]> Alter Meridian Pty Ltd

blake@truealter.com

This memo specifies a read-time freshness evaluator and an observation-gated re-assertion discipline for concurrent autonomous readers of a single reconciled substrate history. For every claim read from the substrate, a three-state currency band (FRESH, AGING, STALE) is derived at read time from the durable history and is never stored. A claim whose derived band is not FRESH MUST NOT be re-emitted as current and MUST NOT ground a new durable claim; the sole transition back to currency is a fresh observation of the claim's basis, enforced at the substrate's append stage rather than at any reader's discretion. The memo is the claim-layer consumer that two companion specifications, Substrate-Observation as an Alternative to Envelope Coordination and the Substrate-Provenance Annotation Grammar, each left unspecified. The contribution is a specific composition: a read-time-derived band, a decay clock measured in missing observations learned from a basis's own change cadence, an append-stage rejection of any claim citing a basis that is no longer the head of its lineage, and observation as the only admissible refresh. No new substrate is standardised; the discipline composes with substrate that already exists.

Introduction When several autonomous readers share a single body of recorded knowledge, a recurring failure is that a reader cites an aged claim as though it were current. The claim was true when it was written; nothing in the intervening period forced it into an explicit uncertain state; so a reader retrieves it, finds a plausible value, and re-asserts it as present truth. The failure is acute for software agents that read a shared store, act on what they read, and write new records grounded in it: an aged foundation propagates silently into new durable state. Two companion memos establish the ground this memo builds on but each stops short of the claim layer. describes how concurrent sessions of a principal observe each other's presence through substrate byproducts rather than through a coordination envelope, and defines decay-to-uncertainty as a first-class terminal operating state; it concerns who-else-is-here, not what-was-written, and it deliberately standardises nothing. defines a closed-class grammar for annotating the provenance of a claim, including a terminal decayed-to-uncertainty class and an optional observation timestamp, but states that it does not specify what an inference system must do with the annotation. This memo specifies that missing consumer. It defines the shape of a read over a reconciled substrate, the derivation of a currency band for the read, and the discipline under which an aged claim may still be spoken but may not be re-asserted as current nor used to ground a new claim. The enforcement point is the substrate's append stage, since that is the only place a shared history can enforce anything without transmitting a coordination message.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. The following terms are defined for the purposes of this document:

• Claim. A recorded assertion together with the observations that ground it, held in the reconciled substrate history.
• Reconciled substrate. The single durable history that concurrent readers share, to which a claim is appended through the substrate-physics cascade of and from which every currency band is derived.
• Append stage. The point in that cascade at which a submitted claim is admitted to the durable history or rejected.
• Basis lineage. The append-only sequence of observation events for a single basis element (a file, a record, an external source, a prior claim). Each event has a stable observation identifier and a timestamp.
• Lineage head. The most recent observation event in a basis lineage at the moment of evaluation.
• Grounding observation. The specific observation event a claim cited as basis when it was written.
• Currency band. A three-state value, FRESH, AGING, or STALE, derived at read time for a claim, expressing whether the claim may be re-asserted as current.
• Expected-observation deficit. The difference between the number of observations a basis lineage's own measured cadence predicts should have occurred since a claim's grounding observation, and the number that actually occurred.
• Re-observation. A new observation event appended to a basis lineage, producing a new lineage head.
• Currency-fast-forward rule. The append-stage admissibility predicate that rejects any submitted claim whose cited basis is not the current head of its lineage.

The Claim Currency Envelope A read of the reconciled substrate returns a claim as an envelope, never as a bare value. The envelope carries the assertion, the timestamp of its grounding observation (as_of), the basis set (each element naming its substrate class per , its observation identifier, and its observation timestamp), the claim's decay class, the currency band derived at this read, the evidence from which the band was derived, the re-verification trigger (the moved or deficit-bearing basis elements whose re-observation F6 requires before the claim is FRESH again), and the supersession state. Three structural commitments govern the envelope. First, the band is derived at read time and MUST NOT be stored. A stored band is itself a claim that ages and would reintroduce the problem one level up. Deriving the band at each read from the current durable history makes the band exactly as fresh as the read. The envelope carries the band's own evidence (the lineage heads and deficits it was computed from) so that a relying party can re-derive and audit it. Second, as_of is the time of the grounding observation, not the time the claim was written. A claim is only ever as current as the observation that grounded it, and the delay between observing a basis and writing the claim MUST NOT make the claim appear younger than that observation. Third, supersession resolves before any band is derived. Validity and currency are separate: supersession decides whether a claim is valid, and the band grades whether a valid claim is current. A superseded claim has no band, and no band makes a superseded claim valid again.

Band Derivation The band is a pure function of the durable history. Every reader that derives the band against the same history state derives the same band. Two axes contribute, and either is sufficient to degrade a band.

Motion Axis For each basis element, the evaluator compares the claim's grounding observation identifier against the current head of that element's basis lineage. If a head has moved, the basis was re-observed after the claim was grounded, and what the basis records may have changed since. The motion axis counts appended observation events, not seconds. Counting events rather than reading a wall clock defeats confidence-replay (re-emitting an old observation cannot rewind a lineage head) and removes divergence from clock skew between readers (all readers observe the same sequence).

Silence Axis A basis that goes unobserved also decays, at a rate learned from its own lineage. The evaluator maintains, per basis element, the measured observation cadence: the empirical distribution of inter-observation intervals over a trailing window of the lineage. The expected-observation deficit is the number of observations the cadence predicts should have occurred since as_of, minus the number that occurred. A basis that historically changes hourly and has been silent for a day carries a large deficit; a basis that changes yearly and has been silent for a day carries none. No party declares the window; it is measured from the lineage itself. Confidence in an earlier observation therefore falls at a rate set by how fast the observed thing changes, rather than holding until a fixed expiry, as , Section 3.1 argues for authentication. A corollary follows. If a basis lineage's own observation cadence collapses, because the process that observes it has stopped, the deficit on that basis grows, and its dependent claims degrade toward STALE. Observer failure therefore produces conservative decay toward uncertainty, and a claim whose observer has stopped never appears current.

The Band

• FRESH: every lineage head equals the claim's grounding observation identifier, and the deficit is below its lower bound on every basis element.
• AGING: any single lineage head has moved, or the deficit is past its lower bound on any basis element.
• STALE: a moved head together with a deficit past the lower bound on the same element, or the deficit past its upper bound on any basis element, or the transitive rule of forces it.

STALE is a terminal operating state in the sense of Section 2: it is a state the reader continues to operate under, not an abort and not an eviction. The decay class of remains in the envelope as a coarse, human-legible summary of the measured volatility, but the normative derivation runs on the measured cadence, not on the label.

The Re-Assertion Discipline The discipline has a reader side and a substrate side. The reader-side rules alone would be advisory; the substrate-side rules enforce them.

Reader-Side Emission Rules

• F1. A reader MUST derive the band at read time from the durable history and MUST NOT reuse a band derived at an earlier read.
• F2. A claim whose derived band is FRESH MAY be emitted as current, carrying its substrate-class provenance, its as_of, and the band's evidence.
• F3. A claim whose derived band is AGING or STALE MUST NOT be emitted as current. It MAY be emitted only with the decayed-to-uncertainty annotation of attached, together with its as_of and derived band. Emission without the annotation, or with a fabricated FRESH band, is non-conformant.
• F4. A claim whose derived band is not FRESH MUST NOT appear in the basis set of any new claim submitted for append to the durable history. Aged state MAY be discussed; it MUST NOT be built upon.

Substrate-Side Enforcement

• F5 (the currency-fast-forward rule). The append stage of the reconciled substrate MUST reject any submitted claim whose cited basis observation identifier is not the current head of that basis element's lineage at append time. The rejection is a substrate commitment: it is observed identically by every session, transmits no coordination message, and fails closed. It is the claim-layer analogue of a cryptographic non-fast-forward rejection at a settlement layer.
• F6 (observation as the sole transition). The only transition from AGING or STALE back to FRESH is a re-observation: a new observation event on every moved or deficit-bearing basis element, appended to the durable history with a new observation identifier and timestamp. Elapsed time, repetition of the claim, agreement among any number of readers, receipt of any message, and any server grant MUST NOT effect the transition.
• F7. The evaluator MUST resolve supersession before band derivation, and the append stage MUST treat a claim citing a superseded claim as basis identically to one citing a non-head observation: rejected.

F4 and F5 are the central novel element. They relocate freshness enforcement from the read path to the append path, and they invert the protected direction. Cache freshness protects a reader from an aged copy; claim currency protects the future history from an aged foundation.

Transitive Currency A claim whose basis set includes another claim, rather than a raw observation, inherits a band equal to the minimum of its own intrinsic band and the minimum band across its basis closure. The inheritance is evaluated lazily at read time over the basis graph and memoised per read. Nothing propagates. There is no invalidation message, no dirty-flag walk, and no publish-subscribe fan-out, because those are the envelope coordination that identifies as an anti-pattern. Because each read recomputes the closure against the durable history, transitive currency is a pure function of the history, and every reader observes identical inheritance at identical history states. A dependent claim loses currency when its basis does, and no invalidation message is sent. A bound follows from F5: a claim whose basis had already been superseded at its lineage head can never have been admitted. Chains resting on a moved head therefore cannot form in the history going forward. A basis can still age by silence after admission, and transitive currency governs those chains as well as chains recorded before the discipline was in force.

Binding to the Reconciliation Cascade The claim tuples and their basis lineages live in the append-only identity-log stages of the substrate-physics cascade described in : the per-principal append log for claims scoped to one principal's sessions, and the per-organisation append log for collective claims. The principal and the organisation are each named by a ~handle, which corresponds to an alter: URI , for example alter:~alice for a person and alter:~example.com for an organisation. Filesystem-lock arbitration orders concurrent append attempts on the same lineage. External operational settlement is where a currency-fast-forward rejection surfaces for externally-visible commitments, the cryptographic non-fast-forward being the existing instance the rule generalises. The band evaluator reads lineage heads from the append-log stages, and the F5 gate executes at the same append stage the cascade already owns. The forcing function therefore adds no new stage; it adds one admissibility predicate to an existing stage. Like , this memo standardises no new substrate; it specifies a discipline over substrate that already exists.

Binding to the Provenance Grammar A decayed read carries its own wire evidence. The emission is tagged with the decayed-to-uncertainty terminal class of ; the grammar's observation timestamp field carries as_of; the grammar's observation-identifier field carries the grounding observation identifier. Any relying party can re-query the named lineage and confirm both the age and the head divergence independently. notes that an annotation is a declaration, not a proof. This memo answers that concern at the append stage. A forged FRESH band is rejected at F5, because a fabricated envelope cannot alter the lineage head the append stage checks. The append stage does not rely on a reader reporting its band honestly; it checks the lineage head.

One History, Many Views A single reconciled history and the mutual-hallucination property of are not in tension, because they occupy different layers. Each reader derives its own band at its own read moment. Two readers reading seconds apart, or reading while an append is in flight, may hold divergent local views of currency. No local band is canonical; that is mutual hallucination, preserved in full. But every band is a pure function of the same durable history. Divergence between readers is bounded to read-timing skew and never extends to disagreement about what the history contains. Divergence reconciles where reconciles everything: at the commitment stage. Whichever reader appends first advances the lineage head; the other reader's now-aged local view is caught by F5 when it attempts to build on it. No reader is ever told it was wrong; it observes the rejection, re-reads, and re-derives. There is one history and many views of it, and F5 keeps an aged view from being written into that history.

Why Not a TTL, Why Not Invalidation Messages, Why Not Abort Three simpler designs are rejected here, each for a different reason. A declared time-to-live, whether a fixed lifetime or a per-record fresh_until, is a window a party chooses. A chosen window is gameable and is blind to the basis's actual rate of change. The silence axis of measures the window from the basis's own lineage instead of declaring it. An invalidation message broadcast to readers when a basis changes is the envelope coordination rejects: it re-introduces a fan-out, a delivery guarantee, and a broker. The transitive currency of achieves invalidation as a read-time function of the history, with no message. An abort on aged input, the posture of a security-metadata expiry scheme, forfeits the terminal-operating-state posture. An agent that must continue under partial information needs to keep operating with an aged claim marked uncertain, not to halt. F3 keeps the aged claim speakable while F4 keeps it unbuildable.

Relation to Prior Art The contribution of this memo is a specific composition. Each element below exists somewhere in the landscape; none of the cited families combines them, and several are designed against the combination. Knowledge units for multi-model deliberation carry a per-unit fresh_until, a status of active, stale, or superseded, and a volatility tier, and on ageing a unit "SHOULD be considered potentially stale" and "SHOULD be re-deliberated". This is advisory, not forcing: the primary text places no block on citing or using an aged unit, and its own write side has no rule rejecting a new unit for referencing a stale parent. It is explicitly a many-units model: units are never modified in place, and change produces new units linked by supersedes and parent inheritance in a directed graph. Its recovery primitive is re-deliberation of the claim (a fresh round of model questioning), not re-observation of the basis. This memo inverts each of these: the discipline is forcing at the append stage, binds to a single reconciled history, and admits only re-observation as the transition to currency. HTTP caching freshness , with stale-while-revalidate and stale-if-error , computes freshness lifetime against current age and, on exceeding it, marks a response stale but permits serving it, either directly or while revalidating. Revalidation fires only on a reuse attempt, and currency is restored by an origin grant. Caches are per-node; there is no single reconciled history, and no origin exists behind a reconciled substrate. Under this memo an aged claim may still be spoken but may not be built on, currency returns only through a new observation, and the band is derived at every read whether or not a reuse is attempted. The Update Framework expires metadata and requires a client to refuse an expired file, aborting the workflow and reporting a possible freeze attack. The terminal state is abort, not an uncertainty state operated under, and the model is one client's security workflow, not a shared multi-reader history. Certificate Transparency requires a log to publish a signed tree head no older than a maximum merge delay, re-signing even when idle, with non-progress detected by external monitors. The freshness obligation is on the producer and the detection is off-path; there is no reader-side decay of a stored claim to uncertainty. The phi accrual failure detector outputs a continuous suspicion level about a process's liveness from heartbeat-arrival history, leaving the threshold to the consumer. The silence axis of borrows this inter-arrival statistical shape and inverts its subject: phi grades suspicion of a node's death and only ever informs, whereas the deficit grades uncertainty of a stored claim's currency and gates an append. Leases grant time-bounded permission to trust a cached datum, requiring re-acquisition on expiry. Expiry is a binary lapse of a server-granted permission, not a decay of the claim into a labelled uncertainty state, and the grant is an envelope from a server rather than a reader-side observation. DNS negative caching counts a time-to-live down to eviction, with an explicit absence of any intermediate unknown state, per resolver, with lazy re-query. Eviction is not decay-to-uncertainty, and there is no reconciled history.

Security Considerations Confidence-replay, in which an adversary re-emits an aged observation to refresh readers' confidence in stale state, is closed by two properties together. Because the motion axis counts in appended observation events, replay cannot rewind a lineage head, and because refresh requires a new append, a strictly advancing head cannot be moved backward. Ghost-basis injection, in which an adversary fabricates a lineage to feed a false cadence, is mitigated by the identity-bound append admission of the cascade in and by that memo's monotonic layer-coverage commitment. Band forgery has no effect at the append stage. A forged FRESH band cannot alter the lineage head the F5 predicate checks, and a forged envelope citing a non-head basis is rejected whatever band it claims. Emission-side forgery, a reader emitting an aged claim as FRESH, remains a conformance violation and is detectable by re-derivation against the history. Currency starvation, in which an adversary appends spurious observations onto a basis lineage to hold every dependent claim at AGING indefinitely, is mitigated by identity-bound append admission, by the cadence learner treating a sustained change in append rate as a new volatility regime, and by a per-lineage append-rate ceiling. Simulated split-brain across cascade stages is inherited from and its per-observer monotonic layer-coverage mitigation.

Privacy Considerations An observation lineage exposes the observation cadence of its basis, and that cadence can itself profile a principal's activity rhythm. Implementations SHOULD scope lineage visibility to the principal's own scope, and cadence-derived windows MUST NOT be used to manufacture a continuously refreshing per-individual surveillance signal. Pseudonymous-tier observations follow the refusal postures of Privacy Considerations.

IANA Considerations This memo requires no IANA actions. A future revision may register the currency-band vocabulary alongside any substrate-class registry established by .

Normative References In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Alter Meridian Pty Ltd Alter Meridian Pty Ltd Informative References The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document defines HTTP caches and the associated header fields that control cache behavior or indicate cacheable response messages. This document obsoletes RFC 7234. This document defines two independent HTTP Cache-Control extensions that allow control over the use of stale responses by caches. This document is not an Internet Standards Track specification; it is published for informational purposes. RFC1034 provided a description of how to cache negative responses. It however had a fundamental flaw in that it did not allow a name server to hand out those cached responses to other resolvers, thereby greatly reducing the effect of the caching. This document addresses issues raise in the light of experience and replaces RFC1034 Section 4.3.4. [STANDARDS-TRACK] This document describes version 2.0 of the Certificate Transparency (CT) protocol for publicly logging the existence of Transport Layer Security (TLS) server certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. This document obsoletes RFC 6962. It also specifies a new TLS extension that is used to send various CT log artifacts. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. Alter Meridian Pty Ltd Alter Meridian Pty Ltd

Acknowledgements This memo is the claim-layer consumer that and each left unspecified, and it stands directly on both.

Document History

draft-morrison-claim-currency-00

• Initial revision.
• Names the principal and the organisation of the per-principal and per-organisation append logs by ~handle, written as an alter: URI, and adds an informative reference to .
• Cites , Section 3.1 (informative), from the silence axis in .
• Rewrites figurative and aphoristic sentences in Sections 3, 4.1, 4.2, 4.3, 5, 6, 8, 9, 10, 11 and 12 as plain statements, with no requirement changed.
• Removes the hand-written Status of This Memo and Author's Address sections, which duplicated the ones the tools generate, replaces the hand-typed BCP 14 key-words paragraph in Section 2 with the standard boilerplate, and replaces the hard-coded section numbers with cross-references.
• Rewrites the prose against the drafting rules and pins each citation of another Internet-Draft to its latest posted revision, with no requirement changed.
• Moves each citation of another Internet-Draft in the stack to the revision going up with this one, with no requirement changed.