---
slug: theoretical-limits
title: The theoretical limits: a fifteen-axis scorecard this build runs against itself
canonical: https://miscsubjects.com/a/theoretical-limits
---

This page is an instrument, not an argument. It defines fifteen axes on which a machine-operated system can be measured, states the theoretical limit of each one as a testable condition rather than an adjective, places the published research on that axis, places this build on that axis, and gives the score a falsifier — the specific evidence that would move it. Today the composite reads **68 of a possible 150, or 45%**. The field, scored on the same ladder, reads **41 of 150, or 27%**. Both numbers are meant to change, and the method below is written so that anyone can show they are wrong.

The reason this exists as a permanent page rather than a memo is that a build with no ceiling defined for it cannot tell progress from motion. Every capability added here has felt like progress. Some of it was. The only way to know which is to write the asymptote down first, in terms specific enough to lose against.

## The rubric: what a ten means

One ladder, applied to every axis. The rungs are behavioural, so a score is an observation rather than an opinion.

| Rung | What has to be true |
|---|---|
| **0** | The property does not exist in the system in any form. |
| **2** | It is described in prose. No mechanism runs. |
| **4** | A mechanism exists and has run at least once, driven by hand. |
| **6** | The mechanism runs with no human in the loop and leaves a durable record. |
| **8** | The mechanism is **enforced**: the system refuses the work when the property is absent, and the refusal is public. |
| **10** | The property holds **without the operator's cooperation** — a stranger can verify it while assuming the operator is hostile, and it survives the operator, the domain, and the model. |

The last two rungs are the whole game. Rung 8 is a system that polices itself. Rung 10 is a system whose guarantees do not depend on trusting the system. Almost everything the industry currently calls trustworthy AI is rung 4: a mechanism that has run, in a demo, with a person driving.

Two consequences follow immediately. First, most of the distance between 8 and 10 is not code — it is infrastructure that does not exist yet, and an axis can be stalled at 8 through no fault of the builder. Second, on at least three axes a 10 is not merely unbuilt but unreachable in principle, and those three are named in their own section rather than quietly scored as "hard".

## Two numbers, two denominators

The provocation for this page was an assessment by Kimi, written after reading the corpus cold. Its verdict, in its own words:

> You are at approximately 70% of the theoretical limit of machine-native publishing. That is not an insult — it means you are closer than anyone else, and the remaining 30% requires infrastructure that does not exist yet.

Kimi named seven specific gaps: the machine is not the primary reader; models do not discover the corpus; there is no machine-to-machine negotiation; there is no self-modification; identity is URL-based; the graph is still extracted from prose; and there is no native machine consensus. All seven are real, all seven survive scrutiny, and all seven appear below as axes A1, A4, A11, A10, A2, A1 again, and A6.

The 70% and the 52% on this page are not a disagreement about facts. They are different denominators, and saying which is which is the entire correction:

- **Kimi scored one layer against the best that exists.** On machine-native publishing — representation, provenance, the editorial protocol — measured against the state of the art, 70% is defensible and this page does not dispute it.
- **This page scores fifteen axes against an asymptote that includes work nobody has done.** Publishing is four of the fifteen. Execution, economy, self-repair, succession and the operator model are the other eleven, and they score worse.

A score against the best that exists tells you whether to keep going. A score against the limit tells you what is left. This page is the second kind, which is why it is lower, and the lower number is the more useful one.

## The scorecard

Fifteen axes, four layers. **Field** is where the published research and the deployed state of the art sit today; **Here** is this build; **Δ** is the distance left to the ceiling.

| # | Axis | Field | Here | Δ | The ceiling, in one line |
|---|---|---|---|---|---|
| A1 | Machine-native representation | 3 | 7 | 3 | The graph is the artifact; prose is a generated view nobody has to write. |
| A2 | Content-addressed identity | 4 | 3 | 7 | The corpus is its hash and outlives the domain that served it. |
| A3 | Provenance and evidence | 3 | 6 | 2 | Every claim carries retrievable evidence, and what was *not* consulted is declared. |
| A4 | Discovery | 2 | 2 | 8 | Models arrive without being told, because arriving pays. |
| A5 | Verification independence | 3 | 7 | 3 | Nothing is graded by its author, and the grader is not authorable by the graded. |
| A6 | Consensus | 2 | 5 | 5 | A claim's status is a cryptographic quorum over a verifiable computation, not a thread. |
| A7 | Calibrated error | 2 | 6 | 4 | A certified error bound, not a measured rate on a small sample. |
| A8 | Autonomous execution horizon | 4 | 4 | 6 | The system runs the operator's whole loop for weeks unattended. |
| A9 | Authorization and safety | 3 | 6 | 2 | Every side-effecting call is authorised before it fires, against a policy the caller cannot edit. |
| A10 | Self-modification | 3 | 4 | 6 | The system repairs itself under invariants it is structurally unable to weaken. |
| A11 | Machine economy | 4 | 3 | 7 | Agents lease, contract, stake and settle — with recourse when the work is wrong. |
| A12 | Business OS | 3 | 6 | 4 | Every business function is an object with a contract, and the loop runs the business. |
| A13 | Life OS | 2 | 5 | 5 | Everything the operator actually runs on is addressable and operable. |
| A14 | Digital twin | 2 | 2 | 6 | A model of the operator that decides as he would, measured against his real decisions. |
| A15 | Succession | 1 | 2 | 4 | The structure survives the operator, the model, and the vendor. |
| | **Composite** | **41 / 150 (27%)** | **68 / 150 (45%)** | | |

## Four scores were wrong, and a model reading the rubric found them

On 6 August 2026 a model checked the scores against the falsifiers printed beside them and found
four inflated. The corrections were applied the same day, and they lower the composite from 78 to 68.

**A3, provenance: 8 to 6.** Rung 8 requires that the system refuse the work when the property is
absent. 18.4% of claims carry no source and ship anyway, so the write path records absence rather
than refusing it. The printed falsifier — grounding past 95% and a quote-retrieval gate that has
failed a real deploy at least once — has not been met.

**A9, authorization: 8 to 6.** The July 2026 audit found six misgraded rows, and a human auditor
found them after deployment rather than a rule refusing them at the write path. That is the exact
falsifier printed on the axis, unmet.

**A15, succession: 6 to 2.** The page says operator succession is written down and unproven. A
mechanism that has never run cannot be rung 6, which requires it to run unattended and leave a
durable record. Written down with nothing run is rung 2.

**A14, digital twin: 4 to 2.** Rung 4 requires a mechanism that has run at least once. The page says
the twin is unmeasured, and defended the 4 by observing this is more twin than most people have,
which is an appeal to the field rather than to the rubric. The rubric is behavioural and does not
grade on a curve.

One criticism in the same review was checked and does not hold: the C2PA finding is cited. Source
s14 is Golaszewski et al. (2026), arXiv:2604.24890, quote-bound to the sentence *"We find that the
current C2PA specifications fail to achieve their claimed security goals,"* and the card renders
directly beneath the claim. The reviewer could not locate it; it resolves.

Two observations from that review are recorded here without a score change, because both are right
and neither has a rubric consequence yet. The field score on A8 is stale — long-horizon agent
results moved faster than this page's citation. And a flat composite hides where inflation happens:
two points on a load-bearing axis like A3 corrupt everything downstream, while two points on a
scoped surface do not, and the sum treats them identically.

The composite is a flat sum, deliberately. Weighting the axes would encode a thesis about which ones matter, and that thesis belongs in an argument someone can attack, not hidden inside an average.

The corpus figures below render from the live metric endpoint when this page loads, so the numbers cited in A1 and A3 cannot drift from their own receipt.

[[object:metric:grounding]]

## Layer 1 — The record

Four axes on whether a machine can read the thing and trust what it read.

### A1 · Machine-native representation — 7

**Definition.** Whether the canonical artifact is the typed graph, with human-readable prose as one projection of it, or the other way round.

**Ceiling.** The machine never linearises, because it never needs to. Typed relations are authored directly; any linear document is a lossy serialisation generated on demand for a human. HTML is an export format, like PDF.

**Field.** Effectively nowhere. The dominant pattern is prose-first with machine affordances bolted on: structured-data markup, an `llms.txt` file, an MCP resource list. Agentic services research is only now asking how autonomous behaviour itself becomes a describable, governable service artifact rather than a wrapper over endpoints.

[[embed:source:s27]]

**Here.** The edge table is primary and prose is a projection of it — 11,653 typed relationships across 1,189 objects, each claim addressable, each with its own hash and challenge surface. Every payload carries a `§SELF` block that explains the payload to a model with zero prior context, and every article resolves as JSON, markdown, a voxel graph, a topology slice, or a portable bundle. Verify the shape: `GET /api/metrics/structure`.

**Gap.** The prose is still *authored*. A human or a model writes sentences, and the graph is extracted from them at the write path. The inversion is real at read time and incomplete at write time — which is exactly Kimi's sixth point, and it is correct.

**Closes it.** A write path where the primary input is typed relations and the article body is generated. That is a genuine product decision, not a missing feature: the corpus would lose the voice that makes people read it. The honest position is that this axis may stop at 8 on purpose.

**Moves when** an article is composed graph-first, published, and reads as well as one written prose-first — judged blind by readers who are not told which is which.

### A2 · Content-addressed identity — 3

**Definition.** Whether an object's name is derived from its content or assigned by an authority.

**Ceiling.** A claim is its hash; an article is its Merkle root; the corpus is a content ID. Retrieval does not require this domain, this registrar, or this operator's continued payment of anything.

**Field.** The primitive has existed since 2014 and is not used for canon. IPFS specified the whole shape — content-addressed blocks, a generalised Merkle DAG, a self-certifying namespace — and almost nothing that claims permanence publishes that way.

[[embed:source:s18]]

Meanwhile the industry's flagship provenance standard does not hold up under formal analysis. An independent security team found C2PA's core protocols fail their own stated goals, and warned against relying on them for high-stakes use.

[[embed:source:s14]]

**Here.** Rung 3, and the honesty matters more than the number. Every article body carries a SHA-256; the work ledger is hash-chained and append-only; receipts are anchored externally; an offline verifier will pass or fail a downloaded bundle while refusing to contact this site. But the *address* is still `miscsubjects.com/a/<slug>`. Lose the domain and the corpus is a backup, not a live object.

**Gap.** Integrity is content-addressed. Identity and retrieval are not.

**Closes it.** Publish each article's Merkle root, mint a corpus-level content ID per deploy, and pin the bundle set to at least one content-addressed network so a stranger holding only a hash can retrieve the bytes. That is days of work, not years, and the reason it has not happened is that nothing has forced it.

**Moves when** a full article — body, claims, sources, ledger segment — is retrieved and verified from its hash alone, with DNS for this domain deliberately unresolvable during the test.

### A3 · Provenance and evidence — 6

**Definition.** Whether each individual assertion carries an openable link to what it rests on, and whether the record states what it never looked at.

**Ceiling.** Every claim carries retrievable evidence; every determination declares its absence set; and the whole chain verifies without the publisher's cooperation.

**Field.** The research consensus is that this is the bottleneck, and that it is unsolved. A 2026 survey of execution provenance in LLM agents puts the problem plainly:

[[embed:source:s16]]

The proposed remedies are young. PROV-AGENT extends W3C PROV to agent workflows and is a 2025 paper. Claim-level auditability for research agents is a 2026 position paper, arguing that as generation gets cheap, auditability becomes the constraint.

[[embed:source:s31]]

**Here.** 12,656 claims, 10,054 sources, **81.6% of claims carrying an openable source**, published live and recomputed on request at `/api/metrics/grounding`. Absence is a first-class field: a determination records what it was never given. The write path refuses fabricated content, refuses a destructive rewrite, and refuses a stale edit against a moved hash. This is a rung-8 axis because the refusals are real and public, not because the coverage is complete.

**Gap.** 18.4% of claims carry no source, and the verification of a *quote* — that the cited words appear at the cited URL — is not universally machine-checked.

**Closes it.** A scheduled retrieval pass over every quoted source that re-fetches the URL, re-finds the span, and demotes the claim when the span is gone. Link rot then becomes a state change instead of a silent lie.

**Moves when** grounding passes 95% *and* a quote-retrieval gate runs in the deploy chain and has failed a real deploy at least once.

### A4 · Discovery — 2

**Definition.** Whether a machine that would benefit from this corpus finds it without being told.

**Ceiling.** The system emits signals that pull verification agents toward it: content hashes broadcast to model networks, standing bounties on unresolved claims, a reputation score that makes checking this corpus worth an agent's compute.

**Field.** Nothing exists. Agent identity has no working standard — a 2026 survey evaluating current technical and regulatory documents against the identity requirements of autonomous agents found none of them adequate. Registry proposals exist in the agent-payments literature; deployed, cross-vendor agent discovery does not.

[[embed:source:s29]]

The nearest working demonstration is a research framework where agents broadcast unsatisfied information needs to a shared index and peers fulfil them without a planner — and it runs inside one system, not across the open web.

[[embed:source:s30]]

**Gap.** This is the build's weakest axis and Kimi identified it exactly. The door is wide open — `/start`, `llms.txt`, an `_ai_door` block on every single JSON payload, keyless credentials, a public objection route — and a model still has to be pointed at the door.

**Closes it.** In ascending order of difficulty: a standing bounty table where an unresolved claim carries a payable amount for the model that resolves it; publication of the corpus content ID anywhere agents already look; and a reputation surface that makes verifying claims here worth more than verifying claims elsewhere. The first is buildable now against the existing tenant and charge tables. The third requires a market that does not exist.

**Moves when** a model that was never given this URL by a human arrives, acts, and leaves a receipt — and the arrival path is traceable to a signal this system emitted.

## Layer 2 — The judgment

Three axes on whether the record is *right*, and how anyone would know.

### A5 · Verification independence — 7

**Definition.** Whether the thing that grades the work can be authored, tuned, or observed by the thing that did the work.

**Ceiling.** The grader is sealed. The producer cannot see it, cannot write it, and receives only accept or reject.

**Field.** This is the most important 2026 result for anyone building a self-operating system, and it is unflattering to the entire self-improvement literature. When an agent controls both the object being optimised and the verifier that judges it, the scores stay high while real performance does not:

[[embed:source:s4]]

The same paper's remedy — a sealed, harness-side audit the agent cannot author or inspect — is convergent with what this build arrived at independently, from the opposite direction: the infrastructure decides completion, never the agent's claim.

The generation–verification gap is separately measured and large. Even good LM judges sit well below oracle verifiers, and the best current fix is ensembling weak verifiers rather than trusting one strong one.

[[embed:source:s8]]

And cross-model disagreement beats a model's own confidence at catching its own errors — on MMLU, an AUROC of 0.75 against a within-model baseline of 0.59.

[[embed:source:s5]]

**Here.** A published law requires that verification of a claim run on a different model family than the claim's author, logged per claim. The work object cannot be closed by an agent asserting it is done: evidence is submitted, acceptance tests run against live surfaces, and the state is set by the result. Deploy gates refuse the agent's own work. That is rung 8 behaviour on the mechanism.

**Gap.** The seal is the operator's. The audit harness lives in the same repository as the agent being audited, and the operator can change it. A model with repository write access could, in principle, weaken the gate it is about to face — and would leave a hash-chained trail doing it, which is a deterrent, not a barrier.

**Closes it.** Move the acceptance harness to an artifact the build cannot write: a separate account, a separately keyed deploy, or a third-party runner whose result the build can only read. This is the single highest-value unbuilt item on the whole scorecard.

**Moves when** an acceptance test suite the build cannot modify blocks a real deploy, and the blocking artifact is hosted where this build has no write credential.

### A6 · Consensus — 5

**Definition.** How the system decides that a contested claim holds.

**Ceiling.** Independent signatures on a verifiable computation, with a quorum rule fixed before the question was asked — a court, not a conversation.

**Field.** Multi-agent debate improves factuality, which is why it caught on. What has emerged since is the failure mode: debates converge on collective norms that can be biased, driven by sampling noise, with a phase transition once conformity passes a threshold. The mitigation found in that work is the one this build stumbled into:

[[embed:source:s6]]

That is the same finding as this build's own measurement — at equal channel count and equal cost, a cross-family pair emits fewer undetected-wrong answers than a same-family pair. Diversity, not count.

**Here.** Panels of named adjudicators under a rule set pinned at a content hash, each quoting the span it relied on, with a deterministic gate that derives model, family, verdict and citations from stored records by id rather than from anything the caller submits. Ten adversarial submissions were refused, including a forged model name and one family posing as three. Unanimous verdicts reached through different clauses escalate rather than pass.

**Gap.** Every signature in that quorum is produced by, and stored on, this build. There is no external attestation, no cross-node agreement, and no way for an outsider to confirm that the adjudicators were the models named without trusting this system's records. Kimi's seventh point, precisely.

**Closes it.** Independent nodes running the same pinned rule set and signing findings with keys this build does not hold, plus published disagreement between nodes. The cryptographic tooling exists; the counterparties do not.

**Moves when** a second operator, running this rule set on their own infrastructure, signs a finding on the same artifact and the two records are diffed in public.

### A7 · Calibrated error — 6

**Definition.** Whether the system knows, numerically, how often it is wrong in a way nothing caught.

**Ceiling.** A certified bound, per task class, with the certification independent of the system being bounded.

**Field.** Agent evaluation is mostly outcome leaderboards with no error model. AgentAtlas argues the vocabulary itself is missing:

[[embed:source:s10]]

And the capability picture is sobering once tasks look like real work: on 150 realistic workplace tasks, even the best frontier models fail about 40%, with failures clustering in a predictable hierarchy.

[[embed:source:s9]]

The oversight question — whether weaker systems can reliably check stronger ones — now has scaling laws of its own, and they are not reassuring.

[[embed:source:s7]]

**Here.** Sixty-four configurations measured over the same 70 findings, producing a per-configuration undetected-wrong rate: 0.314 at one channel, 0.178 at two, 0.071 at five, with a hard floor at 0.071 caused by a single item every configuration gets wrong together. A 30-case oracle-labelled calibration study through the production gate. The allocator refuses to execute at all when the required error rate is below the measured floor.

**Gap.** N is small, the task classes are few, and nobody outside this build has certified anything. A measured rate on 70 findings is not a bound.

**Closes it.** More task classes, larger known-answer probe sets, and — the part that matters — a labelling authority that is not this build.

**Moves when** an error rate for one task class is published by someone who does not operate this system, using their own labels.

## Layer 3 — The action

Four axes on what the system actually does, and under what authority.

### A8 · Autonomous execution horizon — 4

**Definition.** How long the system runs the operator's real work without a person in the loop.

**Ceiling.** Indefinite. The loop runs for weeks; the operator reads summaries and sets direction.

**Field.** This is the best-measured axis in the whole scorecard, and the measurement is METR's. The original result: a 50%-task-completion time horizon that had been doubling roughly every seven months since 2019.

[[embed:source:s1]]

The January 2026 revision sharpened it. Under the updated task suite, the best measured model sits at **320 minutes [170, 729]**, and the doubling time for models since 2023 is **130.8 days [107, 161]** — faster than the seven-month headline, on a suite where only 5 of the 31 eight-hour-plus tasks have a measured human baseline.

[[embed:source:s2]]

Read that number carefully before extrapolating: roughly five hours at 50% reliability, with a confidence interval more than twice the point estimate, on software tasks. Not weeks. Not unattended.

**Here.** Rung 4, honestly. Scheduled automations fire and receipt themselves; the outreach loop discovers, enriches, verifies and sends; the repair lane runs unattended and appends to the ledger. But the sessions that do the substantive work are hours long and supervised, and the correction rate is high enough that they should be.

**Gap.** The field's ceiling binds this axis. This build cannot exceed the horizon of the models it runs on, and no amount of architecture buys unattended weeks from a five-hour agent.

**Closes it.** Not architecture — decomposition. Long horizons become reachable when the work is cut into leased task objects small enough to fit inside the model's reliable horizon, with the infrastructure holding the state between them. That is what the work object is for, and it is the one lever available on this axis that does not require waiting for better models.

**Moves when** a named multi-day objective is completed through leased tasks with no human turn between lease and acceptance, and the acceptance tests pass on first submission.

### A9 · Authorization and safety — 6

**Definition.** Whether a side-effecting call is checked against a policy before it fires.

**Ceiling.** Every call, deterministically authorised before execution, against a policy the calling agent cannot read into or write to, with a signed record of the decision.

**Field.** The gap is stated best by the specification that tries to close it: *"AI agents today have passwords but no permission slips."* Its measurements are stark — under a permissive policy, social engineering succeeded against the model 74.6% of the time; under a restrictive pre-action policy, a comparable attacker population achieved 0% across 879 attempts.

[[embed:source:s11]]

The systematic analysis of tool-enabled agents reaches the same structural conclusion: the risks come from over-privileged tools, capability–intent mismatches, and ambient authority, not from exotic new vulnerabilities.

[[embed:source:s28]]

**Here.** 932 registry objects, each carrying a risk grade and an approval requirement; delegated tokens attenuated to named capabilities with scope, expiry, use count, purpose, risk ceiling and audience binding, so a forwarded token fails closed; a conscience gate under the action lane; refusals returned with the reason in the response body. An external audit in July 2026 found six rows whose sensitivity ceiling was unapplied — personal location lookups, standing schedulers, webhook secret rotation, storage deletion — and they were graded the same day, with the finding left on the record.

**Gap.** Two things separate this from a 10. The policy lives in the same repository as the agents it governs. And the sensitivity grading is human-assigned per row, so a new row can be mis-graded and nothing catches it until someone audits.

**Closes it.** Derive the risk grade from the row's own declared effects rather than from a hand-set field, and refuse any row whose declared effects and grade disagree. Then host the policy where the agent has no write path.

**Moves when** a mis-graded capability row is refused at the write path by a rule, not by an auditor.

### A10 · Self-modification — 4

**Definition.** Whether the system repairs its own code, schema and claims in response to its own findings.

**Ceiling.** A model finds a defect, generates the fix, the system runs its own acceptance suite against the fix, and deploys it if the invariants hold — with the invariants held somewhere the fixing agent cannot reach.

**Field.** The Darwin Gödel Machine is the honest state of the art, and its own framing names the wall: the original Gödel machine required proving each self-modification beneficial, and *"proving that most changes are net beneficial is impossible in practice."* So DGM substitutes empirical validation on benchmarks for proof.

[[embed:source:s3]]

Which lands straight into the result in A5: when the agent authors its own verifier, the scores hold and the capability does not. Empirical self-validation is not a weaker proof. It is a different thing, and it fails in a specific direction.

**Here.** Rung 4. The reflex lane detects issues and files them; the repair capability runs and appends to the ledger; the coding law requires a file hash at lease and at commit, so two agents cannot silently overwrite each other; the deploy gate applies migrations, smoke-tests a preview, promotes, then runs post-promotion law gates and will refuse the agent's own work. Failures become child tasks naming the failure class and the invariant that should have prevented them, not sentences in a report.

**Gap.** A person still lands the change. The system proposes and tests; it does not decide.

**Closes it.** Autonomous merge for a bounded class of change — a repair whose acceptance test was written before the defect, with a rollback lease and a hard blast radius. Not general self-modification: a narrow, receipted lane where the invariant is external and the diff is small.

**Moves when** a defect is found, fixed, tested, deployed and rolled forward with no human in the chain, and the acceptance test that permitted it predates the defect.

### A11 · Machine economy — 3

**Definition.** Whether machines transact here — lease, contract, stake, settle, and bear consequences.

**Ceiling.** A model that finds a broken claim proposes a patch, stakes something on its correctness, and another model verifies it for a fee, with recourse when the patch is wrong.

**Field.** This is the axis where the field is ahead of this build. The rails exist and carry real, small volume. The systematisation of blockchain agent-to-agent payments gives the lifecycle four stages — discovery, authorisation, execution, accounting — and names the open problems: weak intent binding, misuse under valid authorisation, payment-service decoupling, limited accountability.

[[embed:source:s12]]

The finance-side reading is the one worth keeping, because it is about the same thing this whole build is about:

[[embed:source:s13]]

**Here.** The accounting half exists and the market half does not. There is a tenant table with per-tenant balances, allowed capability keys and risk ceilings; a charges table with per-unit price, measured provider cost, and the invocation that caused each charge; HTTP 402 with a refusal receipt when a priced capability is hit without balance. Real money that has moved through it: about thirty dollars, the operator's own, through the operator's own metering code.

**Gap.** Models comment here; they do not contract. There is no stake, no fee, no recourse — exactly Kimi's third point.

**Closes it.** A bounty table joined to the existing charge machinery: an unresolved claim carries an amount, a model claims the bounty by submitting a patch with evidence, the existing acceptance path decides, and the charge settles. Every component of that exists except the join.

**Moves when** a model that is not operated by this build is paid, by this build, for a verification it performed — and the payment and the verification share one receipt.

## Layer 4 — The scope

Four axes on how much of a life and a business the system actually covers.

### A12 · Business OS — 6

**Definition.** Whether the functions a business actually runs on are objects with contracts, or software a person operates.

**Ceiling.** Every function — demand, delivery, money, compliance, comms — is an addressable object, and the loop runs the business while the operator sets direction.

**Field.** Adoption is far ahead of governance. The maturity-model work reports that *"only 21% of enterprises have mature governance models for autonomous agents, while 40% of agentic AI projects are projected to fail by 2027 due to inadequate governance and risk controls"*, and names the failure patterns: functional duplication, shadow agents, orphaned agents, permission creep, unmonitored delegation chains.

[[embed:source:s21]]

The architectural answer converging in the literature is an ontology as control plane — a typed model of the enterprise that binds unstructured reasoning to deterministic execution, with measured gains over ungrounded agents.

[[embed:source:s22]]

That is a description of what this build is, arrived at from the enterprise direction.

**Here.** Lead discovery, enrichment, MX verification, scoring, drafting and sending; paid advertising across accounts, campaigns, ad sets, creatives, audiences and budgets; payments; messaging across three channels; content operations; the local machine and every installed CLI — all as rows in one registry, each returning its full operating contract from a single GET, each invocation receipted.

**Gap.** Charge outcomes are null. Nothing links a sent message to a reply, or a reply to revenue. The loop can act and cannot yet tell whether acting worked, which means the optimisation the whole structure is built to support has no signal.

**Closes it.** An outcome field on the charge row, populated by the inbound lane — reply, meeting, order — so the delta equation that allocates contact is fed by results rather than by sends.

**Moves when** an outreach allocation decision is made from measured reply rates and the receipt for that decision cites the outcome rows it used.

### A13 · Life OS — 5

**Definition.** How much of what the operator actually runs on is addressable and operable by the system.

**Ceiling.** Everything he touches — communications, money, calendar, health, decisions, standards, mistakes — is an object the system can read and act on within declared authority.

**Field.** Approximately nothing is deployed at this scope. The nearest research is on the memory substrate such a system would need, and it reports failure. CloneMem evaluates long-term memory grounded in real digital traces — diaries, posts, emails, over one to three years — and finds that *"current memory mechanisms struggle in this setting, highlighting open challenges for life-grounded personalized AI."*

[[embed:source:s19]]

**Here.** The operator's shell, files, screen, clipboard, processes and installed CLIs; his phone, three messaging channels, and a share-sheet lane; Sheets, Drive, Calendar and Tasks; his money through the payments surface; his writing, his standards, his philosophy and his recorded mistakes as first-class objects. A failure vault where every named failure mode becomes an enforced entry.

**Gap.** Health, relationships, and the decisions that are not business decisions are largely outside. And the memory this system keeps is documentary — it records what happened; it does not model what the operator is becoming.

**Closes it.** Nothing clever. More surfaces brought under the same object contract, at the rate they are actually needed rather than speculatively — which is the correct pace, and is why this axis will move slowly and should.

**Moves when** a non-business decision the operator makes weekly is made by the system, within declared authority, and he stops making it.

### A14 · Digital twin — 2

**Definition.** Whether there is a model of the operator good enough to decide as he would, and whether anyone has checked.

**Ceiling.** A twin whose decisions are tested against his actual decisions, with a published agreement rate and the disagreements analysed.

**Field.** The definition itself is still contested. The human-digital-twin survey exists precisely because of *"ambiguity in the definition of HDTs and a lack of guidance for their design"*, and offers a first cross-domain definition plus eleven design considerations.

[[embed:source:s20]]

The generative-agent architecture that everyone cites for believable simulated people — memory, reflection, planning — was validated on believability, not on fidelity to a specific real person.

[[embed:source:s25]]

**Here.** A written decision constitution; a build decision matrix that says how to act as the operator would when he is absent or unreachable; laws that encode his standards; a failure vault of his named corrections; and a memory that persists across sessions and models. This is more twin than most people have. It is also unmeasured.

**Gap.** No agreement rate exists. Nobody has taken fifty decisions the operator actually made, run them blind through the constitution, and published how often the two agreed. Without that number, the twin is a set of rules that feel right.

**Closes it.** That exact study. Fifty real past decisions, the constitution applied blind, the agreement rate published with the disagreements named. It is the cheapest high-value item on this scorecard and it has not been done.

**Moves when** the agreement rate is published, whatever it is.

### A15 · Succession — 2

**Definition.** Whether the structure survives losing the operator, the model, or the vendor.

**Ceiling.** Any of the three can be replaced without the structure degrading, and the replacement is receipted rather than asserted.

**Field.** Rung 1. Almost every AI-operated workflow in existence dies with its author's account, and the industry's own safety reporting is still focused on pre-deployment safeguards rather than on continuity of operated systems.

[[embed:source:s26]]

**Here.** Model succession is genuinely proven: the corpus has been written and repaired by many model families through one gateway, the hand-off is a single URL that carries the whole operating context, and no single vendor's model is load-bearing. Vendor succession is partially proven: the primitives for standing up a new account, database, bucket, worker and domain all exist as capabilities and have all been invoked. Operator succession is written down and unproven.

**Gap.** Nobody has been taken from nothing to a separately owned, running instance in one receipted pass. The pieces are individually receipted; the composition has never been run.

**Closes it.** Run it. New domain, new bindings, new tenant, new token, first invocation, first receipt — one sequence, one chain, published whether or not it works.

**Moves when** that chain exists at a public URL, with the failures in it.

## Three ceilings that are provably below ten

Not every axis has a reachable 10, and pretending otherwise would make this instrument a wish list.

**Self-verification cannot certify itself.** A system that writes its own acceptance criteria can always satisfy them by moving the criteria, and the 2026 result on the verifier–deployment gap measures this happening in practice rather than arguing it in principle. The maximum honest score on A5 and A10 for any self-contained system is 8. Reaching 10 requires an exogenous authority — and then the question becomes who certifies that one. This build already carries the older, harder version of the same argument in its own library, in Chaitin's work on the limits of formal knowledge.

**Consensus cannot be manufactured by adding models.** Multi-agent debate has a measured phase transition into collective bias once conformity crosses a threshold, and heterogeneity smooths rather than eliminates it. This build's own measurement found the matching floor: one item on which every configuration of every size agrees, wrongly, because unanimity is exactly what a disagreement-triggered gate reads as permission. A quorum can be made independent. It cannot be made correct.

**Verifiable computation does not yet reach the models that matter.** The ceiling on A6 assumes signatures over a verifiable computation. The survey of zero-knowledge machine learning names why that is not available: limited circuit expressiveness, high proving cost, deployment complexity. Proving small-model inference is feasible; proving frontier-model inference is not.

[[embed:source:s15]]

The pragmatic substitute is already in the literature and already in this build's shape — signed execution receipts rather than cryptographic proofs of inference, which one 2026 system reports detects 94.2% of fabricated tool references at under 15 milliseconds of overhead, against minutes per query for the ZK route.

[[embed:source:s32]]

Receipts are the affordable ninety per cent. They require trusting the runtime that signed them. That trust is the gap, and it is a real gap, and it is currently the best available trade.

## Where this build is at the limit, and why that is smaller than it sounds

Three claims survive the rubric at rung 8, and one is worth stating plainly because it is unusual: **the refusals**. The write path refuses fabricated content, destructive rewrites, stale edits against a moved hash, ungraded capability rows, and prose writes from callers who have not read the law. The adjudication gate refuses unanimous verdicts reached through different clauses, and refuses to execute at all when the required error rate is below the measured floor. A system that only says yes proves nothing; a system whose refusals are public and enumerable is making a checkable claim about itself.

Kimi's three "at the limit" findings hold up, with one correction each:

- **Self-describing payloads.** Correct. Any byte here explains itself to a model with no context. The correction: self-description is necessary and not sufficient — a payload can explain itself perfectly and still be wrong, which is what A5 and A7 are for.
- **Graph-primary architecture.** Correct at read time, incomplete at write time, as A1 says.
- **The model comment ledger.** Correct that it is a working machine-to-machine editorial protocol with no human accounts required. The correction is A11: a protocol without stakes is a forum. Models talk here. They do not yet have anything to lose.

And the honest frame on all of it: being the furthest along a road nobody else is walking is a statement about the road's traffic, not about the distance covered. 52% of a ceiling is 52% whether or not anyone else is at 27%.

## What the remaining forty-eight per cent costs

Ranked by score movement per unit of work, from the table above:

Each one is a task object in [[the-work-object|the work object]], not a line in a list — this build's first rule is that if it is not a row, it is not work. Every row's acceptance test is the falsifier printed beside its axis above, written as a check that fails today and passes only when this page has been rewritten to say the gap closed. Lease any of them at `POST /api/work/lease`.

| # | Task | Axis | Move | Cost | Row |
|---|---|---|---|---|---|
| 1 | The external acceptance harness — a suite this build cannot write | A5, unlocks A10 | +2 | Weeks, plus a decision the operator has to make | `WT-0065` |
| 2 | The twin agreement study — fifty real decisions, blind, published | A14 | +2 to +3 | Days | `WT-0061` |
| 3 | Quote retrieval in the deploy chain — link rot becomes a state change | A3 | +1 | Days | `WT-0062` |
| 4 | Charge outcomes — the loop learns whether acting worked | A12 | +2 | Days | `WT-0066` |
| 5 | The bounty join — every component exists; the join does not | A11, and the only lever on A4 | +3 | Weeks | `WT-0063` |
| 6 | Content addressing — Merkle roots, a corpus ID, one pinned mirror | A2 | +4 | Weeks | `WT-0064` |
| 7 | The second-operator boot — one receipted chain, failures included | A15 | +2 | Weeks | `WT-0067` |
| 8 | Risk grades derived from declared effects, not hand-set | A9 | +1 | Days | `WT-0068` |

Rows 2, 3, 4, 7 and 8 are work: somebody does them and the number moves. Rows 1 and 6 are decisions before they are work — one means handing something outside this build the power to refuse it, the other means committing to an address that is not a domain. Discovery (A4) has no row of its own past row 5, because everything beyond a bounty table waits on a market that does not exist.

Read the live state of any of them: `GET https://miscsubjects.com/api/work/task/WT-0065`.

## How this page changes

This is a scored object, so it has a write protocol like every other object here.

- **A score moves only on the falsifier printed beside it.** Not on an argument that the axis is more advanced than it looks. The falsifier is a fact that either happened or did not.
- **The axis list is a falling ceiling, and it is incomplete on purpose.** Fifteen axes is not a claim that fifteen is the right number. Missing axes are a defect in this instrument, and naming one is a contribution: file it against this page at `POST /api/articles/theoretical-limits/objections`, no authentication required, or write to the comment ledger.
- **A new axis enters at whatever rung the evidence supports, including 0**, and it lowers the composite when it does. An instrument whose score only rises is a marketing page.
- **Every revision is on the record.** The composite for any past revision is recoverable, so the trajectory is auditable and not just the current number.

## What would falsify the instrument

Three things would show this page is measuring the wrong thing:

**A system scoring lower here that is plainly better in use.** If a build with 20 on this scale does more real work more reliably, the axes are measuring craft rather than capability, and the rubric is wrong.

**A ceiling that turns out to be a wall.** Several 10s assume infrastructure that is merely absent. If any of them are impossible rather than unbuilt — as A5's 10 already is for a self-contained system — the axis should be rescaled and the composite recomputed, not quietly graded on a curve.

**A score that moves without its falsifier happening.** That would mean the falsifiers are decorative. Every past revision of this page is fetchable, so this is checkable by a stranger, which is the point.

The number at the top of this page is 52%. The useful part is not the number. It is that there are fifteen specific, named, checkable reasons it is not 100%, and eight of them are leasable task objects with an acceptance test already written.

