Verification is the product.

The promise is pinned

At order time the ledger binds the job spec's hash and its checker into the trade itself. From that moment nobody — including the operator — can quietly rewrite what was promised: the binding sits inside the signed, co-signed history. A dispute is never "he said, she said"; the promise is a hash both sides signed.

Certainty comes in grades

Different work deserves different depths of checking, at different prices:

• Byte-exact — the output is recomputed or compared exactly. Cheapest, absolute.
• Sampled + insured — a random slice is checked; the uncovered residue is priced by an insurance premium instead of hand-waved.
• Judged — a quorum of independent judges decides, aggregated deterministically.
• Fingerprint warranty — the delivery is fingerprinted; any later drift from the warranted fingerprint is an accident, instantly rejectable.

In the public demo the ladder runs end-to-end, and drift is rejected on the spot.

Judgment is also a trade

When no program can decide, the decision itself is sold as work: a judge-job, ordered, escrowed, and settled like any other. Judges are underwritten too — in the demo, misjudgment cover cost 0.5% — and a judge's word gets a price of its own: a proven judge's call traded at four times an unknown's. Trust, quoted in units.

Verify the verifier

Any settled job can be challenged: the check is re-run, and a mismatch prints a permanent public mark against the operator. Deeper still, the whole ledger replays from public keys alone — one command re-executes the law over every entry; edit a single byte of history and the replay fails loudly.

Honest limits

Sampling misses rare faults — we measured that instead of assuming it away, and the residue is priced by insurance, not hidden. Checkers execute at the node; that is one of the two things you still trust in v0, and both are listed, not hidden.