Observed
PR #27 adds four identities to the observation settlement report. Only one of them is bound to anything:
| Field |
Witnessed by |
Bound to |
externalEvidenceDigest |
stale-basis two-route case |
bytes actually observed |
basisDigest |
shape only |
the value the request declared |
attemptId |
shape only |
nothing |
schemaAdmissionEvidenceDigest |
shape only |
nothing |
assert_settlement_evidence requires all four to match ^[0-9a-f]{64}$ and nothing more. A producer emitting one arbitrary constant for attemptId and schemaAdmissionEvidenceDigest across every settlement passes the entire suite.
Why it matters
This is the I0 level of evidence — the field exists and is well-formed — presented alongside a field that reaches I2. Uniform-looking assertions over non-uniform evidence strength is exactly what made #26 hard to see in the first place.
schemaAdmissionEvidenceDigest is the more interesting of the two. It is derived by schema_admission_evidence(profile.settlement_schema_digest, &result) over the settlement result bytes, so it should vary with the result and be constant for identical results under the same schema. That is a checkable claim and nothing checks it.
attemptId has no obvious claim beyond uniqueness per attempt. It may be correct to state that it carries no semantic claim rather than to witness it.
Not done in #27 deliberately
#27's claim is precise and adversarially verified. Growing it to cover fields with no stated claim would have widened the PR without strengthening it. Filing instead.
Acceptance
schemaAdmissionEvidenceDigest is pinned to vary with the settlement result and to be stable across identical results under one schema; or
- the documentation states which projected identities carry no witness and why, so that shape-only assertions are not mistaken for bindings.
Observed
PR #27 adds four identities to the observation settlement report. Only one of them is bound to anything:
externalEvidenceDigeststale-basistwo-route casebasisDigestattemptIdschemaAdmissionEvidenceDigestassert_settlement_evidencerequires all four to match^[0-9a-f]{64}$and nothing more. A producer emitting one arbitrary constant forattemptIdandschemaAdmissionEvidenceDigestacross every settlement passes the entire suite.Why it matters
This is the I0 level of evidence — the field exists and is well-formed — presented alongside a field that reaches I2. Uniform-looking assertions over non-uniform evidence strength is exactly what made #26 hard to see in the first place.
schemaAdmissionEvidenceDigestis the more interesting of the two. It is derived byschema_admission_evidence(profile.settlement_schema_digest, &result)over the settlement result bytes, so it should vary with the result and be constant for identical results under the same schema. That is a checkable claim and nothing checks it.attemptIdhas no obvious claim beyond uniqueness per attempt. It may be correct to state that it carries no semantic claim rather than to witness it.Not done in #27 deliberately
#27's claim is precise and adversarially verified. Growing it to cover fields with no stated claim would have widened the PR without strengthening it. Filing instead.
Acceptance
schemaAdmissionEvidenceDigestis pinned to vary with the settlement result and to be stable across identical results under one schema; or