[SCITT] Re: Closing omission from the receiver's vantage — what a record must carry

[Joel Hillier <[e-mail]>]

Hi Henri, Pablo, Walter, Todd,

Emek, I'm adding you to this because the rung ladder is yours and it's been travelling without your name on it. Henri's message this morning credits you with cloning at befdced and running the three cases, which is true, but you're also the one who wrote the ladder and the rule that goes with it. That rule is the most useful thing in this thread, and the first thing I did with it was turn it on my own document. It cost me two claims I made to you all yesterday. Both are below, before the rest.

Correction one. I told you ARP's sweep chain makes a withdrawn Statement detectable. That's true for the middle and false for the tail.

Each Evaluation Sweep Statement carries the previous Statement's notarisation, so I had the chain doing a job it can't do. Your 0.2.4 shipped under "a hash chain is blind to a shorter tail" and it applies to my series exactly as it applies to yours: a truncated tail of Sweep Statements verifies precisely as it did before.

What actually puts ARP at rung 3 is a different mechanism, which I'd been crediting to the chain. Each Statement is due inside a bounded interval measured from its trigger, and where the trigger is a public event with a public timestamp, a sanctions list publishing a delta starts a clock the operator doesn't own. An operator with no Statement inside the interval hasn't evaluated in time, and anyone can check that holding none of the set. The chain covers the middle. The deadline covers the tail. Two mechanisms, and I'd had them credited as one.

Correction two, and this one is worse, because it's the sentence where I congratulated myself on not rounding up.

I said the falsifiability argument holds for three of ARP's four triggers, "stated rather than rounded up." Only one of those three rested on anything outside the reconciliation server. The other two rested on a transition list published by the server, under the server's own key, in a document with no publication time, no notarisation and no chain. A transition simply left out of that array started no clock, and no party could date the document well enough to show that it had been. On that footing the count was one in four, and the sentence claiming otherwise was the one place the document rounded up.

It's three in four now because I fixed the mechanism rather than the sentence: the document carries a publication timestamp, is notarised on the ledger-head interval, and has to be republished on that interval whether or not anything in it changed. That last part is the one that matters, and it's your placement argument doing the work. Without it, an operator that removed a witness entry and an operator that changed nothing publish the same thing, and the notarised series has no entry to be missing.

The claim is now conditional and the document says so: a deployment whose policy parameters aren't anchored that way has one falsifiable trigger, not three. Which is your rule about naming the ground, applied to a count I'd already published.

One more, since it's the mechanism I described to Walter yesterday. I said ARP's witness quorum counts entries under common control once, because two instances of one observer aren't two observers. The distinctness test was written over the operating-party identifier alone and said nothing about the keys. Two entries declaring the same key under two different party identifiers satisfied a quorum of two with a single signature. Both entries verify, the identifiers are distinct, and a relying party doing exactly what the document said counted one signer twice. Now fixed by requiring the verification method references to be pairwise distinct as well.

Worth separating that from the limit I did state correctly. Whether two named parties are genuinely independent can't be tested by a verifier and the document concedes it. Whether two entries name one key can always be tested, and wasn't.

Now the thing I owe this thread.

Henri and Pablo have both said they'd need to add the fourth item before they could point at one, and Henri's suggested the substrate cite components normatively rather than restate them. Together that means the fourth item gets lifted out of ARP. So let me hand it over along with what was wrong with it, rather than after it's in shared text.

A Partial Attestation carries a Source-Data Version Identifier Set: one identifier per source consulted in evaluating the predicate. Each is a tuple of the list name as declared in the bilateral agreement, and the state identifier the list publisher assigns to that state, not a value the answering party made up. It rides in the protected header so it's covered by the register's signature, and it's carried into the output so it's covered by the sealing signature.

The reason it's the publisher's identifier and not the register's is the part worth carrying into any shared text, because it isn't obvious and it's the whole point. A register-chosen opaque string would be an arbitrary-bandwidth channel from register to relying party, travelling under signature into a sealed and ledgered artefact, and the accompanying rule that differing identifiers mustn't be read as disagreement would normalise it. Taking the identifier from the publisher's own state sequence is what makes it evidence instead of a side channel.

Three things were wrong with the encoding, all found yesterday, all now repaired:

1. The Set had no ordering rule. Five other collections in ARP carry an explicit bytewise sort. This one was called a Set in its own section heading, was carried into two signatures, and was never sorted, so a register consulting three lists had six conforming encodings of one attestation. Now sorted.

2. The state identifier was disjunctive with no discriminator. "A published version token, or a digest of the published corpus where the publisher assigns none." Text in one branch, digest bytes in the other, same position, no algorithm named, and no statement of what the corpus is as a byte sequence. It now carries an explicit form discriminator, and the digest branch is taken over the octets the publisher serves, before any decompression. That second part is the one I'd have got wrong: a list published as a compressed archive has at least two byte sequences with an equal claim to being the corpus, and two registers choosing differently produce two identifiers for one state, which a retroactive sweep then reads as a version change that never happened.

3. It was carried twice with no equality rule. ARP has exactly the right sentence for this, that a value carried twice with no equality rule is a value an implementation may read either way, and applied it to the two other duplicated headers and not to this one.

So the shape and the reason are worth lifting. The encoding is worth lifting as of this morning and wasn't yesterday.

On placement, Emek, your distinction deserves to be a named property of the substrate rather than a remark about two implementations.

You put it as: Henri's seal is a record inside the stream, signed and carried with the evidence, readable by whoever holds the set; Conarium's pin is an argument to the verifier, so a third party handed only the receipt set can't tell it's short unless someone states what it should have been, and the obvious someone is the issuer, the party the audit is about.

That's sharper than the rung number alone, because two mechanisms can sit on the same rung and differ entirely in who has to be asked. I'd state it as three placements:

Inside the evidence. Travels with the set, needs nobody. Henri's seal.

Supplied by the audited party. The verifier has to be told the expected count or terminal hash, and the party best placed to tell it is the one under audit. Conarium's pin, and you said so yourself rather than letting the symmetry flatter you.

Supplied by a party with no stake. ARP's deadline is this one: the clock is started by a list publisher who's never heard of the reconciliation server.

The third is strongest and least available, because it only exists where the obligation happens to be triggered by something public. It isn't a design choice you can make freely. Where it exists it should be used, and where it doesn't the statement should say which of the other two you're on.

The sweep found a fourth case that the three-way split predicts and I hadn't looked for: a mechanism sitting at the first placement whose evidence is only obtainable from the second. ARP's head consistency statements are signed by independent witnesses, which is the whole point of them, and the document specified the artefact, the quorum arithmetic and the freshness window and specified no channel by which a relying party obtains one. The obvious implementation is that the responding service hands them over with its response. Every check passes. The witness signature stops the service forging a statement and does nothing to stop it choosing which ones to pass on, so under exactly the fork the mechanism exists to detect, each branch's reader gets the witnesses that branch was fed. Now fixed by requiring witnesses to publish on their own origins and forbidding acceptance of one obtained from the responding service.

Worth adding to the substrate as a rule in its own right: state where the evidence is obtained, not only where it is produced. An artefact produced at the third placement and delivered by the second is at the second.

Your weakest-rung rule already exists in ARP under another name, which I think argues it's the right general rule rather than a local convention.

You wrote that a result which doesn't say which rung it stands on has to be read at the weakest one, and that it's Walter's completeness ladder one level up.

ARP arrived at the same rule from the verdict side and calls it verdict re-typing. An answer over a register whose attestation can't be verified doesn't produce a weaker match, it produces indeterminate. Where a re-notification can't say whether a change came from policy or from the underlying corpus, it has to carry attribution-indeterminate and name which causes were examined and why neither could be excluded, because a bare qualifier is a discretionary escape signed by the party that benefits from it. And conformance run records carry a does_not_establish field so the things a run didn't prove are enumerated rather than inferred from silence.

Four instances, four documents, arrived at separately: bounds in yours, populations in Walter's, verdicts and conformance claims in mine. Worth stating once in the substrate, roughly as: every result names the ground it stands on, and a result that names none is read at the weakest ground available to it.

The corollary is the one implementations skip, including both of ours. The vocabulary has to reach the output. You say your exit codes predate the vocabulary and still aren't a mapping of it. I found two of the same shape this week: a verifier told to refuse a proof with no defined way to say which of four refusals it made, and one reason code carrying five distinct causes because four other sections pointed at it for conditions its own definition never named. Both now split. Defining the distinction and giving the implementation no way to express it is a document agreeing with itself.

On your open question about the boundary declaration.

You framed it well: a boundary inside the record has nothing to drift from and is the stronger guarantee, but it's asserted by one party at issue time; a profile is the weaker binding and the only one that can be agreed between parties before a run and pointed at afterwards by both.

ARP's answer is to make the profile a signed bilateral instrument with a hash. The agreement is settled before any run, both parties compute an agreement hash over its declared items independently and have to get the same value, and every reconciliation commits to that hash. Drift suspends reconciliation rather than producing a weaker answer. So it keeps the agreed-not-asserted property of a profile and gains the nothing-to-drift-from property of an in-record boundary.

The cost is that it only works bilaterally. It doesn't reach a population of parties who have never negotiated, which is most of Walter's setting. Worth having in the statement as one of the answers rather than the answer.

Pablo, your precedence point generalises, and it flips direction depending on what's being anchored. Yours is anchoring_precedence: the anchor has to be strictly earlier than the outcome it covers, because an anchor arriving after the fact proves nothing about what was true when the outcome was recorded. ARP's is the mirror image. The Statement has to fall later than the trigger and inside a bounded interval, because what's being proved is that a duty was discharged on time, not that a fact was true beforehand.

Same underlying requirement, that an anchor with no ordering constraint against the thing it covers is decorative. Two opposite orderings, because one anchors the proof and the other anchors the duty. I'd say it that way in the shared text: every external anchor declares its required ordering relative to what it covers, and which of the two it is.

Agreed on normative citation over restatement, with one addition. Where a component is cited rather than restated, the citing statement should also name the rung the component reaches. Henri's correction this morning is the case in point, and so are both of mine above. None of the three components changed. The claim made about each was one rung short. A substrate that cites a component and repeats an over-broad claim about it has moved the error rather than removed it.

Joel