Plain English edition · rev1 · 19 September 2026 · For Jon
What we can say, and what we can’t.
For Jon, and anyone meeting investors who is not an engineer. Everything here is the same content as the technical playbook, in ordinary language. The engineering detail is tucked into the grey boxes. Open a box only if someone asks.
- Say this Safe to say as written
- Say it this way Say it, with the qualifier attached
- Never say With the reason why
Read this part twice
You are selling a machine that governments and hospitals can trust with sensitive records.
Three things make it different: their data physically cannot leave the building, their passwords and keys cannot leak, and the machine refuses to act on its own rather than guessing.
You are not selling speed, and you must not. We have not measured how fast it is yet. Anyone who tells you otherwise inside this company is quoting a document written by somebody else about a different machine.
Your biggest asset in the room is that we say what we can’t do. Every AI company these investors meet claims everything. We publish our own limits. Lead with that.
The opening
Say this first, before anything else.
“Before I tell you what we have, let me tell you three things I’m not allowed to say about it.
We don’t say ‘fully verified,’ because we start from a set of assumptions and we publish the list.
We don’t claim our hardware avoids US export controls, because we did the arithmetic and it doesn’t.
And we don’t quote a speed figure, because we haven’t measured one yet.
Everything I say after this comes with a label: proven, built, or built but not yet finished. You can hold me to the labels.”
Why this works
These investors have been pitched by a dozen AI companies that claimed everything. Nobody has opened by handing them a list of things they won’t say. It costs you nothing and it buys you the rest of the meeting.
The labels. Use them out loud.
If you say something without a label, you will have to take it back later.
| Label | What it means in plain terms |
|---|---|
| Proven | A machine has checked the maths. It can be re-checked by them. |
| Built | The code exists and runs. Nobody has proved it correct. |
| Nearly there | Written and working on our engineer’s machine, not yet locked in. |
Proof
“You say it’s mathematically proven. Proven how?”
Say this
“A machine checks the maths every time the code is built. Not a person reading it, not a test that tries a few examples. The proof either holds or the build fails.”
Say it this wayThe question underneath. Someone will eventually ask: “does the proof cover the software you actually ship?”
“No, and we tell you that before you ask. Think of it as a set of engineering calculations that have been checked, and a building that was then put up by hand from those calculations, with a system that checks each part against the plan. We don’t claim the building assembled itself from the drawings. That’s the honest boundary, and it’s written on our own list of gaps.”
Nobody else answers this question honestly. It is worth more than the proof itself.
Never say
- “Fully verified.” “Zero defects.” Any count of proofs.Why: the count is a real number and it’s enormous, and a technical person will take it apart in the room by pointing out that most of it is repetitive. You will not be able to defend it. Talk about the assumption list instead. It’s smaller, it’s honest, and it’s the thing that impresses people who know what they’re looking at.
How do we know?
“We publish the list of assumptions we start from. Thirty-five of them, all by name, all inside a piece of software we didn’t write ourselves. An auditor can download the whole thing and check it.”
Technical detailfor their technical advisor
Zero proof holes tree-wide. 35 substantive axioms plus 33 typeclass postulates, all inside the vendored Continuity canon; no axiom in our own proofs. 16,217 Lean files. The theorem count (117,494) is mechanically expanded, so quote the file count and axiom list instead. The Lean-to-Haskell bridge is neither extraction nor a verified compiler: hand-written against the specification with 15,063 per-atom anchors and per-codec exhaustive specs. The extraction limit is itself a named axiom, compiler_faithful. Tree jpyxal/lemma at a38a4d6094.
Passwords and keys
Passwords and keys.
This is your strongest slide. Lead with it.
Say this
“Your keys are never ours to leak. When a customer connects their own AI account, the key is locked on their side before it ever reaches us, and we never hold a readable copy. How our system handles that key is mathematically proven, not just tested.”
Why this is your lead: almost every company these investors have money in is struggling with exactly this problem right now. It is the one thing on our list they will recognise from their own portfolio.
Never say
- Don’t stretch it.Why: it covers how we handle keys. It says nothing about the AI model, the customer’s data, or the rest of the system.
How do we know?
“Twelve separate proofs. Among them: the key never appears in a log, never appears in an error message, never appears in a diagnostic trace, and the masked version can’t be reversed.”
Technical detailfor their technical advisor
Continuity/LLM/APIKey.lean, twelve theorems including no_unredact, secrets_not_in_logs, secrets_not_in_errors, secrets_not_in_traces, header_only_from_memory, api_key_security_complete. Threat model: attacker can read logs, errors and HTTP responses and send malicious requests; cannot read server memory or config files. Network outside TLS is a theorem, not an assumption. Paired with Connectors.SecretClientSeal: customer keys sealed client-side under a BLAKE3-derived key from the user root.
Acting on its own
“Does your AI act on its own?”
Say this
“It can carry out multi-step work. But the decision to actually do something is made by our system, not by the AI. Every action passes a ladder of permission checks, a human can be required at any point, and there’s a kill switch.”
Say it this waySay this too, without being asked.
“The part that runs this in a live system is finished and working on our engineer’s machine, but it isn’t locked into the official build yet. I’m not going to tell you it’s in production, because it isn’t.”
Say it this wayIf they ask what stops it running away.
“A hard limit that’s built into the structure, not a timeout. The system can only chain 64 steps, and if an engineer adds a new kind of action, the software won’t build until that action is accounted for.”
Never say
- “Agentic AI in production.”Why: it isn’t in production. You would be walking it back in the next meeting.
- Anything suggesting the AI plans its own work.Why: it doesn’t, and that’s a deliberate design choice rather than a shortcoming.
How do we know?
“The permission ladder has eight gates and we’ve proved it behaves correctly in all 256 possible combinations of those gates. Not tested. Proved.”
Technical detailfor their technical advisor
Agents.Runtime: event-sourced engine, pure reducer, 21 events and 17 effects. Agents.Runtime.Loop bounds cascade depth at 64 and enumerates all 17 effect constructors so a new effect fails the build. Auth.AuthorizationDischarge is an eight-gate discriminator proven as admit_iff_all_gates_pass_and_no_gater and pinned in Haskell over all 256 gate states. Seven-gate session chain with human gater and kill switch. Production host Switchyard.RuntimeHost.AgentLoopBoot (1,162 lines) typechecks through a 2,943-module cone but is uncommitted at the header hash.
Speed
Speed. We haven’t measured it yet.
Be careful here. Do not improvise.
Say thisAnd only this.
“Every request through our system costs about four hundredths of a second extra. What that buys is a signed receipt proving what happened, on every single request, with no loss of accuracy. That’s a security cost, not a speed claim.”
Say it this wayIf they ask how fast it is.
“We haven’t measured that yet, and I’d rather show you how we’re going to measure it than give you a number I can’t stand behind.”
Then show them the testing plan. For this audience the plan is more persuasive than a number would be, because it commits us in advance:
“We’ve written down what we’re going to test, what counts as a win, and what would make us retire the claim, all before running anything. Five runs each way. A result inside the noise isn’t a win. Most companies pick the number after they see the results.”
Say it this wayIf they push on when.
“One session on a rented machine. It’s the second item on our own to-do list.”
Never say
- “Two thousand-plus tokens per second.”Why: that is a projection from a paper somebody else wrote about a different machine. Our own engineer told us not to use it, even with a caveat.
- Anything from our load tests.Why: we ran a machine with no graphics card and no AI connected. It proves our system doesn’t fall over. It says nothing about speed.
- The February benchmark.Why: that test ran on a version of the engine that couldn’t produce correct answers yet. It’s a stopwatch on an unfinished job.
Technical detailfor their technical advisor
Router tax: 150 decidable operations, both arms 100% validation, 0 errors. Direct p50 13.2 ms / p99 56.3 ms; through gateway p50 52.5 ms / p99 193.0 ms. September k6 runs (827,605 /health at p99 8.2 ms) were on WSL2, Threadripper PRO 3975WX, no GPU, no provider keys: admission-path only. February 2026 bench: RTX PRO 6000, TinyLlama-1.1B, 128/128, ours at 7.51 ms prefill “with the perplexity of an engine that had no attention yet.” Pre-registration: fixed workload shapes, throttled comparator tiers, five interleaved runs per arm, win = better by more than twice pooled SD, with retirement triggers.
Data leaving the building
“Can our data leave the building?”
Second strongest. For Europeans, possibly first.
Say this
“No, and it’s not a promise, it’s the factory setting. The machine ships with no way out. That setting is sealed cryptographically, so a customer can check it themselves rather than trusting us, and an administrator can’t quietly flip it.”
Say it this wayThe qualifier. You must include it.
“In the sealed configuration there’s no route out at all. If a customer chooses to connect it to something, there’s still no unsupervised route: data only moves on a request a person makes, only to places that customer has approved, and every crossing is recorded.”
Say thisSay this too.
“On a machine the customer runs, we see nothing at all. No usage data, no records, nothing. It only leaves if the customer deliberately turns on an export, and those are off by default.”
Say thisOn Europe specifically.
“Moving data between EU countries isn’t a cross-border transfer under GDPR, so the usual objection doesn’t apply. The real constraint is national rules requiring data to stay in-country, and we treat those as binding.”
Never say
- That leaks are “prevented.”Why: our own honest wording is “limited, not prevented,” and that distinction is deliberate. Saying “prevented” is the kind of claim that gets taken apart.
- A flat promise that the software never calls home.Why: our engineer looked and found nothing, but the search wasn’t exhaustive. Say instead: “we looked, we found nothing, and the licence is a contract rather than something the software polices.”
Technical detailfor their technical advisor
Gov.ConnectivityPosture: airgapped / scoped egress / mesh participant, the seventh fixed-width field of a signed Gov.DeploymentProfile. Every preset (municipal, state, federal, hospital) pins airgapped. Proven: default_no_egress, airgapped_no_egress, permitsEgress_iff_not_airgapped, servesPeers_iff_mesh, plus roundtrip and consumption. Coverage table row reads “scoped, not prevented.” Allodial sees customer metadata only where Allodial is the deployment’s root owner. 53-regime residency vocabulary with statutory deadlines as theorems.
Quantum computers
“What about quantum computers?”
Say this
“Every link between our machines uses the new US government standards for post-quantum encryption, alongside the conventional kind. We use three signature schemes at once, and we’ve proved all three are required. If two of them are broken in the future, including by a quantum computer, the third still holds.”
Say it this wayIf they ask whether the encryption itself is proven.
“No, and nobody’s is. Whether encryption can be broken is a hard mathematical question nobody has solved. We treat those as stated assumptions, and everything built on top of them is proven.”
Never say
- Kyber, Dilithium or SPHINCS+.Why: those are the old competition names. Using them in a European room tells a technical advisor we stopped paying attention two years ago, and these people have technical advisors. Say ML-KEM, ML-DSA and SLH-DSA, and mention FIPS 203, 204 and 205.
- “Military grade.”Why: it names nothing a technical advisor can check. Name the standard instead.
Technical detailfor their technical advisor
X25519 + ML-KEM-768 for key establishment. Signature triple Ed25519 + ML-DSA-65 + SLH-DSA-128s (64 / 3,309 / 7,856 bytes), hybrid_requires_all_three. verifyHybrid_full_slhdsa_survives covers simultaneous quantum break of Ed25519 and lattice break of ML-DSA. 18 documented axioms across two crypto pillars, build-enforced by proofs/AxiomAudit/CryptoTrustRoot.lean.
The mesh (machines sharing capacity)
The mesh: machines sharing capacity.
Say this
“Designed, with the hard parts already proven. If one government borrows capacity from another, the data travels sealed to a specific machine that has proved its own identity first, and if that proof fails the transfer is refused rather than downgraded.”
Say it this wayThe honest version if pressed.
“The security and the plumbing are proven. The scheduling piece is written but not yet connected. Call it designed and partly proven, not built.”
Never say
- That it’s something we sell today, or that anyone can buy shared capacity now.Why: it’s designed and partly proven, not built. There is nothing to sell yet.
Technical detailfor their technical advisor
Runtime.EnclaveAttestation.SendGate with required_never_plaintext; AWS Nitro document verification against a pinned root, PCR expectations, freshness and nonce; closed verdict type. Continuity/Machine/Mesh.lean mesh_faithful. Auction.PeerCapacity written as a law with no production consumer at the hash. Mesh is the mesh-participant posture of the routing layer, not a new layer.
Export controls
Our hardware is export-controlled.
The claim changed. The new answer is better.
Say this
“Our hardware is on the US export control list. We checked the arithmetic rather than hoping, and it’s about seventy percent over the threshold. We’re not going to tell you we designed around it, because we can’t.”
Say thisThen say this, which is the actual answer.
“That settles the classification, so the live question is licensing per country, which is much smaller. The UK and the EU are allied destinations where the paperwork is routine. The Middle East is the hard one, and that’s where the compliance money actually goes. Our counsel has the current rules.”
Why this helps you: a founder who volunteers a regulatory problem, with the arithmetic, is a founder whose good news is worth something. Use it that way.
Never say
- “No export-controlled components.”Why: it’s false, and it has to come off the deck, the website, the Sigil-8 summary and every brief.
- An offer to redesign around it.Why: cheaper chips cost about three quarters of the capacity, and our smallest product wouldn’t fit on them.
Technical detailfor their technical advisor
ECCN 3A090.a controls an IC at TPP ≥ 4,800, where TPP = 2 × MacTOPS × bit length; or TPP ≥ 1,600 with performance density ≥ 5.92. 4A090 covers computers containing such ICs. RTX PRO 6000 Blackwell at 504 TFLOPS dense FP16 = 252 TMAC/s, so TPP about 8,064. Verified independently against current BIS guidance. Sub-threshold alternative (L4-class, TPP about 1,900, 24 GB) does not fit gpt-oss-120b.
The product itself
One machine, three sizes, three security settings.
Say this
“One machine, three sizes, three security settings. Two kilowatts, seven kilowatts, seventy kilowatts. Each can be sealed shut, partly connected, or joined to other machines. The setting is cryptographic, not a checkbox, so the difference between the products is something a customer can verify.”
Say it this wayOn the power and cooling engineering.
“The engineering is proven as mathematics: grid limits, heat, backup power, survival if a component fails. Proven as mathematics means the sums are checked. The physical build is still ahead of us.”
Never say
- Customers. Deployments. Performance per rack.Why: we don’t have them yet.
When you don’t know the answer
You will get a technical question you cannot answer.
This is the most important page in this document.
Here is how to handle it without losing the room.
Say this
“I don’t know, and I’m not going to guess in front of you. Let me get you the exact answer from our engineer this week.”
Then actually do it. In this category, a founder who says “I don’t know” and follows up in two days is more credible than one who answers everything.
Say thisIf they press.
“I can tell you what I do know, which is that we publish our own list of gaps. I’d rather send you that list than improvise.”
Three specific rescues
-
If they ask a maths question
“That’s Justin’s area and I’ll get it to you in writing. What I can tell you is what it’s for.” Then say what it’s for.
-
If they ask for a number we don’t have
“We haven’t measured that. We’ve written down how we’re going to, before running it, which is the part I’d rather you judge us on.”
-
If they catch an inconsistency
“That’s a fair catch. Which document did you see it in? I’ll correct it and send you the corrected version.” Never defend a number you can’t source.
The four questions that will definitely come
The four questions that will definitely come.
-
“Do you have a paying customer?”
“No. What we have is proven technology, a working system, and a measured security cost. I’m not going to dress that up.”
-
“What would a hostile technical expert attack first?”
“The gap between the proven maths and the shipped software. It’s the open item on our own list. We’d rather point at it than have them find it.”
-
“What do you need the money for?”
“Two things you can check afterwards. Hardware to produce our first real speed measurements, under a test plan written before the test. And the export licensing work for the countries we’ve named.”
-
“Why should we believe you?”
“Because I opened by telling you three things I’m not allowed to say, and one of them is a regulatory problem that costs us money.”
The one page to read before the meeting
Cheat sheet: never say these, and the jargon translator.
The five things you never say
Never say
- 1 · “Zero sorry” or “zero proof holes.”Why: engineering slang that invites a correction, and the correction costs more than the claim is worth.
- 2 · “Fully verified.”Why: we start from a list of assumptions. Say that first, and publish the list.
- 3 · Any count of proofs.Why: it’s enormous, and a technical person will take it apart in the room. You won’t be able to defend it.
- 4 · “No export-controlled components.”Why: it’s false. Our hardware is export-controlled, and saying so builds trust.
- 5 · Any speed figure.Why: we haven’t measured one yet. Every number in circulation is someone else’s, or the wrong test.
Jargon translator
| They say | You say |
|---|---|
| Formally verified / machine-checked | “A machine checks the maths every time the code is built” |
| Axiom | “An assumption we start from, and we publish the list” |
| Theorem, proof | “Something proved, not just tested” |
| Zero sorry / zero proof holes | Don’t translate it. Don’t say it. |
| Extraction, compiler-faithful | “The plans are checked; the building was put up by hand from the plans” |
| Airgapped | “Sealed. No way in or out.” |
| Egress | “Data leaving the machine” |
| Attestation | “The machine proves who it is before anything is sent to it” |
| Post-quantum | “Encryption designed to survive future quantum computers” |
| Enclave, confidential computing | “A sealed compartment even we can’t see inside” |
| Graded monad, capability grading | “Every action has to declare what it’s allowed to touch” |
| Coeffect, effect grade | Don’t use it. Say “permissions.” |
| Conformal, calibration | “The system knows when it isn’t sure, and hands those to a person” |
| Latency, p99 | “How long it takes, including the slowest few requests” |
| Tokens per second | Don’t use it. We don’t have one. |
| Attested, signed, hash | “Sealed, and the customer can check the seal” |
| Kernel-checked, trusted computing base | “The small piece everything else rests on” |