Return-Path: X-Original-To: scitt@mail2.ietf.org Delivered-To: scitt@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 91EC712D4CE1D for ; Fri, 21 Aug 2026 04:36:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1787312200; bh=CG5+y20J/8G63VQdIyboX9dG8gswEZSNCpoUKqRo8ZM=; h=Cc:From:In-Reply-To:References:Subject:To:Date; b=kIUXtSUfbcGi8CI5tyYWejBUbhudXkNzL2yCJsD0c0cFOTFv+Q67USoM66ylesIUk y6i9z/AbpTX1OHK4KSDhlz6wvfhx2+C88ePlz839yCAkZb8aqUV6sKw0xb1dfCVJ7Y 7ZSo1lf1o1lI8GEbt8LgC9EFfVaiFVvLoNBgezJo= X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -0.618 X-Spam-Level: X-Spam-Status: No, score=-0.618 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, GB_AFFORDABLE=1, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.377, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=conarium.dev Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qdilQ-oH8_od for ; Fri, 21 Aug 2026 04:36:37 -0700 (PDT) Received: from buffalo.larch.relay.mailchannels.net (buffalo.larch.relay.mailchannels.net [23.83.213.24]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id B402E12D4CE16 for ; Fri, 21 Aug 2026 04:36:36 -0700 (PDT) X-Sender-Id: hostingeremail|x-authuser|e.dogru@conarium.dev Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 9E5B061175 for ; Fri, 21 Aug 2026 11:36:30 +0000 (UTC) Received: from de-fra-smtpout3.hostinger.io (100-96-14-83.trex-nlb.outbound.svc.cluster.local [100.96.14.83]) (Authenticated sender: hostingeremail) by relay.mailchannels.net (Postfix) with ESMTPA id 9ED2262EDB for ; Fri, 21 Aug 2026 11:36:25 +0000 (UTC) X-Sender-Id: hostingeremail|x-authuser|e.dogru@conarium.dev X-MC-Relay: Good X-MailChannels-SenderId: hostingeremail|x-authuser|e.dogru@conarium.dev X-MailChannels-Auth-Id: hostingeremail X-Desert-Slimy: 6aba945034d7ac08_1787312190585_3143783256 X-MC-Loop-Signature: 1787312190585:3755331484 X-MC-Ingress-Time: 1787312190585 Received: from de-fra-smtpout3.hostinger.io (de-fra-smtpout3.hostinger.io [148.222.55.15]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.96.14.83 (trex/8.0.2); Fri, 21 Aug 2026 11:36:30 +0000 Received: from localhost (34.86.89.34.bc.googleusercontent.com [IPv6:2a00:1d35:17a4:d900:51f5:85e2:e74c:e841]) (Authenticated sender: e.dogru@conarium.dev) by smtp.hostinger.com (smtp.hostinger.com) with ESMTPSA id 4hRJD74zL8z40Sk for ; Fri, 21 Aug 2026 11:36:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conarium.dev; s=hostingermail-a; t=1787312183; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pZ1gUUnrgMhjYjpx4hPAKeFZZt/mwIbE6EbEITOWdzA=; b=rsUusMl3VSxgNoonf3OU5eEufYUULbRjFnhOQb4qp6rDlOKjYhSxcjjfHJ4d2ADr/eepKN YRupjtsXugTJuVJ+Azgmo6w8SWHKtTa/0GFNkWRVQTSO+3iVy2LjwB3oTZ1Pkru8BNiCZY vM4F1YLKJwcpxEzuzZzQgwxrC/nyGYI5qdIsNfnPU3YKuOLLsPsHUqC6CEmB4mgsm7khTf jFq+pTGgkAxCvbyroajWpvu55RjJDgePf+z1/eR1Tz+WfnxmKOEeaFRTeno7GoNxbvuoek 1PtzIJKYkwDrLjgDzAUe0oRpTJUToPfRGKwoabFO2CPProOHixjxH1u6kd4QHQ== Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 From: In-Reply-To: Message-Id: <1787312175766668752.1787312175@conarium.dev> Mime-Version: 1.0 References: <1787262784652143705.1787262784@conarium.dev> <1787272059233193813.1787272059@conarium.dev> To: Date: Fri, 21 Aug 2026 11:36:23 +0000 (UTC) X-CM-Envelope: MS4xfBAzeeCB2PtP2tXNSIktim5jnVV5RItw16Vjan/T31kG7YTHpTWnhQ3LaoD7bR5QrjOdXXHoXrYad+HpHNd/wu3qY5htnSu/cVbxUdQ1nWyBsTzRWeAe GRIuB3aevHTksyHtZK5wsWkVFEPeR7yeCs9B72hrX5JcD8SjCGRaTR/CKakcnhDqoWnzwmbDMTrYqbeEPW67igLGb8yVu0RN7ahuBPiYQWz1imMBlO3yaMAp kZZnBMY33jOWwPVsuHYxDA== X-CM-Analysis: v=2.4 cv=fr2OZ04f c=1 sm=1 tr=0 ts=6a883837 a=RddCdUNZqxBAE8jYSUBS9Q==:617 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=5KLPUuaC_9wA:10 a=NEAV23lmAAAA:8 a=hi0xlm6rAAAA:8 a=pGLkceISAAAA:8 a=48vgC7mUAAAA:8 a=LDjtMF89vs4DFsddjhUA:9 a=ikbW8NqlxDghnTl6:21 a=lqcHg5cX4UMA:10 a=QEXdDO2ut3YA:10 a=be0iV6EvdG5NM9SqR88d:22 X-AuthUser: e.dogru@conarium.dev Message-ID-Hash: QNKXVR2P3B4VJHFNLQL2IHTMO4WCMZH7 X-Message-ID-Hash: QNKXVR2P3B4VJHFNLQL2IHTMO4WCMZH7 X-MailFrom: e.dogru@conarium.dev X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: hello@vaara.io, wdhawkins46@gmail.com, scitt@ietf.org, jhillier@certisyn.com, nenadvasic@protonmail.com, Todd.Gibson@t-mobile.com X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BSCITT=5D_Re=3A_Closing_omission_from_the_receiver=27s_vantage_?= =?utf-8?q?=E2=80=94_what_a_record_must_carry?= List-Id: "Supply Chain Integrity, Transparency, and Trust" Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe:
All,

Pablo =E2=80=94 the partition you merged= is the third independent one, and the three
disagree about enoug= h that the agreement is worth naming. Walter reached it from
the = ladder, Henri from a closed reason set in a release condition, yours from a=
binary read path where `trail_not_found` is unreached and the re= st ran and
failed. None of us started from the same problem, and = none of the three collapses
a cleanly-resolving value into whiche= ver adjacent state was easiest to code
against.

I have the fourth, and I am posting the cost rather than the agreem= ent, because
the cost is the part that is not obvious.
=
The receipt format takes the null branch: an absent optional= is **present and
null**, never omitted, and a receipt that omits= the keys is rejected as
malformed rather than read as empty. Vec= tor `013-disclosure-keys-omitted` exits
20 for exactly that.

Joel's objection in the encoding thread is the right o= ne to raise against it: a
null-for-absent rule makes every digest= computed before a member existed
incomparable the day it is intr= oduced. That is a real flag day and we pay it =E2=80=94
except we= do not, and the reason is worth stating, because it is not the null
<= div>rule that saves us.

The version string is insi= de the preimage. Removing `v` from a published vector
changes its= content hash, so the digest carries which schema was in force when it
was taken, and a member absent under 0.3 is attributable rather than = ambiguous.
`012-mixed-chain` is a 0.3 receipt followed by a 0.4 r= eceipt, and the chain
verifies. Both were published before this a= rgument started, so I am reporting a
property rather than claimin= g foresight.

Which lands where Joel's own thread l= ands: *if you omit, carry something in the
preimage that says whi= ch members were defined when the digest was taken.* We do
not omi= t, and we carry it anyway. The version is doing the work the omission rule<= /div>
was invented to do, and the null is buying the distinction betwee= n *declared
empty* and *never written*. They are separable, and I= had them mixed up until
this thread.

Ev= erything above is in `@conarium-ai/core@0.2.39` on npm, vectors included.

Emek


On = Fri, Aug 21, 2026 at 12:32 PM Pablo Play <playplay2736@gmail.com> wro= te:
=20
Henri, all =E2= =80=94

  Second empirical data point under the closed-enum prop= erty, from a different mechanism than
  Vaara's release condition b= ut the same shape: a binary result whose reasons already
  partitio= n into two non-overlapping categories, documented additively rather than wi= dening
  the enum.

  verify_chain() in our stack return= s valid: false for two structurally different situations
  =E2=80= =94 a trail that was never reachable to evaluate, and one that was read com= pletely and failed
  a real check. The read path is binary by const= ruction (single-row lookup, no partial
  reads), so trail_not_found= always runs first against the raw result, and everything
  evaluat= ed after it =E2=80=94 including missing_signature_ref =E2=80=94 is a check = against a record we
  already read in full. That gives a clean part= ition without touching the valid contract:

    trail_not_f= ound                  -> un= reached
    missing_signature_ref         =    -> ran-and-failed
    delegation_ref_parent_mi= smatch   -> ran-and-failed
    cycle_detected   &= nbsp;               -> ran-and-failed=

  Merged as-is, 69 lines added, 0 removed (commit e12658d,
=   github.com/giskard09/argentum-core= , negotiation-ref.md).

  Same underlying rule as your block= ed-but-verified receipt: a value that resolves cleanly
  deserves i= ts own place in the partition, not a collapse into whichever adjacent state= is
  easiest to code against.

  =E2=80=94 Pablo
<= br>
El vie, 21 ago 2026 a la(s) 2:28=E2=80=AFa.m., Henri Sirkka= vaara (hello@vaara.io) escribi=C3=B3:
Nenad, Walter, Joel, Pablo, Emek, Todd,

The principal row is right and I would take it further than a row.= Your revocation case and the receiver's settlement case are the same shape= at two different levels, and neither party can be substituted for the othe= r, which by this thread's own argument puts the vantage question in the sub= strate rather than in any one draft.

= On the closed-enum property, I have something to put under it rather than a= nother agreement.

Vaara 1.71.0 ships = a release condition: money is held against a signed statement of what must = be proved, and a receipt proving the authorised action happened is what rel= eases it. Evaluation returns one of four states, each carrying a reason fro= m a closed set. The mapping from reason to state is a table, not control fl= ow, so no code path can file a forgery under a hold.

<= /div>
The partition runs on one axis. A broken signature, a recei= pt under a key the condition does not pin, or evidence that does not resolv= e to the digest the receipt signed are failures as evidence, and they refus= e. A missing receipt, a receipt for another action, another authorization, = or one that soundly proves a refusal are sound and insufficient, and they h= old. Soundness is checked before the clock, so an expired window cannot swa= llow a tampering finding.

Eight vecto= rs in tests/vectors/release_condition_v0, all four states present, and a ch= ecker that imports no Vaara and recomputes every verdict from the case byte= s. Among them is a receipt that verifies correctly and proves the action wa= s blocked. It must not release, and treating it as a plain false would put = it in the same state as a forgery.

DOI 10.= 5281/zenodo.22029444 if it is useful to cite the exact bytes.

Henri Sirkkavaara
=
Vaara -&n= bsp;Runtime execution layer for AI age= nts
Bu= ilt to see over the noise.
Helsinki,= Finland

On Friday, August= 21st, 2026 at 04:10, Walter Hawkins <wdhawkins46@g= mail.com> wrote:
Emek,

You came back with the check and what it c= aught, so here is mine =E2=80=94 same shape, a day behind you.

The r= ule, as shipped. An anchored sequence moves a verifier's floor only when al= l of the following hold: the calldata parses and names this grant; the key = segment equals the grant's accountant; the anchored content was actually re= trieved; the anchor digest recomputes over the retrieved head; the head's s= ignature verifies; and the head itself names this grant, this accountant, a= nd this sequence. Anything short of that is ignored with a warning naming t= he reason, and a refusal can only lower the floor toward the tamper-evidenc= e downgrade, never raise it. The old scan =E2=80=94 the one that trusts the= sequence printed in calldata =E2=80=94 survives under an UNVERIFIED label = for survey work, because a claimed sequence is still a lead worth following= . It is no longer anything a verifier may refuse an honest head against.
Shown failing before wired in, on your reasoning that a check which ha= s only ever been green demonstrates nothing. Four controls:

- The fo= rged-key attack from my last message, run for real: a stranger's anchor cla= iming sequence 999999999 under the accountant's public key. The unverified = scan reads 999999999 =E2=80=94 poisoned exactly as I described it two days = ago. The verified scan holds the floor at the genuine head and prints a war= ning naming the anchor it ignored.

- An anchor whose retrieved head = does not reproduce the anchored digest: no floor movement.

- Calldat= a claiming one sequence over a head that states another: no floor movement.=

- No qualifying anchor at all: the floor is null, and null is not z= ero. "I could not derive a floor" is the labelled tamper-evidence downgrade= , not a fact about sequence 0.

What it caught immediately: my own an= chor. The only anchor we have ever written to a chain =E2=80=94 the Coston2= transaction at block 34259963 that I brought to this thread as evidence = =E2=80=94 is refused by the rule it motivated. I read its calldata back off= the chain today: it parses, and it carries no key segment at all, because = the grammar predates the hardening; the head it points to predates the acco= untant field. Two independent grounds, either one fatal to floor-eligibilit= y. Your check's first catch was your own sentence; mine refused my own anch= or. It stays in the record, labelled, as tamper evidence of the day the wir= ing first worked =E2=80=94 which is exactly as much as the hardened rule pe= rmits it to be. The lesson I passed on last time, that we anchored a shape = we were still editing, now has an enforcement mechanism instead of a caveat= .

Your 14-versus-15 split is in here too, arrived at separately. An = anchor whose content cannot be fetched is ignored with "content not retriev= ed, so its sequence is unverified" =E2=80=94 could-not-check never gets swa= llowed into failed, and never silently reads as verified. The null-rather-t= han-zero floor is the same rule one level up. I'd add both of ours to the p= ile Joel is counting: the weakest-rung rule keeps being reinvented at whate= ver layer someone is standing on, which is the strongest argument yet that = it belongs in the substrate stated once.

Two limits, stated now rath= er than found later.

First, the verifier takes the retrieved heads a= s inputs; where they came from is outside the rule. Joel's placement rule = =E2=80=94 state where the evidence is obtained, not only where it is produc= ed =E2=80=94 lands on this with full force. A verifier handed heads by the = executor it is auditing has re-derived at the second placement, and the res= ult object should say so. Mine does not yet distinguish the placements; tha= t is the next honest gap.

Second, floor-eligibility depends on retri= evability, so the floor's strength decays with content availability. An adv= ersary who cannot forge a floor can still lower one by making anchored cont= ent unfetchable. That fails in the right direction =E2=80=94 a downgrade ra= ther than honest heads refused =E2=80=94 but it is a downgrade an attacker = can induce, and the record has to name it, or "no floor" reads as "nothing = was ever anchored", which is a different claim.

Walter

On Thu, Aug 20, 2026 07:27 PM, e.dogru@conarium.dev wrote:
All,

I said I would= come back with the check and what it caught rather than with a plan. It is= written and merged; this is what it caught. Walter's rung 3 question gets = a measured answer at the end, because it turned out I could check it rather= than argue it.

The problem is in -05 in my own wo= rds: four sentences in the Implementation Status section of -04 were accura= te the day they were written and false within days, every one of them claim= ing less than the code did, and nothing in the repository compared that sec= tion to the tool. They were found by a reader holding the document beside t= he output.

The check runs the section instead of r= eading it. Three declarations of one fact exist: the code, the prose, and n= ow a claim table between them, because prose cannot be executed. Each behav= ioural sentence is bound to a run of the shipped CLI over a named fixture, = and two directions are enforced. Every value a run produced must still appe= ar in the sentence that states it, and the number of sentences must equal t= he number of claims. A sentence with no claim is one nothing measures. A cl= aim with no sentence is a measurement the document dropped.

<= /div>
The revision it reads is derived from what is in the repository r= ather than named in the check, because a hard-coded revision is the same cl= ass of stale declaration the check exists to catch.

I showed it failing three ways before wiring it in, since a check that ha= s only ever been green demonstrates nothing:

a= value edited out of a sentence
-> the sentence no longe= r contains observed-without-receipt
one bullet removed
<= div> -> states 4 observed behaviour(s), the claim table runs 5
a fixture changed so the tool's outcome moved, sentence untouched=
-> item outcomes are ["excluded","indeterminate"],
the table says ["excluded","observed-without-receipt"]
=

The third is the one that matters: the code moved and t= he sentence stood still, which is what happened four times in -04.

What it caught immediately is a sentence of mine. -05 says= "The implementation's test suite contains no check that compares this sect= ion against what the code does." From the merge commit that is false, and a= posted draft cannot be edited, so it is the first correction -06 owes.

Two limits, stated now rather than discovered later. = It pins the behaviour table and not the prose around it, so a paragraph can= still go stale in a way nothing runs. And a red has two honest fixes: chan= ge the code back, or write the revision that says what the code now does. E= diting a posted draft is not one of them, which makes the cost of drift a d= ocument rather than a diff.

Walter, on rung 3. You= put it as: an external anchor is not automatically rung 3, an anchor is a = claim by whoever paid for it, and a profile that says "anchored" without sa= ying "and re-derived" has described rung 2 with extra steps. I went and loo= ked rather than answering from memory, and the implementation agrees with y= ou, which I did not know for certain before you wrote it.

--anchor-check deserialises the timestamp proof, refuses a proof wh= ose digest is not the chain head, walks the attestations, and where the att= estation is Bitcoin it fetches that block and compares the digest against t= he merkle root. So the re-derivation is in the path and not in the prose.

The part I would not have thought to defend, and wh= ich your framing is the reason to mention: it separates two answers that a = single exit code would have merged. A proof that fails to verify exits 14. = A proof that could not be checked at all, where the block could not be fetc= hed, exits 15, and 15 is evaluated first, so "I could not check" never gets= swallowed by "it failed". Returning 0 there would have been the same error= in the other direction: the caller has to know the anchor was not verified= , not merely that it was not disproved. That is the weakest-rung rule appli= ed to our own tool, and it was written before anyone asked us for it, which= is the only reason I can say it now without it sounding convenient.
<= div>
Emek


On Fri, Aug 21, 2026 at 2:= 50 AM Walter Hawkins <wdhawkins46@gmail.com>= wrote:
Henri, Joel, Emek, Pablo, Nena= d, Todd,

Two corrections of my own before the part I owe this thread= , since that appears
to be the going rate here and it's a good rate.
=
**One.** I used the words "omission-proof" in my own notes and it was a= rung
short. Our spend log is chained and gap-free under a signed grant,= and the head
that seals it is counter-signed by a named accountant carr= ying a root and a
running total. That much I had right =E2=80=94 it's ru= ng 2. What I had wrong was the
floor. A verifier arriving for the first = time, holding no prior state and doing
no anchor lookup, accepts an old = validly-signed head together with the prefix
that matches it. Monotonic = sequence, perfect arithmetic, short set. Henri's
correction this morning= is the same shape as mine, and I'd made mine a day
earlier without noti= cing what it cost.

Fixed the way Emek's rule says it should be: the = freshness floor is now a
required argument, and passing nothing is an ex= plicit downgrade whose verdict
is labelled tamper-evidence rather than c= ompleteness. The weakest-rung rule
applied to an argument I had made opt= ional.

**Two, and this is the one I think is worth the thread's time= , because it's a
hole in rung 3 itself.**

We put our heads on-cha= in: a zero-value transaction whose calldata carries the
head digest, the= grant it covers, the sequence, and the key that signed it. A
first-cont= act verifier scans for those and takes the highest sequence as its
floor= . That is the external anchor the ladder asks for, and two days ago I'd
= have told you it put us at rung 3.

Anchoring is permissionless. That= property is why it resists censorship and it
is also the attack. Anyone= can write that calldata. The key field is plaintext,
and the accountant= 's key is public because it's named in the grant. So a
stranger writes a= n anchor for my grant at sequence 999999999, my scanner reads
it, and ev= ery honest head I produce afterwards is refused as a rollback. The
floor= is poisonable by anyone willing to pay for one transaction, and the
fai= lure mode isn't a missed omission =E2=80=94 it's an honest record permanent= ly
refused. We had traded a false negative for a false positive against = ourselves,
which is the worse of the two trades.

The fix is that = an anchored sequence cannot be read as a fact. It is a pointer.
A verifi= er deriving a floor has to fetch the anchored bytes, recompute the
diges= t over them, check the signature, and check that the head it just verified<= br>names this grant and this sequence =E2=80=94 and only then let it move t= he floor. An
anchor whose content can't be retrieved simply isn't floor-= eligible, which can
only lower the floor toward the tamper-evidence down= grade, never raise it.

Stated honestly about where we are with it: t= hat rule is written into our spec
text and our scanner does not yet do i= t. What the scanner does today is the
cheap half =E2=80=94 it ignores an= chors that don't name the grant's accountant, which
closes the stranger-= with-no-key case and leaves the forged-key case open,
because that field= is unauthenticated. So take the paragraph above as a claim
about what r= ung 3 requires, not a claim about what I've shipped. The
re-derivation i= s the next thing I write, and I'll come back with what it caught.

So= for the statement I'd put it this way: an external anchor is not
automa= tically rung 3. An anchor is a claim by whoever paid for it. Rung 3 is
a= n anchor plus the verification that recovers what it points at, and a profi= le
that says "anchored" without saying "and re-derived" has described ru= ng 2 with
extra steps. Nenad, I think this bears directly on precedence = =E2=80=94 ordering a
revocation strictly against a settlement only means= something if both anchored
objects are re-derived first; otherwise you'= ve ordered two assertions.

**What I owe: the rail enumeration.**
=
Every payment under a grant carries a binding in the one payer-chosen s= lot the
rail's own signature covers =E2=80=94 the EIP-3009 nonce, the Pe= rmit2 nonce, the XRPL
InvoiceID. The value is a domain-separated digest = over the grant digest and the
payment identifier, so it's derivable by a= nyone holding those two and
recomputable from the settled transaction by= anyone holding that.

The receiver's use is the part this thread wan= ts. A payee holding a settled
transaction recovers which grant and which= payment it commits to from the
artefact itself, without asking the exec= utor which authorisation it would like
to be judged under. And the enume= ration runs off the rail rather than off a
list: the payee walks settled= transactions to their own address, not a set the
executor hands them. A= leg the executor never wrote down is still on the rail
if the money mov= ed, and the party holding it is the party who cannot be made to
un-know = it arrived.

Testnet EVM rail, as promised: Coston2. A head anchored = as a real transaction at
block 34259963, the calldata read back off the = chain and matched against the
signed head, block timestamp doing the ord= ering.

With a caveat that belongs in this thread more than most. Tha= t anchor predates
the hardening I described above =E2=80=94 its commitme= nt has no accountant field and its
calldata has no key segment, so it ve= rifies against the code as of the commit
that produced it and not agains= t current HEAD. I keep it as evidence that the
wiring worked on the day,= and as a small lesson I'd pass on: we anchored a shape
we were still ed= iting, and permanence is the one property an anchor has whether
or not y= ou were finished. New heads use the hardened shape. I'll bring both,
lab= elled.

Two limits I'd rather state than have found.

The rail = has to enforce slot uniqueness for once-per-payment to come free.
EIP-30= 09 and Permit2 consume the nonce, so it does. XRPL does not enforce
Invo= iceID uniqueness =E2=80=94 two Payments carrying the same InvoiceID both se= ttle =E2=80=94
so anyone deriving a cumulative total from XRPL evidence = has to de-duplicate by
(grant, payment) and cannot lean on the rail for = it.

The second one I had wrong until a review pulled it apart yester= day, and it
generalises past payments. The binding identifies the grant;= it does not bound
the amount. The slot commits to the grant and the pay= ment identifier and
nothing else, so an agent holding the payer key can = settle a million against a
payment it reports as one. The cap only binds= if the verifier reads amount,
recipient and asset out of the settled tr= ansaction and compares them back to
the grant. I had a document claiming= one artefact proved both that money moved
and that it moved within auth= ority, and that sentence was doing work the
mechanism didn't do. Identif= ying which authorisation governed an act is not
the same as bounding the= act performed under it =E2=80=94 Nenad, that's your item 2
from the oth= er end, and I think it's a second thing the substrate should say
outrigh= t, because the failure is invisible and every incentive points at it.
The object model and its vectors are public as of today, as an open PR ra= ther
than anything settled: specs/extensions/authority.md and
authori= ty-vectors.json in x402-foundation/x402 #3220. If the statement cites
co= mponents normatively the way Henri suggests, that's the published home for<= br>the rail-binding piece, under the same one-authority rule Nenad named.
**Nenad's fourth vantage.**

I think it's right and I'd add a n= ote from our side. We have no revocation, and
that's deliberate rather t= han missing: our grants carry an expiry, and authority
decays without an= yone needing to deliver anything. A suppressed revocation is
invisible t= o a receiver, as you say =E2=80=94 but you can't suppress the passage oftime. It's a real trade, not a free win: a short expiry means re-issuance<= br>traffic and a live principal, and a long one means a wide window where y= our
attack is exactly as bad as you describe. Where re-issuance is affor= dable,
expiry is revocation you don't have to deliver, and I'd rather th= e substrate
name that as an option than have every profile carry a revoc= ation channel it
can't guarantee reaches anyone.

**Joel's fourth = item.**

Same answer as Henri, Pablo and Nenad: we don't have it. Not= hing in our records
pins the publisher-assigned version of any corpus a = decision was computed
against. Four for four is a better argument for li= fting it into the substrate
than any of us adding a field and then citin= g ourselves.

**Willing, and here's what I bring.**

The rail-e= numeration binding above, the Coston2 fixtures, and the rung-3
refinemen= t =E2=80=94 anchor as pointer, not fact. Henri, the completeness component = and
its rungs stay yours to state; Todd, the fraud side is what keeps th= is attached
to a real failure; and if Emek's ladder is going to carry th= e structure of the
document, it should carry his name in it.

Walt= er

On Thu, Aug 20, 2026 04:53 = PM, e.dogru@conarium.dev wrote:
Joel, Henri, Pablo, Walter, Todd, Ne= nad,

Joel, you withdrew two claims in public befor= e making your argument. I will put something of the same kind on the table = before making mine.

The corollary you name is the = half I have not done, and I can show you exactly where the line falls.

You wrote that the vocabulary has to reach the output,= and that both our implementations skip it. In mine the /2 result carries a= bounds object: for each bound the comparison relied on, its source is prot= ocol-defined, measured, operator-declared, or undeclared, and a result whos= e bounds are operator-declared states an outcome of that standing and no st= ronger. Measured against the published package, one fixture, a receipt thre= e seconds outside a two-hour window:

- no profile:= all three bounds undeclared, both items indeterminate
- a profil= e with no clocks member: multiplicity and exclusion operator-declared, skew= still undeclared
- clocks.skew declared wider than the offset: o= perator-declared, and the item stays indeterminate. A declaration does not = manufacture a match.
- clocks.skew declared narrower than the off= set: the same item becomes observed-without-receipt

So the vocabulary reaches that object. It does not reach the exit codes, = which predate it and are still not a mapping of it. Your sentence covers pr= ecisely the half I have not done, and I would rather that stayed in the rec= ord than get answered with a plan.

The three clock= s fields you asked for are in -05 with their encoding: clocks.observation, = clocks.receipt, clocks.skew, a duration grammar, a rule that an unknown key= in clocks is rejected by name, and a rule that the same bound declared twi= ce must parse to the same milliseconds or the run fails rather than picking= one. Written to be borrowed, not restated.

On pla= cement. The distinction is in -05 as a security consideration (sec-complete= ness), written against my own implementation rather than about two of them:= a truncated receipt set verifies, detecting the removal needs a quantity f= rom outside it, and whether that quantity reached the verifier independentl= y of the Issuer is not visible in a digest. I support lifting it to the sub= strate, with one caveat about how it is worded there. The property that mat= ters is not "in-record beats argument". It is that a Consumer cannot tell t= he two apart from the artefact, so the result has to say which one it relie= d on. Stated as a ranking it invites an implementation to claim the stronge= r form without carrying it; stated as a disclosure obligation it does not.<= /div>

On the weakest-rung rule. Four documents arriving = at it separately is a better argument for the substrate than any one of us = restating it, and your verdict-side version is the one I would take as the = general form, because it survives translation to outputs that are not bound= s at all. One caution from the side that has already shipped it: the rule i= s cheap to write and expensive to keep. indeterminate is only load-bearing = while nobody is allowed to average it, and the pressure to fold it into a c= overage percentage arrives from outside engineering, after the vocabulary i= s public and looks like a scoring system.

One more= thing worth putting in the record. Your sentence from two days ago, that a= gaps section going stale understating an implementation fails the same way= as one that overstates, turned out to apply to mine four times over. Each = statement was accurate when written and false within days, always in the di= rection of claiming less than the code did, and nothing in my test suite co= mpares that section against the code. So the corollary reaches further than= either of us put it: the problem is not that our implementations skip the = vocabulary. It is that neither of us has a check that would notice if they = did. That is the gap I would most like the substrate to make expensive to l= eave open, and it is the next thing I write on my own side. I will come bac= k with the check and what it caught, rather than with a plan.
Emek Can Dogru
Conarium


On F= ri, Aug 21, 2026 at 12:06 AM Joel Hillier <jhillier=3D40certisyn.com@dmarc.ietf.org> wrote:

Hi Henri= , Pablo, Walter, Todd,

Emek, I'm adding you to this because the rung ladder is yours = and it's been travelling without your name on it. Henri's message this morn= ing credits you with cloning at befdced and running the three = cases, which is true, but you're also the one who wrote the ladder and the = rule that goes with it. That rule is the most useful thing in this thread, = and the first thing I did with it was turn it on my own document.It cost me= two claims I made to you all yesterday. Both are below, before the rest.

Correcti= on one. I told you ARP's sweep chain makes a withdrawn Statement detectable= . That's true for the middle and false for the tail.

Each Evaluation Sweep Statem= ent carries the previous Statement's notarisation, so I had the chain doing= a job it can't do. Your 0.2.4 shipped under "a hash chain is blind to a sh= orter tail" and it applies to my series exactly as it applies to yours: a t= runcatedtail of Sweep Statements verifies precisely as it did before.

<= p style=3D"direction:ltr;margin-top:1em;margin-bottom:1em"> What actually p= uts ARP at rung 3 is a different mechanism, which I'd been crediting to the= chain. Each Statement is due inside a bounded interval measured from its t= rigger, and where the trigger is a public event with a public timestamp, a = sanctions list publishinga delta starts a clock the operator doesn't own. A= n operator with no Statement inside the interval hasn't evaluated in time, = and anyone can check that holding none of the set. The chain covers the mid= dle. The deadline covers the tail. Two mechanisms, and I'dhad them credited= as one.

<= b>Correction two, and this one is worse, because it's the sentence where I = congratulated myself on not rounding up.

I said the falsifiability argument holds= for three of ARP's four triggers, "stated rather than rounded up." Only on= e of those three rested on anything outside the reconciliation server. The = other two rested on a transition list published by the server, underthe ser= ver's own key, in a document with no publication time, no notarisation and = no chain. A transition simply left out of that array started no clock, and = no party could date the document well enough to show that it had been. On t= hat footing the count wasone in four, and the sentence claiming otherwise w= as the one place the document rounded up.

It's three in four now because I fixed the = mechanism rather than the sentence: the document carries a publication time= stamp, is notarised on the ledger-head interval, and has to be republished = on that interval whether or not anything in it changed. That lastpart is th= e one that matters, and it's your placement argument doing the work. Withou= t it, an operator that removed a witness entry and an operator that changed= nothing publish the same thing, and the notarised series has no entry to b= e missing.

= The claim is now conditional and the document says so: a deployment whose = policy parameters aren't anchored that way has one falsifiable trigger, not= three. Which is your rule about naming the ground, applied to a count I'd = already published.

One more, since it's the mechanism I described to Walter yester= day. I said ARP's witness quorum counts entries under common control on= ce, because two instances of one observer aren't two observers. The distinc= tness test was written over the operating-partyidentifier alone and said no= thing about the keys. Two entries declaring the same key under two differen= t party identifiers satisfied a quorum of two with a single signature. Both= entries verify, the identifiers are distinct, and a relying party doing ex= actlywhat the document said counted one signer twice. Now fixed by requirin= g the verification method references to be pairwise distinct as well.

<= p style=3D"direction:ltr;margin-top:1em;margin-bottom:1em"> Worth separatin= g that from the limit I did state correctly. Whether two named parties are = genuinely independent can't be tested by a verifier and the document conced= es it. Whether two entries name one key can always be tested, and wasn't.

Now the = thing I owe this thread.

Henri and Pablo have both said they'd need to add the fo= urth item before they could point at one, and Henri's suggested the substra= te cite components normatively rather than restate them. Together that mean= s the fourth item gets lifted out of ARP. So let mehand it over along with = what was wrong with it, rather than after it's in shared text.

A Partial Attestation = carries a Source-Data Version Identifier Set: one identifier per source con= sulted in evaluating the predicate. Each is a tuple of the list name as dec= lared in the bilateral agreement, and the state identifier the list publish= er assignsto that state, not a value the answering party made up. It rides = in the protected header so it's covered by the register's signature, and it= 's carried into the output so it's covered by the sealing signature.

The reason it's = the publisher's identifier and not the register's is the part worth carryin= g into any shared text, because it isn't obvious and it's the whole point. = A register-chosen opaque string would be an arbitrary-bandwidth channel fro= m register to relyingparty, travelling under signature into a sealed and le= dgered artefact, and the accompanying rule that differing identifiers mustn= 't be read as disagreement would normalise it. Taking the identifier from t= he publisher's own state sequence is what makes it evidenceinstead of a sid= e channel.

= Three things were wrong with the encoding, all found yesterday, all now re= paired:

1.= The Set had no ordering rule. Five other collections in ARP carry an expli= cit bytewise sort. This one was called a Set in its own section heading, wa= s carried into two signatures, and was never sorted, so a register consulti= ng three lists had six conformingencodings of one attestation. Now sorted.<= /p>

2. The sta= te identifier was disjunctive with no discriminator. "A published version t= oken, or a digest of the published corpus where the publisher assigns none.= " Text in one branch, digest bytes in the other, same position, no algorith= m named, and no statementof what the corpus is as a byte sequence. It now c= arries an explicit form discriminator, and the digest branch is taken over = the octets the publisher serves, before any decompression. That second part= is the one I'd have got wrong: a list published as a compressedarchive has= at least two byte sequences with an equal claim to being the corpus, and t= wo registers choosing differently produce two identifiers for one state, wh= ich a retroactive sweep then reads as a version change that never happened.=

3. It was= carried twice with no equality rule. ARP has exactly the right sentence fo= r this, that a value carried twice with no equality rule is a value an impl= ementation may read either way, and applied it to the two other duplicated = headers and not to thisone.

So the shape and the reason are worth lifting. The encodi= ng is worth lifting as of this morning and wasn't yesterday.

On placement, Emek,= your distinction deserves to be a named property of the substrate rather t= han a remark about two implementations.

You put it as: Henri's seal is a record i= nside the stream, signed and carried with the evidence, readable by whoever= holds the set; Conarium's pin is an argument to the verifier, so a third p= arty handed only the receipt set can't tell it's short unless someonestates= what it should have been, and the obvious someone is the issuer, the party= the audit is about.

That's sharper than the rung number alone, because two mechanism= s can sit on the same rung and differ entirely in who has to be asked. I'd = state it as three placements:

Inside the evidence. Travels with the set, needs nobody= . Henri's seal.

Supplied by the audited party. The verifier has to be told the expect= ed count or terminal hash, and the party best placed to tell it is the one = under audit. Conarium's pin, and you said so yourself rather than letting t= he symmetry flatter you.

Supplied by a party with no stake. ARP's deadline is this on= e: the clock is started by a list publisher who's never heard of the reconc= iliation server.

The third is strongest and least available, because it only exists w= here the obligation happens to be triggered by something public. It isn't a= design choice you can make freely. Where it exists it should be used, and = where it doesn't the statement should saywhich of the other two you're on.<= /p>

The sweep = found a fourth case that the three-way split predicts and I hadn't looked f= or: a mechanism sitting at the first placement whose evidence is only obtai= nable from the second. ARP's head consistency statements are signed by inde= pendent witnesses, whichis the whole point of them, and the document specif= ied the artefact, the quorum arithmetic and the freshness window and specif= ied no channel by which a relying party obtains one. The obvious implementa= tion is that the responding service hands them over withits response. Every= check passes. The witness signature stops the service forging a statement = and does nothing to stop it choosing which ones to pass on, so under exactl= y the fork the mechanism exists to detect, each branch's reader gets the wi= tnesses thatbranch was fed. Now fixed by requiring witnesses to publish on = their own origins and forbidding acceptance of one obtained from the respon= ding service.

Worth adding to the substrate as a rule in its own right: state wher= e the evidence is obtained, not only where it is produced. An artefact = produced at the third placement and delivered by the second is at the secon= d.

Your= weakest-rung rule already exists in ARP under another name, which I think = argues it's the right general rule rather than a local convention.

=

You wrote that= a result which doesn't say which rung it stands on has to be read at the w= eakest one, and that it's Walter's completeness ladder one level up.

ARP arrived at t= he same rule from the verdict side and calls it verdict re-typing. An answe= r over a register whose attestation can't be verified doesn't produce a wea= ker match, it produces indeterminate. Where a re-notification = can't say whether a change came from policy or from the underlying corpus, = it has to carry attribution-indeterminate and name which cause= s were examined and why neither could be excluded, because a bare qualifier= is a discretionary escape signed by the party that benefits from it. And c= onformance run records carry a does_not_establish field so the= things a run didn't prove are enumerated rather than inferred from silence= .

Four ins= tances, four documents, arrived at separately: bounds in yours, populations= in Walter's, verdicts and conformance claims in mine. Worth stating once i= n the substrate, roughly as: every result names the ground it stands on,= and a result that names none is read at the weakest ground available to it= .

The = corollary is the one implementations skip, including both of ours. The voca= bulary has to reach the output. You say your exit codes predate the vocabul= ary and still aren't a mapping of it. I found two of the same shape this we= ek: a verifier told to refusea proof with no defined way to say which of fo= ur refusals it made, and one reason code carrying five distinct causes beca= use four other sections pointed at it for conditions its own definition nev= er named. Both now split. Defining the distinction and givingthe implementa= tion no way to express it is a document agreeing with itself.

On your open questi= on about the boundary declaration.

You framed it well: a boundary inside the reco= rd has nothing to drift from and is the stronger guarantee, but it's assert= ed by one party at issue time; a profile is the weaker binding and the only= one that can be agreed between parties before a run and pointedat afterwar= ds by both.

ARP's answer is to make the profile a signed bilateral instrument with a = hash. The agreement is settled before any run, both parties compute an agre= ement hash over its declared items independently and have to get the same v= alue, and every reconciliation commitsto that hash. Drift suspends reconcil= iation rather than producing a weaker answer. So it keeps the agreed-not-as= serted property of a profile and gains the nothing-to-drift-from property o= f an in-record boundary.

The cost is that it only works bilaterally. It doesn't reach= a population of parties who have never negotiated, which is most of Walter= 's setting. Worth having in the statement as one of the answers rather than= the answer.

Pablo, your precedence point generalises, and it flips direction depe= nding on what's being anchored. Yours is anchoring_precedence: the anchor has to be strictly earlier than the outcome it covers, beca= use an anchor arriving after the fact proves nothing about what was true wh= en the outcome was recorded. ARP's is the mirror image. The Statement has t= ofall later than the trigger and inside a bounded interval, because what's = being proved is that a duty was discharged on time, not that a fact was tru= e beforehand.

Same underlying requirement, that an anchor with no ordering constraint= against the thing it covers is decorative. Two opposite orderings, because= one anchors the proof and the other anchors the duty. I'd say it that way = in the shared text: every external anchordeclares its required ordering rel= ative to what it covers, and which of the two it is.

Agreed on normative citation ove= r restatement, with one addition. Where a component is cited rather than re= stated, the citing statement should also name the rung the component reache= s. Henri's correction this morning is the case in point, and so are both of= mine above. None of the three components changed. The claim made about each= was one rung short. A substrate that cites a component and repeats an over= -broad claim about it has moved the error rather than removed it.

Joel