Dual Attestation Protocol

3 Cryptographic dependencies

The construction is the standard sealed-bid primitive: publish a hash of your figure plus a blinding nonce, then reveal, and the hash proves the revealed value is the one you were bound to (Chainlink on commit-and-reveal). The known failure mode of naive commit–reveal is the last-revealer advantage — whoever reveals last can compute the outcome and choose to abort. §6.4 addresses that directly, and it is the reason non-reveal is penalised rather than merely logged.

4.4 Grade precedes price

A price round cannot open until a grade is published. This is not a courtesy of sequencing — it is enforced at the station, and it is the reason the whole two-party structure holds.

The reason is the same one that makes policy_hash get published before any commitment. If price could be committed while the grade was still adjustable, a party could shade its grade to justify a number it had already picked. Fixing the grade first makes the number argue against a settled fact rather than against a movable one.

1. P1

   Grade round

   Both parties commit a sealed 66-field observation sheet, then reveal. The station recomputes each commitment and refuses a reveal that does not reproduce it. The published grade is derived from the conservative merge of the two sheets — the worse reading of every field — so neither party can improve the grade by being generous to itself.

2. P2

   Price round

   Only now does the price window open, and only against the published grade_token. A price commitment carrying any other grade is refused outright rather than settled at a discount.

4.4.1 The three terminal states

Two of the grade-round outcomes end the round and no price window opens on either.

• Void — the two sheets disagree on a Class M field, a machine reading. One instrument, two answers, means the reading procedure failed. This voids even when both sheets happen to derive the same grade, because the defect is in the measurement, not the judgement. The unit is re-read.
• Material divergence — the sheets derive different grades. The station reports the minimal set of fields responsible and stops. Nothing is averaged; there is no midpoint between two grades.
• Immaterial divergence — the sheets differ but derive the same grade. This one proceeds. The conservative merge is authoritative.

Each of these guards was removed from the implementation one at a time to confirm that a real test fails in its absence. The results of that exercise are recorded in the test file rather than asserted here.

The grade binding lives at the station, not inside Policy. Policy is hashed into policy_hash, and the published test vectors pin that hash — adding fields to Policy would have silently invalidated every one of them. The station carries the binding under its own domain tag SCST1|policy|, and the test suite asserts the original policy_hash is byte-for-byte unchanged.

6 Settlement

6.1 Policy

{
  "tolerance_bp":                   1000,   // 10.00% auto-settle band
  "floor_cents":                    2500,   // low-value absolute gap
  "absolute_floor_bp_exempt_cents": 5000,
  "bonus_bp":                        250,   // verified-condition bonus
  "bonus_inner_bp":                  300,   // bonus band
  "bonus_cap_cents":                7500,
  "late_reveal_penalty": "counterparty_amount",
  "index_name":          "SC-COMP-A"
}

policy_hash = f5bbc16aaba884177e6581aa528aa6b84c489aa842e592a9998909154ed5c0c1

6.2 Spread

spread_bp = round_half_up( (max − min) × 10000 / min )

Measured against the lower of the two amounts. This is the conservative choice: it produces a larger number than measuring against the midpoint or the higher amount, so the band is harder to satisfy. Any round that auto-settles under this definition would also auto-settle under the looser ones. In plain language, the gap is expressed as a percentage of the smaller number.

6.3 The ladder

amount = max( min_revealed, min( max_revealed, index ) )

6.4 Non-reveal

6.5 What the protocol deliberately does not do

• It does not decide whether a unit is worth anything. That is the grading rubric, which runs first and must publish a grade_token before this protocol's price window opens.
• It does not price subscriptions. Published Sentinel prices remain a floor and are not undercut by any credit produced here.
• It does not arbitrate disputes about physical condition. It records both positions and settles the money; a condition dispute is a separate process.

8 The sealed record

{
  "protocol":    "sovereign-circuit/dual-attestation/1",
  "round_id":    "R-2026-08-0417",
  "asset_id":    "SC-LT-000391",
  "policy_hash": "f5bbc16a…d5c0c1",
  "commitments": { "holder": "…", "inspector": "…" },
  "reveals": {
    "holder":    { "amount_cents": 42000, "grade": "B2", "nonce": "…" },
    "inspector": { "amount_cents": 39000, "grade": "B3", "nonce": "…" }
  },
  "settlement": {
    "outcome":      "auto_settled",
    "amount_cents": 40500,
    "spread_bp":    769,
    "bonus_cents":  0,
    "total_cents":  40500,
    "reason": "spread 769 bp within 1000 bp band; midpoint settlement"
  },
  "timestamps": { "commit_opened": "…", "reveal_closed": "…", "settled": "…" }
}

The record retains both revealed amounts, not just the settled figure. The holder's claim stays visible as an assertion and the inspector's finding stays visible as an observation. Collapsing them into one price would destroy the evidentiary value of the record. The reason string is human-readable on purpose: a participant reading their own record should see the arithmetic without a decoder.

entry_hash = SHA256( "SCDA1|record|" || JCS({ prev, seq, body }) )

Genesis prev is 64 zeros. This reuses the audit-chain pattern already used elsewhere in the platform. A Merkle log per RFC 6962 is the natural upgrade once efficient inclusion proofs are needed — a holder proving their single round is in the log without downloading it. A linear chain is sufficient at pilot volume and far easier to audit by reading.

11 Open items

These are genuinely unresolved and are called out rather than papered over.

1. The grading rubric written, not calibrated

   This was the biggest dependency and it is now closed structurally. SCGR1/1.0 defines 66 recorded fields, three derived axes and a grade_token, asserted by 247 checks. What remains open is calibration, not construction: every threshold in it is a defensible starting guess rather than a number measured from fleet data. Two consequences here — rubric_hash changes when thresholds are recalibrated, so rounds are only comparable within a rubric version; and the grade-before-price ordering in §4.4 is now enforced by station.py (SCST1/1.0), covered by 99 checks, with every guard removed one at a time to confirm a real test fails without it. Calibration is now instrumented rather than merely admitted — a twenty-unit blind double-grading worksheet and an analyser report divergence rates, pivotal fields and observed distributions. Batch 1's honest output is a better measurement method, not recalibrated thresholds.

2. The index does not exist yet

   SC-COMP-A needs a defined construction, publication cadence, source list and archive, so a historical round can be re-verified against the value that was current at the time. An index that can be silently restated is not a tie-breaker.

3. Tolerance band calibration

   1000 bp is a starting guess. It should be set from real paired data — bench grade versus holder self-grade across a first batch — not chosen because it is a round number.

4. Bonus cap

   $75 is a placeholder. The cap must sit below the marginal cost of a full inspection, or the bonus stops paying for itself.

5. Deadlines

   T_c and T_r need defaults. Too short disadvantages a holder without technical staff; too long stalls the loop.

6. Identity and signatures

   Ed25519 signing is optional today. It becomes necessary the moment a participant might deny having committed. Key distribution is unspecified.