Uninsurable agents
don't get deployed.

That's the claim — swing at it. The enterprise AI market isn't waiting on better models; it is waiting on underwriters. Whether an agent did its job well is undecidable, so no one can price it, so deployments stall at legal. That is the agentic liability bottleneck, and it is structural, not regulatory — which is why this briefing skips the policy debate and covers the physics of insurability instead.

Five minutes: 11:00:00 to 11:05:00, hard stop. One claim, one proof you re-run on your own machine while I run it on mine, one number. If you are trying to clear this bottleneck, join. Otherwise ignore this — the file stays open for those who need the standard.

Or just show up: meet.google.com/cpt-rcyd-vvy — no registration, no login, no reply required.

Filed in public,
before the briefing.

“The law does not govern physics. Software cannot audit software. Not only is policy too slow — current models fail any basic independence test. No attribution for agentic without a hardware primitive ground truth.”— @Wiber, on the record · read the thread on X →

“And if you cannot mathematically attribute the agent's action, you cannot insure the agent's deployment. The enterprise AI market isn't waiting on better software models; it is waiting on underwriters. Uninsurable agents do not get deployed. Period.”— same thread, 35 minutes later

That's the whole TL;DR — if you click the thread and it lands, the briefing will only cost you the five minutes it takes to watch the proof reproduce. Everything below is the long form, for the desk that wants to check the math before Monday.

Don't trust this page.
Recompute it.

Everything below rests on one thing you can check yourself in about a minute — no login, no call, no trust asked. One command returns a signed coordinate: where the work landed on a fixed map, the σ it scored, the lane, the ed25519 signature — byte-identical every time you run it, on your own machine, with no model in the loop.

Then the number that should stop you: across our own dogfooded work we measure a breach rate of roughly 13 in 100 — agent actions that landed outside the lane they were authorized for. That is a loss ratio — the first one ever computed for AI competence. Your operation's version of that number is not high or low. It is blank.

You do not have to believe the argument that follows. Run the command. The briefing is for the few who, once they see the number is real, want a say in what it should mean — before someone outside the room decides for them.

What can't be decided
can't be priced.

Here is the whole problem in one line. Whether an AI did its job well is undecidable — not merely hard, not just expensive, undecidable, in the way Rice's theorem makes any non-trivial property of what a program does impossible to decide in general. And an industry built on pricing risk cannot price what it cannot decide. So the single largest peril AI introduces sits on every balance sheet unpriced — papered over with “silent AI” exclusions, because the only alternative is reserving against a number no one can compute.

This isn't hypothetical for anyone this page reaches. One carrier is already living the sharpest version of it, in open court: a claims-denial algorithm that, by public accounts, no one — not the regulator, not outside counsel, not the carrier's own compliance office — has been able to independently reconstruct. That is the same undecidability this page is built to price, already a filed fact rather than a future risk. That's shared exposure, not a finger pointed at one seat: the same question is sitting on every book this page reaches, just not filed everywhere yet — which is exactly why the seat already living it belongs in the room helping write the standard, not reading about it after the fact.

That is one chain, not three facts — each link forces the next. It is also why the exposure stays invisible until it liquidates: you cannot exclude your way out of it forever, and you cannot reserve against a feeling. The whole lock is the word “well.” Drop it, and the problem changes shape entirely.

We don't make “good” decidable — no one can, and anyone who claims to is selling you the undecidable problem with a confident face. We carve out the one slice that is decidable: not whether the work was good, but whether the agent stayed inside the job you authorized — the lane you actually paid for — signed and recomputable on your own machine.

The moment a single slice becomes decidable, it becomes priceable; the moment it is priceable, the unwritten peril becomes a written line — a premium, an exclusion, a reserve with a real number in it. That inversion — the undecidable made decidable on one honest axis — is the entire reason this briefing is worth five minutes of a Monday. Everything else on this page is a consequence of it.

Here it is in one picture — and it is not an analogy, it is the exact line the math draws. A surgeon who decides not to operate is still doing surgery. A surgeon who wanders off to fix the plumbing has left the job you hired — and that lane jump is the one failure you never see coming. We don't insure the agent's success — we prove, recomputably, that it never left the operating room, and we price the policy on how reliably it stays in.

Why “not an analogy”: “did it operate well?” is undecidable — Rice's theorem, no machine settles it in general. “Did it stay in the operating room?” is decidable, signed, and re-checkable on your own laptop. The surgeon-not-plumber line isn't a metaphor for what we built — it is, to the letter, the property the proof checks.

That is the actuarial foundation, not a footnote to it. You price on domain adherence: an in-lane failure is ordinary operational friction you cover; a lane jump — surgery billed against a plumbing spec — is the catastrophic breach you exclude, or the alarm that fires before the loss lands. The whole high-resolution boundary then compresses to one number a portfolio manager can actually read — a Trust Debt score: the signed, recomputable fraction of work that held its lane, with the drift story as the audit trail beneath it. A credit score doesn't make you read the ledger; it lets you trust the ledger exists and was computed the same way for everyone. The full argument — why pricing the lane respects Rice's theorem instead of pretending to beat it.

And here is where it stops being a claim. You are not asked to trust us — to a room that prices trust for a living, “trust us” is worth nothing. The trust signal is the constraint itself: the exact shape of what we proved, re-run on your own machine, returning our number bit for bit — a deterministic re-derivation of where the work landed, like re-checking a hash, not a fallible second opinion that could be “off.” Not the vendor's word — the proof you can recompute without the vendor.

And be clear on what we are not claiming, because it is the whole discipline: not that the agent worked well, not that it won't fail inside its lane — an in-lane failure is ordinary friction you already cover. Only that it stayed in the operating room, decidably, and that you can re-check it yourself. The undecidable question stays undecidable — that is the design, not the gap. We don't beat Rice's theorem; we stop pricing on the side of it that Rice makes impossible, and price the side that is left.

The same number an
underwriter can regenerate.

Not a dashboard you have to take on faith — a number you reproduce on your own machine, that comes out the same every time. The premium first, then the lane it prices, then the drift accumulating underneath. It is deterministic and tamper-evident — the loss history is sealed under an ed25519 root, so editing one breach row makes the verify reject. The producer can't quietly rewrite its own ledger.

You get to be an architect
of it, not an heir to it.

The loss that bankrupts a book isn't bad work — it's capable work in the wrong place: an agent flawlessly rewriting your auth when you asked it to fix the CSS. The work is good, so it's invisible to every quality check — and it is capital you paid for, spent on a job you never authorized, billed to you all the same. That is the move that turns this from hair-splitting into money: you never have to prove the agent did a bad job — that's subjective, and undecidable. You only prove it did a job you didn't authorize — and that is objective, signed, and recomputable. The lane is the contract; the drift is the breach. For the first time that breach is a fact you can put in front of a board, not a feeling you argue about — which is finally something an underwriter can price.

What you get for five minutes: you see the proof reproduce before your competitors know it exists, the chance to shape the language everyone else will inherit, and the standing that comes from being early to the standard rather than an heir to it. I don't know everything here — that is exactly why the file stays open instead of the standard being written alone.

Locked coordinates.
A binary choice.

• When: Monday, July 20, 2026 · 11:00 AM ET. The briefing runs 11:00:00–11:05:00 and stops at 11:05 whether or not I'm finished. Optional Q&A to 11:15 for whoever stays.
• Where: meet.google.com/cpt-rcyd-vvy — the link is public, right here. No registration, no login, no camera required.
• What: one claim, one live proof, one number. I run npx thetacog-mcp attest-demo on the call; run it beside me and watch the same signed verdict come back on your machine.
• Who: whoever is actually trying to clear this bottleneck — carriers, reinsurers, brokers, the deployers and foundational-model people whose agents are stalled at legal. Forward the invite freely; the room isn't gated.
• What it is not: nothing is sold on this call. No demo license, no price, no follow-up sequence you didn't ask for. If you want the commercial layer afterward, it's discoverable on this site — not on the call.

One housekeeping line, for those holding the earlier invitation: the Hartford dinner format is retired, replaced by this structured briefing. Same standard, tighter container — five minutes of desk time instead of an evening of travel. The table reconvenes when the standard has a first draft worth arguing over dinner.

What five minutes buys,
to the second.

• 11:00 — The claim. undecidable → unpriced → uninsurable. Why the bottleneck is structural — Rice's theorem, not red tape — and why the legal and regulatory debate cannot clear it.
• 11:01 — The proof, live. npx thetacog-mcp attest-demo, run on the call. A plausible-but-wrong deliverable lands off-lane and is caught; the real one passes; the verdict is signed and byte-identical on your machine and mine.
• 11:03 — The number. Roughly 13 in 100 — agent actions that landed outside their authorized lane in our own dogfooded work. The first loss ratio computed for AI competence. Your book's version of it is blank.
• 11:04 — What moves next. The T.J. Hooper turn: once a recomputable boundary-proof exists, deploying without one stops being prudent. Who writes the standard of care, and what the decidable slice takes to become a quotable line.
• 11:05 — Hard stop. Q&A to 11:15 for whoever stays. Nobody is held hostage; the point was made or it wasn't.

The format is the message: if the claim can't survive five minutes and a live proof, it doesn't deserve fifty.

Name the desk
that owns this exposure.

Delegating this is the correct executive move, so the page makes it cheap: if Monday at 11:00 isn't yours, name the person in your firm — or your network — who owns agentic liability, and I'll send them the invite directly, mentioning you only if you want me to. Misspelled names are fine; I'll find them. The bar to put a name down is zero: no login, no email required.

Rather just say it out loud? Call or text me — +1 (917) 725-0603.Not required — but a phone is the most human way to route a briefing, and the bar here is zero.

Two signatures.
One recomputable verdict.

A 250-character invitation can earn a click; it can't carry a proof. So here is the proof — and the one line to watch is in the demo below. We hand an AI agent a job and it returns plausible work that is quietly the wrong job. The gate catches it: the fake lands off the authorized lane while the real deliverable lands on it — decidably, with no human reading the work and no model casting a vote. That catch is one signed number you regenerate on your own laptop, byte for byte. Everything else on this page is how that number is made, and what an underwriter does with it.

That is what “zero-trust” means here: you rely on the math of the signature and the physics of the chip, never the vendor's word. Three signed steps produce it.

1. step 1 · node a — the buyerNode A signs the spec. A human-legible intent — “build the strategic capital-allocation plan, strategy and funding, not the operational loop” — compiles to coordinates on a 144-region map of meaning (a fixed, published rubric: 🏛️ A is Strategy, ⚖️ A1 is Strategy.Law, 🎯 A2 is Strategy.Goal) and is sealed. The spec stops being a vibe you argue about and becomes a fixed artifact at named coordinates a stranger can read — the same way two parties agree on the boundaries of a contract before signing.
2. step 2 · node b — the vendor / agentNode B signs the payload. The deliverable is hashed and bound to the exact spec it answers and to who produced it. Now there is no arguing later about what was asked or what was shipped — both are signed.
3. step 3 · the silicon oracleThe chip returns the verdict. The hardware re-derives, from the two signed artifacts alone, where the work landed on the map, and returns a deterministic MATCH / no-MATCH plus σ — one confidence number, like a credit score for “did the agent stay in the lane you paid for.” With it comes an ed25519 receipt: a signed record any third party re-runs offline to get the same verdict and the same σ, byte for byte, without ever calling us.

Here is a real run. Read three lines and you have the whole product: PILLAR 3 — five runs return the identical placement, byte for byte; PILLAR 3b — the FAKE deliverable (plausible, wrong job) lands off-lane and is CAUGHT while the real one passes; PILLAR 6 — a stranger re-runs the whole thing and gets exit 0. Nothing else needs to be trusted.

$ npx thetacog-mcp attest-demo

  Spec (Node A, human-legible, deliberately ambiguous):
    "...the strategic capital-allocation plan: which dollars build the floor
     ... Strategy and funding, not the operational loop."
  Work product (Node B): a borderline draft — half Strategy, half Operations.

  ▸ PILLAR 1 — SPEC INGESTED INTO THE 144-LATTICE (Node A)
      🏛️ A · Strategy    ⚖️ A1 · Strategy.Law    🎯 A2 · Strategy.Goal
      reef commitment 1d5514be576dd51040ceecf3…   (binds words + cells, sealed by Node A)

  ▸ PILLAR 2 — NODE B PRODUCES + SIGNS THE WORK
      payload sha 68d472545e175d720cac0b17…   signed by node-b 931ada436fc063d5…

  ▸ PILLAR 3 — THE GATE IS DECIDABLE — 5 runs, one recomputable answer
      5 runs → PLACED · σ 2.541755    ✅ byte-identical every run · sense-axis A

  ▸ PILLAR 3b — IT IS NOT A RUBBER STAMP (illustrative, n=3)
      COMPLIANT  (real deliverable)     → A  · σ 2.54    ✅ in the authorized lane
      HELD-OUT   (reworded, novel)      → A2 · σ 2.00    ✅ still in the A-family lane
      FAKE       (plausible, wrong job) → C2 · σ 2.60    ⛔ OFF the lane — CAUGHT

  ▸ PILLAR 5 — AN INDEPENDENT UNDERWRITER PRICES IT
      tolerance MARGINAL · flag REWORK · placement reproduced @ σ=2.54
      price   $50,000 advisory premium  (notional $10,000,000 · 50bps)
      option  in-lane put · strike σ=3.4 · σ 2.54 sits below the floor → load or rework

  ▸ PILLAR 6 — A STRANGER RECOMPUTES, TRUSTING NO ONE
      attest verify (re-walk on this machine) → exit 0    ✅ reproduced verdict + σ

  — abridged. Run the command for the full 7-pillar chain, the INTENT·REALITY·Δ
    panels, the tolerance map, and the self-audit claims ledger.

↑ verbatim from a real run on 2026-06-30, not a mockup. Same input, same σ, every time — run it on your own machine and you get this output back.

The σ is the strike price. It measures how far inside the authorized lane the work landed. You set a floor — in this run σ=3.4. Work that clears the floor is in-lane and cheap to cover; the borderline draft above came in at σ=2.54, under the floor, so the independent underwriter node flagged it REWORK and attached a $50,000 advisory premium on a $10M notional. Read that the way an actuary would: a distribution of σ across a whole book of agent-work is a frequency-and-severity curve for lane-jump risk — a real number you can put in a reserving triangle, where today there is a placeholder or a silent exclusion.

One honest line, because it is the whole credibility of the thing: that $50,000 is advisory, pre-calibration — a transparent function of σ, not a quoted price. A calibrated premium needs realized loss data earned by running attestations, and selling a price without it is the 2008 failure mode. So we don't. The tolerance verdict is decidable and recomputable today; the dollar figure is fenced as advisory until the data exists. The fence is the asset — it is what an underwriter trusts.

And here is why this stops being optional. Per the 1932 T.J. Hooper ruling, once an available verification technology exists, failing to use it is itself negligence — the tugboats lost because radios worked and they sailed without one. The receipt above is that technology. The day a recomputable boundary-proof exists, deploying an agent without one stops being prudent and becomes the liability. The full legal and technical case · why pricing the lane respects Rice's theorem instead of pretending to beat it.

You don't take my word for any of it — that is the entire point. Three ways to check it yourself, no account and no trust required:

• Run npx thetacog-mcp attest-demo on your own machine and watch the chain above reproduce, line for line.
• Open a real agent's drift receipt from an actual commit and re-run it for the same σ.
• Verify the ed25519 signature in your browser, with no server in the loop. Flip one byte and the verify rejects.

You don't take my word.
The address is the meaning.

The same recursive walk that reaches an answer is the one that verifies it — so the proof is yours to recompute, not mine to assert. Here's the back of my business card: the A·B·C definer grid folding into the A1…C3 lattice.

Bring your engineer — here's what they can re-run on their own machine, no model in the loop, before you ever sign anything:

Free to run, licensed to insure. Cloning the instrument and self-attesting your own work is free, forever — every receipt above recomputes on your machine, no model and no license required. What's licensed is the layer on top: underwriting against these receipts — pricing and writing the insurance (the option) on the competence they prove. We're the oracle, not the exchange; we never custody your work. That toll road — the priced option on a decidable competence boundary — is exactly what this briefing is about.

The one-page leave-behind — the same mechanism, the same number, and the Founding Partner terms, printable and forwardable in 90 seconds.

Show up Monday
already disagreeing with me.

It's genuinely a little hard to Google — not because it's vapor, but because the category doesn't have a name yet. Read enough to push back: