| Internet-Draft | Claim Currency | October 2026 |
| Morrison | Expires 24 April 2027 | [Page] |
This memo specifies a read-time freshness evaluator and an observation-gated re-assertion discipline for concurrent autonomous readers of a single reconciled substrate history. For every claim read from the substrate, a three-state currency band (FRESH, AGING, STALE) is derived at read time from the durable history and is never stored. A claim whose derived band is not FRESH MUST NOT be re-emitted as current and MUST NOT ground a new durable claim; the sole transition back to currency is a fresh observation of the claim's basis, enforced at the substrate's append stage rather than at any reader's discretion. The memo is the claim-layer consumer that two companion specifications, Substrate-Observation as an Alternative to Envelope Coordination and the Substrate-Provenance Annotation Grammar, each left unspecified. The contribution is a specific composition: a read-time-derived band, a decay clock measured in missing observations learned from a basis's own change cadence, an append-stage rejection of any claim citing a basis that is no longer the head of its lineage, and observation as the only admissible refresh. No new substrate is standardised; the discipline composes with substrate that already exists.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 24 April 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
When several autonomous readers share a single body of recorded knowledge, a recurring failure is that a reader cites an aged claim as though it were current. The claim was true when it was written; nothing in the intervening period forced it into an explicit uncertain state; so a reader retrieves it, finds a plausible value, and re-asserts it as present truth. The failure is acute for software agents that read a shared store, act on what they read, and write new records grounded in it: an aged foundation propagates silently into new durable state.¶
Two companion memos establish the ground this memo builds on but
each stops short of the claim layer. [SUBOBS] describes how
concurrent sessions of a principal observe each other's presence
through substrate byproducts rather than through a coordination
envelope, and defines decay-to-uncertainty as a first-class terminal
operating state; it concerns who-else-is-here, not what-was-written,
and it deliberately standardises nothing. [SUBPROV] defines a
closed-class grammar for annotating the provenance of a claim,
including a terminal decayed-to-uncertainty class and an optional
observation timestamp, but states that it does not specify what an
inference system must do with the annotation.¶
This memo specifies that missing consumer. It defines the shape of a read over a reconciled substrate, the derivation of a currency band for the read, and the discipline under which an aged claim may still be spoken but may not be re-asserted as current nor used to ground a new claim. The enforcement point is the substrate's append stage, since that is the only place a shared history can enforce anything without transmitting a coordination message.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
The following terms are defined for the purposes of this document:¶
Claim. A recorded assertion together with the observations that ground it, held in the reconciled substrate history.¶
Reconciled substrate. The single durable history that concurrent readers share, to which a claim is appended through the substrate-physics cascade of [SUBOBS] and from which every currency band is derived.¶
Append stage. The point in that cascade at which a submitted claim is admitted to the durable history or rejected.¶
Basis lineage. The append-only sequence of observation events for a single basis element (a file, a record, an external source, a prior claim). Each event has a stable observation identifier and a timestamp.¶
Lineage head. The most recent observation event in a basis lineage at the moment of evaluation.¶
Grounding observation. The specific observation event a claim cited as basis when it was written.¶
Currency band. A three-state value, FRESH, AGING, or STALE, derived at read time for a claim, expressing whether the claim may be re-asserted as current.¶
Expected-observation deficit. The difference between the number of observations a basis lineage's own measured cadence predicts should have occurred since a claim's grounding observation, and the number that actually occurred.¶
Re-observation. A new observation event appended to a basis lineage, producing a new lineage head.¶
Currency-fast-forward rule. The append-stage admissibility predicate that rejects any submitted claim whose cited basis is not the current head of its lineage.¶
A read of the reconciled substrate returns a claim as an envelope,
never as a bare value. The envelope carries the assertion, the
timestamp of its grounding observation (as_of), the basis set
(each element naming its substrate class per [SUBPROV], its
observation identifier, and its observation timestamp), the claim's
decay class, the currency band derived at this read, the evidence
from which the band was derived, the re-verification trigger (the
moved or deficit-bearing basis elements whose re-observation F6
requires before the claim is FRESH again), and the supersession
state.¶
Three structural commitments govern the envelope.¶
First, the band is derived at read time and MUST NOT be stored. A stored band is itself a claim that ages and would reintroduce the problem one level up. Deriving the band at each read from the current durable history makes the band exactly as fresh as the read. The envelope carries the band's own evidence (the lineage heads and deficits it was computed from) so that a relying party can re-derive and audit it.¶
Second, as_of is the time of the grounding observation, not the
time the claim was written. A claim is only ever as current as the
observation that grounded it, and the delay between observing a
basis and writing the claim MUST NOT make the claim appear younger
than that observation.¶
Third, supersession resolves before any band is derived. Validity and currency are separate: supersession decides whether a claim is valid, and the band grades whether a valid claim is current. A superseded claim has no band, and no band makes a superseded claim valid again.¶
The band is a pure function of the durable history. Every reader that derives the band against the same history state derives the same band. Two axes contribute, and either is sufficient to degrade a band.¶
For each basis element, the evaluator compares the claim's grounding observation identifier against the current head of that element's basis lineage. If a head has moved, the basis was re-observed after the claim was grounded, and what the basis records may have changed since. The motion axis counts appended observation events, not seconds. Counting events rather than reading a wall clock defeats confidence-replay (re-emitting an old observation cannot rewind a lineage head) and removes divergence from clock skew between readers (all readers observe the same sequence).¶
A basis that goes unobserved also decays, at a rate learned from its
own lineage.
The evaluator maintains, per basis element, the measured observation
cadence: the empirical distribution of inter-observation intervals
over a trailing window of the lineage. The expected-observation
deficit is the number of observations the cadence predicts should
have occurred since as_of, minus the number that occurred. A
basis that historically changes hourly and has been silent for a day
carries a large deficit; a basis that changes yearly and has been
silent for a day carries none. No party declares the window; it is
measured from the lineage itself. Confidence in an earlier
observation therefore falls at a rate set by how fast the observed
thing changes, rather than holding until a fixed expiry, as
[MORRISON-IFT], Section 3.1 argues for authentication.¶
A corollary follows. If a basis lineage's own observation cadence collapses, because the process that observes it has stopped, the deficit on that basis grows, and its dependent claims degrade toward STALE. Observer failure therefore produces conservative decay toward uncertainty, and a claim whose observer has stopped never appears current.¶
FRESH: every lineage head equals the claim's grounding observation identifier, and the deficit is below its lower bound on every basis element.¶
AGING: any single lineage head has moved, or the deficit is past its lower bound on any basis element.¶
STALE: a moved head together with a deficit past the lower bound on the same element, or the deficit past its upper bound on any basis element, or the transitive rule of Section 6 forces it.¶
STALE is a terminal operating state in the sense of [SUBOBS] Section 2: it is a state the reader continues to operate under, not an abort and not an eviction. The decay class of [SUBPROV] remains in the envelope as a coarse, human-legible summary of the measured volatility, but the normative derivation runs on the measured cadence, not on the label.¶
The discipline has a reader side and a substrate side. The reader-side rules alone would be advisory; the substrate-side rules enforce them.¶
F1. A reader MUST derive the band at read time from the durable history and MUST NOT reuse a band derived at an earlier read.¶
F2. A claim whose derived band is FRESH MAY be emitted as
current, carrying its substrate-class provenance, its as_of, and
the band's evidence.¶
F3. A claim whose derived band is AGING or STALE MUST NOT be
emitted as current. It MAY be emitted only with the
decayed-to-uncertainty annotation of [SUBPROV] attached,
together with its as_of and derived band. Emission without the
annotation, or with a fabricated FRESH band, is non-conformant.¶
F4. A claim whose derived band is not FRESH MUST NOT appear in the basis set of any new claim submitted for append to the durable history. Aged state MAY be discussed; it MUST NOT be built upon.¶
F5 (the currency-fast-forward rule). The append stage of the reconciled substrate MUST reject any submitted claim whose cited basis observation identifier is not the current head of that basis element's lineage at append time. The rejection is a substrate commitment: it is observed identically by every session, transmits no coordination message, and fails closed. It is the claim-layer analogue of a cryptographic non-fast-forward rejection at a settlement layer.¶
F6 (observation as the sole transition). The only transition from AGING or STALE back to FRESH is a re-observation: a new observation event on every moved or deficit-bearing basis element, appended to the durable history with a new observation identifier and timestamp. Elapsed time, repetition of the claim, agreement among any number of readers, receipt of any message, and any server grant MUST NOT effect the transition.¶
F7. The evaluator MUST resolve supersession before band derivation, and the append stage MUST treat a claim citing a superseded claim as basis identically to one citing a non-head observation: rejected.¶
F4 and F5 are the central novel element. They relocate freshness enforcement from the read path to the append path, and they invert the protected direction. Cache freshness protects a reader from an aged copy; claim currency protects the future history from an aged foundation.¶
A claim whose basis set includes another claim, rather than a raw observation, inherits a band equal to the minimum of its own intrinsic band and the minimum band across its basis closure. The inheritance is evaluated lazily at read time over the basis graph and memoised per read.¶
Nothing propagates. There is no invalidation message, no dirty-flag walk, and no publish-subscribe fan-out, because those are the envelope coordination that [SUBOBS] identifies as an anti-pattern. Because each read recomputes the closure against the durable history, transitive currency is a pure function of the history, and every reader observes identical inheritance at identical history states. A dependent claim loses currency when its basis does, and no invalidation message is sent.¶
A bound follows from F5: a claim whose basis had already been superseded at its lineage head can never have been admitted. Chains resting on a moved head therefore cannot form in the history going forward. A basis can still age by silence after admission, and transitive currency governs those chains as well as chains recorded before the discipline was in force.¶
The claim tuples and their basis lineages live in the append-only
identity-log stages of the substrate-physics cascade described in
[SUBOBS]: the per-principal append log for claims scoped to one
principal's sessions, and the per-organisation append log for
collective claims. The principal and the organisation are each
named by a ~handle, which corresponds to an alter: URI
[ALTER-URI], for example alter:~alice for a person and
alter:~example.com for an organisation. Filesystem-lock
arbitration orders concurrent append attempts on the same lineage.
External operational settlement is where a currency-fast-forward
rejection surfaces for externally-visible commitments, the
cryptographic non-fast-forward being the existing instance the rule
generalises.¶
The band evaluator reads lineage heads from the append-log stages, and the F5 gate executes at the same append stage the cascade already owns. The forcing function therefore adds no new stage; it adds one admissibility predicate to an existing stage. Like [SUBOBS], this memo standardises no new substrate; it specifies a discipline over substrate that already exists.¶
A decayed read carries its own wire evidence. The emission is
tagged with the decayed-to-uncertainty terminal class of
[SUBPROV]; the grammar's observation timestamp field carries
as_of; the grammar's observation-identifier field carries the
grounding observation identifier. Any relying party can re-query
the named lineage and confirm both the age and the head divergence
independently.¶
[SUBPROV] notes that an annotation is a declaration, not a proof. This memo answers that concern at the append stage. A forged FRESH band is rejected at F5, because a fabricated envelope cannot alter the lineage head the append stage checks. The append stage does not rely on a reader reporting its band honestly; it checks the lineage head.¶
A single reconciled history and the mutual-hallucination property of [SUBOBS] are not in tension, because they occupy different layers.¶
Each reader derives its own band at its own read moment. Two readers reading seconds apart, or reading while an append is in flight, may hold divergent local views of currency. No local band is canonical; that is mutual hallucination, preserved in full. But every band is a pure function of the same durable history. Divergence between readers is bounded to read-timing skew and never extends to disagreement about what the history contains.¶
Divergence reconciles where [SUBOBS] reconciles everything: at the commitment stage. Whichever reader appends first advances the lineage head; the other reader's now-aged local view is caught by F5 when it attempts to build on it. No reader is ever told it was wrong; it observes the rejection, re-reads, and re-derives. There is one history and many views of it, and F5 keeps an aged view from being written into that history.¶
Three simpler designs are rejected here, each for a different reason.¶
A declared time-to-live, whether a fixed lifetime or a per-record
fresh_until, is a window a party chooses. A chosen window is
gameable and is blind to the basis's actual rate of change. The
silence axis of Section 4.2 measures the window from the basis's own
lineage instead of declaring it.¶
An invalidation message broadcast to readers when a basis changes is the envelope coordination [SUBOBS] rejects: it re-introduces a fan-out, a delivery guarantee, and a broker. The transitive currency of Section 6 achieves invalidation as a read-time function of the history, with no message.¶
An abort on aged input, the posture of a security-metadata expiry scheme, forfeits the terminal-operating-state posture. An agent that must continue under partial information needs to keep operating with an aged claim marked uncertain, not to halt. F3 keeps the aged claim speakable while F4 keeps it unbuildable.¶
The contribution of this memo is a specific composition. Each element below exists somewhere in the landscape; none of the cited families combines them, and several are designed against the combination.¶
Knowledge units for multi-model deliberation [KU] carry a per-unit
fresh_until, a status of active, stale, or superseded, and a
volatility tier, and on ageing a unit "SHOULD be considered
potentially stale" and "SHOULD be re-deliberated". This is
advisory, not forcing: the primary text places no block on citing or
using an aged unit, and its own write side has no rule rejecting a
new unit for referencing a stale parent. It is explicitly a
many-units model: units are never modified in place, and change
produces new units linked by supersedes and parent inheritance in a
directed graph. Its recovery primitive is re-deliberation of the
claim (a fresh round of model questioning), not re-observation of
the basis. This memo inverts each of these: the discipline is
forcing at the append stage, binds to a single reconciled history,
and admits only re-observation as the transition to currency.¶
HTTP caching freshness [RFC9111], with stale-while-revalidate and stale-if-error [RFC5861], computes freshness lifetime against current age and, on exceeding it, marks a response stale but permits serving it, either directly or while revalidating. Revalidation fires only on a reuse attempt, and currency is restored by an origin grant. Caches are per-node; there is no single reconciled history, and no origin exists behind a reconciled substrate. Under this memo an aged claim may still be spoken but may not be built on, currency returns only through a new observation, and the band is derived at every read whether or not a reuse is attempted.¶
The Update Framework [TUF] expires metadata and requires a client to refuse an expired file, aborting the workflow and reporting a possible freeze attack. The terminal state is abort, not an uncertainty state operated under, and the model is one client's security workflow, not a shared multi-reader history.¶
Certificate Transparency [RFC9162] requires a log to publish a signed tree head no older than a maximum merge delay, re-signing even when idle, with non-progress detected by external monitors. The freshness obligation is on the producer and the detection is off-path; there is no reader-side decay of a stored claim to uncertainty.¶
The phi accrual failure detector [PHIACCRUAL] outputs a continuous suspicion level about a process's liveness from heartbeat-arrival history, leaving the threshold to the consumer. The silence axis of Section 4.2 borrows this inter-arrival statistical shape and inverts its subject: phi grades suspicion of a node's death and only ever informs, whereas the deficit grades uncertainty of a stored claim's currency and gates an append.¶
Leases [LEASES] grant time-bounded permission to trust a cached datum, requiring re-acquisition on expiry. Expiry is a binary lapse of a server-granted permission, not a decay of the claim into a labelled uncertainty state, and the grant is an envelope from a server rather than a reader-side observation.¶
DNS negative caching [RFC2308] counts a time-to-live down to eviction, with an explicit absence of any intermediate unknown state, per resolver, with lazy re-query. Eviction is not decay-to-uncertainty, and there is no reconciled history.¶
Confidence-replay, in which an adversary re-emits an aged observation to refresh readers' confidence in stale state, is closed by two properties together. Because the motion axis counts in appended observation events, replay cannot rewind a lineage head, and because refresh requires a new append, a strictly advancing head cannot be moved backward.¶
Ghost-basis injection, in which an adversary fabricates a lineage to feed a false cadence, is mitigated by the identity-bound append admission of the cascade in [SUBOBS] and by that memo's monotonic layer-coverage commitment.¶
Band forgery has no effect at the append stage. A forged FRESH band cannot alter the lineage head the F5 predicate checks, and a forged envelope citing a non-head basis is rejected whatever band it claims. Emission-side forgery, a reader emitting an aged claim as FRESH, remains a conformance violation and is detectable by re-derivation against the history.¶
Currency starvation, in which an adversary appends spurious observations onto a basis lineage to hold every dependent claim at AGING indefinitely, is mitigated by identity-bound append admission, by the cadence learner treating a sustained change in append rate as a new volatility regime, and by a per-lineage append-rate ceiling.¶
Simulated split-brain across cascade stages is inherited from [SUBOBS] and its per-observer monotonic layer-coverage mitigation.¶
An observation lineage exposes the observation cadence of its basis, and that cadence can itself profile a principal's activity rhythm. Implementations SHOULD scope lineage visibility to the principal's own scope, and cadence-derived windows MUST NOT be used to manufacture a continuously refreshing per-individual surveillance signal. Pseudonymous-tier observations follow the refusal postures of [SUBOBS] Privacy Considerations.¶
This memo requires no IANA actions. A future revision may register the currency-band vocabulary alongside any substrate-class registry established by [SUBPROV].¶
This memo is the claim-layer consumer that [SUBOBS] and [SUBPROV] each left unspecified, and it stands directly on both.¶
Initial revision.¶
Names the principal and the organisation of the per-principal and
per-organisation append logs by ~handle, written as an alter:
URI, and adds an informative reference to [ALTER-URI].¶
Cites [MORRISON-IFT], Section 3.1 (informative), from the silence axis in Section 4.2.¶
Rewrites figurative and aphoristic sentences in Sections 3, 4.1, 4.2, 4.3, 5, 6, 8, 9, 10, 11 and 12 as plain statements, with no requirement changed.¶
Removes the hand-written Status of This Memo and Author's Address sections, which duplicated the ones the tools generate, replaces the hand-typed BCP 14 key-words paragraph in Section 2 with the standard boilerplate, and replaces the hard-coded section numbers with cross-references.¶
Rewrites the prose against the drafting rules and pins each citation of another Internet-Draft to its latest posted revision, with no requirement changed.¶
Moves each citation of another Internet-Draft in the stack to the revision going up with this one, with no requirement changed.¶