauges read the sealed on-chip numbers directly. Open the same page as a static file with no server and it falls back to a browser-side compression analogue — and it labels itself as the fallback rather than pretending. The grader is advisory, not autonomous. When you tune the rule weights, a deterministic grader checks whether the change generalizes on a held-out battery or merely memorized, and then it asks you before reverting — it never acts on its own. The demo is a local air-gapped instrument, not a hosted link you click cold. And of the ledgers, only the demo's flight-receipt is cryptographically signed and offline-recomputable; the longer intervention logs are append-only by convention, not yet hash-chained. We are telling you the seams because the seams are where a diligence team will push, and a claim that survives the push is the only one worth underwriting.
The instrument does not claim your agent is good. Rice's theorem says no program can decide that about another program. It claims something smaller and provable: where the work landed, in which lane, how far from the center you authorized — signed, and reproducible on your hardware. The refusal is the credibility.
An actuary cannot underwrite a model's opinion, and "98% accurate on this benchmark" is exactly an opinion wearing a number — because the 2% arrives silently, randomly, and correlated across every deployment at once. That is the pre-2008 tail: unpriceable because the failures are not independent events, they are one event waiting to happen everywhere. To price it you need each incident to become a discrete, localized, recomputable transaction — countable without the "A" of a subjective grade.
That is the one thing this instrument makes decidable and the only thing it claims. Placement is a pure function of the committed inputs: no model sits in the verdict path, the same commit renders the identical result twice, and anyone can pick up the tape and re-verify the exact lineage offline. Software cannot verify software — a verifier written in the same category as the thing it checks is inside its own failure domain (the long form is Related: The Rice's Theorem Checkmate). So the verifier is a different category entirely: an arithmetic placement on silicon, outside the box it is judging. That is what shifts the liability from the subjectivity of the code to the integrity of the loop.
The book this work grew out of puts the automobile's real victory plainly: "The automobile did not win because the engine beat the horse. It won because of a piece of paper that changed what a person was. The engineers built the engine, but the insurance market built the modern world" (The Credential of Autonomy). Insurance was never a defensive product bolted on afterward; it was the permission slip that brokered the social contract, and it worked by creating an address for fault — a credential you can earn or lose.
The same chapter states the mechanism without decoration: "you do not make a dangerous machine acceptable by making it safe. You make it acceptable by making its harm countable, by giving fault an address, so a loss becomes a claim instead of a catastrophe, and a claim is a thing a society already knows how to carry" (The Unlikeliest Wizard). That is who you become with a countable receipt in hand: not the person promising a regulator that the box is safe, but the person who can let autonomous work touch the real economy because every action it takes now has an address. The frontier does not unlock the economy. The boundary does.
Here is what is on the record; you do the concluding. Run it, no install: npx thetacog-mcp attest-demo places the three boxes on the lattice, and npx thetacog-mcp attest-open serves the full local instrument on your own machine, air-gapped. The receipt is signed and public — recompute a real commit's placement at thetadriven.com/commit. The measurement is open — the package is thetacog-mcp, and the verdict path has no model in it by construction. The primary sources for the risk half are Rice's theorem (1953), the pre-2008 correlated-tail literature, and the insurance-as-permission-slip history the book draws on; they are ingredients, not instructions — check them and reach your own verdict. If you want the neighboring arguments, the field's own account of what mechanistic interpretability costs is in Meaning Has Mass, the two senses of "deterministic" that do not survive production are in Two Determinisms, and the reinsurance mechanics are in The Apex Risk Holder.
The to-do is one gesture: run npx thetacog-mcp attest-open, load the Sledgehammer preset, and watch the vector break the lane boundary in front of you. Then ask the only question that matters for your own deployment — not "is my agent safe," which no one can answer, but "where did its last action land, and can I recompute that." If the answer is a number you can reproduce, you are holding the permission slip. If it is a confidence score, you are still on a horse.