R-12 — Conserved-State Constraints: An Open Design Question

[allansendagi]

Full note: https://www.computableauthority.com/research/conserved-state-authority

Every authority artifact today expresses static constraints — an amount, a role, a date range. Some real authority is not static: 'up to $20,000 cumulatively during this window' is a claim about a running total, not a threshold checked once per call. A stateless per-call check can be asked past its intended budget an unlimited number of times.

The note argues the fix cannot be 'just add a mutable counter' without breaking the deterministic-execution and offline-verification guarantees the rest of the model depends on, and proposes four decisions instead: the consumed amount as a recorded input fact rather than fetched state; honest disclosure (not silent failure) when an offline verifier has no ledger to check; reserve/settle over atomic-decrement for a general-purpose primitive, decided by a concrete test (does asking consume?); and an explicitly declared scope field rather than inferred scope.

Open question: is fact-not-state actually sufficient to preserve determinism once a ledger is real infrastructure with its own consistency guarantees, and is reserve/settle actually the right default, or only for some class of caller? If you've built something like this, or see a hole in the reasoning, this thread is the place for it.