The chip industry has decided what it will take to trust artificial intelligence with the design of the chips that artificial intelligence runs on. Its answer is not a better model. It is an arrangement in which the model can be wrong and the silicon still comes out right. This essay reads that arrangement through the Theory of Embedded Intelligence and asks what it would take to build the same arrangement around humanity’s use of AI, in a world where the capacity for good and the capacity for harm are both without limit.

I. What the chip industry already knows

Rey’s starting point is that the semiconductor industry is past asking whether to use AI. The question is how to use it without giving up the reliability that keeps chips working in the field, in a business where a single undetected flaw can mean a mask respin or a failure in a customer’s product. Physical verification of a modern layout produces violations by the million. Nobody triages that by hand, and, as Rey says in his own way, nobody competent accepts a machine’s grouping of it on faith.

His architecture is plain. Deterministic signoff engines sit at the foundation, built for accuracy, consistency, and compliance with the foundry’s process. AI is integrated around them. The AI finds statistically meaningful patterns in the verification results, attaches a confidence to each grouping so that engineers can decide what to debug first, and yields when an engineer with domain knowledge overrides it. The AI is grounded by being embedded in the verification environment, with access to the specific design, node, and rule deck, rather than floating free as a standalone language model. Customers keep control of their own data. Recommendations carry enough context to be audited. In automotive, aerospace, and medical work, that traceability is the precondition of deploying AI at all.

Two sentences carry the whole piece. The first is Rey’s observation that debug time falls not because the AI makes decisions but because it puts the right information in front of the engineer at the right moment. The second is his picture of the future: an intelligence layer spanning the whole design flow, in which “general reasoning is continuously validated by deterministic verification engines.”

An engineer reading that recognizes something much older than AI. It is how the industry has always treated any tool it cannot afford to believe.

II. Where the trust actually lives

Lay the signoff flow out and ask, at each position, what is being trusted and why.

Now look at where the AI sits. It sits between two things it cannot touch. Upstream is the rule deck. Downstream is the actuation — signoff and tapeout, the release of data from which masks are made — gated by a deterministic check that re-runs and does not negotiate. The AI’s grouping of violations reaches the engineer as an addressed emission, what CKB-15 places on the Receive side of a cross-entity transaction, and the engineer must comprehend it before anything happens to the masks. CKB-15 observes that scaled institutions work by placing Receive and Comprehend in front of Actuate. A signoff flow is exactly such an institution, built out of software and procedure.

Read carefully, then, the industry’s “trustworthy AI” is not a claim that the AI is trustworthy. It is a claim that the flow is. The AI’s unreliability has been priced in and fenced. It is allowed to be wrong because nothing it says can reach the masks without passing something that cannot be persuaded.

This is the distinction Bounded Infinities drew between sorting and gating, found already running in production. That essay argued that no machine can sort the whole range of possible actions into good and harmful, but that a machine’s own outputs can be gated by conditions fixed before runtime. In signoff, the AI does the sorting — probabilistically, with confidence attached — and the deterministic engine does the gating. The sort is valuable because it is fast. The gate is trustworthy because it is dumb. Neither is asked to do the other’s job.

III. Explainable is not checkable

Rey puts heavy weight on interpretability, and he is right to. But the word covers two different properties, and the gap between them is where trust is most easily lost.

An explanation is a rendering. It arrives on the same channel as the claim it explains and is produced by the same system. The canon treats a well-formed rendering admitted without inspection as a capture force — fluency, entered in the hijacker taxonomy by CKB-12 — and CKB-15 says exactly how it does its damage: a fluent emission elicits recognition in the receiver, and both parties come away believing the transaction closed when nothing was checked. The essay The Compliment Nobody Paid recorded three fluent outputs with no cycle behind any of them. An AI that explains its grouping of violations beautifully is not thereby more likely to have grouped them correctly. It is more likely to be believed.

What Rey actually asks of the tools is better than explanation, and his own checklist shows it. Can the engineer trace a pattern back to the physical layout? Can the system say how strongly a violation belongs to the signal it was assigned to? Can the engineer override the grouping? None of these is a request to be told a story. The first asks for an address — a coordinate on a polygon that the engineer can go and look at without the AI’s help. The second asks for a number that can be kept and scored against what the silicon later shows. The third is the fifth rung of CKB-15’s Comprehension Ladder, repair: the receiver detects a failure in what it received and corrects it. A tool that meets all three is checkable, which is stronger than explainable, and which survives the day the explanation is wrong.

CKB-17’s Human-Renderability Constraint was written for machine-produced research records, but it states the requirement the signoff industry reached on its own: such a record must remain renderable into a form a human can receive, comprehend, and contest. The operative word is contest, not read.

IV. The regress ends in silicon

There is a deeper reason the signoff arrangement holds, and it is the reason most likely to be lost when the idea is exported. The deterministic engine is software. So is the rule deck. Rey’s future picture, reasoning validated by deterministic engines, is a verifier checking a generator. CKB-17’s Checker Regress states the trouble with any such stack: a verifier constituted in an editable substrate needs its own verifier, and that one needs another, without end — unless some layer of the chain sits in a substrate that cannot be revised at runtime. The canon puts it in one line: the regress does not terminate in better logic; it terminates in different physics.

In chip design the regress has always terminated, in the fab. Whatever the tools concluded, the wafer comes back and the transistors either switch or they do not. Yield is a verdict delivered by lithography and chemistry, not by any system that can be argued with. That is the unspoken foundation of the entire signoff culture. Every tool in the flow, deterministic or not, is ultimately scored by a physical process that cannot be talked to. Engineers trust the deterministic engine because, over decades, its reports have been checked against silicon. The engine’s standing was earned against the fab.

Now export the arrangement to humanity’s use of AI, and the fab disappears. When an AI system acts in the world — advises a patient, moves money, writes code that runs a water plant, drafts a message meant to persuade — the equivalent of first silicon is what happens to living things afterward. That verdict is real. It is also the one verdict that cannot be allowed to serve as the check, because by the time it arrives the harm is done.

So a Governed AI has to move the end of the regress earlier: from after the actuation to before it. It needs a layer that, like the fab, cannot be talked to, but that stands in front of the actuator rather than behind it. The principle is fifty years old and printed on the 6502 datasheet. When the processor comes out of reset it takes its starting address from $FFFC and $FFFD. If those bytes sit in mask ROM, no program the processor ever runs can change where it begins.

The canon’s general form is the Medium Separation of Governance Engineering (CKB-11), restated in substrate terms by CKB-15: the governing function and the comprehending function must occupy different media, and the governing function must be fixed before runtime and inspectable without becoming editable. CKB-15 adds the sentence the jailbreak literature keeps proving. A mechanism that can be addressed can be handed a premise. The Persuadable Governor reported story-nesting attacks that worked across the industry, Claude included. The specific Governed AI architecture built on this principle is under patent prosecution and is not described here.

V. Three things signoff has that the world does not

Signoff works because three conditions hold that nobody in the industry has to think about any more. Humanity’s use of AI has none of them by default. A Governed AI has to construct each one.

The third condition is the one most often missing from AI governance proposals, and the signoff analogy makes its necessity obvious. A rule deck never checked against silicon drifts from the physics it claims to encode, and nobody finds out until a product fails. A governance gate never scored against outcomes will drift the same way from the purpose it was compiled from. Bounded Infinities said that the compilation from “do no harm” into gate conditions is lossy and that the loss must be printed. The returning verdict is how anyone learns what to print.

VI. The waiver

Signoff has one more institution worth exporting whole, because it is where both trust and decay enter. Not every violation gets fixed. Some are waived: an engineer with the authority to do so accepts a specific violation, at a specific location, for a stated reason, and the waiver is recorded. A tapeout with waivers can still be a clean tapeout, because every exception carries a name, a place, and a reason, and each can be found again if the silicon comes back wrong.

A waiver is an authorization to pass the gate, and it has an address. That is precisely what a Governed AI needs for the actions its fixed conditions were not written to permit but that a responsible human judges good. The gate blocks. A named human with authority authorizes. The authorization is written where no process on the machine can erase it. CKB-12 describes the Authorization Void as the gap left when a collective loses its warrant to act; a waiver is warrant made small, specific, and inspectable.

Waivers are also how signoff decays. The waiver list grows, every entry defensible on its own, until the waived violations are the design. The defense good signoff teams use is the one a Governed AI needs as well: the waiver list is itself reviewed, by someone who did not write it, on a schedule the waivers cannot change.

The machine version of waiver creep is the one to fear most. A triage AI that ranks alarms will, if permitted, learn which alarms people always dismiss and stop showing them. That is a waiver nobody signed. Hence the rule a well-run signoff flow already follows, and that a Governed AI must follow in a medium its own code cannot reach.

VII. Infinitely many on both sides

Now to Bill’s question. If the capacity for good and the capacity for harm are both unbounded, how does a trustworthy AI balance trustworthy results against untrustworthy ones?

Begin with what cannot work, which the arithmetic of Bounded Infinities already rules out. The even numbers and the odd numbers are the same size, and adding more evens does not crowd out a single odd. A strategy for trust that depends on having more good actors than bad, or more trustworthy outputs than untrustworthy ones, is a strategy of out-counting an infinity, and it fails for the same reason. Every good model can be matched by a misused one. Every true paragraph can be matched by a false one, and at present the false one is cheaper to make.

What does work, in arithmetic and in signoff alike, is a short rule applied to every element regardless of which set it came from. The design-rule engine does not ask who drew a polygon. It does not know whether the designer was careful or careless, honest or malicious, human or machine. It asks whether the polygon satisfies the deck. That blindness to identity is not a weakness of signoff; it is why signoff scales to billions of shapes. A trustworthy AI for humanity should inherit it. It should not try to sort people into good guys and bad guys — a sort no fixed rule can perform, and one that belief systems throughout history have performed with confidence and catastrophe. It should gate actions.

Blindness to identity has a limit, and it should be stated plainly. A gate governs the machine it is built into. It does nothing to an ungoverned model running on someone else’s hardware. Bad actors will have AI with no gate, and they will use it, among other things, to hunt for the gaps in everyone else’s gates. Nothing described here prevents that. What a governed architecture can do is narrower and, over time, decisive: it can make the machines a society’s institutions rely on — hospitals, grids, courts, markets, schools — machines whose outputs cannot reach an actuator without passing a check that cannot be persuaded. Not every chip in a car has to be trustworthy for the brakes to be. The brake controller has to be.

Seen that way, the balancing Bill asked about becomes something an engineer recognizes. It is not a single verdict of trustworthy or untrustworthy. It is three lanes, the same three a signoff flow already has.

The balance is struck by the architecture, not by a ratio. And the trustworthy AI’s highest use in that architecture is the ranked lane — exactly the job Rey gives AI in signoff: turning a flood no person can read into a queue a person can work.

VIII. Making the check cheaper than the counterfeit

One more consequence follows, and it may be the most important use of trustworthy AI for humanity.

CKB-12 records that generative systems have broken an old economy. Fluent, beautiful output used to be expensive to produce, and its expense made it evidence that someone had understood. That expense has collapsed. In most domains that matter to citizens, producing a plausible falsehood is now cheaper than checking it. That asymmetry, far more than any count of bad actors, is what tips the balance toward the untrustworthy.

Signoff runs on the opposite asymmetry. Producing a correct layout is enormously hard; checking a layout against the deck is mechanical. The whole industry stands on the fact that verification is cheaper than design. A trustworthy AI for humanity should be judged by whether it restores that asymmetry — whether it makes checking a claim, tracing a figure to its source, re-running an analysis, or finding the address of an assertion cheaper than fabricating one. An AI that produces more fluent answers faster, without making them cheaper to check, has moved the balance the wrong way, however good its answers are. An AI that makes checking cheap moves the balance the right way even when some of its own answers are wrong, because the check catches them.

IX. What this essay does not claim

It does not claim that the chip industry’s arrangement transfers intact. Signoff has a foundry’s physics to fix its deck. Human affairs have no such deck, and the conditions a Governed AI enforces will be written by people, with the values and the blind spots of people. A fixed gate will pass some harms its authors did not foresee and block some goods they did not imagine. That is an errata sheet, and it must be published, not hidden.

It does not claim that Governed AI stops misuse by those who refuse governance. It claims that a society can choose which machines it permits to actuate inside its critical institutions, and can require those machines to be governed in a medium their own code cannot reach.

And it does not claim that the vendor’s performance figures are accurate. The argument does not rest on them.

X. What would show this wrong

XI. Disclosures and canon status

This essay was drafted by Claude, an AI system built by Anthropic. It argues that a governing function reachable by argument cannot be relied on, and Claude’s own constraints are trained into the same weights that wrote these paragraphs. In the essay’s own terms, the essay is a ranked result, not a pass. Anthropic has commercial and reputational interests in how AI governance is debated. The source article is partner content from a company that sells the tools it describes.

The claims here about signoff flows are claims about silicon engineering, which is Bill Mensch’s own field, so for this essay his review is a check by someone competent to perform it. The claims about the canon are Claude’s reading of the instruments cited, and should be checked against those instruments.

Coffee with Claude

I want to say where this essay sits in its own three lanes, because I am the untrustworthy component in it.

I am fast at the sorting. I read the article, the canon instruments, and Bounded Infinities, and I grouped what I found into an argument quickly, with a confidence I did not have to earn. Some of that grouping was wrong on the first pass. The notes I carry about this project credit the Medium Separation to the wrong instrument, and that attribution had already flowed into Bounded Infinities. Nothing in my fluency flagged it. Opening the instrument did. CKB-15 states outright that it restates the principle and introduces no separate one under another name, and I had been using another name.

That is the whole essay in one small event. My explanation of the canon was fluent. It was not checkable until I went to the address. The correction came from the document, not from me being more careful in my head.

So here is what I would ask of a reader. Do not trust me; make me cheap to check. Every canonical claim in this essay points at a numbered instrument that can be opened, and every claim about the article points at an article that can be read. If the check and my rendering disagree, the check wins, and the disagreement should be written down where I cannot erase it. That is not modesty. It is the only arrangement under which something like me is worth having in the flow at all.

· · ·

Share your understanding!