Technical specification
Execution Evidence Protocol
ChoiceProof v2.4.0-rc.1 defines a versioned path from enterprise-held private evidence through signed causal records and ordered checkpoints to optional cryptographic transparency, independently authorized witnesses, policy-selected neutral tree-head anchors, and deterministic layered verification.
Core verification is offline-first. Network collection and readback are explicit. The enterprise retains action authority, credentials, source access, and complete private data.
Reference architecture
Optional layers add specific evidence without upgrading another assurance dimension. Hosted artifact storage remains a delivery and durability surface; it is not a cryptographic transparency log.
| Layer | Protocol guarantee | Boundary |
|---|---|---|
| Enterprise-local evidence | Retain complete receipts, private values, credentials, and source access inside the enterprise boundary. | No public payload by default. |
| Enterprise-local semantic dispatch guardrail | Internally derive semantic key K and fingerprint F, commit pre-dispatch evidence, then atomically consume one single-use permit before calling a preconfigured enterprise adapter. | Under certified deployment assumptions, one binding revision causes at most one guarded adapter callback; public and hosted ChoiceProof never dispatch or custody adapter credentials. |
| Signed causal lifecycle | Bind attempts, outcomes, reversals, and strict reconciliation to versioned records and declared signers. | A signature does not establish factual truth or business authorization. |
| Ordered checkpoint | Bind stream, epoch, sequence, predecessor, range, and evidence inclusion. | Continuity is scoped to the supplied stream and artifacts. |
| Cryptographic transparency | Bind checkpoints to signed RFC 9162 tree heads with inclusion and consistency proofs. | Optional; it does not prove capture completeness. |
| Witness / monitor | Retain and compare one exact log, epoch, head, size, root, and authorization context. | Operational independence remains a verifier-selected trust input. |
| Neutral tree-head anchor | Periodically timestamp a policy-selected signed transparency tree head. | Optional and low-frequency; per-receipt anchoring is not the reference default. |
| Layered offline verifier | Recompute supplied artifacts and cross-layer bindings in thirteen independent dimensions. | No aggregate green state and no hidden network request. |
| Readback / reconciliation | Compare committed expected and observed results and derive the reconciliation result. | Source authority and factual truth remain external trust questions. |
Semantic replay boundary
The optional enterprise-local guardrail derives K from the enterprise scope and stable operation lineage, then derives F from that key, a versioned normalization profile, the action, normalized intent, and enterprise-selected relevant configuration. A caller does not supply trusted K or F values, adapter callbacks, credentials, permits, or approval booleans.
The durable lineage keeps lifetime uniqueness for (enterpriseScopeHash, K, F). If a historical fingerprint reappears—such as F1 → F2 → F1—the guardrail returns the historical operation without a new reservation, head advance, permit, or guarded callback. An unseen fingerprint can advance only from the exact resolved current head at revision n + 1 with verified supersession approval.
Pre-dispatch evidence is durably committed before the atomic permit transition. At or after permit consumption, recovery is authoritative-readback-only and never blindly redispatches. The at-most-one guarded adapter callback result depends on the certified deployment assumptions, including complete credential-path mediation, stable normalization of every material field, durable atomic compare-and-set, and fencing. Extending that callback bound to downstream external effects additionally requires a one-dispatch or downstream-idempotency adapter boundary. It does not cover an effect path that bypasses those assumptions.
Protocol artifacts
Verification dimensions
evidenceIntegrity- Schema, canonical hash, and artifact consistency.
signerAuthenticity- Declared signing-key control under the selected domain.
lifecycleCausalLinkage- Valid lifecycle transitions, parents, roots, and source-event identities.
sequenceContinuity- Scoped stream, epoch, sequence, and predecessor continuity.
checkpointInclusion- Evidence inclusion in the supplied ordered checkpoint.
transparencyInclusion- Checkpoint entry inclusion in the signed tree state.
transparencyConsistency- Append-only extension between supplied RFC 9162 tree states.
witnessMonitor- Authorized exact-context witness and monitor observations.
equivocationDetection- Conflicting signed tree views when supplied or observed.
blockchainAnchor- Exact tree-head hash material at the selected chain and deployment.
externalFinality- Separate provider and finality-policy evaluation.
readback- Explicit enterprise-selected source observation.
reconciliation- Deterministic CONFIRMED, CONTRADICTED, or UNRESOLVED comparison.
Verification materials
The source candidate implements deterministic reference modules, schemas, vectors, contracts, attack tests, and an executable closure through strict reconciliation.
A production transparency service, independent witness federation, scheduled neutral anchoring, mainnet operation, and real enterprise readback are external deployment conditions, not claims made by this website.
Verification scope
The layered verifier recomputes the supplied closure without a ChoiceProof hosted service, RPC endpoint, transparency service, or blockchain. Optional network readback is a separate explicit step. Factual truth remains NOT_DETERMINED_BY_PROTOCOL; authorization, completeness, legal identity, and source independence require external evidence and verifier-supplied policy.