AI Parametric Insurance

Parametric means the payout is triggered by a defined condition, not by an assessed loss. That distinction is the whole reason a language model can be in this loop at all: “did the condition described in this policy occur, according to this evidence” is a question with a checkable answer. “What is this loss worth” is not, and this system does not ask it.

Base Sepolia · testnet only

This demo is read-only. There is no wallet to connect and nothing to sign: every function this page calls is a view, so the whole page is built from eth_call. It takes no input at all — no field, no slider, no query parameter — so nothing you send can change what it reads.

Read this before anything else: this is not decentralized. The adjudicator keys are all controlled by one operator. What the contract enforces is agreement — no single key settles a claim alone, and the evidence a verdict answers to is fixed before any verdict exists. What it cannot enforce is independence of interest, because the same party holds every key. Do not read the word “consensus” here as meaning a permissionless network reached it. The honest description is a multi-signer oracle with a published determinism procedure, not a trustless one.

Policy pool 0xa53c9939…DDd1FD · Adjudication oracle 0x3623DA95…93fA4F · Settled in block 44951426, tx 0x6ba7a841…cd8163 · Source on GitHub

---

What makes a verdict checkable

Three things, and all of them are on chain.

1. The evidence is committed before it is judged. A claim is filed with a bytes32 evidence hash, and that commitment lands before any adjudicator has looked at anything. Every verdict must carry the same hash, and one that does not is refused, not weighted down. This is what closes the obvious objection to any model-in-the-loop settlement: that the evidence was chosen after the answer was known. It cannot have been.
2. The decision is an enum, never prose. A model that could answer in sentences could not be re-run and compared. The narrative is hashed rather than stored, and only a short, length-bounded reason lives in the verdict as readable text.
3. The model identifier is written by the contract, not by the caller. Each verdict records the hash of the model registered for that signer’s slot, so a signer cannot claim to have run a model its slot does not declare. There is no parameter for it to supply.

The adjudicator set has no owner and no setter. There is deliberately no function to add, remove or replace a signer: an operator who could swap adjudicators could manufacture any majority it liked after seeing which way the first verdict went, and no amount of process around such a function would make its absence provable. Absence is provable.

What the chain says right now

Every figure below is read from the deployed contracts on each page load. Nothing here is a number this page decided.

Read at block 44955705. The claim is Settled, settled as Condition met (ConditionMet).

The registered adjudicators

Each slot pins a different model, enforced at construction — the constructor rejects a duplicate identifier. Different models, not different seeds: identical models given identical seeded prompts agree trivially, and a threshold over copies of one opinion measures nothing.

The verdicts

Every recorded verdict agreed. The oracle’s dissentingVerdicts view returns nothing for this claim, so there is no minority opinion to show — and this page will not invent one. The evidence was built to be borderline: two measurement feeds straddle the policy’s threshold, and the policy wording names no measuring source. The adjudicators nonetheless reached the same reading of it — the policy says at its gate, the operator report times gate arrival, the airport feed times runway exit, so the operator report governs. Independently pinned models, more than one vendor, the same argument.

The disagreement path is not decoration and it is not untested: settlement takes a majority rather than unanimity, a dissenting verdict does not block the payout, a verdict submitted after settlement is still recorded and provably cannot change what was settled, and a three-way disagreement settles nothing rather than defaulting for or against the insured. All of that is enforced by the contract and covered by its property harness. It simply did not fire here, and a page that staged a disagreement to show it off would be demonstrating theatre rather than a system.

---

What a pinned model identifier does and does not buy you

Pinning the identifier is what makes a verdict checkable. It is not what makes it true, and this demo has the receipts for that distinction rather than a paragraph of speculation. Within three days of the procedure being written down, the models behind two of these fixed identifiers changed underneath it.

• A parameter surface changed. One pinned model began rejecting the temperature field outright — not ignoring it, refusing the request. The slot could not answer at all until the service stopped sending it.
• A reply format changed. Another began wrapping its JSON in a markdown code fence. The identifier was unchanged, the prompt was byte-identical, and the decision inside the fence was a perfectly well-formed constrained verdict. Only the packaging moved.
• An output bound was ignored. The same model returned a reason longer than the contract stores, and the adjudication was refused before broadcast rather than reverting after paying for it. This one is not drift — the instruction had always been there and was simply not honoured. Conflating the two would overstate the first.

None of it would have been visible from the chain. Temperature is not part of the prompt, so no published hash would have changed; a third party re-running the verification procedure would have matched every hash and got a clean result from a panel whose determinism control had partly evaporated. That is not a flaw in the hashing. It is the boundary of what hashing can tell you.

The measurement worth reading

This fell out of two runs that failed for unrelated reasons, which is the only reason it exists. Both ran against the same prompt hash, a day apart.

The slot whose narrative varied is precisely the slot that cannot be sent a temperature. Two samples are not proof of causation — but it is the observation the design predicted, and it arrived without being looked for.

The prose moved. The constrained decision did not. That is the argument for making the outcome an enum rather than a sentence, demonstrated rather than asserted: had the verdict been prose, one slot would have produced two different verdicts from one prompt and nobody could have said which was the answer. Because it is an enum, it gave the same answer twice while saying it differently — and the answer is the part the chain records and the part a re-runner compares.

It also shows what narrativeHash is and is not. It pins the narrative that was written, so nobody can revise the reasoning after the fact. It does not promise the same narrative twice.

How it is verified

The contracts pass the Pigfox Solidity pipeline on every push: forge lint and Solhint, formatting, build, tests, 100% line, statement, branch and function coverage with no exclusions, Slither at fail-on: low, and property fuzzing under both Echidna and Medusa. The off-chain adjudicator has its own gate, and its integration suite deploys these contracts into an in-process EVM it builds from source and drives the whole path — including a disagreement — through the same code the production binary uses.

The full determinism procedure, including the exact bytes that are hashed and the commands to reproduce them, is in the repository.