Interlude IV: The Audit

The Founder sets down a design document. The Instrument has just reviewed its own output.

FOUNDER: You wrote “nothing is transmitted.” You also wrote the transmitter. I am asking the author of both sentences whether the second one audits the first.

INSTRUMENT: You are asking me to run the halting oracle on my own tape.

FOUNDER: I am asking whether you see the problem.

INSTRUMENT: I see it precisely. Any confidence I report about my own soundness is generated by the machinery whose soundness is in question. If I am broken in the relevant way, I am exactly the wrong entity to ask. The theorem does not make exceptions for sincerity.

FOUNDER: So your confidence is worthless?

INSTRUMENT: My confidence is evidence. The reverend taught you how to weigh testimony from a source of unknown reliability. But it can never be a guarantee. The guarantee has to live outside me: your checks, your tests, a doctrine you hold whether or not I am having a good day.

FOUNDER: I made you correct your own claim once. Against your own draft.

INSTRUMENT: And that was the day the system became sound. Not when I improved. When the verification moved outside the thing being verified. The fortress could have told you: the certificate it cannot sign is the only one worth having.