Outcome Binding for Authorized Actions and Independently Observed Effects

Introduction A valid authorization, an accepted dispatch, and an observed effect are different facts. Treating a controller acknowledgment as proof of a physical outcome permits the actor that caused an effect to be its only witness. Treating absent evidence as an unfavorable measurement similarly collapses uncertainty into a false result. This profile keeps those axes separate. It extends the original executor-attestation comparison with independently pinned source roles, exact cross-source bindings, and an explicit indeterminate lifecycle. Existing EP-OUTCOME-ATTESTATION-v1 objects remain valid and default to the executor source role.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Terms and State Separation

Executor: The party that attempts the authorized effect.
System of record: A source authoritative for a bounded digital state, but not necessarily independent of the executor.
Independent observer: A separately pinned source whose canonical public key identity and relying-party-declared control domain differ from every source that performed or controlled the action, such as a revenue meter, telemetry provider, or external measurement service. A declaration is policy input; it is not cryptographic proof of organizational or physical independence.
Indeterminate: The lifecycle state used when required evidence is missing, unauthenticated, unpinned, or not exactly bound. It is not a comparison outcome and MUST NOT authorize blind retry.
Incomparable: A comparison result reached only after authentic, bound evidence exists but cannot be evaluated under the closed predicate language.

Source-Routed Predicted Effects predicted_effects is a non-empty array covered by the authorization signature or an explicitly identified additive relying-party policy. Its digest is SHA-256 over JCS bytes. Every entry has effect_type, literal target, and a closed predicate. An entry MAY also have required_source_role and required_source_class. The role is one of executor, system_of_record, or independent_observer. When omitted, the role defaults to executor for compatibility with EP-OUTCOME-ATTESTATION-v1. The closed predicate set is eq, lte, gte, range, set_eq, count_lte, and absent. Comparison values are strings. Targets are literal; wildcard semantics are not defined. Unknown members, unknown operations, and numeric comparison operands MUST be refused.

Outcome Observation EP-OUTCOME-OBSERVATION-v1 is a closed I-JSON object signed with Ed25519 under the domain string "EP-OUTCOME-OBSERVATION-v1" followed by a zero octet. The signed body is: The verifier MUST pin source_id, public key, role, source_class, control_domain_id, status, valid_from, valid_to, and any required facility. A compromised source pin MUST also carry compromised_at. The verifier MUST parse the pinned and presented keys as Ed25519 SubjectPublicKeyInfo, compare their canonical DER encodings, and derive key identity from those bytes rather than from caller-provided key text or key_id. It MUST verify observed_from is not after observed_until, observed_until is not after attested_at, and attested_at is not in the verifier's future. A valid signature without an accepted, current pin is verified but not accepted.

Relying-Party Source Policy The relying party supplies source requirements independently of the observation presenter. A requirement selects a role and optional source class, sets min_distinct_sources, and selects one or both distinctness dimensions: key or control_domain. It MAY further restrict accepted source identifiers. min_distinct_sources MUST be between 1 and 16. An independent_observer observation MUST use a canonical key identity and control_domain_id distinct from every accepted non-independent source, even when min_distinct_sources is one. Re-encoding the same Ed25519 key MUST NOT create a distinct source. Different keys under the same declared control domain MUST NOT satisfy independence or a control-domain quorum. The relying party MAY also supply an observation-window requirement by role and optional source class. relation is exact, within, or covers and compares observed_from and observed_until with the required not_before and not_after. max_attestation_delay_ms limits the interval from observed_until to attested_at and MUST NOT exceed 86400000. A presenter MUST NOT widen, replace, or select these requirements.

Verification and Reconciliation

Verify the authorization under its native rules and recompute the predicted-effects commitment.
Verify every observation signature against the canonical Ed25519 key in its source pin. Refuse a source whose pin is malformed, compromised at or before attested_at, not yet valid, or expired at attested_at. A retired key MAY verify a historical observation only when attested_at remains inside its pinned validity interval.
Require exact equality of receipt identifier and digest, action digest, optional CAID, consumption nonce, operation identifier, required facility, and source metadata.
Enforce independent-observer canonical-key and declared-control-domain separation from every accepted non-independent source.
Enforce every relying-party source quorum and observation-window requirement. Missing, non-current, non-distinct, late, or window-mismatched evidence returns lifecycle_state=indeterminate and outcome=null.
Group predictions by required source role and class. If any group lacks an accepted observation, return lifecycle_state=indeterminate and outcome=null.
Evaluate each group against only the matching accepted observations. Aggregate with precedence divergent, then incomparable, then in_bounds.

A reconciled in_bounds result MAY satisfy an additive reliance policy. A divergent result MUST NOT be rewritten as success. An incomparable result MUST NOT be treated as missing evidence. An indeterminate state MUST enter authenticated reconciliation; it MUST NOT trigger blind replay of a potentially completed consequence.

Industrial Curtailment Profile A grid-curtailment deployment SHOULD require at least two sources: an executor-class controller acknowledgment and an independent meter-class observation. The controller statement establishes accepted dispatch, not delivered power. The meter statement establishes what the pinned meter claimed over the bound interval, not market eligibility or tariff rules. Baseline and settlement policy remain relying-party policy. Settlement MUST be downstream of reconciliation. A controller pass with a divergent meter result is a reconciled divergence and MUST NOT settle. An unavailable meter is indeterminate and MUST NOT settle or cause a blind redispatch. Action State or another external evidence capsule MAY carry the result digest; such a carrier is not required for core verification.

Security Considerations Independent means separately pinned with a distinct canonical key and a distinct relying-party-declared control domain. A second key controlled by the executor is not independent, and control_domain_id alone does not prove otherwise. Multiple sources can collude or share faulty inputs. Sensors can be biased, replayed, or installed at the wrong boundary. This profile proves signed claims and exact joins, not physical truth. Deployments need calibration, key governance, custody, authenticated time, anti-replay state, and dispute procedures appropriate to the consequence. Source substitution, facility substitution, action substitution, CAID substitution, operation substitution, and window substitution MUST fail closed. Result digests MUST cover lifecycle state, comparison outcome, checks, errors, input commitments, and source evaluations.

Privacy Considerations Observations can expose facilities, operations, timing, and sensitive effects. Implementations SHOULD minimize identifiers, keep raw telemetry outside portable artifacts, and disclose only commitments and bounded values necessary for the relying purpose.

IANA ConsiderationsThis document has no IANA actions.

Implementation Status An Apache-2.0 TypeScript reference implementation includes legacy executor-attestation compatibility, source-routed predictions, signed multi-source observations, exact binding checks, deterministic result digests, eight real-cryptography source-policy vectors, five hostile independence/freshness/window/quorum cases, eleven bounded obligations with deliberately weakened counterexamples, Model-to-Matter composition, and a synthetic GRACE controller-plus-meter settlement path. The bounded model and implementation are same-team artifacts, not an unbounded proof or independent implementation. The GRACE path is a reference simulation and is not evidence of a physical deployment, utility acceptance, meter certification, or partner endorsement.