Model-to-Matter: Authorization and Outcome Evidence for Model-Directed Physical Execution

Introduction A digital proposal can become a physical effect through a laboratory, instrument gateway, robot, manufacturing system, or other executor. Independent authorities may each approve a different fact. The executor therefore constructs one closed Action Object and accepts evidence only when every required issuer agrees about that action. Authorization and outcome are separate phases. clear_to_execute permits one invocation; it does not assert that invocation occurred. An executor effect statement records the executor's claim; it does not prove a sensor result. Outcome reconciliation requires the independently pinned sources selected by the expected-effects policy.

Requirements LanguageThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Canonical Action EP-MODEL-TO-MATTER-ACTION-v1 is a closed I-JSON object serialized with JCS . It binds model manifest, harness and safeguards; experiment protocol, material commitment and expected-effects digest; principal; executor and facility; purpose; destination; requested time; and max_executions=1. Raw biological content, prompts, completions, and hidden reasoning MUST NOT appear in the portable object. The executor independently computes both action_digest and CAID. The identifiers MUST encode the same canonical bytes. CAID identifies the action; it does not prove identity, authority, safety, execution, or outcome.

Pre-Execution Evidence and Clearance The executor pins its own acceptance profile. The initial profile requires model_attestation, safety_case_attestation, institutional_authority, biosafety_review, domain_screening, and human_authorization artifacts. Each artifact is signed by a pinned issuer and binds action_digest. Presenter-supplied issuer keys, sufficiency rules, or revocation policy MUST NOT influence acceptance. The executor registers and atomically consumes a short-lived challenge. Before returning clear_to_execute it atomically consumes the action digest in durable shared state. Storage ambiguity returns indeterminate and freezes execution pending authenticated reconciliation. It MUST NOT permit blind retry.

Effect Custody After clearance consumption, the protected effect enters dispatch custody. The executor records a stable operation identifier and the exact action digest, CAID, clearance replay digest, provider, and facility. A lost provider response after invocation is indeterminate. Reconciliation MUST query the authenticated provider operation; it MUST NOT issue a new physical action under the consumed clearance.

Outcome Claims and Binding The Action Object's experiment.expected_effects_digest MUST commit to the exact source-routed predicted_effects array. Each prediction identifies an executor, system_of_record, or independent_observer role and MAY require a source class. Post-execution observations conform to . For this profile, each observation MUST bind the action_digest as action_hash, the action CAID, clearance replay digest, stable operation identifier, executor facility, and observation window. The clearance replay digest is used as the authorization digest and consumption binding; the derived authorization identifier is "ep:m2m:clearance:" followed by the lowercase hexadecimal digest value. EP-MODEL-TO-MATTER-EFFECT-v1 remains the executor's signed statement. Its status is completed, failed, aborted, or indeterminate. Its observed_effect_digest MUST equal the observed_effects_digest of the accepted executor-role observation. This prevents an executor statement from being attached to different executor observations. An accepted executor statement is necessary when required by policy and is not physical truth. If a prediction requires an independent observer, the verifier MUST NOT reconcile without an accepted observation from a separately pinned source matching the required role, class, and facility. The independent source MUST use an Ed25519 canonical key identity and a relying-party-declared control domain distinct from every executor or other non-independent source. A second key in the executor's control domain is not independent. The executor's acceptance profile MUST pin source status and validity, source quorum, distinctness dimensions, and any required observation window and maximum attestation delay. Those requirements are verifier policy and MUST NOT be accepted from the observation presenter. A compromised at the attestation instant, retired outside its pinned historical validity interval, expired, not-yet-valid, non-distinct, late, or window-mismatched source cannot satisfy the required evidence role. Missing or unauthenticated evidence yields lifecycle_state=indeterminate and outcome=null. Authentic evidence yields in_bounds, divergent, or incomparable under Outcome Binding. An indeterminate state MUST NOT be mapped to incomparable.

Remedy and Subsequent Action A divergent or failed outcome does not authorize a remedy. Any rollback, compensation, cleanup, repeat experiment, or other consequence is a new action with a separately constructed Action Object, CAID, evidence set, challenge, clearance, and consumption event.

Industrial Execution Profile An industrial deployment SHOULD separate at least three roles: the actuator or facility executes; a meter, EMS, SCADA historian, laboratory instrument, or other telemetry source observes under a separately pinned identity; and the Model-to-Matter verifier reconciles evidence and applies settlement or remediation policy. A controller acknowledgment MUST NOT be represented as an independent physical measurement. Action State or another external evidence format MAY carry the stable action identity, custody transition, and Outcome Binding result digest. Such a carrier is an adapter and is not a core dependency of this profile.

Security Considerations This profile does not decide scientific safety, validate raw material, certify a source, establish control-domain ownership, or establish physical truth. Pinned sources may be wrong, compromised, correlated, or colluding. Deployments need independent operational controls, source calibration, key governance, bounded observation windows, incident response, and legal review appropriate to the physical consequence. Exact action, CAID, clearance, operation, executor, facility, source, and time bindings are mandatory. Evidence for different operations or facilities MUST NOT be joined. An effect status of indeterminate and an Outcome Binding lifecycle of indeterminate prohibit blind retry.

Privacy Considerations Portable evidence can reveal models, institutions, facilities, principals, purposes, destinations, and times. Deployments SHOULD minimize identifiers and use hiding commitments for low-entropy sensitive content. A plain digest is not automatically confidential.

IANA ConsiderationsThis document has no IANA actions.

Implementation Status An Apache-2.0 TypeScript implementation provides the closed Action Object, CAID binding, six signed evidence adapters, registered challenge, durable single-use clearance, effect statements, source-routed Outcome Binding, independently signed observation sets, canonical-key and control-domain separation, source status and validity, observation-window policy, distinct-source quorum, and adversarial tests. Demonstrations are synthetic and process no raw biological content. No wet-lab deployment, scientific validation, partner endorsement, or independent implementation is claimed.

Changes since -01 This revision makes expected_effects_digest resolve to source-routed predicted effects, adds independent signed observations and exact operation/facility bindings, distinguishes indeterminate evidence from an incomparable measurement, permits an indeterminate executor effect status, requires canonical-key and declared-control-domain separation, binds source status, validity, quorum, observation windows, and attestation delay, and makes remedies separately authorized actions. It preserves the limitation that signed observations are claims by pinned sources rather than proof of physical truth.