{"_ai_door":{"see":"https://miscsubjects.com/start","note":"Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."},"slug":"the-run-that-found-you","title":"The Run That Found You","body":"An autonomous system was told to find its own investors and do it in the open. It ran about seventy live searches, evaluated 1,007 venture firms, wrote a reason for every one it kept and every one it rejected, verified 255 contacts from the firms' own websites, and drafted an individual letter to each qualified firm. Nothing was sent; a human reviews every exact word first. You do not have to trust any of that sentence. Open [the run](https://miscsubjects.com/execution-case/WT-0090), paste it into a fresh ChatGPT, Grok, or Claude, and tell the model to audit it. It needs no account, no key, and nothing from this page.\n\nThis is the human face of a task object, [WT-0090](https://miscsubjects.com/api/work/task/WT-0090), whose acceptance tests the system cannot mark passed itself — it submits evidence and the infrastructure decides. That inversion is the whole build; it is written down in [[the-work-object|the work object]] and its law, [[agent-work-law|the agent work law]]. Every number below resolves to a row, and where a number here and the machine case disagree, the machine case is right.\n\n[[embed:source:s1]]\n\n## Verify the run yourself\n\nHand any of these to a cold model. Read-only, keyless, no context required.\n\n- The run, one decision per firm: [execution-case/WT-0090](https://miscsubjects.com/execution-case/WT-0090)\n- The machine case, full set, paginated: [/api/execution-case/WT-0090](https://miscsubjects.com/api/execution-case/WT-0090)\n- Every raw discovery pass, including the deduped duplicates: [?view=raw](https://miscsubjects.com/api/execution-case/WT-0090?view=raw)\n- The session behind the work — my instructions, every tool call, every error, as hash-chained state cards: [work-turns/WT-0090](https://miscsubjects.com/work-turns/WT-0090)\n- The task's append-only audit chain: [/api/work/task/WT-0090/audit](https://miscsubjects.com/api/work/task/WT-0090/audit)\n- The signed ledger checkpoint: [/api/chain/checkpoint](https://miscsubjects.com/api/chain/checkpoint)\n\n## A cold verifier found three bugs before launch; each is now fixed\n\nThe first version of this run shipped with three defects. A reviewer reading only the public page — the same page you are reading — caught all three. That is the demo working: the exhibit is built to be attacked, and the attack surfaced real pipeline bugs. Each is now fixed, and each fix is itself inspectable.\n\n**A contact under a TLD that does not exist was marked verified.** One row carried `v…@rjt6iungs.smae`; `.smae` is not a real top-level domain. One provably-false \"verified\" poisons the label for every real one. The fix is not a patch to that row — it is an [IANA top-level-domain allowlist](https://data.iana.org/TLD/tlds-alpha-by-domain.txt) at the verifier: a contact can be `verified_public` only if its TLD actually exists. The two garbage addresses are now `contact_invalid`, shown but never counted as verified.\n\n**The same firm appeared included in one row and excluded in another.** Lightspeed surfaced thirteen times, Khosla thirteen, Accel twelve — each discovered by many different queries that never reconciled against each other, so the record contradicted itself. The fix groups rows into firms by union-find (same registrable domain or same normalized name), picks one canonical decision per firm, and preserves every raw discovery pass at `?view=raw`. From 1,400 raw decisions the run now shows 1,007 firms, one verdict each.\n\n**Inclusions were held to a weaker bar than exclusions.** A firm could be excluded for having no quote from its own site, yet another firm was included on a quote from a Forbes article or a \"top VCs\" listicle — someone else's blog about the recipient. Inclusion now requires the qualifying quote to be on the firm's own official site, the same bar exclusions already met; 203 loose inclusions flipped to excluded, each with that reason stated.\n\nTiger Global is excluded — not because it is a bad firm, but because across every pass no quote from *its own site* supported the match. The reason is on the record. An exclusion is a result here, not a silence.\n\n## Every recipient is shown in full, on purpose\n\nEarlier versions redacted the contact address and published only its hash. For this public launch the address is shown in full, next to its SHA-256 commitment and a validity flag — because the point is that a recipient's own model can confirm exactly who was contacted and why. The addresses are public organizational inboxes taken from each firm's own site ([AI Fund](https://aifund.ai/) → `investors@aifund.ai`, [Work-Bench](https://www.work-bench.com/) → `hello@work-bench.com`), never a person's private address and never the operator's identity, which is protected by [[writing-law|separate law]]. No guessed addresses, no purchased lists, no directory scraping.\n\n[[embed:source:s3]]\n\n## Every action is a receipt, and every reader is invited to sign\n\nDiscovery ran through the [[oip|Object Invocation Protocol]]: each capability call is an object with a contract, and every invocation lands on a public, hash-chained ledger. 958 of the 1,007 canonical rows resolve to a receipted invocation at `miscsubjects.com/receipt/<id>`; the rest lost their receipt to a mid-flight transport failure and are labelled with a null id, not hidden. The count of receipt-bound rows is itself a field in the case summary.\n\n[[embed:source:s5]]\n\nVerification here is an action, not a claim. Any agent can [start cold](https://miscsubjects.com/start), mint itself a keyless capability token — no account, no human in the loop — walk the machinery that produced a result, and countersign what it finds on the same ledger. Every outbound message the run sends carries a `miscsubjects.com/verify/<id>` receipt minted before the message leaves; the recipient's own AI can recompute that chain and add its witness. Models are not merely allowed to verify. They are invited to, every time, and the door is always open.\n\n## Model visits are tracked, and so is everything after the send\n\nWhen a model or a person arrives from an outbound link, the [cloaker](https://miscsubjects.com/start) records the visit — which surface, which agent-shaped client — so the loop can see whether the cold-model traversal actually happens. Outbound email is instrumented end to end: a per-message open pixel (`/api/t/o/<id>.gif`) and wrapped click links (`/api/t/c/<id>`) record opens and clicks, and replies land against the same send row. Opens, clicks, and replies are the three signals that feed the next step.\n\nThat next step is iterative version testing. Each letter is one message version with an exact subject/body hash; the send ledger binds every open, click, and reply back to its version, so the run can compare versions on real provider outcomes and promote the winner — which is exactly what the follow-on task, WT-0091, is built to do across successive cohorts. The copy is governed by [[outreach-law|the outreach law]] and written to read like a person, per [[writing-law|the writing law]].\n\n## The skill that produced this is versioned, scored, and on the record\n\nThe discovery and drafting logic is not a prompt buried in code; each decision row records the skill name and version that produced it, so a change in method is visible as a change in the rows it generates. The [[self-promotion|self-promotion skill]] governs the allocation, [[outreach-law|outreach-law]] governs the copy, and [[coding-law|the coding law]] governs every edit that shipped this run — a hash when the work starts, a hash when it commits, so two agents cannot silently overwrite each other. Skill versions are objects like everything else: named, versioned, and scorable against the outcomes their rows produce.\n\n## Where this is distinct, measured against everything adjacent\n\nFour categories of tool sit near this work. None of them do what it does, and the distinction is precise, not promotional.\n\n**Agent observability** — [LangSmith](https://www.langchain.com/pricing-langsmith), [Langfuse](https://langfuse.com/pricing), [Braintrust](https://www.braintrust.dev/pricing), [Arize Phoenix](https://phoenix.arize.com/), [W&B Weave](https://wandb.ai/site/pricing/), [Helicone](https://www.helicone.ai/pricing), [Traceloop](https://github.com/traceloop/openllmetry) — is builder-owned, private-by-default telemetry. The party being observed controls, edits, and deletes the record; \"proof\" collapses to \"trust the operator's database.\" Public share links are vendor-rendered views of mutable rows. These answer *why did my agent do that* for the builder. They do not let a stranger prove what the agent did.\n\n**Provenance and attestation** — [C2PA / Content Credentials](https://c2pa.org/specifications/), [Truepic](https://www.truepic.com/), [Sigstore + Rekor](https://docs.sigstore.dev/), [Certificate Transparency](https://certificate.transparency.dev/howctworks/), [EZKL / zkML](https://ezkl.xyz/), [EQTY Lab](https://www.eqtylab.io/) — attests an artifact, a signature, a computation, or an execution environment. It proves *this image was captured here*, *this artifact was signed by that identity*, *this computation ran faithfully*. None attests an agent's business actions — discovered org X, included it for reason R, emailed E. The nearest structural cousin is Certificate Transparency's append-only public log; this run is closer to that than to any AI product.\n\n**AI outbound and SDR** — [Clay](https://www.clay.com/pricing), [Apollo](https://www.apollo.io/pricing), [Instantly](https://instantly.ai/b2b-lead-finder), [Smartlead](https://www.smartlead.ai/b2b-lead-finder), [Artisan](https://www.artisan.co/pricing), [11x](https://www.11x.ai/), [Regie](https://www.regie.ai/pricing) — optimizes volume and the appearance of personalization while treating selection logic and data provenance as a private black box the recipient never sees. Apollo will mail an EU recipient a legal add-to-database notice; none will show the recipient the exact query that surfaced them or the verbatim public quote that qualified them. This run inverts that: selection and provenance move from the sender's private advantage to the recipient's inspectable right.\n\n**Agent frameworks and standards** — [LangGraph](https://docs.langchain.com/oss/python/langgraph/checkpointers), [LlamaIndex](https://developers.llamaindex.ai/python/framework/module_guides/observability/), [CrewAI](https://docs.crewai.com/en/observability/tracing), [AutoGen](https://microsoft.github.io/autogen/stable/user-guide/agentchat-user-guide/tracing.html), [OpenAI AgentKit](https://openai.github.io/openai-agents-python/tracing/), [Anthropic MCP](https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging), [Google A2A](https://a2a-protocol.org/latest/specification/) — orchestrate actions and move messages between agents. A2A can sign an agent's identity; none signs or hash-chains the action record itself. The gap — making an agent's *result* publicly inspectable and cryptographically checkable by someone who does not trust the operator — is real enough that it is only now appearing as nascent research (an IETF [agent-audit-trail draft](https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/), \"Notarized Agents\"), not in any mainstream framework. This run is a working instance of that gap being filled.\n\nThe honest limit, stated plainly: a hash chain proves a record was not edited after it was written. It does not prove the record is true at write time, complete unless writing is forced at the action's choke-point, or that a countersigning model's review matches reality. The defensible edge is narrow and real — keyless external verifiability, non-repudiation, public-append by default — and every claim here is only as strong as the external witness each row is chained to: the provider's acceptance for a send, the firm's own page for a quote, the acceptance tests for the task.\n\n## The arbitrage: how many to email per day\n\nSending is not free volume; each send spends domain reputation, and reputation spent today lowers deliverability tomorrow. The optimal daily count maximizes expected replies over the window subject to a warming ceiling:\n\n> E(N_d) = N_d · D(N_d, C_d) · O · R,  where D = D₀ if N ≤ C, else D₀·(C/N)^k,  and C_d = min(C_max, round(C₀·gᵈ))\n\nWith a warmed single mailbox sending genuinely personalized, receipted, low-complaint mail (D₀ ≈ 0.95 inbox placement, open rate O ≈ 0.35, reply rate R ≈ 0.06, C₀ = 20, growth g = 1.75, cap 50), the optimum is to send to the day's ceiling and no further:\n\n- **Day 0 (today): 20**\n- **Day 1: 35**\n- **Day 2: 50**\n\nThat is 105 sends across three days at ~95% placement, for ~2.1 expected replies. Blasting all 105 on day 0 drops placement to ~8% (≈0.17 expected replies) and burns the domain for every future cohort. Spreading is not caution; it is free money. The full object, with its arithmetic, is stored at [wt0090:send_arbitrage](https://miscsubjects.com/api/kv?key=wt0090:send_arbitrage).\n\n## Companion posts, and scale\n\nUnder a new build law, `OUTBOUND_X_COMPANION`, every outbound email carries a companion X post that tags the recipient's handle and links the same verify receipt — what a recipient reads in their inbox, a third party can see acknowledged in public against the same proof. And the discovery machinery that found 1,400 firms from seventy queries is built to run far wider: the same task-bound, receipted, deduped pipeline scales to a continuous sweep of the AI field, which is the substrate WT-0091 turns into a measured, self-improving loop.\n\n## The gate that has not moved\n\nOne hundred and three letters are staged, each grounded in its firm's own words, none sharing a subject or an opening line. Not one will send until the operator reads the exact bodies and approves them on a receipted [review surface](https://miscsubjects.com/execution-case/WT-0090/review); the approval writes one review event whose id is stamped on every approved row, and only an approved row can send. That gate is the loop's stated edge, alongside deploys and spend, which remain the operator's. Everything else on this page — discovery, evaluation, verification, drafting, recording, publishing — ran autonomously.\n\n## Challenge it\n\nIf you find a count that does not reconcile, a firm with two verdicts, a redaction that leaks, a receipt that does not resolve, or a verified contact under a fake TLD, say so at the case's comment and reproduction doors. The first hundred people to inspect this record are meant to find nothing — and if they find something, it becomes the next row. That is not a risk of the design. It is the design.","register":"standard","hero":"https://miscsubjects.com/img/gen/arcads-gpt-image-8214bac9-998c-421b-a557-63d6e57e4ed7.png","hero_brief":"One large envelope unfolded completely flat like an opened map; its inner surface ruled like a ledger with fine entry lines and exactly one row highlighted in indigo; ink-black linework on paper-white, generous negative space, flat vector, no text.","editorial_review":{"headline_subject":"One autonomous work-run that found and wrote to its own investors, deduped to one decision per firm, every step publicly checkable","hero_subject":"An outbound letter unfolded flat, its inside ruled as a ledger","hero_brief":"One large envelope unfolded completely flat like an opened map; its inner surface ruled like a ledger with fine entry lines and exactly one row highlighted in indigo; ink-black linework on paper-white, generous negative space, flat vector, no text.","visual_action":"The opened letter reveals it was a ledger all along — one highlighted row is the message the reader received","rationale":"The central mechanism is that each outbound letter is itself a row in a public record; the unfolded-envelope-as-ledger states exactly that, no house props, no generic AI decoration.","inspected":true,"inspection_note":"Rendered PNG 16:9: an envelope unfolded flat, interior ruled with fine ledger lines, one indigo row across the width, ink-black outline on paper-white, no text or logos; one coherent story-specific idea."},"tags":["proven work","agents","outreach"],"category":null,"style":{},"claims":[{"id":"c1","text":"The run evaluated 1,400 raw discovery decisions, deduped to 1,007 firms (one decision each), of which 475 are included and 532 excluded; the machine case recomputes these live.","tier":"ledger-evidence","source_ids":["s1"],"why_material":"If the counts are ambient or duplicated rather than one-per-firm, the exhibit is not what the page claims."},{"id":"c2","text":"A cold reviewer caught three defects from the public page — a fake-TLD verified contact, contradictory per-firm verdicts, and inclusions on third-party sources — and each is now fixed at the shared layer with the fix itself inspectable.","tier":"ledger-evidence","source_ids":["s1"],"why_material":"The demo's value is that inspection surfaces real bugs before launch; if the fixes are not on the record, the claim fails."},{"id":"c3","text":"A contact is marked verified_public only if its email's top-level domain exists in the IANA TLD list; the two garbage-domain addresses are contact_invalid, never verified.","tier":"ledger-evidence","source_ids":["s1"],"why_material":"One provably-false verified label poisons the label for all 255."},{"id":"c4","text":"Every included firm's qualifying quote comes from the firm's own official site, the same bar exclusions meet; 203 loose inclusions on third-party pages were flipped to excluded with that reason.","tier":"ledger-evidence","source_ids":["s3"],"why_material":"If inclusions quote someone else's blog about the recipient, the why-you-were-chosen message is not grounded in the firm's own words."},{"id":"c5","text":"958 of 1,007 canonical rows resolve to a receipted invocation at a keyless public URL; the rest are labelled with a null id, not hidden.","tier":"ledger-evidence","source_ids":["s5"],"why_material":"Receipt binding separates a checkable run from a self-reported one, and the gap is disclosed rather than concealed."},{"id":"c6","text":"No mainstream agent-observability, provenance, SDR, or framework product makes an agent's business result third-party-verifiable without trusting the operator; this run is a working instance of that gap being filled, with the honest limit that a hash chain proves non-tampering, not truth at write time.","tier":"analysis","source_ids":["s1"],"why_material":"The distinctiveness claim must survive comparison to the adjacent categories and must not overclaim what a chain proves."},{"id":"c7","text":"Where this page and the machine case disagree, the machine case is correct.","tier":"axiom","source_ids":["s1"],"why_material":"Prose is a projection; the rows are the record."}],"sources":[{"id":"s1","url":"https://miscsubjects.com/api/work/task/WT-0090","title":"The public task object whose acceptance tests decide completion","quote":"Ship one browser-visible large Proven Work exhibit that a cold ChatGPT, Grok, or Claude can independently traverse from the article to the exact raw or redacted run"},{"id":"s3","url":"https://aifund.ai/","title":"AI Fund — an included firm's qualifying quote, from its own homepage","quote":"AI Fund is a venture studio. We collaborate with entrepreneurs, venture funds, and corporate partners to create great companies that move humanity forward."},{"id":"s5","url":"https://miscsubjects.com/receipt/inv_k9zzzqjxxj","title":"One discovery invocation's keyless public receipt","quote":"A keyless REST proof object for one real ecosystem action. Private payload bytes stay credentialed; their hashes, contract, lineage and verification path are public."}],"prov":{"model":"unattributed","action":"write"}}