Skip to main content

Oracle Confidence Gating: G-Score, Correlation-Aware von Neumann Confidence, and AdaptiveSwitch
draft-helmprotocol-confidence-00

Document Type Active Internet-Draft (individual)
Author 장동호
Last updated 2026-09-19
RFC stream (None)
Intended RFC status (None)
Formats
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date (None)
Responsible AD (None)
Send notices to (None)
draft-helmprotocol-confidence-00
Network Working Group                                          H. Jorgen
Internet-Draft                                               Independent
Intended status: Experimental                          19 September 2026
Expires: 23 March 2027

    Oracle Confidence Gating: G-Score, Correlation-Aware von Neumann
                     Confidence, and AdaptiveSwitch
                    draft-helmprotocol-confidence-00

Abstract

   This document specifies an optional confidence layer for the TLS
   TimeToken Secure Protocol (TTTPS).  It defines the G-Score, a
   normalized entropy measure of agreement concentration; an optional
   correlation-aware von Neumann extension; the InsufficientKnowledge
   signal; and the AdaptiveSwitch state machine over TURBO and FULL.
   The confidence layer qualifies whether evidence justifies action.  It
   does not replace cryptographic integrity, define a wire format,
   allocate a codepoint, establish source independence, or require any
   core TTTPS implementation to compute confidence.

Status of This Memo

   This document is an Internet-Draft and is submitted in full
   conformance with BCP 78 and BCP 79.  Internet- Drafts are working
   documents of the IETF and have no formal standing in the IETF
   standards process.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 23 March 2027.

Jorgen                    Expires 23 March 2027                 [Page 1]
Internet-Draft          Oracle Confidence Gating          September 2026

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
   2.  Conventions and Terminology . . . . . . . . . . . . . . . . .   3
   3.  G-Score . . . . . . . . . . . . . . . . . . . . . . . . . . .   4
   4.  Separation from Integrity . . . . . . . . . . . . . . . . . .   4
   5.  Optional GRG Integrity Profile  . . . . . . . . . . . . . . .   4
   6.  Optional Correlation-Aware Extension  . . . . . . . . . . . .   6
   7.  Epi-Entropy Shadow Analysis . . . . . . . . . . . . . . . . .   6
   8.  InsufficientKnowledge . . . . . . . . . . . . . . . . . . . .   7
   9.  AdaptiveSwitch  . . . . . . . . . . . . . . . . . . . . . . .   8
   10. Operational Confidence Contract . . . . . . . . . . . . . . .   8
   11. Epistemic Bundle Contract . . . . . . . . . . . . . . . . . .   9
   12. Threat-to-Control Analysis  . . . . . . . . . . . . . . . . .   9
   13. System Model and Observation Lifecycle  . . . . . . . . . . .  10
   14. Agreement Construction and Calibration  . . . . . . . . . . .  11
   15. Seven-Layer Verification Pipeline . . . . . . . . . . . . . .  11
   16. Point Operators, Correlation, and Epi Shadow  . . . . . . . .  12
   17. AdaptiveSwitch Algorithm and State Semantics  . . . . . . . .  13
   18. Evaluation and Reproducibility Boundary . . . . . . . . . . .  13
   19. Calibration, Thresholds, and Evidence Windows . . . . . . . .  13
   20. Source Independence and Provenance  . . . . . . . . . . . . .  14
   21. Decision States and Transition Matrix . . . . . . . . . . . .  14
   22. Implementation Topology and Commit Boundary . . . . . . . . .  15
   23. Attack and Liveness Evaluation  . . . . . . . . . . . . . . .  16
   24. Evidence and Implementation Boundary  . . . . . . . . . . . .  16
   25. Security Considerations . . . . . . . . . . . . . . . . . . .  17
   26. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  17
   27. Normative References  . . . . . . . . . . . . . . . . . . . .  17
   28. Informative References  . . . . . . . . . . . . . . . . . . .  17
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  18

Jorgen                    Expires 23 March 2027                 [Page 2]
Internet-Draft          Oracle Confidence Gating          September 2026

1.  Introduction

   Integrity answers whether a record is admissible.  Confidence answers
   whether the available evidence justifies acting on it.  A set of
   valid signatures can remain diffuse, correlated, or ambiguous.
   Treating confidence as a restatement of integrity makes the protocol
   unable to preserve uncertainty.

   This is an independent Confidence profile.  It does not reproduce the
   TTTPS core specification: it defines no wire format, header, octet
   layout, transport behavior, PoT construction, GRG implementation
   requirement, or codepoint.  It does not define the mapping from
   observed sources to an agreement distribution, source weighting,
   threshold calibration, or deployment-specific physical identity.

   A core implementation that never computes a confidence metric and
   never signals InsufficientKnowledge remains conforming to the TTTPS
   core.  This document is an experimental companion profile, not a core
   conformance requirement.

2.  Conventions and Terminology

   The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
   SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL are to be
   interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only
   when, they appear in all capitals.

   Source:  an independent time or ordering reference observed by a
      node.

   Agreement distribution:  a probability distribution p over the
      observed sources, with p_i the share attributed to source i.

   G-Score:  the normalized Shannon entropy of p.

   InsufficientKnowledge:  a typed result indicating that the enabled
      confidence policy does not justify an oracle assertion.

   TURBO:  the AdaptiveSwitch state with reduced generation latency or
      other configured acceleration.

   FULL:  the conservative AdaptiveSwitch state and initial state.

   Epi evidence:  optional evidence about residual ambiguity among
      admissible interpretations.

Jorgen                    Expires 23 March 2027                 [Page 3]
Internet-Draft          Oracle Confidence Gating          September 2026

3.  G-Score

   For an agreement distribution p over n sources, define:

           G(p) = H(p) / log n
           H(p) = sum_i -p_i log(p_i)

   The same logarithm base MUST be used in H(p) and log n.  For n
   greater than one, 0 <= G(p) <= 1.  A point mass has G(p) = 0 and a
   uniform distribution has G(p) = 1.  For n = 1, an implementation MUST
   define the normalization explicitly; this document defines G(p) = 0.

   The G-Score is a marginal concentration signal.  It does not prove
   that source labels represent independent physical origins, and it
   does not prove that a valid record is true.

4.  Separation from Integrity

   The confidence subsystem is separate from the TTTPS integrity
   pipeline.  A node MUST NOT substitute a confidence result for
   integrity verification.  A record that fails integrity verification
   is invalid regardless of G(p), and a high confidence result MUST NOT
   make it valid.

   Conversely, InsufficientKnowledge is not an integrity failure.  It
   indicates that the source evidence did not justify the requested
   assertion.  Implementations MUST preserve the distinction in evidence
   receipts and failure handling.

5.  Optional GRG Integrity Profile

   This independent Confidence track carries the optional GRG integrity
   profile that was intentionally kept out of the TTTPS core.  It is an
   integrity-layer input to this track, not a confidence metric.
   G-Score, von Neumann confidence, Epi-Entropy, and AdaptiveSwitch MUST
   NOT repair, reinterpret, or replace a GRG or SHA-256 integrity
   verdict.

   For a protected payload P and context identifier ctx_id, the GRG
   profile exposes the ordered stages Golomb-Rice symbol preparation
   (G1), Reed-Solomon erasure processing (R), Golay(23,12,7) bounded
   correction (G2), and HMAC-SHA256 authentication (H).  The order is
   part of this profile's external interoperability contract.  This
   profile does not require a particular private optimization beyond
   that contract.

Jorgen                    Expires 23 March 2027                 [Page 4]
Internet-Draft          Oracle Confidence Gating          September 2026

           E(P) = G2(R(G1(P)))
           tag = HMAC-SHA256(K, E(P) || ctx_id)
           GRG(P, ctx_id) = (E(P), tag, ctx_id)
           Verify(tag, K, E(P), ctx_id) = true
           Decode(E(P)) = P                    [intact or resolved]

   The profile contract is:

   *  Lossless round trip: after tag verification, a result classified
      intact or resolved MUST recover the protected payload P through
      the inverse G2/R/G1 processing path.  HMAC is authentication, not
      a reversible encoding.

   *  Erasure tolerance: the deployment MUST declare k and n; the
      reference profile uses k=4 and n=6, and recovery is permitted only
      when the declared admissible shard condition is met.

   *  Bounded correction: the reference profile permits up to t=3 bit
      errors per 23-bit Golay block; excess corruption is unresolvable.

   *  Context binding: distinct ctx_id values MUST produce independently
      authenticated contexts; a result for ctx_id_A MUST NOT validate
      for ctx_id_B.

   Round trip:  the recovered payload equals P when verification returns
      resolved or intact.

   Erasure handling:  the profile MAY reconstruct from a declared
      admissible subset of shards; k, n, and policy MUST be recorded.

   Bounded correction:  correction MUST be limited by the declared
      profile capacity; excess corruption returns unresolvable.

   Context binding:  the authenticated result MUST bind ctx_id and MUST
      NOT validate as a different context.

Jorgen                    Expires 23 March 2027                 [Page 5]
Internet-Draft          Oracle Confidence Gating          September 2026

   The profile emits intact, resolved, or unresolvable.  A confidence
   result cannot turn unresolvable into valid.  The SHA-256 core path
   remains sufficient for independent TTTPS conformance, and GRG remains
   OPTIONAL.  The current checked GRG reference path uses the perfect
   binary Golay(23,12,7) code: twelve data bits are represented by a
   23-bit codeword and up to three bit errors are correctable under the
   declared decoder contract.  The binary extended Golay [24,12,8] code
   is a distinct profile and is not interchangeable with this reference
   path; a deployment selecting it MUST declare a separate profile,
   framing, and test vectors.  This document makes no determination
   about IPR validity, scope, or applicability and makes no licensing
   commitment.  Known IPR is handled through the IETF disclosure process
   in BCP 79 [RFC8179].

6.  Optional Correlation-Aware Extension

   The G-Score is marginal and cannot detect source correlation by
   construction.  An implementation MAY assemble an admissible density
   operator rho and compute:

           S_VN(rho) = -Tr(rho log(rho))

   When rho is diagonal under the declared representation, the
   correlation-aware calculation reduces to the corresponding Shannon
   calculation.  Off-diagonal structure represents supplied pairwise
   correlation; it is not evidence that was absent from the input.

   The extension is OPTIONAL and has O(n^3) operator cost in the bounded
   adapter.  If aligned correlation data is absent, an implementation
   MUST either use the Shannon arm or return an explicit unavailable
   state; it MUST NOT fabricate a zero-correlation assertion.

   The optional Epi evidence layer MAY represent a bundle of admissible
   states, an entropy interval, or a bounded purity-derived lower bound.
   It MAY reduce authority at a new commit boundary, but MUST NOT
   rewrite an already committed record or replace the core integrity
   result.  A deep-space implementation may use the separate profile
   [DEEPSPACE].

7.  Epi-Entropy Shadow Analysis

   Epi-Entropy is an optional epistemic layer for cases in which a
   single density-operator estimate would conceal admissible alternative
   interpretations.  It is a shadow analyzer: it may qualify a new
   promotion or commit decision, but it MUST NOT replace core integrity
   or retroactively alter an issued record.

Jorgen                    Expires 23 March 2027                 [Page 6]
Internet-Draft          Oracle Confidence Gating          September 2026

   For observed constraints C = {(A_k,b_k)}, an implementation MAY
   define the admissible density-operator bundle:

           B(C) = { R | R = R^dagger, R >= 0, Tr(R) = 1,
                     Tr(R A_k) <= b_k for every k }
           EpiEnt(B) = [ inf_R S_VN(R), sup_R S_VN(R) ]
           S_VN(R) = -Tr(R log2 R)
           Delta_id(B) = sup_(R,R' in B) 1/2 ||R-R'||_1

   The exact lower endpoint can be computationally expensive because it
   is a concave minimization problem.  An implementation MAY instead
   expose the certified purity-based bound

           inf_R S_VN(R) >= -log2( sup_R Tr(R^2) )

   as a lower bound, never as an exact endpoint unless separately
   established.  If B(C) is empty, the implementation MUST NOT evaluate
   undefined entropy endpoints.  It MUST return CONSTRAINT_INCONSISTENCY
   or a documented degraded HOLD state.

   A Soft-HOLD adapter MAY introduce nonnegative slack xi and solve for
   the minimum declared relaxation.  The slack, objective, tolerance,
   and resulting state MUST be recorded.  Slack MUST NOT silently
   convert an inconsistent bundle into PASS.

           B_xi(C): Tr(R A_k) <= b_k + xi_k, xi_k >= 0
           B(C) = emptyset => State = DEGRADED_HOLD after min ||xi||_2

   An EpiShadowAdapter MAY consume the existing G-Score trajectory and
   authenticated context residuals to construct (A_k,b_k)
   asynchronously.  Missing TCB, OWLT, ephemeris alignment, or
   provenance inputs MUST be represented as unavailable context or
   CONSTRAINT_INCONSISTENCY; they MUST NOT be replaced with zeros or an
   assumed independent source.

   A nonzero Delta_id is not by itself proof of an attack.  It is a
   bounded ambiguity signal.  Implementations SHOULD use a configured
   threshold, hysteresis, and bounded recovery path.  The default safe
   action for an unresolved threshold crossing is HOLD, not permanent
   quarantine.

8.  InsufficientKnowledge

   When confidence gating is enabled and a configured confidence
   predicate is not established, the node MUST signal
   InsufficientKnowledge or an equivalent explicitly documented state.
   It MUST NOT assert oracle agreement for that observation merely
   because a marginal concentration score is available.

Jorgen                    Expires 23 March 2027                 [Page 7]
Internet-Draft          Oracle Confidence Gating          September 2026

   The final predicate is implementation-defined and MAY include diffuse
   agreement, missing aligned correlation, effective quorum below
   policy, stale physical context, or an ambiguous Epi bundle.  A
   missing optional VN input MUST NOT be reported as a computed VN
   result.

9.  AdaptiveSwitch

   AdaptiveSwitch maintains per-node state in {TURBO, FULL}. The initial
   state MUST be FULL.  Deployments define the entry threshold,
   maintenance threshold, evaluation window, dwell time, and backoff
   policy.

   A node MUST NOT enter TURBO unless its configured quorum, freshness,
   integrity, and confidence predicates all clear for the required
   evaluation window.  A node MUST leave TURBO when a configured
   maintenance predicate fails, when freshness or integrity fails, or
   when InsufficientKnowledge blocks promotion.  Entry and maintenance
   thresholds SHOULD provide hysteresis such that the maintenance
   threshold is no more permissive than the entry threshold.

   Backoff MUST be bounded.  A failed confidence observation MAY cause a
   conservative hold or transition, but it MUST NOT be silently counted
   as cryptographic failure.  Recovery MUST require fresh evidence and a
   configured dwell or consecutive-success condition.

10.  Operational Confidence Contract

   The confidence result is meaningful only after admission and
   provenance processing.  Implementations MUST construct the agreement
   distribution from admitted effective identities, not raw key or label
   counts.  A deployment MUST record the roster snapshot, provenance-
   group mapping, observation window, weighting rule, and threshold
   manifest used for the result.

          N_eff = | { PhysicalEntity(stable_node_id_i) : i in Roster } |
          PASS_conf = IntegrityOK AND FreshOK AND N_eff >= N_min
                      AND ConfidencePredicate(p, rho, B(C))

   When N_eff is below the declared quorum, the implementation MUST
   return HOLD_AHE or InsufficientKnowledge.  A newly generated key,
   duplicate certificate, or repeated relay MUST NOT increase N_eff.
   This is the D-chain quorum-uniqueness boundary and is distinct from
   entropy calculation.

   A confidence receipt SHOULD contain a context identifier, roster
   digest, effective-identity digest, provenance digest, distribution or
   operator commitment, G-Score, selected regime, Epi-Entropy status,

Jorgen                    Expires 23 March 2027                 [Page 8]
Internet-Draft          Oracle Confidence Gating          September 2026

   threshold manifest, state transition, reason code, and evidence tier.
   These fields MAY be committed out of band; this document does not add
   them to the TTTPS wire record.

11.  Epistemic Bundle Contract

   The admissible bundle is a model of remaining interpretations, not a
   second integrity verifier.  For constraints C = {(A_k,b_k)}, a
   deployment MAY use:

           B(C) = { R in C^(n x n) | R = R^dagger, R >= 0, Tr(R)=1,
                    Tr(R A_k) <= b_k for every k }
           EpiEnt(B) = [ inf_R S_VN(R), sup_R S_VN(R) ]
           S_VN(R) = -Tr(R log2 R)
           Delta_id(B) = sup_(R,R' in B) 1/2 ||R-R'||_1

   The exact lower endpoint is not assumed to be cheap: minimizing a
   concave entropy over a convex feasible set can be computationally
   difficult.  A bounded implementation MAY expose the certified purity
   lower bound instead:

           lower_bound = -log2( sup_(R in B) Tr(R^2) )
           lower_bound <= inf_(R in B) S_VN(R)

   The field MUST be labelled as a bound and MUST NOT be presented as
   the exact endpoint.  If B(C) is empty, endpoints are undefined.  The
   implementation MUST emit CONSTRAINT_INCONSISTENCY or documented
   DEGRADED_HOLD; it MUST NOT substitute zero entropy or PASS.

   A Soft-HOLD relaxation MAY use nonnegative slack xi.  The slack norm,
   per-constraint slack, solver tolerance, and selected state MUST be
   retained in the evidence record.  Relaxation is an applicability
   decision and does not prove that the original constraints were
   consistent.

12.  Threat-to-Control Analysis

   G-Score alone is blind to shared provenance.  A coordinated Sybil
   group can make marginal observations appear diffuse while retaining
   one physical origin.  The required order is admission, replay and
   freshness checking, physical/provenance collapse, effective quorum
   calculation, robust aggregation, and only then confidence scoring.

   Coordinated Sybil:  collapse duplicate physical or provisioning
      identities; use N_eff; return HOLD_AHE below quorum.

   Subtle poisoning:  bind residuals and constraints to context and

Jorgen                    Expires 23 March 2027                 [Page 9]
Internet-Draft          Oracle Confidence Gating          September 2026

      retain the bundle or contradiction result; do not average
      unavailable constraints as zero.

   Context missing:  signal UNKNOWN, HOLD, or CONSTRAINT_INCONSISTENCY;
      never claim a computed VN value from absent correlation inputs.

   Liveness attack:  cap hysteresis and exponential backoff, preserve
      bounded recovery, and distinguish confidence HOLD from integrity
      REJECT.

13.  System Model and Observation Lifecycle

   The confidence profile assumes an issuer, observing peers, an
   admission authority, and a verifier.  An observation consists of a
   value, observation epoch, context identifier, stable node identifier,
   provenance group, freshness evidence, and the integrity result for
   the enclosing TTTPS record.

   The lifecycle is ordered: authenticate and admit a peer; check
   D-chain freshness and replay scope; collapse duplicate physical
   identities; project observations into the declared window; and only
   then construct an agreement distribution or operator.  A confidence
   calculation performed earlier can count attacker-created labels as
   independent evidence.

   Observation:  an authenticated candidate value with epoch, context,
      identity, and provenance metadata.

   Admitted observation:  an observation that passed key, challenge,
      freshness, replay, and policy checks.

   Effective source:  the source after physical and provisioning-
      identity deduplication.

   Confidence window:  the declared set of aligned admitted observations
      used by one score or bundle.

   Source count, key count, provenance-group count, and effective
   physical-entity count MUST be retained separately.  A large raw
   roster MUST NOT be described as a large independent quorum without an
   authority-backed mapping.

Jorgen                    Expires 23 March 2027                [Page 10]
Internet-Draft          Oracle Confidence Gating          September 2026

14.  Agreement Construction and Calibration

   The input distribution p is policy-defined.  A reference construction
   assigns each admitted effective source a nonnegative agreement
   weight, normalizes over the selected observation window, and records
   the weighting rule and denominator.  Missing or rejected observations
   are not silently assigned a neutral vote.

          w_i >= 0                         (admitted effective source i)
          p_i = w_i / sum_j w_j            (sum_j w_j > 0)
          H(p) = - sum_i p_i log_b(p_i)
          G(p) = H(p) / log_b(n),           n > 1

   Thresholds are deployment contracts, not universal constants.  A
   policy MUST identify the entry threshold, maintenance threshold,
   minimum effective quorum, window length, missing-data rule, and
   recovery requirement.  Calibration SHOULD include source class,
   sample count, fixture identity, and the policy revision.

15.  Seven-Layer Verification Pipeline

   An implementation advertising the full confidence profile SHOULD
   expose the following logical order.  The layers may be colocated, but
   their authority boundaries MUST remain distinguishable.

Jorgen                    Expires 23 March 2027                [Page 11]
Internet-Draft          Oracle Confidence Gating          September 2026

    +===============+===========================+=====================+
    | Layer         | Input                     | Disposition         |
    +===============+===========================+=====================+
    | PKI admission | stable ID, key, challenge | UNAUTHORIZED_VOTE   |
    |               |                           | or admit            |
    +---------------+---------------------------+---------------------+
    | Physical      | identity and provenance   | one vote per        |
    | deduplication | map                       | effective entity    |
    +---------------+---------------------------+---------------------+
    | D-chain       | nonce, RTT, round hash    | replay invalidation |
    | freshness     |                           | or admit            |
    +---------------+---------------------------+---------------------+
    | Unique quorum | N_eff and policy quorum   | HOLD_AHE when       |
    |               |                           | insufficient        |
    +---------------+---------------------------+---------------------+
    | Robust        | aligned admitted values   | median or declared  |
    | aggregation   |                           | aggregate           |
    +---------------+---------------------------+---------------------+
    | VN            | aligned pairwise evidence | optional            |
    | correlation   |                           | qualification       |
    +---------------+---------------------------+---------------------+
    | Epi shadow    | constraint bundle and     | read-only HOLD      |
    |               | ambiguity                 | qualification       |
    +---------------+---------------------------+---------------------+

                    Table 1: Confidence pipeline layers

   No later layer can repair an earlier failure.  A high entropy score
   cannot authorize an unauthenticated vote, and a low Epi ambiguity
   cannot make a stale physical context applicable.

16.  Point Operators, Correlation, and Epi Shadow

   The von Neumann extension is useful only when the operator contains
   declared aligned correlation evidence:

           S_VN(rho) = -Tr(rho log2 rho)

   If rho is diagonal in the declared representation, the value reduces
   to the Shannon entropy of its diagonal.  Off-diagonal terms MUST
   identify their source and alignment window; they MUST NOT be
   fabricated as an assumption of independence or dependence.

   The Epi shadow is attached after provenance collapse and physical
   applicability checks.  A nonzero identity diameter is an ambiguity
   signal, not proof of maliciousness.  Policy MAY require HOLD for a
   threshold crossing, but SHOULD provide hysteresis and bounded
   recovery.

Jorgen                    Expires 23 March 2027                [Page 12]
Internet-Draft          Oracle Confidence Gating          September 2026

17.  AdaptiveSwitch Algorithm and State Semantics

   The initial state is FULL.  Promotion to TURBO requires integrity,
   freshness, effective quorum, applicable context, confidence, and Epi
   predicates to hold for the evaluation window.

           state := FULL
           if state == FULL and success_count >= k_enter
              and IntegrityOK and FreshOK and N_eff >= N_min
              and EpiPolicyOK: state := TURBO
           if state == TURBO and (IntegrityFail or FreshFail
              or N_eff < N_min or EpiHold or failure_count >= k_exit):
                state := FULL

   Every transition SHOULD record pre-state, post-state, policy
   revision, evidence digest, trigger, and time.  Backoff MAY be applied
   to repeated promotion failures, but the cap and reset condition MUST
   be explicit.  A confidence transition is not a cryptographic failure.

18.  Evaluation and Reproducibility Boundary

   The companion paper distinguishes specified, formally checked, unit-
   tested, simulated, synthetic, live black-box, and hardware-measured
   evidence.  A unit test establishes behavior under its fixture; it
   does not establish production wiring, independent source ownership,
   or physical measurement.

   A reproducible result SHOULD bind source revision, compiler and
   dependency lock, configuration and policy hashes, input fixture or
   seed, roster and provenance manifest, and output evidence digest.  If
   an artifact is unavailable, the result SHOULD be NOT_MEASURED, HOLD,
   or UNVERIFIABLE rather than reconstructed from a guessed default.

   The profile does not claim universal Sybil prevention, perfect
   collusion detection, or a calibrated probability of truth.  It
   defines an auditable way to refuse unsupported authority while
   preserving the core TTTPS integrity result.

19.  Calibration, Thresholds, and Evidence Windows

   A confidence threshold is a policy decision, not a universal
   constant.  A deployment MUST declare the observation window, minimum
   effective quorum, weighting rule, missing-observation treatment, and
   calibration data set from which thresholds were selected.
   Calibration SHOULD include benign disagreement, correlated benign
   sources, packet loss, clock drift, and recovery after a partition.
   It MUST NOT use confidence as a substitute for admission or
   authentication.

Jorgen                    Expires 23 March 2027                [Page 13]
Internet-Draft          Oracle Confidence Gating          September 2026

   The confidence window MUST be closed before a result is committed.
   Samples arriving after closure belong to a new window and MUST NOT
   silently alter the previous receipt.  An incomplete window MUST be
   marked as partial under a declared policy or return
   InsufficientKnowledge.

        Window = (context_id, epoch_range, roster_digest, policy_revision)
        ScoreInput = (admitted_observations, provenance_map, Window)
        Decision = f(G(p), rho, B(C), N_eff, freshness, policy_revision)

   Threshold changes MUST be versioned.  Results from different
   threshold manifests MUST NOT be compared as if they were measurements
   from the same policy.

20.  Source Independence and Provenance

   Source independence is an attribution property.  It cannot be
   inferred from the number of public keys, signatures, transport
   connections, or labels alone.  A deployment MUST define the
   provenance attributes it trusts, the authority asserting them, and
   the behavior when an attribute is absent or contradictory.

        N_eff = | { PhysicalEntity(stable_node_id_i) : i in admitted_roster } |

   A relay can be delivery evidence without being a new physical source.
   Two observations from one operator, clock, or ephemeris authority MAY
   be correlated even when their signatures differ.  Receipts SHOULD
   distinguish observation identity, provenance identity, and
   cryptographic signer identity.

   Unknown provenance MAY be retained for diagnosis, but MUST NOT count
   as an independent source for quorum or promotion unless the declared
   policy permits that conservative class.

21.  Decision States and Transition Matrix

    +==========================+=====================+================+
    | State                    | Meaning             | Permitted      |
    |                          |                     | action         |
    +==========================+=====================+================+
    | MEASURED                 | Declared confidence | A configured   |
    |                          | predicates cleared. | promotion or   |
    |                          |                     | commit MAY     |
    |                          |                     | proceed.       |
    +--------------------------+---------------------+----------------+
    | INSUFFICIENT_KNOWLEDGE   | A required          | Do not assert  |
    |                          | predicate was not   | oracle         |
    |                          | established.        | agreement.     |

Jorgen                    Expires 23 March 2027                [Page 14]
Internet-Draft          Oracle Confidence Gating          September 2026

    +--------------------------+---------------------+----------------+
    | HOLD_AHE                 | Effective quorum is | Only bounded   |
    |                          | below policy but a  | holdover under |
    |                          | bounded anchor      | the declared   |
    |                          | remains usable.     | drift budget.  |
    +--------------------------+---------------------+----------------+
    | CONSTRAINT_INCONSISTENCY | The supplied bundle | Do not         |
    |                          | is empty or         | evaluate       |
    |                          | contradictory.      | undefined      |
    |                          |                     | endpoints.     |
    +--------------------------+---------------------+----------------+
    | REJECT                   | Integrity,          | Discard under  |
    |                          | authentication, or  | the core       |
    |                          | replay failed.      | security       |
    |                          |                     | policy.        |
    +--------------------------+---------------------+----------------+

                  Table 2: Confidence state interpretation

   These states are non-equivalent.  A confidence HOLD is not a
   cryptographic REJECT, and a cryptographic REJECT MUST NOT be
   downgraded because an entropy score is high.  Implementations SHOULD
   expose the first failed predicate.

22.  Implementation Topology and Commit Boundary

   A reference deployment may use an asynchronous shadow path.  The
   online path authenticates and admits observations, performs freshness
   and quorum checks, and produces the core result.  The shadow path
   consumes authenticated residuals and provenance-bound observations,
   computes G-Score and optional operator or bundle evidence, and
   returns a qualification decision only to the next commit boundary.

          admitted evidence -> provenance collapse -> G-Score/VN summary
                 |                                      |
                 +-> EpiShadowAdapter -> qualification-+
                                                        |
                                       next promotion/commit boundary

   The shadow path MUST fail closed with respect to promotion: timeout,
   malformed bundle, missing alignment, or unavailable correlation input
   cannot silently become a positive result.  Diagnostic collection MAY
   continue only if it cannot authorize a core commit.

Jorgen                    Expires 23 March 2027                [Page 15]
Internet-Draft          Oracle Confidence Gating          September 2026

23.  Attack and Liveness Evaluation

   A serious evaluation MUST test both false acceptance and false
   withholding.  The matrix SHOULD include shared-provenance Sybil
   observations, residual poisoning, missing physical context, replayed
   windows, partitioned rosters, correlated benign sources, and
   transient sensor noise.  Each case MUST state whether the expected
   disposition is REJECT, HOLD, INSUFFICIENT_KNOWLEDGE, or MEASURED.

   For each scenario retain the admitted roster, N_eff, window size,
   G-Score, correlation-input status, Epi bundle status, AdaptiveSwitch
   state, latency, and recovery time.  Detection of ambiguity does not
   establish attack attribution; it establishes that the stated
   ambiguity policy was exercised.

   DoS resistance is evaluated separately.  Implementations SHOULD cap
   solver work, bound slack search, bound shadow queue growth, and rate-
   limit state transitions.  A conservative HOLD with bounded recovery
   is preferable to permanent quarantine on one noisy observation.

24.  Evidence and Implementation Boundary

   The confidence layer SHOULD record source identities, provenance
   groups, input distribution, selected regime, threshold manifest,
   context identifier, result state, reason code, and evidence tier.
   The following tiers are distinct: specified, formally checked, unit
   tested, implemented offline, simulated, synthetic, live black-box,
   and hardware measured.

   A unit test does not prove live wiring.  An offline Epi adapter does
   not prove a production AdaptiveSwitch path consumes it.  Source count
   does not prove source independence.  These boundaries MUST remain
   visible in implementation status and publication claims.

   The companion research paper is Oracle Confidence Gating for TTTPS:
   G-Score, Correlation-Aware von Neumann Confidence, and
   AdaptiveSwitch, SSRN abstract 7487098, Heime Jorgen, Independent,
   licensed under Creative Commons Attribution (CC BY):
   https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7487098
   [CONFIDENCEPAPER].  The paper is informative background and does not
   change this document's optional status.

Jorgen                    Expires 23 March 2027                [Page 16]
Internet-Draft          Oracle Confidence Gating          September 2026

25.  Security Considerations

   Colluding labels can inflate a marginal agreement distribution when
   provenance is not collapsed.  Implementations SHOULD collapse
   effective identities before quorum and confidence calculation.  The
   mapping is an authority input, not something G-Score can infer from a
   label.

   Sybil resistance is a provenance and admission property, not an
   entropy-only property.  Before constructing p or rho, an
   implementation SHOULD validate D-chain freshness and collapse labels
   to an effective identity and provenance group.  A fresh key MUST NOT
   increase the effective quorum merely because it has a valid
   signature.  Let N_eff be the number of admitted unique provenance
   groups; quorum and Byzantine aggregation MUST use N_eff, not the raw
   label count.  If N_eff is below policy, the result is HOLD or
   InsufficientKnowledge.  This bounds the claimed defense to the
   declared identity and provenance authority; it does not prove
   universal Sybil prevention.

   Confidence thresholds can become denial-of-service controls.
   Implementations SHOULD bound backoff, expose HOLD and UNKNOWN states,
   and preserve a recovery path based on fresh evidence.  A confidence
   result MUST NOT authorize a record that fails integrity, freshness,
   or admission.

26.  IANA Considerations

   This document makes no IANA request.  It defines no wire field,
   codepoint, registry, or mandatory algorithm.

27.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC8179]  Bradner, S. and J. Contreras, "Intellectual Property
              Rights in IETF Technology", BCP 79, RFC 8179, May 2017,
              <https://www.rfc-editor.org/info/rfc8179>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, May 2017,
              <https://www.rfc-editor.org/info/rfc8174>.

28.  Informative References

Jorgen                    Expires 23 March 2027                [Page 17]
Internet-Draft          Oracle Confidence Gating          September 2026

   [TTTPS]    Jorgen, H., "The TLS TimeToken Secure Protocol
              (tttps://)", Work in Progress, Internet-Draft, draft-
              helmprotocol-tttps-10, <https://datatracker.ietf.org/doc/
              draft-helmprotocol-tttps/>.

   [DEEPSPACE]
              Jorgen, H., "TTTPS Deep-space Profile", Work in Progress,
              Internet-Draft, draft-helmprotocol-deepspace-00, 2026,
              <https://datatracker.ietf.org/doc/draft-helmprotocol-
              deepspace/>.

   [CONFIDENCEPAPER]
              Jorgen, H., "Oracle Confidence Gating for TTTPS: G-Score,
              Correlation-Aware von Neumann Confidence, and
              AdaptiveSwitch", SSRN 7487098, 2026,
              <https://papers.ssrn.com/sol3/
              papers.cfm?abstract_id=7487098>.

Author's Address

   Heime Jorgen
   Independent
   Email: heime.jorgen@proton.me

Jorgen                    Expires 23 March 2027                [Page 18]