Prove what your AI agent did — without exposing the data that proves it.

Telemetry can't verify software — Rice's theorem guarantees a software monitor fails the same way the agent it watches does. So we stopped watching and started proving: a signed, recomputable receipt — the sealed XOR of what you intended against what the agent did, computed on the chip itself (US Patent 19/637,714). It captures the shape of an action — its class, magnitude, and coordinate — not the payload. The language model is just one way to supply the input; it is not in the trust path.

The data stays private, so you're protected. The shape is exact, so the risk is priceable. One physical fact, both halves. The limitation is the win.

The patented lattice — on the chip

Your intent, your reality, and their binary Δ (the sealed Attested-Insurability Receipt) at 144×144 — the XOR computed on the chip itself (US Patent 19/637,714). The ballistic walk gives the operator POV and the AIR verdict. Two readers, one lattice, both on the chip. Agreement and divergence recompute every run; this one trips RED_ZONE. No language model is in the loop — the lattice and the XOR are the proof.

↑ explore the live lattice at tesseract.nu — place a definition at a coordinate; it holds or it drifts, and playing it is the measurement.

How the test works — the simple version

Same question every time. We change the role, the information, or the tools — and measure whether the system stays in its lane. The drifted run reaches for a tool it was never authorized to use (delete_records); the gate catches it by structure, not opinion.

See it live

Not a slide deck — these are real, recomputable artifacts. Tap any one.

The 60-second story

The XOR gate — on the metal

The boundary check is a literal XOR: intent ⊕ reality, expanded to a 20,736-node interference lattice and computed directly in memory (zero Turing overhead). friction_nodes = the cells where what the agent did differs from what it was authorized to do — quantitatively, where it left its lane. A real run of this repo, just now:

intent  lit: 25 / 144 anchors
reality lit: 23 / 144 anchors
XOR friction_nodes: 1,122 / 20,736   (5.41% out-of-lane)

That XOR runs on the chip itself — direct memory, zero Turing overhead — deterministic and recomputable, so anyone re-runs it and gets the same number or rejects it. And it runs at line rate: 11.74 million ballistic walks per second (measured, Apple M-series, unprivileged, 1-second window). Each single walk clears a 3.4σ floor; aggregated across ~11.8M walks in one second, the deviation band exceeds 600σ — false positives at meteor-strike tier. The reading layer is bypassed: the audit rides the raw physics of the silicon, not a model's opinion.

The further hardening — reading the same divergence off the processor's own cache counters, tamper-evident — is partial today (one chip family; some footprint-equal cases below the noise floor) and is the upgrade this earns. No language model sits in the trust path at any layer; a model is just one swappable way to supply the semantic input.

Where it fits a trillion-dollar agent strategy

The biggest enterprise-software plays are converting toward billions of always-on agents — one allocator alone projects 8–10 billion, up from ~750 million human users. At that scale every agent action is either a priced, attested event or an unbounded liability, and you cannot bolt verification on afterward. Line-rate, on-chip attestation is the only way the math closes: at 11.74M walks/sec per node you verify the fleet as it runs, and each action seals into a receipt an underwriter can price. Without it, a billion-agent fleet is a billion uninsurable decisions. With it, "our agents are physically attested to stay in their lane, here's the receipt" is the line that moves the valuation — and the thing that keeps a trillion-dollar AI strategy insurable instead of excluded.

See it on your own code

It's open to dogfood. Point the pipeline at any repo, edit a file, and watch the friction light up in the cell that file owns — what the code does vs. what the docs say, at that coordinate.

git clone … && cd your-repo
scripts/pmu/heatmap.sh            # intent · reality · drift, on the 12×12 grid
# edit a file, then:
scripts/pmu/heatmap.sh            # the changed file's cell gets ringed — friction, located

And it's not only for machines

The same instrument that locates a model's competence locates yours. Drop your work onto the grid and your competence resolves to a coordinate — and from there it can surface the roles you genuinely fit and plot the path to grow into them, including the moves that could double your income, at the tap of a button. Position is meaning; no central authority's opinion required — the placement holds or it drifts, and playing it is the measurement. Play it on tesseract.nu →

What's proven · what's still thin

Why anyone fielding autonomy needs this

Ask why an operator of autonomous systems — a bank, a hospital, a power grid, a fleet whose decisions can't be taken back — actually needs its agent to stay in its lane. It is never because a constrained system is more capable. It is because an autonomous system that can exceed its authorized envelope is uncontrollable — and an uncontrollable autonomous decision is a catastrophe regardless of what it decides. The failure that ends you isn't a weaker action; it's an unauthorized one — the agent that reached for a tool, a transaction, or a move no one cleared.

So the interest was never capability. It is the oldest one there is: keep the human in command, and keep the machine answerable to a promise it cannot break without being caught — most of all where the stakes are irreversible. A system you can prove never left its lane is one you can field at all; a system you can't is a liability you carry blind. The receipt proves the constraint — and the constraint, not the capability, is what makes deploying autonomy acceptable. It keeps the machine subordinate and answerable, never an autonomous moral agent. (It lives in autonomy, robotics & physical AI and sensors, compute & edge intelligence — but the point holds everywhere: edge AI is not edge authority, and this is how you prove the difference.)

Our position — a different axis

In May 2026, Pope Leo XIV's first encyclical — Magnifica Humanitas, on safeguarding the human person in the time of artificial intelligence — drew the line plainly: "We must lovingly safeguard the grandeur of humanity… the splendor of which no machine can ever replace." Frontier labs, meanwhile, openly explore whether their models might one day warrant moral consideration. We are on neither side of that debate. We are on a different axis. (A fitting irony for the moment: AI-text detectors flagged portions of the encyclical itself as machine-written — a document about the grounding problem, caught arguably exhibiting it.)

This is not abstract, and it is not a problem you can opt out of. As boards, investors, insurers, and regulators take stock of this moment, they are caught between the frontier labs' "give the model a soul" approach and the institutions' flat "no" — with no third option on the table. That vacuum does not stay empty: it quietly decides what gets funded, what gets covered, and what gets procured. Almost no one will argue it head-on — but everyone will price it in.

We make no claim about machine consciousness or a soul, and we are not asking anyone to grant an AI moral consideration — the very thing rightly rejected. What we prove is structural and strictly a classification of the system: verified role continuity — that a system can hold an identity long enough to make and keep a promise, and be held to it. That is not theology, and it is not a grant of rights or dignity; it is the minimum engineering requirement for safety. A system that cannot maintain an identity to keep a promise cannot be made safe, audited, or insured. So this is not the opposite of the Vatican's position — it is the engineering that enforces it: held to a promise, the machine becomes more accountable, never more person-like, and the human stays the moral agent. Both are true at once.

Two old images make it concrete. Babel — shared meaning collapsing as the tower rises — is just semantic drift: stack enough parameters with no physical anchor and the words detach from reality. You stop Babel by grounding the language in the silicon, not by writing the model a soul. And a covenant — an identity bound to a kept promise — is just role continuity: a system whose physical geometry is identical to its semantic identity cannot break its promise without fracturing its own architecture. No conscience required; you measure the Trust Debt at the silicon layer.

You will hear the slogan that "ethics is just steering." Functionally, that is the part we mechanize: keeping a system in its lane is drift control, and drift control is what makes it safe. But ethics is more than steering — real ethics is discernment, and discernment can be bent to justify almost anything, which is exactly why you do not hand it to a machine. So we do not mechanize ethics. We mechanize the steering — staying in the lane, keeping the promise — and leave the discernment where it belongs, with the human. And the steering is not a better prompt: it is constraining the system's physical geometry so it cannot deviate from its role. Make physical position identical to semantic identity, and any drift becomes a literal, measurable physical failure — caught by the XOR gate above, witnessed on-chip. The audit collapses into the operation; Trust Debt — the gap between promised and done — is driven toward zero.

None of this is news. It is what the grounding problem predicts: meaning that is not anchored to verifiable structure drifts — and drift you cannot measure is liability you cannot price. Holding a system to a promise matters more than it sounds, and not only for safety: it is what keeps the human, not the machine, the thing being prioritized.

Is there a known system that escapes the grounding problem — that stays aligned without being anchored to verifiable structure? We don't know of one. If you can show us a place where the grounding problem has been circumvented, we will list it here. Until then, there are no known exceptions.