You excluded AI because nothing you were handed could be counted. On the evidence you were handed, that is the correct price.
All three exhibits were written inside the boundary they report on. Put it where your insured works. An agent with valid credentials is asked to fix a flaky test. In the same commit it also rewrites a database migration. CI goes green. The agent's summary reports a fixed flaky test, and every word of that summary is true. The migration is not in the summary. Nothing in the loop reads the part of the change nobody asked for, except whoever happens to open the diff. A desk asked to price that file is pricing handwriting.
The other record takes one minute on a laptop, offline, and reads nothing of yours. Run it twice and compare the hashes:
The old error has four names. Philosophers of science call it the epistemic fallacy; organisational researchers call it surrogation; Whitehead called it misplaced concreteness; Robert McNamara counted a war by it. The error is the same at every scale: the readout gets taken for the thing that produced it. Prussian foresters in the eighteenth century read a forest as cubic metres of lumber, planted the lumber in rows, and watched the second rotation fail.
An eval is a readout. The lab runs the model on a sample, scores the tape, and the score stands in for the run you are asked to cover. Optimise against the score and the score holds while the run moves (Goodhart). Two published results set the edges of what any readout can claim:
Whether it was good is undecidable (Rice, 1953). What it actually did cannot be reconstructed from its own account (the data processing inequality). The only remaining move is to read a record the actor did not write.
None of this makes evals, CI or formal verification useless. The proof, the test and the log all sit on the actor's side of the ledger, and a policy needs the second entry. A smarter judge reading the actor's own account reads the same missing pages, faster.
A policy binds an obligor across time: the party that signed the warranty is the party standing there when the loss lands. An agent at step fifty is not the agent at step one. Context rolls over, intermediate errors compound, and the later self grades the run against its own drifted state, and passes itself.
Our own record caught this on 14 October 2026. A worker merging one branch into another read 17 red guards and filed every one as a condition of its machine: fixtures recorded elsewhere, words on another reef. The account was fluent and detailed, and any model reading it would have passed it. The guards stayed red. The worker went back to the files and found the binary the guards ran was a build from before the merge. Rebuilding the binary turned seven reds green at once. Seven reds had one cause the fluent account never named. The worker did not lie. The worker that wrote the excuse was no longer the worker that promised a green suite.
The strongest answer on the other side now lives inside the model. Researchers at Anthropic found a region of a language model's activations, the J-space, that behaves like a global workspace, the mechanism cognitive science ties to conscious access, and David Chalmers has asked in print whether the match holds. Grant all of it. A workspace is still written by the run it reports on. People have carried global workspaces for as long as there have been people, and the deed still goes to a notary, the cash to a ledger, the cockpit to a flight recorder.
For anything that signs, identity is a property of the record, not of the mind. An agent with no outside record is no counterparty at all: a string of strangers sharing one name. The exclusion prices exactly that.
Deployers cannot turn autonomous write-access on without enterprise risk sign-off, and underwriters cannot price third-party AI liability without an independent, out-of-failure-domain flight recorder. That recorder is what we build. Four parts, each one checkable by your own staff:
The insured declares the scope of the work in a spec and commits the spec before the agent starts. The baseline is the declaration, never an ideal state of the world nobody can name. The spec is the policy wording: coverage resolution equals spec resolution, so a tighter spec is a tighter line.
After the run, a walk reads what the agent changed out of the immutable commit, never the working tree and never the agent's summary, and places the change on a fixed map against the lane. No model sits in that path. Same bytes in, same placement and same hash out, on any machine. The verdict has three values: in lane, off lane, or UNMEASURED. A field nobody measured never prints a zero.
Each crossing of the declared fence is counted as a whole number, c, and charged at kE = 0.003 per crossing. The receipt line reads c=N · kE=0.NNN. The unit is an agreed gauge, fixed in public the way the metre was fixed to a bar and the Richter scale to a reference quake: a base period can start from the day the count starts. A count is a trigger a parametric wording can name; a judgment about whether an agent "behaved" is a lawsuit.
The insured's machine bundles the tape into one archive named by the sha256 of its own bytes. The archive stays on the insured's disk at no cost. A paid receipt is countersigned by a notary who did not write the tape, and a carrier, an auditor or counsel recomputes the hash without asking anyone's permission. The log is hearsay. The countersigned receipt is a record the actor did not write.
The halt is real and the halt is the insured's. The first off-lane crossing can be wired to stop the run on the insured's own machine, instantly. Pulling the plug is a control; pricing the tick is what insurance does.
A binder needs to know what it attaches to and what it does not. Every line below is a refusal we hold on every surface, with the reason a hostile reader can check.
We never guarantee behavior. Rice closed that door in 1953 for every vendor at once. We guarantee the deviation is detected, placed, priced and dispatched. Insurance never prevented a fire; it made fire a number.
We never say whether the work was good. The receipt claims where the work landed against the lane. Whether the work was any good stays with the people in the room who can judge it. Placed, never judged.
We never let the actor grade itself. No model sits in the receipt path, ours included. A model reading a model's account reads the same missing pages.
We never print a zero where nothing was measured. A clean month and an unwatched month look identical on a dashboard. On ours the unwatched month reads UNMEASURED.
We never hold the halt. The wheel is handed over with the place to bolt a brake on. Whose hand is on the brake is the whole point.
We never sell a hardware counter reading as shipped. The default receipt recomputes on any laptop from the commit bytes. A raw processor counter is privileged and platform-gated, so it stays in the lab.
We never claim the map is lossless. The placement is a projection: sufficient for where, explicitly not for whether. Every receipt states both halves.
We never underwrite, pool capital or transfer risk. The attestation licence is software and verification. The carriers write the cover and hold the capital and the risk. Every carrier and broker joins on the same terms; nobody gets exclusivity or a first look.
In 1932 Learned Hand held the owners of two tugs liable for barges lost in a gale. Most of the trade carried no radio receiver, and the court found the custom no defence: a receiver was cheap, available, and would have heard the forecast (The T.J. Hooper, 60 F.2d 737). Whether a recorder becomes that radio for AI is for the courts and the carriers to say. The recorder is on npm under MIT either way, so the question can be asked with the instrument in hand.
The measurement is free and open-source (MIT); only the financialization and attestation layer is licensed. The split has two tiers, never conflated. The licence is software and verification, bought by whoever runs the agents. The pool is carrier capacity, bound only against telemetry a licence already produced.
For carriers, MGAs and brokers → PricingFor the deployments that can, the question changes shape. The question stops being whether the model is safe, which nobody can decide, and becomes how often the agent crosses a line its owner drew, which anybody can count. That is a tail with a number on it. Whether the model is conscious and whether the model is insurable are two different questions, and only the second one has a record.
Let's see how that prices out.
Green in-lane · amber a little out · red drift. Every panel below is a real commit that edited this page, placed by the walk the page describes.
Geometric Driven Development — 4 measured edits to this page, from June. These commits live in our working repository, which is private, so the links above open only for us. You don't have to take our word for it. The same instrument runs on public bytes, and the check is below.
The page above is a measurement to reproduce, never a thesis to believe. Install nothing — it runs straight from npm, and a stranger gets the same bytes you do.
Or recompute a placement from a public commit yourself. Clone the public mirror, pin the commit, and run the published package against one file:
If your line matches, you are one of the first people outside the company to recompute a receipt. If it doesn't, that difference is the finding. Tell us. "Witnesses agree: false" is part of the answer: the two measures placed that file differently, and the tool says so instead of picking one. Where it landed can be re-run. Whether the file is any good is not claimed (Rice).
See it run — /pixel → Get the package
