Oracle Confidence Gating: G-Score, Correlation-Aware von Neumann Confidence, and AdaptiveSwitch
draft-helmprotocol-confidence-00
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Author | 장동호 | ||
| Last updated | 2026-09-19 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-helmprotocol-confidence-00
Network Working Group H. Jorgen
Internet-Draft Independent
Intended status: Experimental 19 September 2026
Expires: 23 March 2027
Oracle Confidence Gating: G-Score, Correlation-Aware von Neumann
Confidence, and AdaptiveSwitch
draft-helmprotocol-confidence-00
Abstract
This document specifies an optional confidence layer for the TLS
TimeToken Secure Protocol (TTTPS). It defines the G-Score, a
normalized entropy measure of agreement concentration; an optional
correlation-aware von Neumann extension; the InsufficientKnowledge
signal; and the AdaptiveSwitch state machine over TURBO and FULL.
The confidence layer qualifies whether evidence justifies action. It
does not replace cryptographic integrity, define a wire format,
allocate a codepoint, establish source independence, or require any
core TTTPS implementation to compute confidence.
Status of This Memo
This document is an Internet-Draft and is submitted in full
conformance with BCP 78 and BCP 79. Internet- Drafts are working
documents of the IETF and have no formal standing in the IETF
standards process.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 23 March 2027.
Jorgen Expires 23 March 2027 [Page 1]
Internet-Draft Oracle Confidence Gating September 2026
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Conventions and Terminology . . . . . . . . . . . . . . . . . 3
3. G-Score . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Separation from Integrity . . . . . . . . . . . . . . . . . . 4
5. Optional GRG Integrity Profile . . . . . . . . . . . . . . . 4
6. Optional Correlation-Aware Extension . . . . . . . . . . . . 6
7. Epi-Entropy Shadow Analysis . . . . . . . . . . . . . . . . . 6
8. InsufficientKnowledge . . . . . . . . . . . . . . . . . . . . 7
9. AdaptiveSwitch . . . . . . . . . . . . . . . . . . . . . . . 8
10. Operational Confidence Contract . . . . . . . . . . . . . . . 8
11. Epistemic Bundle Contract . . . . . . . . . . . . . . . . . . 9
12. Threat-to-Control Analysis . . . . . . . . . . . . . . . . . 9
13. System Model and Observation Lifecycle . . . . . . . . . . . 10
14. Agreement Construction and Calibration . . . . . . . . . . . 11
15. Seven-Layer Verification Pipeline . . . . . . . . . . . . . . 11
16. Point Operators, Correlation, and Epi Shadow . . . . . . . . 12
17. AdaptiveSwitch Algorithm and State Semantics . . . . . . . . 13
18. Evaluation and Reproducibility Boundary . . . . . . . . . . . 13
19. Calibration, Thresholds, and Evidence Windows . . . . . . . . 13
20. Source Independence and Provenance . . . . . . . . . . . . . 14
21. Decision States and Transition Matrix . . . . . . . . . . . . 14
22. Implementation Topology and Commit Boundary . . . . . . . . . 15
23. Attack and Liveness Evaluation . . . . . . . . . . . . . . . 16
24. Evidence and Implementation Boundary . . . . . . . . . . . . 16
25. Security Considerations . . . . . . . . . . . . . . . . . . . 17
26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17
27. Normative References . . . . . . . . . . . . . . . . . . . . 17
28. Informative References . . . . . . . . . . . . . . . . . . . 17
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 18
Jorgen Expires 23 March 2027 [Page 2]
Internet-Draft Oracle Confidence Gating September 2026
1. Introduction
Integrity answers whether a record is admissible. Confidence answers
whether the available evidence justifies acting on it. A set of
valid signatures can remain diffuse, correlated, or ambiguous.
Treating confidence as a restatement of integrity makes the protocol
unable to preserve uncertainty.
This is an independent Confidence profile. It does not reproduce the
TTTPS core specification: it defines no wire format, header, octet
layout, transport behavior, PoT construction, GRG implementation
requirement, or codepoint. It does not define the mapping from
observed sources to an agreement distribution, source weighting,
threshold calibration, or deployment-specific physical identity.
A core implementation that never computes a confidence metric and
never signals InsufficientKnowledge remains conforming to the TTTPS
core. This document is an experimental companion profile, not a core
conformance requirement.
2. Conventions and Terminology
The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL are to be
interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only
when, they appear in all capitals.
Source: an independent time or ordering reference observed by a
node.
Agreement distribution: a probability distribution p over the
observed sources, with p_i the share attributed to source i.
G-Score: the normalized Shannon entropy of p.
InsufficientKnowledge: a typed result indicating that the enabled
confidence policy does not justify an oracle assertion.
TURBO: the AdaptiveSwitch state with reduced generation latency or
other configured acceleration.
FULL: the conservative AdaptiveSwitch state and initial state.
Epi evidence: optional evidence about residual ambiguity among
admissible interpretations.
Jorgen Expires 23 March 2027 [Page 3]
Internet-Draft Oracle Confidence Gating September 2026
3. G-Score
For an agreement distribution p over n sources, define:
G(p) = H(p) / log n
H(p) = sum_i -p_i log(p_i)
The same logarithm base MUST be used in H(p) and log n. For n
greater than one, 0 <= G(p) <= 1. A point mass has G(p) = 0 and a
uniform distribution has G(p) = 1. For n = 1, an implementation MUST
define the normalization explicitly; this document defines G(p) = 0.
The G-Score is a marginal concentration signal. It does not prove
that source labels represent independent physical origins, and it
does not prove that a valid record is true.
4. Separation from Integrity
The confidence subsystem is separate from the TTTPS integrity
pipeline. A node MUST NOT substitute a confidence result for
integrity verification. A record that fails integrity verification
is invalid regardless of G(p), and a high confidence result MUST NOT
make it valid.
Conversely, InsufficientKnowledge is not an integrity failure. It
indicates that the source evidence did not justify the requested
assertion. Implementations MUST preserve the distinction in evidence
receipts and failure handling.
5. Optional GRG Integrity Profile
This independent Confidence track carries the optional GRG integrity
profile that was intentionally kept out of the TTTPS core. It is an
integrity-layer input to this track, not a confidence metric.
G-Score, von Neumann confidence, Epi-Entropy, and AdaptiveSwitch MUST
NOT repair, reinterpret, or replace a GRG or SHA-256 integrity
verdict.
For a protected payload P and context identifier ctx_id, the GRG
profile exposes the ordered stages Golomb-Rice symbol preparation
(G1), Reed-Solomon erasure processing (R), Golay(23,12,7) bounded
correction (G2), and HMAC-SHA256 authentication (H). The order is
part of this profile's external interoperability contract. This
profile does not require a particular private optimization beyond
that contract.
Jorgen Expires 23 March 2027 [Page 4]
Internet-Draft Oracle Confidence Gating September 2026
E(P) = G2(R(G1(P)))
tag = HMAC-SHA256(K, E(P) || ctx_id)
GRG(P, ctx_id) = (E(P), tag, ctx_id)
Verify(tag, K, E(P), ctx_id) = true
Decode(E(P)) = P [intact or resolved]
The profile contract is:
* Lossless round trip: after tag verification, a result classified
intact or resolved MUST recover the protected payload P through
the inverse G2/R/G1 processing path. HMAC is authentication, not
a reversible encoding.
* Erasure tolerance: the deployment MUST declare k and n; the
reference profile uses k=4 and n=6, and recovery is permitted only
when the declared admissible shard condition is met.
* Bounded correction: the reference profile permits up to t=3 bit
errors per 23-bit Golay block; excess corruption is unresolvable.
* Context binding: distinct ctx_id values MUST produce independently
authenticated contexts; a result for ctx_id_A MUST NOT validate
for ctx_id_B.
Round trip: the recovered payload equals P when verification returns
resolved or intact.
Erasure handling: the profile MAY reconstruct from a declared
admissible subset of shards; k, n, and policy MUST be recorded.
Bounded correction: correction MUST be limited by the declared
profile capacity; excess corruption returns unresolvable.
Context binding: the authenticated result MUST bind ctx_id and MUST
NOT validate as a different context.
Jorgen Expires 23 March 2027 [Page 5]
Internet-Draft Oracle Confidence Gating September 2026
The profile emits intact, resolved, or unresolvable. A confidence
result cannot turn unresolvable into valid. The SHA-256 core path
remains sufficient for independent TTTPS conformance, and GRG remains
OPTIONAL. The current checked GRG reference path uses the perfect
binary Golay(23,12,7) code: twelve data bits are represented by a
23-bit codeword and up to three bit errors are correctable under the
declared decoder contract. The binary extended Golay [24,12,8] code
is a distinct profile and is not interchangeable with this reference
path; a deployment selecting it MUST declare a separate profile,
framing, and test vectors. This document makes no determination
about IPR validity, scope, or applicability and makes no licensing
commitment. Known IPR is handled through the IETF disclosure process
in BCP 79 [RFC8179].
6. Optional Correlation-Aware Extension
The G-Score is marginal and cannot detect source correlation by
construction. An implementation MAY assemble an admissible density
operator rho and compute:
S_VN(rho) = -Tr(rho log(rho))
When rho is diagonal under the declared representation, the
correlation-aware calculation reduces to the corresponding Shannon
calculation. Off-diagonal structure represents supplied pairwise
correlation; it is not evidence that was absent from the input.
The extension is OPTIONAL and has O(n^3) operator cost in the bounded
adapter. If aligned correlation data is absent, an implementation
MUST either use the Shannon arm or return an explicit unavailable
state; it MUST NOT fabricate a zero-correlation assertion.
The optional Epi evidence layer MAY represent a bundle of admissible
states, an entropy interval, or a bounded purity-derived lower bound.
It MAY reduce authority at a new commit boundary, but MUST NOT
rewrite an already committed record or replace the core integrity
result. A deep-space implementation may use the separate profile
[DEEPSPACE].
7. Epi-Entropy Shadow Analysis
Epi-Entropy is an optional epistemic layer for cases in which a
single density-operator estimate would conceal admissible alternative
interpretations. It is a shadow analyzer: it may qualify a new
promotion or commit decision, but it MUST NOT replace core integrity
or retroactively alter an issued record.
Jorgen Expires 23 March 2027 [Page 6]
Internet-Draft Oracle Confidence Gating September 2026
For observed constraints C = {(A_k,b_k)}, an implementation MAY
define the admissible density-operator bundle:
B(C) = { R | R = R^dagger, R >= 0, Tr(R) = 1,
Tr(R A_k) <= b_k for every k }
EpiEnt(B) = [ inf_R S_VN(R), sup_R S_VN(R) ]
S_VN(R) = -Tr(R log2 R)
Delta_id(B) = sup_(R,R' in B) 1/2 ||R-R'||_1
The exact lower endpoint can be computationally expensive because it
is a concave minimization problem. An implementation MAY instead
expose the certified purity-based bound
inf_R S_VN(R) >= -log2( sup_R Tr(R^2) )
as a lower bound, never as an exact endpoint unless separately
established. If B(C) is empty, the implementation MUST NOT evaluate
undefined entropy endpoints. It MUST return CONSTRAINT_INCONSISTENCY
or a documented degraded HOLD state.
A Soft-HOLD adapter MAY introduce nonnegative slack xi and solve for
the minimum declared relaxation. The slack, objective, tolerance,
and resulting state MUST be recorded. Slack MUST NOT silently
convert an inconsistent bundle into PASS.
B_xi(C): Tr(R A_k) <= b_k + xi_k, xi_k >= 0
B(C) = emptyset => State = DEGRADED_HOLD after min ||xi||_2
An EpiShadowAdapter MAY consume the existing G-Score trajectory and
authenticated context residuals to construct (A_k,b_k)
asynchronously. Missing TCB, OWLT, ephemeris alignment, or
provenance inputs MUST be represented as unavailable context or
CONSTRAINT_INCONSISTENCY; they MUST NOT be replaced with zeros or an
assumed independent source.
A nonzero Delta_id is not by itself proof of an attack. It is a
bounded ambiguity signal. Implementations SHOULD use a configured
threshold, hysteresis, and bounded recovery path. The default safe
action for an unresolved threshold crossing is HOLD, not permanent
quarantine.
8. InsufficientKnowledge
When confidence gating is enabled and a configured confidence
predicate is not established, the node MUST signal
InsufficientKnowledge or an equivalent explicitly documented state.
It MUST NOT assert oracle agreement for that observation merely
because a marginal concentration score is available.
Jorgen Expires 23 March 2027 [Page 7]
Internet-Draft Oracle Confidence Gating September 2026
The final predicate is implementation-defined and MAY include diffuse
agreement, missing aligned correlation, effective quorum below
policy, stale physical context, or an ambiguous Epi bundle. A
missing optional VN input MUST NOT be reported as a computed VN
result.
9. AdaptiveSwitch
AdaptiveSwitch maintains per-node state in {TURBO, FULL}. The initial
state MUST be FULL. Deployments define the entry threshold,
maintenance threshold, evaluation window, dwell time, and backoff
policy.
A node MUST NOT enter TURBO unless its configured quorum, freshness,
integrity, and confidence predicates all clear for the required
evaluation window. A node MUST leave TURBO when a configured
maintenance predicate fails, when freshness or integrity fails, or
when InsufficientKnowledge blocks promotion. Entry and maintenance
thresholds SHOULD provide hysteresis such that the maintenance
threshold is no more permissive than the entry threshold.
Backoff MUST be bounded. A failed confidence observation MAY cause a
conservative hold or transition, but it MUST NOT be silently counted
as cryptographic failure. Recovery MUST require fresh evidence and a
configured dwell or consecutive-success condition.
10. Operational Confidence Contract
The confidence result is meaningful only after admission and
provenance processing. Implementations MUST construct the agreement
distribution from admitted effective identities, not raw key or label
counts. A deployment MUST record the roster snapshot, provenance-
group mapping, observation window, weighting rule, and threshold
manifest used for the result.
N_eff = | { PhysicalEntity(stable_node_id_i) : i in Roster } |
PASS_conf = IntegrityOK AND FreshOK AND N_eff >= N_min
AND ConfidencePredicate(p, rho, B(C))
When N_eff is below the declared quorum, the implementation MUST
return HOLD_AHE or InsufficientKnowledge. A newly generated key,
duplicate certificate, or repeated relay MUST NOT increase N_eff.
This is the D-chain quorum-uniqueness boundary and is distinct from
entropy calculation.
A confidence receipt SHOULD contain a context identifier, roster
digest, effective-identity digest, provenance digest, distribution or
operator commitment, G-Score, selected regime, Epi-Entropy status,
Jorgen Expires 23 March 2027 [Page 8]
Internet-Draft Oracle Confidence Gating September 2026
threshold manifest, state transition, reason code, and evidence tier.
These fields MAY be committed out of band; this document does not add
them to the TTTPS wire record.
11. Epistemic Bundle Contract
The admissible bundle is a model of remaining interpretations, not a
second integrity verifier. For constraints C = {(A_k,b_k)}, a
deployment MAY use:
B(C) = { R in C^(n x n) | R = R^dagger, R >= 0, Tr(R)=1,
Tr(R A_k) <= b_k for every k }
EpiEnt(B) = [ inf_R S_VN(R), sup_R S_VN(R) ]
S_VN(R) = -Tr(R log2 R)
Delta_id(B) = sup_(R,R' in B) 1/2 ||R-R'||_1
The exact lower endpoint is not assumed to be cheap: minimizing a
concave entropy over a convex feasible set can be computationally
difficult. A bounded implementation MAY expose the certified purity
lower bound instead:
lower_bound = -log2( sup_(R in B) Tr(R^2) )
lower_bound <= inf_(R in B) S_VN(R)
The field MUST be labelled as a bound and MUST NOT be presented as
the exact endpoint. If B(C) is empty, endpoints are undefined. The
implementation MUST emit CONSTRAINT_INCONSISTENCY or documented
DEGRADED_HOLD; it MUST NOT substitute zero entropy or PASS.
A Soft-HOLD relaxation MAY use nonnegative slack xi. The slack norm,
per-constraint slack, solver tolerance, and selected state MUST be
retained in the evidence record. Relaxation is an applicability
decision and does not prove that the original constraints were
consistent.
12. Threat-to-Control Analysis
G-Score alone is blind to shared provenance. A coordinated Sybil
group can make marginal observations appear diffuse while retaining
one physical origin. The required order is admission, replay and
freshness checking, physical/provenance collapse, effective quorum
calculation, robust aggregation, and only then confidence scoring.
Coordinated Sybil: collapse duplicate physical or provisioning
identities; use N_eff; return HOLD_AHE below quorum.
Subtle poisoning: bind residuals and constraints to context and
Jorgen Expires 23 March 2027 [Page 9]
Internet-Draft Oracle Confidence Gating September 2026
retain the bundle or contradiction result; do not average
unavailable constraints as zero.
Context missing: signal UNKNOWN, HOLD, or CONSTRAINT_INCONSISTENCY;
never claim a computed VN value from absent correlation inputs.
Liveness attack: cap hysteresis and exponential backoff, preserve
bounded recovery, and distinguish confidence HOLD from integrity
REJECT.
13. System Model and Observation Lifecycle
The confidence profile assumes an issuer, observing peers, an
admission authority, and a verifier. An observation consists of a
value, observation epoch, context identifier, stable node identifier,
provenance group, freshness evidence, and the integrity result for
the enclosing TTTPS record.
The lifecycle is ordered: authenticate and admit a peer; check
D-chain freshness and replay scope; collapse duplicate physical
identities; project observations into the declared window; and only
then construct an agreement distribution or operator. A confidence
calculation performed earlier can count attacker-created labels as
independent evidence.
Observation: an authenticated candidate value with epoch, context,
identity, and provenance metadata.
Admitted observation: an observation that passed key, challenge,
freshness, replay, and policy checks.
Effective source: the source after physical and provisioning-
identity deduplication.
Confidence window: the declared set of aligned admitted observations
used by one score or bundle.
Source count, key count, provenance-group count, and effective
physical-entity count MUST be retained separately. A large raw
roster MUST NOT be described as a large independent quorum without an
authority-backed mapping.
Jorgen Expires 23 March 2027 [Page 10]
Internet-Draft Oracle Confidence Gating September 2026
14. Agreement Construction and Calibration
The input distribution p is policy-defined. A reference construction
assigns each admitted effective source a nonnegative agreement
weight, normalizes over the selected observation window, and records
the weighting rule and denominator. Missing or rejected observations
are not silently assigned a neutral vote.
w_i >= 0 (admitted effective source i)
p_i = w_i / sum_j w_j (sum_j w_j > 0)
H(p) = - sum_i p_i log_b(p_i)
G(p) = H(p) / log_b(n), n > 1
Thresholds are deployment contracts, not universal constants. A
policy MUST identify the entry threshold, maintenance threshold,
minimum effective quorum, window length, missing-data rule, and
recovery requirement. Calibration SHOULD include source class,
sample count, fixture identity, and the policy revision.
15. Seven-Layer Verification Pipeline
An implementation advertising the full confidence profile SHOULD
expose the following logical order. The layers may be colocated, but
their authority boundaries MUST remain distinguishable.
Jorgen Expires 23 March 2027 [Page 11]
Internet-Draft Oracle Confidence Gating September 2026
+===============+===========================+=====================+
| Layer | Input | Disposition |
+===============+===========================+=====================+
| PKI admission | stable ID, key, challenge | UNAUTHORIZED_VOTE |
| | | or admit |
+---------------+---------------------------+---------------------+
| Physical | identity and provenance | one vote per |
| deduplication | map | effective entity |
+---------------+---------------------------+---------------------+
| D-chain | nonce, RTT, round hash | replay invalidation |
| freshness | | or admit |
+---------------+---------------------------+---------------------+
| Unique quorum | N_eff and policy quorum | HOLD_AHE when |
| | | insufficient |
+---------------+---------------------------+---------------------+
| Robust | aligned admitted values | median or declared |
| aggregation | | aggregate |
+---------------+---------------------------+---------------------+
| VN | aligned pairwise evidence | optional |
| correlation | | qualification |
+---------------+---------------------------+---------------------+
| Epi shadow | constraint bundle and | read-only HOLD |
| | ambiguity | qualification |
+---------------+---------------------------+---------------------+
Table 1: Confidence pipeline layers
No later layer can repair an earlier failure. A high entropy score
cannot authorize an unauthenticated vote, and a low Epi ambiguity
cannot make a stale physical context applicable.
16. Point Operators, Correlation, and Epi Shadow
The von Neumann extension is useful only when the operator contains
declared aligned correlation evidence:
S_VN(rho) = -Tr(rho log2 rho)
If rho is diagonal in the declared representation, the value reduces
to the Shannon entropy of its diagonal. Off-diagonal terms MUST
identify their source and alignment window; they MUST NOT be
fabricated as an assumption of independence or dependence.
The Epi shadow is attached after provenance collapse and physical
applicability checks. A nonzero identity diameter is an ambiguity
signal, not proof of maliciousness. Policy MAY require HOLD for a
threshold crossing, but SHOULD provide hysteresis and bounded
recovery.
Jorgen Expires 23 March 2027 [Page 12]
Internet-Draft Oracle Confidence Gating September 2026
17. AdaptiveSwitch Algorithm and State Semantics
The initial state is FULL. Promotion to TURBO requires integrity,
freshness, effective quorum, applicable context, confidence, and Epi
predicates to hold for the evaluation window.
state := FULL
if state == FULL and success_count >= k_enter
and IntegrityOK and FreshOK and N_eff >= N_min
and EpiPolicyOK: state := TURBO
if state == TURBO and (IntegrityFail or FreshFail
or N_eff < N_min or EpiHold or failure_count >= k_exit):
state := FULL
Every transition SHOULD record pre-state, post-state, policy
revision, evidence digest, trigger, and time. Backoff MAY be applied
to repeated promotion failures, but the cap and reset condition MUST
be explicit. A confidence transition is not a cryptographic failure.
18. Evaluation and Reproducibility Boundary
The companion paper distinguishes specified, formally checked, unit-
tested, simulated, synthetic, live black-box, and hardware-measured
evidence. A unit test establishes behavior under its fixture; it
does not establish production wiring, independent source ownership,
or physical measurement.
A reproducible result SHOULD bind source revision, compiler and
dependency lock, configuration and policy hashes, input fixture or
seed, roster and provenance manifest, and output evidence digest. If
an artifact is unavailable, the result SHOULD be NOT_MEASURED, HOLD,
or UNVERIFIABLE rather than reconstructed from a guessed default.
The profile does not claim universal Sybil prevention, perfect
collusion detection, or a calibrated probability of truth. It
defines an auditable way to refuse unsupported authority while
preserving the core TTTPS integrity result.
19. Calibration, Thresholds, and Evidence Windows
A confidence threshold is a policy decision, not a universal
constant. A deployment MUST declare the observation window, minimum
effective quorum, weighting rule, missing-observation treatment, and
calibration data set from which thresholds were selected.
Calibration SHOULD include benign disagreement, correlated benign
sources, packet loss, clock drift, and recovery after a partition.
It MUST NOT use confidence as a substitute for admission or
authentication.
Jorgen Expires 23 March 2027 [Page 13]
Internet-Draft Oracle Confidence Gating September 2026
The confidence window MUST be closed before a result is committed.
Samples arriving after closure belong to a new window and MUST NOT
silently alter the previous receipt. An incomplete window MUST be
marked as partial under a declared policy or return
InsufficientKnowledge.
Window = (context_id, epoch_range, roster_digest, policy_revision)
ScoreInput = (admitted_observations, provenance_map, Window)
Decision = f(G(p), rho, B(C), N_eff, freshness, policy_revision)
Threshold changes MUST be versioned. Results from different
threshold manifests MUST NOT be compared as if they were measurements
from the same policy.
20. Source Independence and Provenance
Source independence is an attribution property. It cannot be
inferred from the number of public keys, signatures, transport
connections, or labels alone. A deployment MUST define the
provenance attributes it trusts, the authority asserting them, and
the behavior when an attribute is absent or contradictory.
N_eff = | { PhysicalEntity(stable_node_id_i) : i in admitted_roster } |
A relay can be delivery evidence without being a new physical source.
Two observations from one operator, clock, or ephemeris authority MAY
be correlated even when their signatures differ. Receipts SHOULD
distinguish observation identity, provenance identity, and
cryptographic signer identity.
Unknown provenance MAY be retained for diagnosis, but MUST NOT count
as an independent source for quorum or promotion unless the declared
policy permits that conservative class.
21. Decision States and Transition Matrix
+==========================+=====================+================+
| State | Meaning | Permitted |
| | | action |
+==========================+=====================+================+
| MEASURED | Declared confidence | A configured |
| | predicates cleared. | promotion or |
| | | commit MAY |
| | | proceed. |
+--------------------------+---------------------+----------------+
| INSUFFICIENT_KNOWLEDGE | A required | Do not assert |
| | predicate was not | oracle |
| | established. | agreement. |
Jorgen Expires 23 March 2027 [Page 14]
Internet-Draft Oracle Confidence Gating September 2026
+--------------------------+---------------------+----------------+
| HOLD_AHE | Effective quorum is | Only bounded |
| | below policy but a | holdover under |
| | bounded anchor | the declared |
| | remains usable. | drift budget. |
+--------------------------+---------------------+----------------+
| CONSTRAINT_INCONSISTENCY | The supplied bundle | Do not |
| | is empty or | evaluate |
| | contradictory. | undefined |
| | | endpoints. |
+--------------------------+---------------------+----------------+
| REJECT | Integrity, | Discard under |
| | authentication, or | the core |
| | replay failed. | security |
| | | policy. |
+--------------------------+---------------------+----------------+
Table 2: Confidence state interpretation
These states are non-equivalent. A confidence HOLD is not a
cryptographic REJECT, and a cryptographic REJECT MUST NOT be
downgraded because an entropy score is high. Implementations SHOULD
expose the first failed predicate.
22. Implementation Topology and Commit Boundary
A reference deployment may use an asynchronous shadow path. The
online path authenticates and admits observations, performs freshness
and quorum checks, and produces the core result. The shadow path
consumes authenticated residuals and provenance-bound observations,
computes G-Score and optional operator or bundle evidence, and
returns a qualification decision only to the next commit boundary.
admitted evidence -> provenance collapse -> G-Score/VN summary
| |
+-> EpiShadowAdapter -> qualification-+
|
next promotion/commit boundary
The shadow path MUST fail closed with respect to promotion: timeout,
malformed bundle, missing alignment, or unavailable correlation input
cannot silently become a positive result. Diagnostic collection MAY
continue only if it cannot authorize a core commit.
Jorgen Expires 23 March 2027 [Page 15]
Internet-Draft Oracle Confidence Gating September 2026
23. Attack and Liveness Evaluation
A serious evaluation MUST test both false acceptance and false
withholding. The matrix SHOULD include shared-provenance Sybil
observations, residual poisoning, missing physical context, replayed
windows, partitioned rosters, correlated benign sources, and
transient sensor noise. Each case MUST state whether the expected
disposition is REJECT, HOLD, INSUFFICIENT_KNOWLEDGE, or MEASURED.
For each scenario retain the admitted roster, N_eff, window size,
G-Score, correlation-input status, Epi bundle status, AdaptiveSwitch
state, latency, and recovery time. Detection of ambiguity does not
establish attack attribution; it establishes that the stated
ambiguity policy was exercised.
DoS resistance is evaluated separately. Implementations SHOULD cap
solver work, bound slack search, bound shadow queue growth, and rate-
limit state transitions. A conservative HOLD with bounded recovery
is preferable to permanent quarantine on one noisy observation.
24. Evidence and Implementation Boundary
The confidence layer SHOULD record source identities, provenance
groups, input distribution, selected regime, threshold manifest,
context identifier, result state, reason code, and evidence tier.
The following tiers are distinct: specified, formally checked, unit
tested, implemented offline, simulated, synthetic, live black-box,
and hardware measured.
A unit test does not prove live wiring. An offline Epi adapter does
not prove a production AdaptiveSwitch path consumes it. Source count
does not prove source independence. These boundaries MUST remain
visible in implementation status and publication claims.
The companion research paper is Oracle Confidence Gating for TTTPS:
G-Score, Correlation-Aware von Neumann Confidence, and
AdaptiveSwitch, SSRN abstract 7487098, Heime Jorgen, Independent,
licensed under Creative Commons Attribution (CC BY):
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7487098
[CONFIDENCEPAPER]. The paper is informative background and does not
change this document's optional status.
Jorgen Expires 23 March 2027 [Page 16]
Internet-Draft Oracle Confidence Gating September 2026
25. Security Considerations
Colluding labels can inflate a marginal agreement distribution when
provenance is not collapsed. Implementations SHOULD collapse
effective identities before quorum and confidence calculation. The
mapping is an authority input, not something G-Score can infer from a
label.
Sybil resistance is a provenance and admission property, not an
entropy-only property. Before constructing p or rho, an
implementation SHOULD validate D-chain freshness and collapse labels
to an effective identity and provenance group. A fresh key MUST NOT
increase the effective quorum merely because it has a valid
signature. Let N_eff be the number of admitted unique provenance
groups; quorum and Byzantine aggregation MUST use N_eff, not the raw
label count. If N_eff is below policy, the result is HOLD or
InsufficientKnowledge. This bounds the claimed defense to the
declared identity and provenance authority; it does not prove
universal Sybil prevention.
Confidence thresholds can become denial-of-service controls.
Implementations SHOULD bound backoff, expose HOLD and UNKNOWN states,
and preserve a recovery path based on fresh evidence. A confidence
result MUST NOT authorize a record that fails integrity, freshness,
or admission.
26. IANA Considerations
This document makes no IANA request. It defines no wire field,
codepoint, registry, or mandatory algorithm.
27. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC8179] Bradner, S. and J. Contreras, "Intellectual Property
Rights in IETF Technology", BCP 79, RFC 8179, May 2017,
<https://www.rfc-editor.org/info/rfc8179>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, May 2017,
<https://www.rfc-editor.org/info/rfc8174>.
28. Informative References
Jorgen Expires 23 March 2027 [Page 17]
Internet-Draft Oracle Confidence Gating September 2026
[TTTPS] Jorgen, H., "The TLS TimeToken Secure Protocol
(tttps://)", Work in Progress, Internet-Draft, draft-
helmprotocol-tttps-10, <https://datatracker.ietf.org/doc/
draft-helmprotocol-tttps/>.
[DEEPSPACE]
Jorgen, H., "TTTPS Deep-space Profile", Work in Progress,
Internet-Draft, draft-helmprotocol-deepspace-00, 2026,
<https://datatracker.ietf.org/doc/draft-helmprotocol-
deepspace/>.
[CONFIDENCEPAPER]
Jorgen, H., "Oracle Confidence Gating for TTTPS: G-Score,
Correlation-Aware von Neumann Confidence, and
AdaptiveSwitch", SSRN 7487098, 2026,
<https://papers.ssrn.com/sol3/
papers.cfm?abstract_id=7487098>.
Author's Address
Heime Jorgen
Independent
Email: heime.jorgen@proton.me
Jorgen Expires 23 March 2027 [Page 18]