Assurance Tiers
Trust is graduated, and the verdict carries its tier — a conforming verifier never says a bare VALID. A tier
is earned per verification: there is no field a producer can set to claim it.
| verdict | what is proven |
|---|---|
VALID:LIGHT |
the exact bytes · the signing key · the claimed time frame. Identity is the key itself (a self-certifying sha256: shard) or a claimed name — never a verified name. The floor: a key, a canonical form, a signature. No infrastructure, no fees. |
VALID:HIGH |
+ the publisher's name is provably bound to the key (genesis + key-log). Strength corroborated (the publisher's own witness shows no rival) or authoritative (independent non-membership — an anchored name-map inclusion, or a caller air-gap assertion). Only authoritative names the definitive publisher and can reach TOP. |
VALID:TOP |
+ the document provably existed by a real point in time (an anchor inclusion proof — Bitcoin/OTS or Rekor, opt-in). Stream completeness over a range is a separate verdict (verifyStream). |
INVALID |
a definite, deterministic failure — a specific E-* code. |
INDETERMINATE |
a dependency was unreachable, or an optional algorithm is unimplemented. Cannot decide is never conflated with forged. |
LIGHT ⊆ HIGH ⊆ TOP. Each tier adds a proof on top of the one below; none replaces it. HIGH still proves
everything LIGHT does, plus the name binding; TOP adds proven time on top of HIGH. A verdict names the finest
tier decidable from your information set — if the witness surface is unreachable, an otherwise-HIGH document is
honestly reported at LIGHT, not failed.
Not every rung is equally settled — the machine-readable STABILITY export is the source of truth:
-
LIGHT,HIGH— stable; multiple independent adversarial audit rounds left them intact. -
corroboratedfreshness — experimental-usable. -
attestedfreshness — experimental extension; the stable verifier does not emit it (it caps atcorroboratedand names the withheld rung), reachable only with an explicit opt-in. This keeps the whole protocol from inheriting the youngest layer's risk.
The tiers as a lattice (and why two verifiers always agree on the tier) are the subject of the Formal Model. Realizing TOP in a live operator is tracked in the TOP milestone.
