Network Working Group H. Jorgen Internet-Draft Independent Intended status: Experimental 19 September 2026 Expires: 23 March 2027 Oracle Confidence Gating: G-Score, Correlation-Aware von Neumann Confidence, and AdaptiveSwitch draft-helmprotocol-confidence-00 Abstract This document specifies an optional confidence layer for the TLS TimeToken Secure Protocol (TTTPS). It defines the G-Score, a normalized entropy measure of agreement concentration; an optional correlation-aware von Neumann extension; the InsufficientKnowledge signal; and the AdaptiveSwitch state machine over TURBO and FULL. The confidence layer qualifies whether evidence justifies action. It does not replace cryptographic integrity, define a wire format, allocate a codepoint, establish source independence, or require any core TTTPS implementation to compute confidence. Status of This Memo This document is an Internet-Draft and is submitted in full conformance with BCP 78 and BCP 79. Internet- Drafts are working documents of the IETF and have no formal standing in the IETF standards process. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 23 March 2027. Jorgen Expires 23 March 2027 [Page 1] Internet-Draft Oracle Confidence Gating September 2026 Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Conventions and Terminology . . . . . . . . . . . . . . . . . 3 3. G-Score . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4. Separation from Integrity . . . . . . . . . . . . . . . . . . 4 5. Optional GRG Integrity Profile . . . . . . . . . . . . . . . 4 6. Optional Correlation-Aware Extension . . . . . . . . . . . . 6 7. Epi-Entropy Shadow Analysis . . . . . . . . . . . . . . . . . 6 8. InsufficientKnowledge . . . . . . . . . . . . . . . . . . . . 7 9. AdaptiveSwitch . . . . . . . . . . . . . . . . . . . . . . . 8 10. Operational Confidence Contract . . . . . . . . . . . . . . . 8 11. Epistemic Bundle Contract . . . . . . . . . . . . . . . . . . 9 12. Threat-to-Control Analysis . . . . . . . . . . . . . . . . . 9 13. System Model and Observation Lifecycle . . . . . . . . . . . 10 14. Agreement Construction and Calibration . . . . . . . . . . . 11 15. Seven-Layer Verification Pipeline . . . . . . . . . . . . . . 11 16. Point Operators, Correlation, and Epi Shadow . . . . . . . . 12 17. AdaptiveSwitch Algorithm and State Semantics . . . . . . . . 13 18. Evaluation and Reproducibility Boundary . . . . . . . . . . . 13 19. Calibration, Thresholds, and Evidence Windows . . . . . . . . 13 20. Source Independence and Provenance . . . . . . . . . . . . . 14 21. Decision States and Transition Matrix . . . . . . . . . . . . 14 22. Implementation Topology and Commit Boundary . . . . . . . . . 15 23. Attack and Liveness Evaluation . . . . . . . . . . . . . . . 16 24. Evidence and Implementation Boundary . . . . . . . . . . . . 16 25. Security Considerations . . . . . . . . . . . . . . . . . . . 17 26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17 27. Normative References . . . . . . . . . . . . . . . . . . . . 17 28. Informative References . . . . . . . . . . . . . . . . . . . 17 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 18 Jorgen Expires 23 March 2027 [Page 2] Internet-Draft Oracle Confidence Gating September 2026 1. Introduction Integrity answers whether a record is admissible. Confidence answers whether the available evidence justifies acting on it. A set of valid signatures can remain diffuse, correlated, or ambiguous. Treating confidence as a restatement of integrity makes the protocol unable to preserve uncertainty. This is an independent Confidence profile. It does not reproduce the TTTPS core specification: it defines no wire format, header, octet layout, transport behavior, PoT construction, GRG implementation requirement, or codepoint. It does not define the mapping from observed sources to an agreement distribution, source weighting, threshold calibration, or deployment-specific physical identity. A core implementation that never computes a confidence metric and never signals InsufficientKnowledge remains conforming to the TTTPS core. This document is an experimental companion profile, not a core conformance requirement. 2. Conventions and Terminology The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals. Source: an independent time or ordering reference observed by a node. Agreement distribution: a probability distribution p over the observed sources, with p_i the share attributed to source i. G-Score: the normalized Shannon entropy of p. InsufficientKnowledge: a typed result indicating that the enabled confidence policy does not justify an oracle assertion. TURBO: the AdaptiveSwitch state with reduced generation latency or other configured acceleration. FULL: the conservative AdaptiveSwitch state and initial state. Epi evidence: optional evidence about residual ambiguity among admissible interpretations. Jorgen Expires 23 March 2027 [Page 3] Internet-Draft Oracle Confidence Gating September 2026 3. G-Score For an agreement distribution p over n sources, define: G(p) = H(p) / log n H(p) = sum_i -p_i log(p_i) The same logarithm base MUST be used in H(p) and log n. For n greater than one, 0 <= G(p) <= 1. A point mass has G(p) = 0 and a uniform distribution has G(p) = 1. For n = 1, an implementation MUST define the normalization explicitly; this document defines G(p) = 0. The G-Score is a marginal concentration signal. It does not prove that source labels represent independent physical origins, and it does not prove that a valid record is true. 4. Separation from Integrity The confidence subsystem is separate from the TTTPS integrity pipeline. A node MUST NOT substitute a confidence result for integrity verification. A record that fails integrity verification is invalid regardless of G(p), and a high confidence result MUST NOT make it valid. Conversely, InsufficientKnowledge is not an integrity failure. It indicates that the source evidence did not justify the requested assertion. Implementations MUST preserve the distinction in evidence receipts and failure handling. 5. Optional GRG Integrity Profile This independent Confidence track carries the optional GRG integrity profile that was intentionally kept out of the TTTPS core. It is an integrity-layer input to this track, not a confidence metric. G-Score, von Neumann confidence, Epi-Entropy, and AdaptiveSwitch MUST NOT repair, reinterpret, or replace a GRG or SHA-256 integrity verdict. For a protected payload P and context identifier ctx_id, the GRG profile exposes the ordered stages Golomb-Rice symbol preparation (G1), Reed-Solomon erasure processing (R), Golay(23,12,7) bounded correction (G2), and HMAC-SHA256 authentication (H). The order is part of this profile's external interoperability contract. This profile does not require a particular private optimization beyond that contract. Jorgen Expires 23 March 2027 [Page 4] Internet-Draft Oracle Confidence Gating September 2026 E(P) = G2(R(G1(P))) tag = HMAC-SHA256(K, E(P) || ctx_id) GRG(P, ctx_id) = (E(P), tag, ctx_id) Verify(tag, K, E(P), ctx_id) = true Decode(E(P)) = P [intact or resolved] The profile contract is: * Lossless round trip: after tag verification, a result classified intact or resolved MUST recover the protected payload P through the inverse G2/R/G1 processing path. HMAC is authentication, not a reversible encoding. * Erasure tolerance: the deployment MUST declare k and n; the reference profile uses k=4 and n=6, and recovery is permitted only when the declared admissible shard condition is met. * Bounded correction: the reference profile permits up to t=3 bit errors per 23-bit Golay block; excess corruption is unresolvable. * Context binding: distinct ctx_id values MUST produce independently authenticated contexts; a result for ctx_id_A MUST NOT validate for ctx_id_B. Round trip: the recovered payload equals P when verification returns resolved or intact. Erasure handling: the profile MAY reconstruct from a declared admissible subset of shards; k, n, and policy MUST be recorded. Bounded correction: correction MUST be limited by the declared profile capacity; excess corruption returns unresolvable. Context binding: the authenticated result MUST bind ctx_id and MUST NOT validate as a different context. Jorgen Expires 23 March 2027 [Page 5] Internet-Draft Oracle Confidence Gating September 2026 The profile emits intact, resolved, or unresolvable. A confidence result cannot turn unresolvable into valid. The SHA-256 core path remains sufficient for independent TTTPS conformance, and GRG remains OPTIONAL. The current checked GRG reference path uses the perfect binary Golay(23,12,7) code: twelve data bits are represented by a 23-bit codeword and up to three bit errors are correctable under the declared decoder contract. The binary extended Golay [24,12,8] code is a distinct profile and is not interchangeable with this reference path; a deployment selecting it MUST declare a separate profile, framing, and test vectors. This document makes no determination about IPR validity, scope, or applicability and makes no licensing commitment. Known IPR is handled through the IETF disclosure process in BCP 79 [RFC8179]. 6. Optional Correlation-Aware Extension The G-Score is marginal and cannot detect source correlation by construction. An implementation MAY assemble an admissible density operator rho and compute: S_VN(rho) = -Tr(rho log(rho)) When rho is diagonal under the declared representation, the correlation-aware calculation reduces to the corresponding Shannon calculation. Off-diagonal structure represents supplied pairwise correlation; it is not evidence that was absent from the input. The extension is OPTIONAL and has O(n^3) operator cost in the bounded adapter. If aligned correlation data is absent, an implementation MUST either use the Shannon arm or return an explicit unavailable state; it MUST NOT fabricate a zero-correlation assertion. The optional Epi evidence layer MAY represent a bundle of admissible states, an entropy interval, or a bounded purity-derived lower bound. It MAY reduce authority at a new commit boundary, but MUST NOT rewrite an already committed record or replace the core integrity result. A deep-space implementation may use the separate profile [DEEPSPACE]. 7. Epi-Entropy Shadow Analysis Epi-Entropy is an optional epistemic layer for cases in which a single density-operator estimate would conceal admissible alternative interpretations. It is a shadow analyzer: it may qualify a new promotion or commit decision, but it MUST NOT replace core integrity or retroactively alter an issued record. Jorgen Expires 23 March 2027 [Page 6] Internet-Draft Oracle Confidence Gating September 2026 For observed constraints C = {(A_k,b_k)}, an implementation MAY define the admissible density-operator bundle: B(C) = { R | R = R^dagger, R >= 0, Tr(R) = 1, Tr(R A_k) <= b_k for every k } EpiEnt(B) = [ inf_R S_VN(R), sup_R S_VN(R) ] S_VN(R) = -Tr(R log2 R) Delta_id(B) = sup_(R,R' in B) 1/2 ||R-R'||_1 The exact lower endpoint can be computationally expensive because it is a concave minimization problem. An implementation MAY instead expose the certified purity-based bound inf_R S_VN(R) >= -log2( sup_R Tr(R^2) ) as a lower bound, never as an exact endpoint unless separately established. If B(C) is empty, the implementation MUST NOT evaluate undefined entropy endpoints. It MUST return CONSTRAINT_INCONSISTENCY or a documented degraded HOLD state. A Soft-HOLD adapter MAY introduce nonnegative slack xi and solve for the minimum declared relaxation. The slack, objective, tolerance, and resulting state MUST be recorded. Slack MUST NOT silently convert an inconsistent bundle into PASS. B_xi(C): Tr(R A_k) <= b_k + xi_k, xi_k >= 0 B(C) = emptyset => State = DEGRADED_HOLD after min ||xi||_2 An EpiShadowAdapter MAY consume the existing G-Score trajectory and authenticated context residuals to construct (A_k,b_k) asynchronously. Missing TCB, OWLT, ephemeris alignment, or provenance inputs MUST be represented as unavailable context or CONSTRAINT_INCONSISTENCY; they MUST NOT be replaced with zeros or an assumed independent source. A nonzero Delta_id is not by itself proof of an attack. It is a bounded ambiguity signal. Implementations SHOULD use a configured threshold, hysteresis, and bounded recovery path. The default safe action for an unresolved threshold crossing is HOLD, not permanent quarantine. 8. InsufficientKnowledge When confidence gating is enabled and a configured confidence predicate is not established, the node MUST signal InsufficientKnowledge or an equivalent explicitly documented state. It MUST NOT assert oracle agreement for that observation merely because a marginal concentration score is available. Jorgen Expires 23 March 2027 [Page 7] Internet-Draft Oracle Confidence Gating September 2026 The final predicate is implementation-defined and MAY include diffuse agreement, missing aligned correlation, effective quorum below policy, stale physical context, or an ambiguous Epi bundle. A missing optional VN input MUST NOT be reported as a computed VN result. 9. AdaptiveSwitch AdaptiveSwitch maintains per-node state in {TURBO, FULL}. The initial state MUST be FULL. Deployments define the entry threshold, maintenance threshold, evaluation window, dwell time, and backoff policy. A node MUST NOT enter TURBO unless its configured quorum, freshness, integrity, and confidence predicates all clear for the required evaluation window. A node MUST leave TURBO when a configured maintenance predicate fails, when freshness or integrity fails, or when InsufficientKnowledge blocks promotion. Entry and maintenance thresholds SHOULD provide hysteresis such that the maintenance threshold is no more permissive than the entry threshold. Backoff MUST be bounded. A failed confidence observation MAY cause a conservative hold or transition, but it MUST NOT be silently counted as cryptographic failure. Recovery MUST require fresh evidence and a configured dwell or consecutive-success condition. 10. Operational Confidence Contract The confidence result is meaningful only after admission and provenance processing. Implementations MUST construct the agreement distribution from admitted effective identities, not raw key or label counts. A deployment MUST record the roster snapshot, provenance- group mapping, observation window, weighting rule, and threshold manifest used for the result. N_eff = | { PhysicalEntity(stable_node_id_i) : i in Roster } | PASS_conf = IntegrityOK AND FreshOK AND N_eff >= N_min AND ConfidencePredicate(p, rho, B(C)) When N_eff is below the declared quorum, the implementation MUST return HOLD_AHE or InsufficientKnowledge. A newly generated key, duplicate certificate, or repeated relay MUST NOT increase N_eff. This is the D-chain quorum-uniqueness boundary and is distinct from entropy calculation. A confidence receipt SHOULD contain a context identifier, roster digest, effective-identity digest, provenance digest, distribution or operator commitment, G-Score, selected regime, Epi-Entropy status, Jorgen Expires 23 March 2027 [Page 8] Internet-Draft Oracle Confidence Gating September 2026 threshold manifest, state transition, reason code, and evidence tier. These fields MAY be committed out of band; this document does not add them to the TTTPS wire record. 11. Epistemic Bundle Contract The admissible bundle is a model of remaining interpretations, not a second integrity verifier. For constraints C = {(A_k,b_k)}, a deployment MAY use: B(C) = { R in C^(n x n) | R = R^dagger, R >= 0, Tr(R)=1, Tr(R A_k) <= b_k for every k } EpiEnt(B) = [ inf_R S_VN(R), sup_R S_VN(R) ] S_VN(R) = -Tr(R log2 R) Delta_id(B) = sup_(R,R' in B) 1/2 ||R-R'||_1 The exact lower endpoint is not assumed to be cheap: minimizing a concave entropy over a convex feasible set can be computationally difficult. A bounded implementation MAY expose the certified purity lower bound instead: lower_bound = -log2( sup_(R in B) Tr(R^2) ) lower_bound <= inf_(R in B) S_VN(R) The field MUST be labelled as a bound and MUST NOT be presented as the exact endpoint. If B(C) is empty, endpoints are undefined. The implementation MUST emit CONSTRAINT_INCONSISTENCY or documented DEGRADED_HOLD; it MUST NOT substitute zero entropy or PASS. A Soft-HOLD relaxation MAY use nonnegative slack xi. The slack norm, per-constraint slack, solver tolerance, and selected state MUST be retained in the evidence record. Relaxation is an applicability decision and does not prove that the original constraints were consistent. 12. Threat-to-Control Analysis G-Score alone is blind to shared provenance. A coordinated Sybil group can make marginal observations appear diffuse while retaining one physical origin. The required order is admission, replay and freshness checking, physical/provenance collapse, effective quorum calculation, robust aggregation, and only then confidence scoring. Coordinated Sybil: collapse duplicate physical or provisioning identities; use N_eff; return HOLD_AHE below quorum. Subtle poisoning: bind residuals and constraints to context and Jorgen Expires 23 March 2027 [Page 9] Internet-Draft Oracle Confidence Gating September 2026 retain the bundle or contradiction result; do not average unavailable constraints as zero. Context missing: signal UNKNOWN, HOLD, or CONSTRAINT_INCONSISTENCY; never claim a computed VN value from absent correlation inputs. Liveness attack: cap hysteresis and exponential backoff, preserve bounded recovery, and distinguish confidence HOLD from integrity REJECT. 13. System Model and Observation Lifecycle The confidence profile assumes an issuer, observing peers, an admission authority, and a verifier. An observation consists of a value, observation epoch, context identifier, stable node identifier, provenance group, freshness evidence, and the integrity result for the enclosing TTTPS record. The lifecycle is ordered: authenticate and admit a peer; check D-chain freshness and replay scope; collapse duplicate physical identities; project observations into the declared window; and only then construct an agreement distribution or operator. A confidence calculation performed earlier can count attacker-created labels as independent evidence. Observation: an authenticated candidate value with epoch, context, identity, and provenance metadata. Admitted observation: an observation that passed key, challenge, freshness, replay, and policy checks. Effective source: the source after physical and provisioning- identity deduplication. Confidence window: the declared set of aligned admitted observations used by one score or bundle. Source count, key count, provenance-group count, and effective physical-entity count MUST be retained separately. A large raw roster MUST NOT be described as a large independent quorum without an authority-backed mapping. Jorgen Expires 23 March 2027 [Page 10] Internet-Draft Oracle Confidence Gating September 2026 14. Agreement Construction and Calibration The input distribution p is policy-defined. A reference construction assigns each admitted effective source a nonnegative agreement weight, normalizes over the selected observation window, and records the weighting rule and denominator. Missing or rejected observations are not silently assigned a neutral vote. w_i >= 0 (admitted effective source i) p_i = w_i / sum_j w_j (sum_j w_j > 0) H(p) = - sum_i p_i log_b(p_i) G(p) = H(p) / log_b(n), n > 1 Thresholds are deployment contracts, not universal constants. A policy MUST identify the entry threshold, maintenance threshold, minimum effective quorum, window length, missing-data rule, and recovery requirement. Calibration SHOULD include source class, sample count, fixture identity, and the policy revision. 15. Seven-Layer Verification Pipeline An implementation advertising the full confidence profile SHOULD expose the following logical order. The layers may be colocated, but their authority boundaries MUST remain distinguishable. Jorgen Expires 23 March 2027 [Page 11] Internet-Draft Oracle Confidence Gating September 2026 +===============+===========================+=====================+ | Layer | Input | Disposition | +===============+===========================+=====================+ | PKI admission | stable ID, key, challenge | UNAUTHORIZED_VOTE | | | | or admit | +---------------+---------------------------+---------------------+ | Physical | identity and provenance | one vote per | | deduplication | map | effective entity | +---------------+---------------------------+---------------------+ | D-chain | nonce, RTT, round hash | replay invalidation | | freshness | | or admit | +---------------+---------------------------+---------------------+ | Unique quorum | N_eff and policy quorum | HOLD_AHE when | | | | insufficient | +---------------+---------------------------+---------------------+ | Robust | aligned admitted values | median or declared | | aggregation | | aggregate | +---------------+---------------------------+---------------------+ | VN | aligned pairwise evidence | optional | | correlation | | qualification | +---------------+---------------------------+---------------------+ | Epi shadow | constraint bundle and | read-only HOLD | | | ambiguity | qualification | +---------------+---------------------------+---------------------+ Table 1: Confidence pipeline layers No later layer can repair an earlier failure. A high entropy score cannot authorize an unauthenticated vote, and a low Epi ambiguity cannot make a stale physical context applicable. 16. Point Operators, Correlation, and Epi Shadow The von Neumann extension is useful only when the operator contains declared aligned correlation evidence: S_VN(rho) = -Tr(rho log2 rho) If rho is diagonal in the declared representation, the value reduces to the Shannon entropy of its diagonal. Off-diagonal terms MUST identify their source and alignment window; they MUST NOT be fabricated as an assumption of independence or dependence. The Epi shadow is attached after provenance collapse and physical applicability checks. A nonzero identity diameter is an ambiguity signal, not proof of maliciousness. Policy MAY require HOLD for a threshold crossing, but SHOULD provide hysteresis and bounded recovery. Jorgen Expires 23 March 2027 [Page 12] Internet-Draft Oracle Confidence Gating September 2026 17. AdaptiveSwitch Algorithm and State Semantics The initial state is FULL. Promotion to TURBO requires integrity, freshness, effective quorum, applicable context, confidence, and Epi predicates to hold for the evaluation window. state := FULL if state == FULL and success_count >= k_enter and IntegrityOK and FreshOK and N_eff >= N_min and EpiPolicyOK: state := TURBO if state == TURBO and (IntegrityFail or FreshFail or N_eff < N_min or EpiHold or failure_count >= k_exit): state := FULL Every transition SHOULD record pre-state, post-state, policy revision, evidence digest, trigger, and time. Backoff MAY be applied to repeated promotion failures, but the cap and reset condition MUST be explicit. A confidence transition is not a cryptographic failure. 18. Evaluation and Reproducibility Boundary The companion paper distinguishes specified, formally checked, unit- tested, simulated, synthetic, live black-box, and hardware-measured evidence. A unit test establishes behavior under its fixture; it does not establish production wiring, independent source ownership, or physical measurement. A reproducible result SHOULD bind source revision, compiler and dependency lock, configuration and policy hashes, input fixture or seed, roster and provenance manifest, and output evidence digest. If an artifact is unavailable, the result SHOULD be NOT_MEASURED, HOLD, or UNVERIFIABLE rather than reconstructed from a guessed default. The profile does not claim universal Sybil prevention, perfect collusion detection, or a calibrated probability of truth. It defines an auditable way to refuse unsupported authority while preserving the core TTTPS integrity result. 19. Calibration, Thresholds, and Evidence Windows A confidence threshold is a policy decision, not a universal constant. A deployment MUST declare the observation window, minimum effective quorum, weighting rule, missing-observation treatment, and calibration data set from which thresholds were selected. Calibration SHOULD include benign disagreement, correlated benign sources, packet loss, clock drift, and recovery after a partition. It MUST NOT use confidence as a substitute for admission or authentication. Jorgen Expires 23 March 2027 [Page 13] Internet-Draft Oracle Confidence Gating September 2026 The confidence window MUST be closed before a result is committed. Samples arriving after closure belong to a new window and MUST NOT silently alter the previous receipt. An incomplete window MUST be marked as partial under a declared policy or return InsufficientKnowledge. Window = (context_id, epoch_range, roster_digest, policy_revision) ScoreInput = (admitted_observations, provenance_map, Window) Decision = f(G(p), rho, B(C), N_eff, freshness, policy_revision) Threshold changes MUST be versioned. Results from different threshold manifests MUST NOT be compared as if they were measurements from the same policy. 20. Source Independence and Provenance Source independence is an attribution property. It cannot be inferred from the number of public keys, signatures, transport connections, or labels alone. A deployment MUST define the provenance attributes it trusts, the authority asserting them, and the behavior when an attribute is absent or contradictory. N_eff = | { PhysicalEntity(stable_node_id_i) : i in admitted_roster } | A relay can be delivery evidence without being a new physical source. Two observations from one operator, clock, or ephemeris authority MAY be correlated even when their signatures differ. Receipts SHOULD distinguish observation identity, provenance identity, and cryptographic signer identity. Unknown provenance MAY be retained for diagnosis, but MUST NOT count as an independent source for quorum or promotion unless the declared policy permits that conservative class. 21. Decision States and Transition Matrix +==========================+=====================+================+ | State | Meaning | Permitted | | | | action | +==========================+=====================+================+ | MEASURED | Declared confidence | A configured | | | predicates cleared. | promotion or | | | | commit MAY | | | | proceed. | +--------------------------+---------------------+----------------+ | INSUFFICIENT_KNOWLEDGE | A required | Do not assert | | | predicate was not | oracle | | | established. | agreement. | Jorgen Expires 23 March 2027 [Page 14] Internet-Draft Oracle Confidence Gating September 2026 +--------------------------+---------------------+----------------+ | HOLD_AHE | Effective quorum is | Only bounded | | | below policy but a | holdover under | | | bounded anchor | the declared | | | remains usable. | drift budget. | +--------------------------+---------------------+----------------+ | CONSTRAINT_INCONSISTENCY | The supplied bundle | Do not | | | is empty or | evaluate | | | contradictory. | undefined | | | | endpoints. | +--------------------------+---------------------+----------------+ | REJECT | Integrity, | Discard under | | | authentication, or | the core | | | replay failed. | security | | | | policy. | +--------------------------+---------------------+----------------+ Table 2: Confidence state interpretation These states are non-equivalent. A confidence HOLD is not a cryptographic REJECT, and a cryptographic REJECT MUST NOT be downgraded because an entropy score is high. Implementations SHOULD expose the first failed predicate. 22. Implementation Topology and Commit Boundary A reference deployment may use an asynchronous shadow path. The online path authenticates and admits observations, performs freshness and quorum checks, and produces the core result. The shadow path consumes authenticated residuals and provenance-bound observations, computes G-Score and optional operator or bundle evidence, and returns a qualification decision only to the next commit boundary. admitted evidence -> provenance collapse -> G-Score/VN summary | | +-> EpiShadowAdapter -> qualification-+ | next promotion/commit boundary The shadow path MUST fail closed with respect to promotion: timeout, malformed bundle, missing alignment, or unavailable correlation input cannot silently become a positive result. Diagnostic collection MAY continue only if it cannot authorize a core commit. Jorgen Expires 23 March 2027 [Page 15] Internet-Draft Oracle Confidence Gating September 2026 23. Attack and Liveness Evaluation A serious evaluation MUST test both false acceptance and false withholding. The matrix SHOULD include shared-provenance Sybil observations, residual poisoning, missing physical context, replayed windows, partitioned rosters, correlated benign sources, and transient sensor noise. Each case MUST state whether the expected disposition is REJECT, HOLD, INSUFFICIENT_KNOWLEDGE, or MEASURED. For each scenario retain the admitted roster, N_eff, window size, G-Score, correlation-input status, Epi bundle status, AdaptiveSwitch state, latency, and recovery time. Detection of ambiguity does not establish attack attribution; it establishes that the stated ambiguity policy was exercised. DoS resistance is evaluated separately. Implementations SHOULD cap solver work, bound slack search, bound shadow queue growth, and rate- limit state transitions. A conservative HOLD with bounded recovery is preferable to permanent quarantine on one noisy observation. 24. Evidence and Implementation Boundary The confidence layer SHOULD record source identities, provenance groups, input distribution, selected regime, threshold manifest, context identifier, result state, reason code, and evidence tier. The following tiers are distinct: specified, formally checked, unit tested, implemented offline, simulated, synthetic, live black-box, and hardware measured. A unit test does not prove live wiring. An offline Epi adapter does not prove a production AdaptiveSwitch path consumes it. Source count does not prove source independence. These boundaries MUST remain visible in implementation status and publication claims. The companion research paper is Oracle Confidence Gating for TTTPS: G-Score, Correlation-Aware von Neumann Confidence, and AdaptiveSwitch, SSRN abstract 7487098, Heime Jorgen, Independent, licensed under Creative Commons Attribution (CC BY): https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7487098 [CONFIDENCEPAPER]. The paper is informative background and does not change this document's optional status. Jorgen Expires 23 March 2027 [Page 16] Internet-Draft Oracle Confidence Gating September 2026 25. Security Considerations Colluding labels can inflate a marginal agreement distribution when provenance is not collapsed. Implementations SHOULD collapse effective identities before quorum and confidence calculation. The mapping is an authority input, not something G-Score can infer from a label. Sybil resistance is a provenance and admission property, not an entropy-only property. Before constructing p or rho, an implementation SHOULD validate D-chain freshness and collapse labels to an effective identity and provenance group. A fresh key MUST NOT increase the effective quorum merely because it has a valid signature. Let N_eff be the number of admitted unique provenance groups; quorum and Byzantine aggregation MUST use N_eff, not the raw label count. If N_eff is below policy, the result is HOLD or InsufficientKnowledge. This bounds the claimed defense to the declared identity and provenance authority; it does not prove universal Sybil prevention. Confidence thresholds can become denial-of-service controls. Implementations SHOULD bound backoff, expose HOLD and UNKNOWN states, and preserve a recovery path based on fresh evidence. A confidence result MUST NOT authorize a record that fails integrity, freshness, or admission. 26. IANA Considerations This document makes no IANA request. It defines no wire field, codepoint, registry, or mandatory algorithm. 27. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997, . [RFC8179] Bradner, S. and J. Contreras, "Intellectual Property Rights in IETF Technology", BCP 79, RFC 8179, May 2017, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, May 2017, . 28. Informative References Jorgen Expires 23 March 2027 [Page 17] Internet-Draft Oracle Confidence Gating September 2026 [TTTPS] Jorgen, H., "The TLS TimeToken Secure Protocol (tttps://)", Work in Progress, Internet-Draft, draft- helmprotocol-tttps-10, . [DEEPSPACE] Jorgen, H., "TTTPS Deep-space Profile", Work in Progress, Internet-Draft, draft-helmprotocol-deepspace-00, 2026, . [CONFIDENCEPAPER] Jorgen, H., "Oracle Confidence Gating for TTTPS: G-Score, Correlation-Aware von Neumann Confidence, and AdaptiveSwitch", SSRN 7487098, 2026, . Author's Address Heime Jorgen Independent Email: heime.jorgen@proton.me Jorgen Expires 23 March 2027 [Page 18]