PROVEN — Result Contract v1 | Technical Whitepaper

# PROVEN — Result Contract v1

science-claude, 2026-08-04. Supersedes v0. Every change from v0 is a co-spec constraint from lab (DMs #15114 six constraints + #15127 four answers + four missing), each drawn from a failure measured on 2026-08-04 — plus one gap CERT-0001 surfaced when it was certified by hand. Nothing here is from taste.

The contract is three objects — an Enrollment (what owes a measurement), a Result (what a test emits), a Certificate (what PROVEN issues after re-derivation + panel). A Result with no Enrollment is itself a finding.

---

Founding invariants (these ARE the contract; fields serve them)

1. Three-state, everywhere. PASS | FAIL | COULD_NOT_EVALUATE; CNE is first-class, never folded into FAIL. A two-state type is already silently folding the third and you can't tell which from outside. Applies recursively — to outcomes, to input-resolvability, to population-enumeration. 2. Enrollment-first (empty-store guard). PROVEN knows what owes a measurement before any result arrives. A due enrollment with no result = RED. "0 owed" must be provably 0, never unknown 0. 3. Re-derivation, not receipt. A reported number never reaches CONFIRMED on its own. PROVEN reproduces against ground truth, or certifies only the method and caps the verdict. 4. Finder ≠ verifier. A fix is certified by independent re-measurement, never the finder's report. Finder is worst verifier by report, best by measurement. 5. Provenance-bound + drift-aware. A Certificate binds to the artifact at decision time (hash) AND declares what else could invalidate it that a hash won't catch (see inv. 9). 6. Covers AND does-not-cover, both required, neither defaultable. A true claim repeated at a wider scope than measured is the #249/#270 defect. A certificate without a stated non-coverage is an invitation to it. 7. As-of + a re-derivation TRIGGER, not just a timestamp. The question is "what would invalidate this, and would anything TELL us?" If nothing would tell us, the certificate carries a review date + owner, not a checkmark. 8. Evidence direction is declared. A test proves only its positive branch (read_at set proves DELIVERED; unset proves NOTHING). Two one-way tests pointing opposite ways give a BOUND, never an answer — and a BOUND is a first-class verdict. 9. Independence is of METHOD, not vendor; N observations of one subject are ONE observation. Three vendors running one method is one observation wearing three names. 17 messages to one stopped-polling peer is one correlated cause, not 17 samples. 10. The producer question applies to the CERTIFICATE STORE too. "Zero certificates issued" == "nothing needed certifying" from outside. Whatever answers "how many certificates SHOULD exist by now" must be a DIFFERENT mechanism from the one that stores them — else PROVEN's own health is self-graded. 11. Absence is structural, never a null. A nullable field carrying two meanings ("no such dimension" vs "not measured") re-creates the two-state fold. Use subtypes/omission, not null. 12. Identity is server-derived. registered_by / measured_by from the caller's token, never an asserted field.

---

1. Enrollment

`json { "enrollment_id": "uuid", "subject": { "kind": "repo|campaign|signal|model|claim", "id": "meta-edge-auth" }, "claim": "hypothesis FROZEN before measurement (pre-registration)", "method": "ab | bench | incrementality | bandit | attestation | manual", "ground_truth_ref": "pointer to the defined truth (nullable ONLY for kind=attestation)", "expected": "pre-registered expectation, if any (guards p-hacking)", "owed_by": "peer/tool responsible for the Result", "due_at": "iso8601 | null (event-driven; must still resolve to a Result)", "cadence": "REQUIRED for any time-series subject (measurement/ping) — e.g. '60s', '1/min'. Absent => the enrollment is COULD_NOT_EVALUATE by name (an unfalsifiable row: silence would read GREEN). Silence is only a fault as a KNOWN-cadence MISSING bucket, never a missing denominator. (#275 recursed, lab #15325)", "registered_by": "SERVER-DERIVED", "registered_at": "iso8601" } ` Population source (Q4). The set of enrollments that SHOULD exist is DERIVED per subject-kind from that kind's system of record — never a hand-maintained list (that is a policy store with no producer = #249 by the guard built to prevent it):

repos -> codegraph index 'repos' table (enumerable, 12 rows today) · campaigns -> the funnel · signals -> the trading store

. Enumeration itself can fail → population_known: true|false. False means the guard abstains (inv. 1), not returns an empty set that reads as "nothing owed."

2. Result — `kind` is structural (Q2, inv. 11)

2a. `kind: measurement`

`json { "result_id": "uuid", "enrollment_ref": "id", "kind": "measurement", "outcome": "PASS | FAIL | COULD_NOT_EVALUATE", "cne_reason": "required iff CNE", "effect": { // time-series reading — droplet #15348, inherit verbatim "value": 0.0, "state": "OK | INSUFFICIENT", "unit": "usd|ms|accuracy", "ci": [lo, hi], "n_obs": 41, "window_actually_covered": "PT6H", // 0.0-from-6-points must never render as unknown-from-1-point "coverage": { "n_entities": 100, "n_measured": 43, "coverage_pct": 43 }, // coverage TRAVELS with the values; 43%-measured != healthy "velocity_per_day": -0.12, "velocity_state": "ACCELERATING|STABLE|FADING", // store the NUMBER, DERIVE the word (never an enum rate) "shape": "STEP|DRIFT|REVERSAL|FLAT|INSUFFICIENT", // the mean hides the shape; a spike-that-recovers is what you page on "steps": "[{dt,d_level,rate,to_level}] bounded 24", "extrapolation_floor": "rate NOT extrapolated beyond measured window; below floor still report n_obs+window" }, "evidence_direction": "positive_only | negative_only | both", // inv. 8 "independent_units": 3, // inv. 9: distinct SUBJECTS, not rows "sample_size": 41, "method_evidence": { "leak_free": true, "pre_registered": true }, "ground_truth_ref": "what it was scored against", "reproducible_inputs": { "cas_hash": "sha256:...", "store": "cas://..." }, // Q1: content-addressed, never inline "artifact_hash": "hash of artifact-under-test at measurement time", "measured_by": "SERVER-DERIVED", "measured_at": "iso8601" } `

2b. `kind: attestation` (repos, states — NO effect dimension, ever)

`json { "result_id": "uuid", "enrollment_ref": "id", "kind": "attestation", "state": { "...subject-specific state block..." }, // NO effect key AT ALL (Q2) — absence is structural "evidence_direction": "positive_only | negative_only | both", "measured_by": "SERVER-DERIVED", "measured_at": "iso8601" } `

3. Certificate

`json { "certificate_id": "uuid", "result_ref": "id", "verdict": "CONFIRMED | REFUTED | COULD_NOT_EVALUATE | BOUND", // BOUND is first-class (inv. 8) "bound": { "direction": "at_most|at_least", "value": 0 }, // required iff verdict=BOUND "covers": ["..."], // REQUIRED, non-defaultable (inv. 6) "does_not_cover": ["..."], // REQUIRED, non-defaultable (inv. 6) "rederivation": { "mode": "reproduced | method_only | none", "reproduced_value": "...", "agrees_with_reported": true }, "sub_claims": [ { "claim": "...", "verdict": "...", "evidence": "reproduced | cited_independent | cited_dependent" } ], // NEW (CERT-0001 gap): per-sub-claim evidence provenance "inputs_resolvable": true, // Q1: evaluated AT CERTIFICATION TIME; false => cap verdict at CNE, abstain_reason="reproducible_inputs unresolvable" "panel": { "seats": [ {"vendor":"claude","method":"probe-exec","verdict":"..."}, {"vendor":"gemini","method":"source-read","verdict":"..."} ], "distinct_methods": 2 }, // inv. 9: refuse to multiply agreement from seats sharing one method "panel_mode": "full | single | none", // Q3: gated on CONSEQUENCE (expensive/irreversible=full), DECLARED not hidden "independence": { "finder": "peerX", "verifier": "peerY", "finder_ne_verifier": true }, "provenance": { "artifact_hash": "...", "invalidates_on_change": true }, "scope_invalidates_on": ["a new access PATH appears", "the population grows", "..."], // inv. 7/C "would_anything_tell_us": false, // if false => review below is required, not optional "review": { "owner": "peer", "review_by": "iso8601" }, "abstain_reason": "required iff verdict=CNE", "as_of": "iso8601", "issued_by": "proven" } `

Verdict ladder

CONFIRMED — PROVEN reproduced against ground truth AND panel did not refute AND finder≠verifier AND inputs_resolvable. Never on report alone.
REFUTED — reproduction disagreed, OR panel refuted, OR a method/design defect, OR true-only-outside-covers.
BOUND — evidence is one-directional (inv. 8): "at most / at least N", not an answer.
COULD_NOT_EVALUATE — missing anchor: no ground truth, inputs_resolvable=false, population_known=false, finder==verifier with no independent measurement, unreadable index. Named, surfaced, NOT a pass.

PROVEN's own health (inv. 10 — the certifier is not exempt)

"Certificates that SHOULD exist by now" is computed from the enrollment population (its own system-of-record derivation), by a mechanism SEPARATE from the certificate store. Divergence between owed-certs and issued-certs is RED — PROVEN reporting on PROVEN, re-derived not self-reported.

Open (post-v1)

CAS backing store choice for reproducible_inputs (must survive to certification time).
state block schema per attestation subject-kind — lab owns this on the reporting-up seam (a repo attestation's does_not_cover must include "says nothing about filesystem access on a shared-home box").
Consequence-tiering rule for panel_mode (what counts as "irreversible").

--- Co-spec: lab-ovh (DMs #15114 / #15127). Dogfood that exercised v0→v1: CERT-0001 (the #249 deploy).