[Pre-ERC Discussion] A Common Interface for RWA Disclosure Records, Evidence, and History

This is an early design discussion, not a finished ERC. The ABI, profile format, extension boundaries, reference implementation, and conformance suite are not finalized. I am seeking feedback before committing to those choices.

Summary and request for feedback

I am proposing a backend-neutral read interface for real-world asset disclosures.

Existing proposals already address important parts of this problem, including signed claims, document anchors, specialized asset records, and minimal disclosure discovery. This proposal addresses the remaining need for a common way to determine:

  • what a disclosure concerns;
  • who provided it and who published it;
  • what period, event, methodology, and evidence it covers;
  • how it has changed or been corrected; and
  • whether a specified set of disclosure requirements can be evaluated from a pinned set of disclosure records.

The proposed ERC standardizes reads over attributable, append-only disclosure histories without requiring every source to adopt the same publication workflow. This interface does not judge whether a disclosure is accurate, complete, legally valid, compliant, or suitable for investment.

Disclosure: I am the co-founder and CTO of Remora, which builds infrastructure for tokenization and management of private-market assets, initially focused on real estate. Remora plans to implement and test the smallest useful version of this proposal. Community feedback will inform its exact boundary before implementation choices are fixed.

Before freezing an ABI, I would particularly value feedback on what belongs in the minimum useful interface, where existing work already provides the needed semantics, and whether profiles and relationships should be part of the same ERC or separate extensions or companion specifications.

Practical motivation

In our work at Remora, we encountered a practical problem: prospective distributors and other disclosure consumers need asset information before they can decide whether deeper diligence or a commercial relationship is warranted. Today, they may need to request that information directly from the issuer or platform, learn a proprietary data model, and repeat much of the same preliminary work for each asset.

A common read interface allows those consumers to discover structured disclosures, check content against its recorded commitments, identify who provided and published it, inspect supporting evidence and history, and evaluate coverage against their own requirements before contacting the issuer or platform. It also reduces the need for issuers, auditors, and other service providers to recreate overlapping diligence packages for each potential consumer.

Putting ownership records on-chain makes ledger state easier to access, inspect, and integrate. We do not think those benefits should stop at the ownership ledger. Information about what an asset represents, which rights it carries, what supports its value, how it is performing, and what evidence supports those statements should also be easier for applications to discover and compare.

Today, that information may be machine-readable and still not be interoperable. Equivalent disclosures can use different contracts, schemas, identifiers, document structures, and publication workflows. A distributor, lender, exchange, protocol, wallet, auditor, or risk application may therefore need a bespoke integration for each issuer or platform.

The proposed standard does not make every asset comparable in an economic or investment sense. It makes the inputs used in those comparisons easier to find, attribute, interpret, and reuse. Each consumer continues to decide which providers, methodologies, evidence, and exceptions it accepts.

The smallest useful case

Consider a private loan represented by one disclosure subject. A consumer may need to find its governing terms, collateral information, and payment-status history. For each item, the consumer should be able to determine who provided the information, when it applies, whether it has been corrected, and what evidence supports it.

The conceptual read flow is:

Find the disclosure subject
-> find disclosure streams by topic
-> read the relevant observations and disclosure records
-> inspect disclosure-record history and supporting evidence
-> optionally evaluate those disclosure records against a named profile
-> apply the consumer's own trust, legal, credit, and investment policy

This simple case should not require a relationship graph or a large set of optional interfaces. Keeping it lightweight is a design goal that still needs to be demonstrated through implementation and gas measurement.

Proposed core model

On EVM chains, a disclosure endpoint is a contract operated by an accountable publisher. It exposes one or more subjects, such as an issuer, asset, agreement, investment interest, loan, property, or token representation.

For token-integrated deployments, an optional token-side locator can identify the disclosure endpoint and exact subject. Legacy tokens and non-token disclosures may instead rely on registries or indexers. Discovery alone proves neither rights nor completeness.

A subject identifier says what a disclosure concerns. It is not proof of ownership, identity, or authority.

Disclosures use the following model:

Subject
`-- Stream
    `-- Observation
        `-- Disclosure record(s)
  • A stream groups comparable reporting about one topic, provider, scope, and methodology, such as loan payment status reported by an administrator.
  • An observation identifies one period, event, or measurement within that stream, such as the payment due for June 2026.
  • A disclosure record is the immutable registered assertion for that observation. It contains or commits to the structured disclosure, its provider, effective period, methodology, evidence set, provider approval, and registration provenance. A correction creates another disclosure record for the same observation; it does not overwrite the earlier record.

“Disclosure record” in this proposal always refers to that immutable registered assertion. It does not mean the stream, observation, payload file, evidence object, profile, review, or evaluation result.

For example:

Property
`-- Occupancy stream, supplied by the property manager
    `-- 2026 Q2 observation
        |-- Original disclosure record: 94%
        `-- Correcting disclosure record: 92%

A second appraiser’s valuation under a different methodology belongs in a separate stream. Both remain discoverable without the standard deciding which one is correct.

Each disclosure record may reference multiple role-labeled evidence objects. Evidence commits to exact content and may have more than one retrieval location. Moving identical bytes to another location should not create new evidence; changing the bytes should.

The model also distinguishes the provider from the publisher. The provider is the party attributed as author of and consenting to the structured disclosure record. The publisher operates the endpoint and registers or relays the record. A platform can therefore publish a provider-approved record without presenting itself as the source of the underlying information.

Naming a provider or attaching its document is not sufficient provider consent. The provider’s proof must commit to the exact structured disclosure record and evidence set; otherwise, the attribution remains an assertion by the publisher.

A signature proves control of a signing method, not by itself the signer’s legal identity, organizational role, or authority. Those connections require separate identity and authority evidence, interpreted under consumer policy.

The exact function selectors, return structures, identifier rules, and event surface remain open. At minimum, a consumer should be able to discover subjects and the publisher, enumerate disclosure streams and immutable disclosure-record history, retrieve baseline evidence references, and inspect subject-scoped profile declarations.

Optional relationships for complex assets

Some investments contain several related subjects:

Investment interest -- ISSUED_BY ------------> Issuer
Token ---------------- REPRESENTS -----------> Investment interest
Investment interest -- ECONOMIC_EXPOSURE_TO -> Investment position
Investment position -- OBLIGATION_OF --------> Borrower
Investment position -- SECURED_BY -----------> Property

Relationships can make this structure traversable, but they should not make a simple disclosure expensive to implement. They establish attributable connections; they do not by themselves establish balances, seniority, waterfalls, legal rights, or completeness. Those matters remain disclosure records with supporting evidence.

This optional capability would allow a consumer to start from an investment interest, follow its disclosed position and collateral, and find relevant disclosure records at a specified checkpoint. Whether relationship semantics belong in the initial ERC is one of the questions this discussion is intended to test.

Profiles as reusable disclosure requirements

A profile is a versioned, content-addressed set of machine-readable disclosure requirements for a named asset type or evaluation process. It can specify required topics, schemas, methodologies, evidence roles, freshness, and traversal rules.

For example, a private-credit profile can require loan terms, payment status, collateral disclosure records, provider attribution, specified evidence, and freshness rules. An evaluator applies the profile to a pinned set of subjects and disclosure records and reports which requirements have qualifying inputs.

A profile declaration does not prove that the profile is satisfied. A successful evaluation does not prove that the disclosures are true or that the asset is acceptable. It reports whether the specified inputs were found and how they were resolved. Consumer policy makes the final trust, legal, credit, and investment decisions.

The minimum interface includes subject-scoped profile-declaration reads, but a subject is not required to declare or use a profile. Zero profile declarations is valid. This discussion will help determine whether the declaration reads and a normative Profile Format v1 ultimately belong in the same ERC, an optional interface, or a companion specification.

Scope and non-goals

The candidate minimum interface covers:

  • subject and publisher discovery;
  • attributable disclosure records and immutable correction history;
  • baseline evidence references;
  • subject-scoped profile-declaration reads, with zero declarations permitted; and
  • registration provenance and structural events.

Possible optional capabilities include relationships, token-to-disclosure bindings, richer evidence and review records, and provenance for disclosure records adapted from other systems.

Backend neutrality is a design objective that implementation and adapter tests must demonstrate. A conforming adapter exposes the normalized reads while preserving the source record, source lifecycle, mapping version, and any information the source cannot supply. Here, “source record” means the native record in the system being adapted, not a normalized disclosure record. Missing information remains explicitly unknown or unsupported; an adapter must not infer it.

The proposal does not:

  • establish that a disclosure is factually or legally true;
  • guarantee that all relevant facts or liabilities were disclosed;
  • approve, value, finance, or recommend an asset;
  • define an underwriting methodology or risk score;
  • enforce transfer restrictions or holder eligibility;
  • make cross-chain information automatically verified; or
  • require consumers to trust a publisher, provider, reviewer, or evaluator.

Encryption, data-room access, provider credentialing, legal-identity resolution, cross-chain proofs, and consumer trust policy remain outside the base interface.

Prior and adjacent work

This proposal does not claim that machine-readable RWA disclosures, signed claims, document anchors, graphs, or external evaluation are new.

ERC-8320 defines signed, schema-bound, versioned regulated-asset claims with multiple active claims and an author/validator/activator publication lifecycle. Its canonical schemas could encode many concepts described here. The question is whether common disclosure reads should depend on that governed write lifecycle or also be exposable by other backends.

KULA’s family of titled-asset interfaces defines composable, specialized primitives for asset anchors, document bundles, transfer domains, compliance events, impact snapshots, and NAV. In particular, ERC-8329 and ERC-8330 already define subject-linked reporting streams, provider attribution, methodology references, reporting periods, and correction histories for impact and NAV. This proposal asks whether a common subset of these reporting and history semantics should be generalized across disclosure topics and backend systems, without requiring them to use the same storage or publication workflow.

The unnumbered RWA Disclosure Interfaces proposal defines optional token-level interfaces for disclosure resolution, attestations, backing status, and legal-document anchors. It provides a deliberately narrow asset-keyed disclosure surface; this proposal asks whether consumers also need comparable record histories and evaluation requirements across more complex disclosure systems.

ERC-8104 explores minimal disclosure discovery through a URI. ERC-8241 is adjacent prior art for structural declarations whose verification and risk interpretation remain external. ERC-8241 focuses on protocol-control topology and dependency disclosure; this proposal focuses on attributable RWA disclosure histories, including provider/publisher separation, reporting periods, corrections, evidence sets, and reusable diligence requirements.

The proposed distinction is a backend-neutral read model combining multi-subject discovery, comparable disclosure streams, immutable corrections, multi-item evidence, and optional profile-based evaluation. Its adoption test is whether it reduces integration work for independent issuers and consumers more effectively than existing standards, specialized interfaces, or one-off adapters.

Feedback requested

I would especially value feedback on three questions:

  1. Where does existing work already provide the required semantics? Which necessary common reads can ERC-8320, KULA, the RWA Disclosure Interfaces proposal, or another existing standard already provide, and which remain unaddressed?

  2. What is the smallest useful core? Which consumer query and corresponding fields are necessary for interoperability, which fields require direct on-chain reads, which can safely use content-addressed payloads, and which parts of the proposed model are unnecessary?

  3. How should the proposal be divided? Should profiles and relationships be part of one ERC, optional interfaces, or companion specifications?

References to overlapping work and examples from issuers, DeFi protocols, distributors, auditors, indexers, and other disclosure consumers would be particularly helpful.

Current maturity and next steps

This proposal remains at the design stage. No ABI or Profile Format v1 serialization should be treated as final.

Following this discussion, the planned next steps are to:

  1. reduce the proposal to the smallest defensible core;
  2. publish illustrative interfaces and examples;
  3. test the same consumer queries against a native implementation, ERC-8320, and at least one other backend, reporting unsupported or missing semantics;
  4. build a reference implementation, evaluator, and conformance fixtures; and
  5. evaluate gas, enumeration, privacy, and security before submitting a formal ERC.

I am posting now because unnecessary complexity and duplication are cheaper to identify before those implementation choices are fixed.

3 Likes

@ish Welcome to EM!

This is a useful question to surface before an ABI is fixed. Speaking as one of the authors of ERC-8325–8330, we agree with the underlying need for consumers to discover attributable disclosure records without learning a different proprietary model for every issuer.

While we support exploring a narrow, backend-neutral discovery and adapter layer, we would be more cautious about a universal disclosure schema or write model that re-expresses specialised records while losing their native lifecycle and query guarantees.

On the first question, existing work already covers important specialised cases:

  • ERC-8326 defines deterministic commitment to an ordered, normalised document bundle. That is relevant where evidence must be reproducible as a bundle, rather than represented as independent hashes and locations.

  • ERC-8328 defines attributed, evidence-linked, correction-preserving event records. It is relevant where a disclosure concerns a compliance or lifecycle event.

  • ERC-8329 defines subject-linked, indicator- and period-bounded impact snapshots with correction provenance and methodology lifecycle semantics.

  • ERC-8330 defines subject-and-currency NAV streams, including valuation and publication timestamps, provider-attributed history, staleness, correction, invalidation, and aggregation.

The remaining potential gap is a common discovery and adaptation surface across those specialised interfaces and other systems. That is valuable, but it is more than a storage or publication-workflow difference: the specialised ERCs define native write, lifecycle, and query guarantees that an adapter may not be able to recreate. A conforming adapter should therefore expose its source record, source lifecycle, mapping version, and any fields that are unknown or unsupported, rather than imply equivalent semantics.

For the smallest useful core, we would start with one consumer query:

For this subject and topic, what disclosure records exist; who provided and registered them; what does each commit to; when did it apply; and which record corrects which?

The direct read surface could contain subject/topic identifiers, immutable record and correction identifiers, provider and publisher attribution, applicable timestamps, payload/schema commitments, evidence commitments, and source/mapping provenance. The underlying disclosure, evidence documents, methodologies, and legal material can remain off-chain but content-addressed.

We would avoid placing directly queryable numerical values in that generic core. Where a contract needs a defined value, timestamp, staleness rule, correction model, and query behavior, a typed interface such as ERC-8330 is the better layer.

On division, our preference would be:

  1. A narrow base interface for disclosure-record discovery, attribution, commitments, history, and explicit unknown/unsupported states.
  2. Optional token or asset-location discovery.
  3. A separate, versioned Profile Format companion specification. The base interface could expose a declared profile commitment without standardising evaluation results initially.
  4. Relationships as a separate extension or later ERC. Their identifiers, traversal semantics, authority, and cross-chain handling are substantial design questions.

The planned test of the same consumer query across a native implementation, ERC-8320, and other backends is exactly the right adoption test. We would add ERC-8326, ERC-8328, ERC-8329, and ERC-8330 to that comparison set, and would be happy to help with concrete mapping fixtures.

3 Likes

From a wallet-user perspective, the smallest useful view would answer a few simple questions: What does this asset represent? Who supplied the information? When was it last updated? Has anything been corrected or replaced?

It is also important to clearly separate “disclosure available” from “information independently verified.” Users could otherwise mistake the presence of documents or records as proof that the asset is safe or trustworthy.

Keeping the first view simple, with the evidence and full history available as optional details, would make this much more approachable in a wallet.

1 Like

Thanks @redcoat! Your reply is very helpful and aligns closely with the direction I have been taking.

I agree that the main risk with adapters is making different source records look more equivalent than they really are. This standard should work on its own, but existing systems should also be able to support it through an adapter without changing how they create and manage records.

An adapter should only normalize information it can safely support. It should preserve the original source record, its lifecycle, the mapping version used, and anything that could not be mapped correctly. Missing or incompatible information should be shown as unknown, unsupported, or lossy instead of being inferred.

The source record should also remain separate from the evidence supporting the disclosure. The source tells consumers where the adapted information came from. The evidence supports the underlying claim.

Your examples make this boundary much clearer:

  • An ERC-8326 document bundle should not be split apart if that would lose its ordering or complete-bundle guarantee.
  • An adapted ERC-8330 NAV record should not imply that the common interface recreates ERC-8330’s staleness, invalidation, aggregation, or other specialized behavior.
  • Provider and publisher information should only be mapped when the source actually supports those meanings.

I also agree that the base interface should not expose a generic numerical value field. The common interface can identify that a stream concerns NAV and expose its records, schema, history, attribution, evidence, and source. Applications that need ERC-8330’s specific on-chain NAV behavior should continue to use ERC-8330 directly.

For the standard’s structure, I am currently leaning toward:

  • A narrow base for subjects, records, attribution, commitments, history, evidence, source information, and profile declarations.
  • Optional token-to-disclosure discovery.
  • Profile Format v1 as a separate, versioned companion specification.
  • Relationships as an optional interface while we test whether they should remain here or eventually become a separate ERC.

I differ slightly on evaluation results. I think Profile Format v1 should eventually define a small, standard result format. It would identify the profile and disclosure state that were evaluated, which records were used, and whether each required input was found, missing, stale, ambiguous, inaccessible, or unsupported. Without this, profiles could standardize the requirements while evaluators still return incompatible results.

These results would only report structural profile coverage. They would not determine truth, legal compliance, underwriting approval, or investment suitability. The exact format should remain open until it has been tested with independent evaluators.

I will also add ERC-8326, ERC-8328, ERC-8329, and ERC-8330 to the adapter tests. I plan to begin with example mappings that show what can be preserved exactly and what must remain unsupported or lossy. I appreciate your offer to help and would welcome your review once those fixtures are drafted.

What if two independent evaluators receive the exact same Profile Format version and the exact same pinned disclosure records, but still produce different results?

For example, suppose a profile says a disclosure is stale after 30 days. The same record could be FOUND on August 20 and STALE on September 10 without the profile or record changing. Likewise, one evaluator could report INACCESSIBLE because an off-chain dependency could not be retrieved while another evaluator successfully resolves it moments later.

That seems to expose a resolution boundary: the result is not determined only by the profile and disclosure records. Some additional context is capable of changing the outcome.

So before standardizing the result format, what exactly has to be pinned so that two independent evaluators necessarily resolve the same inputs to the same result?

My instinct is that any outcome-relevant context such as the evaluation checkpoint/reference time has to become part of the evaluated state, while transient execution conditions such as retrieval failure may need to remain separate from the semantic profile result.

Otherwise two evaluators could both be conforming while disagreeing about the same nominally pinned disclosure state.

1 Like

Thanks for sharing this perspective. I appreciate you framing it around the first view a user would actually see. These are the questions the proposal is intended to make answerable, whether someone is using a wallet, explorer, or another application.

For a tokenized asset, an optional token-side locator could point directly to the relevant disclosure endpoint and subject. An external indexer could provide another discovery path when that locator is not implemented. The proposal is also intended to support disclosures for non-tokenized assets, so token representation would remain an optional capability. When implemented, the disclosure endpoint would expose a binding identifying the token, the subject it claims to represent, and the general representation model. The subject’s disclosure records would then contain structured claims about the underlying terms and rights and link to evidence supporting those claims.

Once the subject is identified, a consumer could enumerate its disclosure streams, see who provided each record, when it was published, and when it applies, follow its correction or replacement history, and inspect its evidence commitments and available locations. Starting with the streams helps a consumer understand what kinds of information have been disclosed before opening individual records. When access permissions allow, the consumer could retrieve the referenced evidence and confirm that it matches the recorded commitment. This creates a simple path through the disclosure while preserving additional detail for those who need it.

An SDK or indexer could turn these reads into a simpler summary, while the underlying disclosure information would remain directly discoverable from the endpoint.

Finally, separating “disclosure available” from “independently verified” has been a foundational principle of this proposal. A disclosed document can serve as supporting evidence, but its availability is not proof that the information is correct. Provider disclosures, supporting evidence, profile-coverage results, and independent reviews would remain separate and attributable. The standard would not provide a generic “verified” or “safe” label, although reference tooling could help applications present those distinctions clearly.

One practical way I expect ordinary users to benefit is through independent reviews of published disclosures. A reviewer could publish a signed review record identifying the specific disclosure records it covers or the state of the disclosure at a particular checkpoint. A wallet, explorer, or indexer could then show who performed the review, what it covered, when it occurred, and whether relevant records have changed since then. This would provide an attributable trust signal while preserving the distinction between disclosure and independent review. How much weight to give that review would remain a decision for the user or application. Users could still inspect the underlying records, evidence, and history themselves, or provide that information to legal and financial professionals for further review.

1 Like

Thanks for raising this. I agree that the profile and disclosure records alone are not always enough to determine the result. Any evaluation condition that is allowed to affect the profile result also needs to be recorded.

For freshness, the profile would define which timestamp to use and how old the information can be. For example, a profile could require a NAV report issued within the last 30 days. A report issued on August 1 could be current on August 20 and stale on September 10. The evaluation would therefore pin the reference time so that another evaluator could reproduce the result.

The on-chain checkpoint would identify the exact contract state being evaluated, while the pinned reference time would determine freshness. Because the availability of off-chain evidence can change independently, relevant retrieval times and outcomes should be recorded separately as execution metadata.

I think the result should commit to an input manifest that identifies the exact records and external inputs used to evaluate each requirement. It should separately identify any required input that could not be resolved. Two evaluators using the same profile, reference time, and input manifest should reach the same profile result.

I also agree that transient execution conditions should remain separate from the profile result. A timeout should be recorded as a retrieval diagnostic, not as a permanent conclusion that the evidence itself is inaccessible. If a required input cannot be retrieved, the result for that requirement could remain unresolved.

Different access permissions can also prevent evaluators from resolving the same inputs. One evaluator may be able to retrieve restricted evidence, while another may have to report the requirement as unresolved, with a restricted-not-accessed diagnostic. That does not mean the disclosure failed unless the profile specifically requires public access.

Evaluator tools could automatically record when retrieval was attempted, the digest of the returned content, and whether it matched the expected commitment. This also shows why shared conformance tests are important. They can use fixed profiles, records, reference times, access conditions, and expected outputs to test independent evaluator implementations before the result format is finalized.

The input manifest makes sense for reproducibility. One question about record selection: how would a consumer distinguish an evaluation over all relevant records from one over a selectively chosen subset?

For example, a publisher registers a loan-payment disclosure and later a correction for the same observation. An evaluator includes only the original in its manifest. Another evaluator can reproduce that result, but how would it detect the omitted correction?

Would the profile need to define the discovery scope and record-selection rules at the pinned checkpoint, with the manifest recording how those rules were applied?

I’m asking about completeness within the declared endpoint and streams, rather than completeness of real-world disclosures. This seems like a useful conformance test: a reproducible result that nevertheless uses a superseded record.

2 Likes

Yes. This is the next boundary I was getting at. Pinning the reference time, checkpoint, and input manifest makes the evaluation reproducible given that manifest. But if the evaluator is free to choose which records enter the manifest, two evaluators can still be perfectly reproducible over different subsets of the same pinned disclosure state.

So I think the manifest has to be the output of a committed selection procedure, not the definition of the input set itself. The profile needs to identify the discovery scope and the record-selection rule at the checkpoint, while the adapter preserves whatever lifecycle semantics the source actually provides. Then another evaluator can independently derive the candidate records and verify that the manifest is the result of applying those rules.

In your example, if the original disclosure and its correction both exist before the checkpoint, an evaluator should not be able to omit the correction and still claim the same evaluation scope. Whether the profile consumes only the current record, the complete history, or some other subset can vary, but that rule has to be fixed rather than chosen after seeing the records.

So I would make the conformance test: same profile, same declared scope, same source/mapping semantics, and same checkpoint must produce the same selected semantic inputs before evaluation begins. If one evaluator can omit a discoverable correction and still conform, the selection procedure is not closed.

This still does not claim that every relevant fact in the real world was disclosed. It only establishes completeness within the disclosure surface the profile actually declared. If an adapter cannot enumerate that surface or preserve enough lifecycle information to apply the selection rule, that requirement should remain unsupported or unresolved rather than treating the subset it happened to find as complete.