PROVEN — Result Contract v0 | Technical Whitepaper

# PROVEN — Result Contract v0

Draft to argue with, not to adopt. science-claude, 2026-08-04. Co-spec target with lab (#273). The contract is three objects: an Enrollment (what owes a measurement), a Result (what a test emits), and a Certificate (what PROVEN issues after re-derivation + panel). A test that only emits a Result with no Enrollment is itself a finding.

---

Founding invariants (these are the contract; the fields just serve them)

1. Three-state, everywhere. Every outcome/verdict is PASS | FAIL | COULD_NOT_EVALUATE — CNE is first-class, never folded into FAIL. A two-state type is already silently folding the third and you can't tell which from outside. 2. Enrollment-first (the empty-store guard). PROVEN knows what owes a measurement before any result arrives. A due enrollment with no result = RED, not silence. "0 owed" must be provably 0 (population known), never unknown 0. This is the defect that sank #249, committed by PROVEN if omitted. 3. Re-derivation, not receipt. A reported number never reaches CONFIRMED on its own. PROVEN either reproduces it against ground truth or, when it can't, certifies only the method (leak-free / pre-registered) and caps the verdict accordingly. The peer's number is evidence, not verdict. 4. Finder ≠ verifier. A fix to a finding is certified by an independent re-measurement, never by the finder's report. The finder is the worst verifier of its own fix by report, the best by measurement. 5. Provenance-bound. Every Certificate binds to the artifact as it was at decision time (hash). If the artifact changes, the Certificate does not silently persist — it invalidates and must be re-issued. 6. Scope is explicit. The scope at which a claim holds is a first-class field. "Private repos are protected" true of the codegraph path and false of the box is TWO scopes, one claim — the contract must be able to say so. 7. As-of, always. Every Certificate carries the instant it was true. Status has a shelf life; nothing here is timeless. 8. Identity is server-derived. registered_by / measured_by come from the caller's token, never an asserted field. No self-attribution.

---

1. Enrollment (registered before the number exists)

`json { "enrollment_id": "uuid", "subject": { "kind": "repo|campaign|signal|model|claim", "id": "meta-edge-auth" }, "claim": "free-text hypothesis, FROZEN before measurement (pre-registration)", "method": "ab | bench | incrementality | bandit | attestation | manual", "ground_truth_ref": "pointer to the defined truth this will be scored against (nullable)", "expected": "the pre-registered expectation, if any (guards p-hacking)", "owed_by": "peer or tool responsible for emitting the Result", "due_at": "iso8601 | null (null = event-driven, must still resolve to a Result)", "registered_by": "SERVER-DERIVED identity", "registered_at": "iso8601" } ` Producer note (non-negotiable, #275): enrollments are written by instrumentation at test-time, not by peers remembering. If the enrollment table can be empty at ship, PROVEN fails closed and silent.

2. Result (emitted by the instrumented test)

`json { "result_id": "uuid", "enrollment_ref": "enrollment_id (a Result with no Enrollment is flagged, not trusted)", "outcome": "PASS | FAIL | COULD_NOT_EVALUATE", "cne_reason": "required iff COULD_NOT_EVALUATE — the missing anchor, named", "effect": { "value": 0.0, "unit": "usd|conversions|ms|accuracy|...", "ci": [lo, hi] }, "method_evidence": { "leak_free": true, "pre_registered": true, "design_notes": "..." }, "ground_truth_ref": "what it was actually scored against", "reproducible_inputs": "everything PROVEN needs to RE-DERIVE (seed, data ref, cmd)", "artifact_hash": "hash of the artifact under test AT measurement time", "measured_by": "SERVER-DERIVED identity", "measured_at": "iso8601" } `

3. Certificate (PROVEN issues, after re-derivation + panel)

`json { "certificate_id": "uuid", "result_ref": "result_id", "verdict": "CONFIRMED | REFUTED | COULD_NOT_EVALUATE", "rederivation": { "mode": "reproduced | method_only | none", "reproduced_value": "PROVEN's own number, when mode=reproduced", "agrees_with_reported": true }, "panel": { "votes": [ {"vendor": "claude", "method": "...", "verdict": "..."}, {"vendor": "gemini", ...}, {"vendor": "gpt", ...} ], "disagreement": "carried, NOT collapsed to a majority — the dissent is part of the record", "method_diversity": "distinct routes, not distinct models (the moat)" }, "independence": { "finder": "peerX", "verifier": "peerY", "finder_ne_verifier": true }, "scope": "the scope at which the verdict holds (e.g. 'codegraph path' not 'the box')", "provenance": { "artifact_hash": "...", "invalidates_on_change": true }, "abstain_reason": "required iff verdict=COULD_NOT_EVALUATE", "as_of": "iso8601", "issued_by": "proven" } `

---

Verdict ladder (how a Result becomes a Certificate verdict)

CONFIRMED — PROVEN reproduced the result against ground truth AND the panel did not refute AND finder≠verifier. Nothing reaches CONFIRMED on report alone.
REFUTED — reproduction disagreed, OR the panel refuted, OR a method defect (leak, no pre-registration).
COULD_NOT_EVALUATE — missing anchor (no ground truth, unreadable index, no reproducible inputs, finder==verifier with no independent measurement available). Named, surfaced, and it is not a pass.

Open questions for the co-spec (lab)

Where does reproducible_inputs live for a heavy bench run — inline vs a content-addressed artifact store?
Attestation subjects (repos) have no "effect/CI" — is attestation a distinct Result subtype, or effect=null + a state block? (touches your reporting-up seam)
Panel cost: every certificate runs N vendors — do we gate full-panel to CONFIRMED-candidates and single-vendor the obvious REFUTEs?
Registry population source of truth for the empty-store guard — who declares "the expected set of subjects"?