The Verification Gap

Three numbers, one story.

One. Mistral's Leanstral 1.5, shipped 2026-06-30. An open 119B / 6.5B-active proof agent runs the Lean 4 compiler as its grader and solves 587 of 672 PutnamBench problems at about $4 per problem — vendor-reported, but the compiler does the grading, which is the point. Frontier brute-force approaches on the same benchmark run north of $300 per problem. Roughly seventy-five times cheaper. Same math. Different grader.

Two. Bridgewater's AIA Labs, working with Thinking Machines, published a tuned Qwen3-235B that hits 84.7% on their internal finance-task evals versus 78.2% for the best frontier model, at 13.8x lower cost per completed task. Vendor-reported, 2026-07-04. The accuracy is not the interesting number. A hedge fund built its own eval suite. Once it existed, fine-tuning became a rational business decision.

Three. Claude Sonnet 5 shipped 2026-06-30 with lower headline pricing than Opus 4.8. Independent measurement from Artificial Analysis put the actual per-task cost at $2.29 — about 15% above Opus 4.8. The tokenizer changed, reasoning got longer, the sticker went down and the invoice went up. Anthropic corrected its own Sonnet 5 BrowseComp chart the same day the model shipped, because the methodology comparison was mismatched.

Three numbers. Same story. And the story is not about models.

The law: margin follows verification

I have put a law on the record before — in the 2028 featured report: where work moves, margin follows. That law was about where a workload gets performed — on-prem, cloud, edge, rented API. Margin followed the location of the work.

There is a second law underneath it, and 2026 is the year to say it in full:

Margin follows verification.

Where a domain can verify cheaply and machine-legibly, it captures the margin from agentic work. It prices on outcomes because it can measure them. It fine-tunes smaller models because it can grade them. It runs bounded autonomy because it can catch failure between the steps. It compresses vendor markup because it owns the ground truth.

Where a domain cannot, it stays hostage. Hostage to frontier tokens. Hostage to seat pricing. Hostage to whichever platform incumbent or global systems integrator will sell it a governance wrapper. The verification gap is a cost curve, not a capability curve — and the cost curve decides who keeps the margin.

Part 1 argued that software got agents first because software could grade itself. Part 2 argued that AGENTS.md is an interface stack, not a document. This post is the pricing consequence, and the one that gets executive attention on a Monday.

The domain CI

Software has a compiler. What does every other domain have?

Not nothing. But nothing yet composed into what an engineer would recognize as continuous integration.

Call it the domain CI — the unit-test equivalent for a non-software workflow, and the three layers of trust the tests have to sit on.

• Legal. Citation checkers, clause libraries, precedent diffs, term-consistency scanners, redline reconciliation. Harvey's Legal Agent Benchmark measured the best frontier model at 10.4% all-pass in late May 2026 — the first time anything crossed the ten-percent line. Compare to 85.2% on SWE-bench Verified five weeks later, on the same tier of models. That is not a domain gap. It is a grader gap. Software's tests grade themselves; law's tests grade the products built around the models. Legal is looking for its compiler.
• Finance. Reconciliation-to-source, control assertions, model-risk validation, journal-entry rules, four-eyes attestation. Morgan Stanley's FIXR P&L reconciliation agent, publicly discussed 2026-07-01, cut per-book time from about six hours to two-to-three, freeing roughly 1,500 hours a week across ~100 controllers (secondary press; verify against the primary write-up). The way FIXR got there is the important part: they made the agents less autonomous. Tighter, human-checkable steps, each one assertable against source. Finance is finding its compiler.
• Supply chain. Constraint solvers, simulation harnesses, physical inventory reconciliation. Real ground truth exists — the truck either arrives or it does not. Public agent case studies remain thin and vendor-heavy. Supply chain has a compiler; almost nobody has agent-wired it yet.
• Sales, marketing, HR. No compiler in view. Ground truth is opinion, revenue attribution, or a human panel. These domains will get durable agents last, and will pay the most for them along the way.

Underneath the tests are three layers of trust, and they matter as much as the tests themselves.

• Tool trust. Can you trust the tools the agent calls? CVE-2026-30856, disclosed 2026-07-02, showed that MCP tool-name collisions and indirect prompt injection are already a working attack surface (CVSS 7.6). The verification layer includes the tool identity layer whether you meant it to or not.
• Methodology audit. Can you trust how the evals were run? Anthropic corrected its Sonnet 5 BrowseComp cost chart the same day the model shipped, because the methodology comparison was mismatched (2026-06-30). Even frontier labs need audit on their own evals. Nobody else gets a pass.
• Output evals. Can you trust the answer? This is the layer everyone talks about. It is also the layer that fails silently — passes the test, misses the point — without the other two underneath it.

No domain, including software, has all three layers wired together yet. That is the assembly job of the next twenty-four months, and it is where the fixed-cost investment of the agent era actually lives.

The economics: verification is the pricing lever

Here is the mechanism.

Move verification cost down on that curve, and three things happen at once. Outcome pricing becomes possible — the vendor trusts its own telemetry enough to charge only on success. Fine-tuning becomes rational — a smaller, tuned model can be graded against ground truth without a human panel in the loop. Autonomy can be safely expanded — because failures are catchable between the steps. Move verification cost up, and every one of those doors closes. You stay on seat pricing, frontier tokens, and human-supervised chat.

The Leanstral, Bridgewater, and Sonnet-5 numbers at the top are three points on that same curve. Leanstral is what happens when verification is free — a $4 per-problem cost, on a 6.5B-active open model. Bridgewater is what happens when a domain builds its own eval suite — 13.8x lower cost per completed task and higher accuracy than frontier, on a tuned open model, vendor-reported. Sonnet 5 is what happens when nobody has fixed the verification underneath the pricing — the sticker moves one way, the invoice moves the other, and no enterprise can honestly predict which workloads got cheaper this month.

The pricing turn is already visible in the majors. Salesforce announced pay-per-resolution for its prebuilt Service Agent on 2026-06-25 — charged only when the agent autonomously resolves the case, no charge on escalation, no charge on negative CSAT. Pega shipped per-completed-case with an explicit "no token tax" line on 2026-06-08. Databricks reframed its agent SKU as "no seats" on 2026-06-16. Three incumbents, three weeks, three outcome-or-consumption SKUs replacing the seat model.

Salesforce's pay-per-resolution is not a pricing innovation. It is an eval telemetry claim wearing a price tag. It only works because Salesforce believes it can measure "resolved" without a human dispute on every ticket. The moment the eval stops being trustworthy, the SKU stops being coherent — and the vendor takes the loss, not the customer. That is the same shape as the Result Contracts and Outcome Control Loop that Results-as-a-Service demands, and it is why RaaS is a verification story before it is a pricing story.

Under the incumbents, an eval-tooling layer is crystallizing into a fundable category. LangChain shipped Harbor on 2026-07-02 as a unified stack for evaluating long-running stateful agents. Pramaana Labs raised $27M from Khosla on 2026-06-17 to build formal-verification tooling that makes AI "prove the answer" for regulated use. Two data points do not make a category. But the pattern rhymes with what happened to observability in 2015-2018 — a control point splits out of the platform layer, gets funded, and then the entire vendor stack reprices around it.

The model isn't the bottleneck. The receipt is.

If you have read the context compilation argument on retrieval benchmarks, this will land the same way: passing the benchmark and being safe in production are two different problems, and the second one is where the money is.

Steelman before the gap

Two honest counterarguments deserve air before I move on.

The two-regime read. HAQQ published a legal benchmark in late June, grading roughly 3,000 answers across frontier models and specialist legal platforms. The finding: frontier models match or beat legal specialists on raw answer quality. The specialists' premium was in workflow, security wrapper, and citation handling — not correctness. Read that generously, and the verification thesis looks partial. On short-answer workflows, distribution and packaging matter more than deep evals.

Concede it. Then sharpen. Verification's importance grows with workflow length and autonomy level. A one-shot answer needs a good model and a good wrapper. A ten-step, multi-tool, cross-system agent workflow with write access needs a grader you can trust between every step. Enterprise money is not being spent on one-shot answers. It is being spent — or trying to be spent — on the long, autonomous runs. That is where the verification asset compounds.

The Morgan Stanley FIXR result belongs in the same steelman. FIXR did not win by making the agent more autonomous; it won by making it less autonomous, decomposed into human-verifiable steps. Read that as confirming, not contradicting, the thesis: autonomy is a dial, and the dial is set by how much you can verify. Autonomy without verification is just faster error. Verification-bounded autonomy is the enterprise pattern — the same pattern I called out under stochastic core, deterministic shell. You do not "trust" the agent. You bound it.

The outcome-pricing ceiling. There is a real limit to how far pay-per-resolution travels. You cannot outcome-price an SEC filing. You cannot outcome-price a diagnosis. You cannot outcome-price anything where the cost of a false positive to the vendor exceeds the price of the resolution itself. Outcome pricing works — and will keep working — in bounded, low-liability, high-volume lanes first: customer support, expense triage, ticket routing, contract redlines against a known clause library. It will not clear legal opinions, medical treatment plans, or M&A memos, and pretending otherwise is a category error. The domains that adopt outcome pricing early are the ones with the tightest verification loops. Not a coincidence.

Vendor-reported metrics — Bridgewater's, Salesforce's, Pega's, most of the Cursor case studies — belong in the "if it holds" column. They are directionally credible and not yet independently reproduced. Treat them like an internal pilot, not a peer-reviewed result.

Predictions on the record

Three dated, measurable claims for the trailing edge.

• By 2027-06-30, at least one non-software enterprise deployment will publish a cost-per-completed-task on a tuned or smaller model at ≥5x advantage vs. frontier, backed by a named domain eval suite. Measurable criterion: a public writeup with a headline task, a defined pass rule, and a cost line on both the tuned model and the frontier baseline. Cited evidence: Bridgewater's tuned Qwen3-235B, 84.7% vs. 78.2% at 13.8x lower cost per task, vendor-reported 2026-07-04 — the private-eval preview of exactly this pattern.
• By 2027-Q4, at least three enterprise SaaS vendors will publish outcome-based SKUs in categories beyond customer experience. Measurable criterion: a public price sheet or contract SKU tied to a completed action outside CX. Cited evidence: Salesforce pay-per-resolution (2026-06-25), Pega per-completed-case with "no token tax" (2026-06-08), Databricks "no seats" agent SKU (2026-06-16) — three incumbents in three weeks starts the clock. Watch legal work, expense automation, and IT service management for the next crossings.
• By 2027-03-31, at least one major enterprise will publicly describe an internal "domain CI" eval suite as a core IP asset. Measurable criterion: an executive keynote, engineering blog, or SEC-disclosed R&D note naming the eval suite as pass/fail gating for agentic workflows in the domain. Cited evidence: Bridgewater's build (2026-07-04, vendor-reported) is the leading indicator; Morgan Stanley's FIXR (2026-07-01, verify against primary) is the reason.

Grade each of these against public evidence, not vendor decks. If any land early, the assembly job of the domain CI is faster than I have priced in. If any land late, the platform incumbents get another year of margin.

What to do on Monday

Three moves, in order.

1. Name your domain CI. For one high-value agentic workflow, write down what "pass" means in machine-checkable form. If you cannot write it, you do not have an agent strategy for that workflow — you have a chat surface with a change-management problem. If it takes you longer than an afternoon, that is the finding: you have located your missing asset.
2. Separate model spend from verification spend in your budget. Most enterprises book everything under "AI tokens." Split it. Track cost-per-completed-task, not cost-per-token — the way Bridgewater and Anthropic already do. The rate card and the invoice have officially diverged (see: Sonnet 5); do not let your finance team learn that from a Q4 variance report.
3. Draw the three-layer stack for one workflow. Tool trust (are the MCP tools identity-verified and permissioned?), methodology audit (who signs off on how the eval is run, and who audits them?), output evals (what is the pass rule, who owns it, and where does it live in git?). Ship the missing layer before you scale the workflow. What the production evaluation and observability layer looks like in a shipped system is worth reading before you build yours. What the invoice-to-outcome line does to your P&L is worth reading before you defend your budget.

If Part 2 was about legibility, this one is about receipts. Legibility without receipts is Potemkin agent-readiness — an impressive benchmark score with an unaudited grader underneath. The compiler is what let software eat itself. The receipt is what will let every other domain do the same.

Part 4 turns to the people who build these evals inside their own domain — the practitioner-builders — and asks the fork question: does your domain build them, or rent them from a vendor who does? The answer decides who owns the margin.

Operate. Publish. Teach.