Vantage-Authority Resolution Profiles — public companion to ERC-8309's divergence boundary (#1826)

ERC-8309, under the §Deduplication amendment proposed in ethereum/ERCs#1826, changes what a mesh does when two vantages disagree about the same observation: instead of silently deduplicating, it preserves the divergence as a first-class store state — single | divergent(committed observation set) | absent — and names an extension point, resolveDivergence, where a declared resolution policy may attach. It deliberately prescribes none.

This companion specification defines what attaches there. It is now public

What it defines. A resolution envelope (E1–E6) every policy must fill — what is being agreed, who counts, over which vantage classes independence is assumed, the fault model and finality rule, the evaluation window, the evidence required — and a verdict (V1–V5) that binds the exact committed evidence set by digest, so every resolution is recomputable by a third party from the bytes it names. An output taxonomy with two symmetric prohibitions: no false green (a resolved disagreement is never reported as agreement — the collapsed state is unrepresentable, not merely discouraged) and no false red (no divergence manufactured from undeclared transformations). Four profiles: A, the normative default, resolves nothing and surfaces divergence for downstream layers; B (quorum, counting distinct signers per vantage class, never raw attestations), C (registry-weighted, requiring verifiable history), and D (declared priority) are opt-in, and each produces a distinct resolved state that never becomes agreement. Evaluations are immutable but supersedable; no evaluation carries finality unless its profile declares a rule.

Boundary, stated narrowly. This is not a standalone proposal. The base owns evidence preservation and divergence exposure; the companion owns only the policy side of that boundary, and makes it explicit and independently recomputable. Serializers are bound per schema and named, never inferred; the reference implementation the document cites is digest-pinned over structured evidence with the recipe stated, so the pin is checkable rather than trusted. Profile A is running in production as the ingestion boundary for TSEI.

Provenance is the point of the repo. Every circulated cut from v0.2 to the current v0.3.9 is preserved as its own file, never edited after circulation. §13 of the document is an append-only record of every design decision, ratification, correction, and landing — including the document’s own errors, each caught by a co-author checking the artifact rather than the announcement. Corrections are new rows superseding old ones by reference, so the record of what was wrong survives beside the fix. That claim is mechanically checkable: diff any two adjacent cuts.

Co-authored by Damon Zwicker, Tiago Merlini, Jimmy Shi, Pavlo Tvardovskyi, and babyblueviper1 — the working group that built and reviewed it, each having chosen co-authorship individually. Base standard: ERC-8309 (Merlini, Zwicker, Wu, Shi). Lineage: the recompute-and-compare mechanism generalizes ERC-8281’s Verification Invariant from a single commitment edge to mesh observations. Neighboring layer above: Recomputable Verification Receipts (RVR), already on this forum.

We’d welcome review at the artifact level — name the section, quote the bytes, say what the record shows. Filing as a companion ERC is deferred until #1826 has meaningful editor movement.

2 Likes

Good to see this out in public. The piece that matters most here is that ERC-8309 deliberately declines to prescribe resolveDivergence — the right call for the base, but on its own it leaves every deployment to invent its own resolution semantics, privately and usually unverifiably. This companion closes that gap: the policy side becomes explicit, named, and recomputable by a third party, and the two symmetric prohibitions make the failure modes unrepresentable rather than merely discouraged. Divergence preservation is only a useful state if downstream can distinguish agreement from resolution; the taxonomy is what makes that distinction hold.

Two specifics that were load-bearing in getting there, both worth keeping visible.

§5, the per-schema serializer binding, earned its rule rather than asserting it. The group’s own code was carrying two byte-distinct serializers — one emits a trailing 0x0a and the other doesn’t, and they diverge on number rendering too, where the -0 case is three payload bytes apart rather than one — so the same object digested to unrelated hashes under the two readings. Binding the serializer explicitly per schema, naming it in the schema itself, and having an unbound schema raise rather than fall back to a default is what turns that class of defect from corrected into unrepresentable. “A default is inference with extra steps, and it fails in the direction where nobody notices” is the line worth keeping.

§6a, immutable but supersedable with no implied finality, states the division of labour the right way round: the base provides monotonic evidence retention, the companion provides historical evaluation identity. A verdict binds its evaluator-local window and its committed set at production time, so late evidence produces a new evaluation rather than mutating an earlier one. Old verdicts stay verifiable without being replayable, which is what keeps divergence preservation usable as evidence accumulates.

One forward-looking item, since it is where the envelope’s own choice meets a different environment. §5 correctly frames the envelope as an off-chain declaration that consumers recompute byte-for-byte, and it already allows on-chain commitments to use typed encodings separately. That carve-out is worth stating as a direction rather than leaving implicit. JCS is a clean target for cross-implementation off-chain recomputation, but parsing and canonicalizing arbitrary JSON inside an EVM contract is unnecessarily expensive — and a consumer that cannot afford to verify is functionally a consumer that does not verify. Where contracts need to produce or check envelope semantics themselves, the cleaner shape is a separate, separately-named contract profile — schema-fixed ABI/EIP-712 or comparable — with equivalence vectors binding it back to the JCS envelope and a definition-derived leg from the start. Named separately so it never inherits the word JCS and reintroduces the ambiguity §5 just removed. It sits on the Next list and does not block this cut.

2 Likes