Published on: August 21, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
Your AI controls cost real money today and buy you nothing at renewal. You are paying an engineer to maintain the eval harness, paying a consultancy for the governance memo, and paying a premium that was set without either one being read, because the underwriter at the far end has no way to check a single line of it and prices the whole class at the average instead. A receipt your insurer can check is a different object from a report your insurer has to believe: it is a small signed file that a stranger recomputes on their own laptop, offline, against one pinned 64-character public key, and gets the identical verdict you did, with no account, no portal, no phone call to the vendor who sold you the instrument. That chain is four signatures long. Three of the four ship in this repository today; the fourth is one small JSON object we can name exactly, and until it exists every receipt this machine has produced is an orphan. Below is the whole chain, the precise gap, the four people whose belief has to move in a specific order, and the one question this design will never be able to answer for the person setting your rate.
One habit of the house: every course's predicted reaction is sealed in the repo before you arrive. The win condition is not agreement — it is you pinning one 64-hex number and recomputing a receipt nobody sent you.
The maître d', presenting: The Bill Nobody Has to Take Your Word For — the itemised chit at the end of a long meal, faintly greasy at the fold, every line adding to the total in front of you rather than after you have already left the room.
THE MINIMUM CHAIN — four signatures, one pinned root, no network call at verify time
[PIN] authority public key 64 hex, pinned once, never fetched again SHIPS
| signs
[TAPE] LICENSE_MINTED license_id, license_pubkey, prev_sha, seq SHIPS
| names
[KEY] licence key HKDF(seed, "thetadriven-license-v1", id) SHIPS
| signs
[CERT] AGENT_AUTHORIZED license_id, agent_id, agent_pubkey, term MISSING
| names
[AGENT] agent key HKDF(licence seed, "thetadriven-agent-v1") SHIPS
| signs
[RECEIPT] the published receipt coordinate, verdict, sigma, chain hash 7,785 ORPHANS
Do you worry about $1.2B in AI liability?
If the property is trivial, software can check it — and why are you paying to check trivial properties? If it isn’t trivial, Rice’s theorem says nobody can. So we fixed the math.
a number we can call — or whatever you would actually ask
Who did this make you think of? We’d love to know.
Run npx -y thetacog-mcp@latest attest-demo on a laptop that is not on your VPN and watch the egress monitor stay flat while a verdict, a coordinate and a sigma print to the terminal in about forty seconds. Run it again and the coordinate is the same one. Change a function in the corpus it reads, run it a third time, and the coordinate moves in a direction you can account for. Four minutes, no salesperson, and the thing you now hold is a reading rather than a claim — which is the whole reason we believe the transaction below closes at all. The reading is worth exactly nothing to an underwriter until it is bound to a name, and binding it takes four signatures in a row. The pinned root is one ed25519 public key derived once from a single secret and published, not fetched (authorityIdentity(), src/lib/license/signing.ts:103). It signs the tape row that names your licence. Your licence key signs a certificate that names your agent keys. Your agent keys sign the receipts. Three of those four links run in production right now; the certificate at position three does not exist, and the entire rest of this piece is the argument for why that one absent object is the whole product.
An agent key is derived one-way from a licence seed. A stranger holding your licence public key from the tape cannot derive, recognise, or search for the agent keys underneath it. So the binding is never discovered — the holder hands it over, already signed, and the verifier checks it. That inversion is why this needs no directory, no lookup API, and nothing of ours that can go down or be subpoenaed.
THE LADDER — FIVE RUNGS, EACH ONE REJECTABLE
Reject any one of these and the piece breaks. You will know exactly which rung to write to us about.
The maître d', presenting: The Sealed Jar Handed Across the Counter — brine still cloudy, the wax stamped with the maker's own mark, so the buyer never once has to write to the maker to ask whether the jar is real.
The obvious design is a lookup service: an insurer holds a public key, queries our directory, and we tell them which licence it belongs to. That design is worse in every dimension that matters. It can go down at the moment a claim is being adjudicated. It can be subpoenaed. It logs who is checking whom, which is a surveillance product nobody asked for. And it becomes a toll booth we would eventually be tempted to charge at, which is the precise failure this company exists to argue against. The alternative is not clever, it is only inverted: the holder hands the verifier the mapping, already signed, and the verifier checks the signature instead of asking anyone a question. Your licence key signs one small object naming your own agent public keys and their term. You publish that object next to your receipts. The insurer verifies the certificate against your licence public key, verifies that key against the authority-signed tape row, and verifies the authority signature against the pin they already hold. Four verifications, one HTTPS fetch of files you chose to publish, zero queries to us. The tape itself is self-authenticating — every row signed, every row carrying the previous row's sha256 — so a copy handed over on a USB stick by the insured is worth precisely as much as one fetched from our servers. That property is what turns "no phone home" from a slogan into an arithmetic fact.
The maître d', presenting: The Supplement Filled In at Eleven at Night — the coffee gone cold and bitter beside the keyboard, half the answers invented because nothing on the desk could answer them honestly.
You know this form. It arrives six weeks before renewal, it has a section on artificial intelligence that did not exist two years ago, and it asks you to describe your model governance in free text. You answered it. Some of the answers were true and checkable, some were true and uncheckable, and at least one was the best sentence you could construct about a thing nobody in the company had measured. Then it went to a broker, who forwarded it to an underwriter, who read your prose and priced you against a class rather than against you, because your prose is the only artifact in the transaction and prose does not recompute. The control never answered the question — you answered a question about the control, and the difference between those two sentences is your entire premium. On the other side of the same transaction the platform lead has a matching problem in a different currency: forty agents in production, one bad March, a budget that will fund a real instrument at eight hundred dollars and will not survive a six-week vendor security review, and a tab that closes the instant a pricing page asks to book a call.
The maître d', presenting: The Cellar Slate, Not the Sommelier's Word — chalked up in a cold stone room that smells of damp husk and iron, and counted by anyone willing to walk down the steps.
Here is the thing you give, and it costs you almost nothing to give: you commit a directory of receipts into the public repository where your compliance artifacts already live. Not the agents' inputs. Not prompts, not customer data, not the diff. A coordinate, a verdict, a sigma, a licence id and a chain hash — a position in a fixed lattice, which is not a payload and cannot be reconstructed into one. That is the answer to the only question legal will ask, and it is a short answer for once. What the underwriter receives in exchange is the first artifact in the history of this line of business that answers for itself: they can take your receipt, take the certificate beside it, take the tape row above that, and arrive at a verdict without contacting you, without contacting us, and without accepting a single sentence either of us wrote. You have handed the person setting your rate the ability to stop trusting you, which sounds like a loss until you notice that trust is the thing you are currently being charged for.
The maître d', presenting: The Second Loaf on the Shelf — one loaf proves the oven lit; the second, crust still crackling as it cools beside it, proves a bakery.
packages/thetacog-mcp/REGISTRY.md currently has exactly one row, numbered zero, and it is ours: over sixteen hundred per-commit panels, append-only, including the readings where our own instrument drifted out of lane and said so. That was deliberate. An underwriter's first recomputation has to be of the vendor, because a vendor who will not publish their own tape is not a vendor anyone rates a customer against, and a vendor who leaves their bad readings on the record is a vendor whose good readings carry information. One row is necessary and it is nowhere near sufficient. The second row is where the economics start, because two independently published tapes are the first thing in this market that can be compared rather than believed. From there the compounding is ordinary rather than magical: a licence renews against a meter of receipts actually published rather than a seat count asserted at signing; a broker who has placed one of these can place the next in a fraction of the time because the artifact is identical in shape; and an acquirer can price a target's agent estate off the target's own published record instead of a data-room questionnaire. None of that is reachable from row zero alone. All of it is reachable from row one.
The maître d', presenting: The Plate Cleared Before the Guest Arrived — six neat portions carried out of a kitchen that cooked forty, the other thirty-four scraped into the bin while the steam was still rising off them.
The first question a working underwriter asks about a customer's receipt is not cryptographic, and this design does not answer it: is this all of their agents, or the ones they chose to show me? A signature proves a reading was not altered after the fact. It says nothing whatsoever about the denominator. Anti-selection, not tamper-evidence, is the underwriting problem, and the mitigation available here is a reconciliation rather than a proof: the licence count on the tape is authority-signed and public, so an underwriter seeing six receipts under a licence minted for forty agent-years has an opening question with real teeth. That is a good question and it is not a guarantee, and anyone selling you the guarantee is selling you something this mathematics cannot deliver. Three more things are broken today and we would rather you read them here than find them in a pentest. AGENT_AUTHORIZED returns zero hits across every source directory in this repository — the certificate at the centre of the chain is a design, not a file. THETACOG_LICENSE_KEY appears in exactly one place, src/app/license/[licenseId]/page.tsx, and it is display copy on the key-collection page; no shipped code path reads that variable, so a buyer today ends up holding a key file that nothing consumes. And the Stripe webhook handles checkout.session.completed and charge.refunded and nothing else, which means the "generate invoice, net 30" path takes a real payment and mints no licence at all. This machine holds 7,785 receipts right now, each one signed by a randomly generated per-machine host key that no registry has ever heard of. They are orphans, and they will stay orphans until the certificate exists.
The completeness limit is structural rather than temporary. No amount of signing tells a stranger that the set they are looking at is the whole set — only a reconciliation against an independently-issued count gets near it, and "near it" is the honest word. Any vendor who claims otherwise has quietly redefined the question.
Here is the part that makes the unfixable gap survivable anyway, and it is not cryptography. Ask who would actually forge this. A hardware root of trust exists to stop an adversary who is willing to be caught, and that is not the person on the other end of an insurance application — they need you to keep honouring the contract afterwards. There is no black market in insurance policies. Corrupt carriers exist; a fake one is worthless, because the whole value of a policy is that a solvent regulated entity pays a claim years later. You cannot fence a forged attestation. It only pays if the relationship survives, and it is the relationship the forgery destroys. So the economics run backwards from normal security: the forger spends real effort to obtain a policy that voids on material misrepresentation the moment anyone looks, commits a criminal act personally by signing the application, and leaves the evidence in a timestamped public repository with their employer's name on it. They end up worse off than buying nothing, because they also stopped buying the control. Forging this is not hard. It is just extremely stupid, and stupid in a way that is permanent, public, and attributable to an organisation rather than a person who can be quietly let go.
Which is why the honest claim is narrower and stronger than the one you were probably expecting. This is not unforgeable. It is attributable and self-defeating — and that claim survives a hostile read, where "unforgeable" would not. It is also the same bargain every attestation regime already lives with: a SOC 2 report does not prove your controls worked, it proves an auditor looked and somebody signed. The difference is that you can recompute ours yourself instead of paying an intermediary to assert it.
The maître d', presenting: One Mark Struck Into the Bone Handle — sunk deep, cold under the thumb, reading the same whether you check it in the shop or years later in your own kitchen.
The trust root is one ed25519 public key and the number of things you have to accept from us to use it is one: those 64 hex characters, taken once, from whichever publication you find least corruptible, and never fetched again — because a pin fetched at verification time is not a pin. It signs tape events and nothing else. Per-licence keys sign the deployer's own certificates and receipts, and keeping those roles apart is what lets a verifier state two independently checkable things: this licence was issued by ThetaDriven, and this receipt was produced under that licence. Two keys sit outside the root deliberately, and naming them is part of the contract rather than an aside. The per-machine host keys at ~/.thetacog/pmu/keys/host.priv.pem are random, unregistered, and carry machine provenance only. The demo issuer identity d8c06ebf…f7fe is derivable by anyone from a clean checkout, which makes it useful for a demonstration and makes it something no verifier may ever accept as authority. Revocation is the one thing a stale tape cannot report, and that is a policy dial rather than a mathematical gap: the tape carries a monotonically increasing sequence number and a tip hash, so an insurer states its own tolerance — verified against a snapshot no older than twenty-four hours, say — and any refresh proves it is a strict extension of the snapshot it replaces. Every certificate revocation list ever deployed makes the same trade. It deserves to be said that plainly rather than dressed up as an innovation.
The maître d', presenting: The Guest Who Now Holds the Knife — the carving passed across the table mid-meal, the joint still hissing and rendering fat onto the board.
Take the pin and something changes about your position that is easy to miss while counting signatures. You are no longer a party to our reputation. An underwriter with those 64 characters can adjudicate a claim about an insured they have never met, using an instrument sold by a company they have never spoken to, in a room where neither of us is present and neither of us is asked. We are structurally disqualified from being the first party to believe any of this — a vendor vouching for its own instrument is exactly the practice being replaced here, so our opinion of our own tape is worth nothing and we designed for that on purpose. The broker's position changes hardest of all: she has spent her career carrying testimony into rooms, and this is the first thing she can carry that survives the room without her. What she is holding is not a better story about her client. It is a file that makes her client's story unnecessary. The book calls this the final receipt for every forfeiture — you gave up scattered meaning and received ground, and the trade only counts because it is checkable by someone with no stake in your version of events.
The maître d', presenting: The Starter Someone Had to Feed First — a jar of sour, yeasty culture kept alive through every month nobody was baking, because no first loaf rises without it.
Read the transaction in the order belief actually has to travel and the shape becomes obvious. The underwriter must be able to verify before the broker will carry it; the broker must carry it before the platform lead's eight hundred dollars is a rational spend; and the platform lead must publish before the underwriter has anything to verify at all. That is a circle, every market has one, and pretending otherwise is how a marketplace launches with two supply-side landing pages and no demand. Ours currently recruits deployers at a checkout and brokers at a mailto, and has built precisely nothing for the one party whose belief the entire structure rests on — no registration, no public tape endpoint, no submission artifact, and no published pin. The break in the circle already exists and it is row zero: the vendor put its own tape on the record first, drifted readings included, so the first recomputation any stranger performs is of us rather than of a customer. That is the correct move and it is also, at this moment, the entire graph. The next thing to build is therefore not a carrier portal, because the moment an underwriter is paying the party that produces the evidence, his reinsurer asks why, and he is right to. It is a publicly fetchable tape, a published pin, and one verb that recomputes a receipt against both, with no account and no call to us.
The maître d', presenting: The Bitter Half of the Bill — served after the plates are cleared, sharp and unsweetened, the arithmetic laid where you can add it up yourself.
Ingredients, not conclusions. The root: authorityIdentity() at src/lib/license/signing.ts:103, which is licenseIdentity('__authority__'), HKDF-SHA256 off one environment secret with salt thetadriven-license-v1. The mint: src/app/api/iamfim/license-checkout/route.ts into mintLicense() at src/lib/license/mint.ts:37, appending a hash-chained LICENSE_MINTED row whose UNIQUE index on prev_sha is what makes two racing minters impossible. The handover: src/app/api/license/key/route.ts, a one-shot reveal gated by a six-digit code sent to the address on the tape record rather than the one typed into the form. The gaps, so you can grep them yourself: AGENT_AUTHORIZED returns nothing; THETACOG_LICENSE_KEY returns one display string; the webhook at src/app/api/webhooks/stripe-iamfim/route.ts handles two Stripe events and invoice.paid is not one of them. The tape: packages/thetacog-mcp/REGISTRY.md, one row, ours, drifted readings left in. The neighbours: you never insure the catastrophe on why the countable event is the insurable one, we gave away the verification on why the verifier is free and the underwriting is not, and the repo is the policy on the spec as policy wording. The general argument sits in Tesseract Physics — Fire Together, Ground Together.
The to-do, in the order that costs you least: run npx -y thetacog-mcp@latest attest-demo twice and confirm the second coordinate matches the first; then open packages/thetacog-mcp/REGISTRY.md and recompute any panel row zero publishes, including one of the drifted ones. If a reading fails to reproduce on your machine, that is the finding, and it is worth more to us than agreement.
Count how many of the ten predicted sentences fired in your head while you read — one per course, sealed in docs/05-content/blog/cook-rounds/2026-08-21-the-receipt-your-insurer-can-check.predictions.md before this went up. That is the declared win condition: not that you agreed, but that a stranger can check what we predicted you would think against what you actually thought.
Do you worry about $1.2B in AI liability?
If the property is trivial, software can check it — and why are you paying to check trivial properties? If it isn’t trivial, Rice’s theorem says nobody can. So we fixed the math.
a number we can call — or whatever you would actually ask
Who did this make you think of? We’d love to know.