Genuine disagreement is the design

Start from sovereignty. A jurisdiction is, by definition, the entity that gets to decide what its rules mean within its territory. Pakistan’s securities regulator and Singapore’s securities regulator are not running the same function on the same inputs. They are running different functions – functions that encode different policy choices, different risk tolerances, different histories of financial crisis. When they produce different verdicts on the same entity, the system is working as designed. Sovereignty means the right to disagree.

The engineering instinct is to treat the disagreement as an inconsistency to resolve. In a distributed database, two nodes returning different answers to the same query is a fault to repair. Separate jurisdictions exist precisely so that they can return different answers to the same facts.

So the first principle: you cannot build a system that eliminates disagreement between sovereigns without eliminating sovereignty.

Self-contradiction is provable

There is a kind of “disagreement” that is not legitimate: a jurisdiction disagreeing with itself. When the same authority evaluates the same question on the same inputs and produces two different verdicts, that is not sovereignty in action. It is incompetence or fraud, and the mechanism below does not need to know which.

The proof rests on what a verdict is. A signed verdict is a cryptographic commitment with an exact scope: jurisdiction J’s key over the statement “entity E has outcome v in domain d”, together with the pinned inputs of the evaluation – the version of the rule archive the evaluation ran under and the digests of the evidence it consumed – and an evaluation index naming which evaluation this is. The index is not the issuer’s to choose, and the evaluation never reads it: it is fixed by the question instance – the operation identifier and corridor epoch under which the evaluation was requested, the corridor index of the companion papers – or it is a digest of the statement’s subject, domain, and pinned inputs, and under either form it names the evaluation without explaining its outcome. The outcome is not a bit: the value set carries Non-Compliant, Pending, and Compliant in that order, with not-applicable and exempt on a separate applicability axis (the companion paper How Compliance Composes fixes this value set). Contradiction is outcome inequality at the same index: two verdicts under the same key, for the same subject and domain, over identical pinned inputs, with different outcomes.

The keying does real work. Compliance status legitimately changes – new evidence arrives, a license expires, a sanctions list updates – and the tempting design is temporal: treat verdicts that flip too fast to be explained as suspect, then tune the window per jurisdiction against false positives (evaluations that raced) and false negatives (contradictions disguised by patience). Pinning the inputs eliminates the window and the tuning with it. Whatever explains a changed verdict – the Wednesday sanctions update between Monday’s verdict and Friday’s – is itself an input, so the two verdicts differ in their pinned inputs and no contradiction arises. Nothing needs to be explained away, because everything that could explain a difference is inside the signed statements, and two verdicts at the same index with different outcomes have no innocent reading. Nor does the index offer an escape: two verdicts over identical pinned inputs with different outcomes either share an index, and are a certificate, or sit at two indices, and then determinism in the pinned inputs – of which the index is not one – means at least one of them fails replay, which is penalized below as the issuer’s own statement failing its own commitments and floors the corridor as a certificate does. The companion papers apply the same discipline with the index anchored externally, as the operation identifier and corridor epoch the protocol assigns: The Sovereign Jurisdiction Network accepts an equivocation certificate only for conflicting signed artifacts under one zone’s key at the same operation identifier and epoch, and Op: A Typed Bytecode for Compliance-Carrying Operations carries verdict uniqueness at that index as a typed invariant, refusing a second local signature at an occupied index outright and reifying a same-signer, same-index conflict between imported artifacts as a blame witness naming the signer. The fault is the same in all three: one signer, one index, two artifacts that conflict.

This is equivocation, and unlike disagreement it produces a proof: the two signed statements themselves, a certificate any holder can check without access to the jurisdiction’s internal reasoning – the signatures and the outcome inequality need no third party, and the key’s attribution to the jurisdiction is read from the registry. Four assumptions carry the claim, and they are the whole of it. The signature scheme is existentially unforgeable under chosen-message attack, so a verifying signature identifies the key. A registry authentically binds each signing key to its jurisdiction and records revocation, so the key identifies the signer. Verdicts have a canonical encoding, so outcome inequality at the same index is machine-decidable. And evaluation is a deterministic function of the pinned inputs, with the index not among its arguments, so inequality is contradiction rather than tolerated noise.

Time still enters, in one place: reliance. A verdict speaks for its index indefinitely, but a party acting today needs the evaluation behind it to be recent enough that nothing material has moved. That is a freshness bound. Corridor policy fixes the maximum age of a verdict it will accept, exactly as it bounds the staleness of a presented passport head (The Compliance Passport). Freshness governs which verdicts may be relied on. It plays no part in what counts as contradiction.

What signed verdicts demand

Before digital signatures, detecting institutional self-contradiction reduced to testimony against testimony. A regulator could say “we never approved that” and no artifact could answer. A signed verdict answers: a jurisdiction cannot deny a verdict its unrevoked key signed. Three requirements follow for any system that takes such verdicts seriously.

Every verdict is signed. An unsigned verdict is unattributed. It cannot be proved issued, cannot contradict anything, and cannot ground accountability.

Every verdict is retained, beyond the issuer’s power to edit. Contradictions live in history, so the history must survive – and the issuer is the one party with an interest in its incompleteness. An issuer-held log invites two attacks: rewrite the past, or serve different histories to different parties, each internally consistent. The answers are structural. Verdicts chain by hash, each entry committing to its predecessor under the issuer’s signature, so editing the past forks the chain, and a fork is two signed successors of one entry – equivocation again, at the level of the log itself. Forks surface through watchers: external parties, bonded, who sign the chain head they observe at the height they observe it, so that serving different histories to different parties produces conflicting attested heads. The companion papers carry the construction: The Chain of Evidence for the hash chain, inclusion proofs, and watcher-based fork detection; The Sovereign Jurisdiction Network for watcher bonds and for the rule that an equivocation certificate carry receipt-chain or watcher inclusion evidence.

Detection is automatic, and it is not the issuer’s job. Nobody cross-references thousands of verdicts by hand, and the party that produced a contradiction is the last party that will hunt for it. Detection belongs to those with the evidence and the stake: recipients, who check each new verdict against those they already hold, and watchers, whose bonded attestations of the chain head make a history served differently to different parties surface as conflicting heads, at the cost of the bond to any watcher that attests conflicting heads itself. Whether a corridor also pays its watchers is a term of its policy, not a part of the construction.

None of these ingredients is novel, and that is a strength: each has carried weight elsewhere. Signed append-only logs that make a node’s faults provable to third parties are PeerReview (Haeberlen, Kouznetsov and Druschel 2007). The forced choice an untrusted log operator faces between consistency and a detectable fork is fork consistency (Li, Krohn, Mazières and Shasha 2004). Public monitoring of a trusted authority’s issuance log is Certificate Transparency (Laurie, Langley and Kasper 2013). Double-signing at the same index as the provable, punishable fault is the accountable-safety discipline of proof-of-stake consensus (Buterin and Griffith 2017; Buchman 2016). Slow-accrual, sharp-loss reputation is the beta reputation family (Jøsang and Ismail 2002) and its network forms (Kamvar, Schlosser and Garcia-Molina 2003). What the sovereign setting changes is the object of accountability. In the first four of those systems the parties share a correctness standard, and any deviation from it is a fault; the reputation pair shares no standard and proves no fault, aggregating subjective ratings instead, and it is precedent here only for the shape of the demotion dynamics in the next section. Here the parties are sovereigns whose deviations from each other are protected, so accountability must attach to exactly one thing: deviation from self.

The economics of trust demotion

Detection requires a response, and the response cannot be punitive. A sovereign cannot be fined or compelled by an external system. What a counterparty controls is its own reliance: the weight it gives the jurisdiction’s future assertions, and the price of re-verifying them.

The object adjusted is not a single score per jurisdiction. Trust in this setting is already structured. Recognition of foreign evaluations is granted per domain – a jurisdiction trusted on anti-money-laundering need not be trusted on data privacy (Mutual Recognition) – and operational trust lives on each corridor as a level in a finite ordered set, each level keying a policy table of transaction limits, settlement windows, and in-flight counts (The Sovereign Jurisdiction Network). The consequence of equivocation is movement in that structure. A corridor at a lower level carries lower limits and longer windows; a domain whose recognition grade falls loses face-value acceptance, and the receiving side re-evaluates locally what it previously accepted.

The dynamics are asymmetric, and the asymmetry is deliberate, because the cost of relying on an untrustworthy counterparty far exceeds the cost of being slow with a trustworthy one. Upward movement is slow and thresholded: a corridor is promoted one level at a time on observed clean settlement. Downward movement on proven equivocation is not a decrement but a floor: the corridor drops to its most restrictive level, or to suspension, regardless of the level it held.

The floor matters because the natural-looking alternative – lose a fraction of current trust – fails in exactly the dangerous cases. Under a proportional rule a low-trust jurisdiction loses almost nothing by equivocating, so the deterrent is weakest for the parties most likely to offend, and each repetition costs geometrically less than the last. Demotion to a floor separates what varies with standing from what does not. The drop varies: an established corridor falls further, which is correct, since a long clean record makes equivocation more alarming, not less. The landing point does not, and neither does the price of leaving it: the floor is the same level for every offender, and every level regained from it costs the same promotion threshold whatever the corridor held before and however many times it has fallen. The offender the drop barely touches – a corridor at or near the floor, whether new there or returned – meets the floor’s own limits, which cap what any counterparty exposes to it and so what a contradictory verdict can gain, and suspension, which permits nothing.

Recovery runs through the same promotion thresholds as a new corridor. There is no shortcut back. The rebuild horizon is the observed clean settlement the thresholds demand, accrued under the limits of each level in turn – floor-level limits first, easing with every promotion – and that horizon, not any nominal penalty, is what equivocation costs.

One event must move nothing at all: a signature that fails to verify. Bytes that do not verify under a jurisdiction’s key are not that jurisdiction’s statement. Under the unforgeability assumption anyone can produce them, and a rule that penalized the named key would hand every third party a lever to demote any jurisdiction by broadcasting garbage. Verification failure is rejection without attribution. The attributable neighbor of this event floors the corridor as a certificate does: a validly signed verdict whose disclosed bundle fails replay – an evidence digest that does not match, a rule-archive version that does not yield the signed outcome. That is the jurisdiction’s own statement failing its own commitments. Key compromise, finally, is answered by revocation through the registry, which bounds what the key can sign from the revocation forward; no scoring rule repairs a stolen key.

Integrity disputes before interpretation disputes

Disputes between parties producing signed claims stratify into two layers with different resolvers.

The first layer is integrity: is this artifact what it claims to be? These are machine questions with exact answers. A content-addressed evidence package either matches its digest or does not; matching proves the content unchanged since commitment. A signature either verifies or does not; verifying attributes the statement to a key. A verdict either replays from its disclosed inputs under the stated rule version or does not. What none of these checks proves is that the committed content was true. Integrity is provenance and preservation, not veracity.

The second layer is interpretation: given authentic evidence, what does it mean? This is not a machine question. Two authentic, unmodified documents can support contradictory legal conclusions depending on which tradition’s rules of interpretation apply; a shipping document that constitutes delivery under one legal system may not under another. This layer belongs to human adjudicators who know the traditions.

The stratification is an ordering: integrity first. There is no point convening a tribunal over evidence that fails its digest. Resolving the first layer mechanically shrinks the adjudicators’ docket to the genuinely contested cases and hands them a verified record, instead of asking them to be forensic cryptographers as well as lawyers.

Contestation as a design requirement

A system that produces verdicts must also produce the means to contest them. A verdict that cannot be contested is not trustworthy: confidence in the uncontested majority comes from the standing possibility of challenge, not from a presumption of infallibility.

Contestation needs a route, and the route cannot end at the issuer. A system that adjudicates disputes over its own outputs offers its counterparties no external check on its correctness, so the corridor instrument names the forum in advance – an institution independent of the issuing system – the way commercial contracts fix their arbitral forum before any dispute exists.

The mechanics follow the stratification. Standing belongs to the parties a verdict binds: the evaluated entity, and any counterparty that relied on the verdict. The challenge artifact is the signed verdict with its disclosed bundle – evidence digests, rule-archive version, replay transcript – and the forum’s first step is mechanical, verifying integrity before hearing argument. The issuing system contributes infrastructure, not judgment: verdict logs, integrity verification, equivocation certificates, corridor trust records. The remedy respects the append-only record: no verdict is deleted; a wrong one is superseded by a new signed verdict whose inputs include the ruling that displaced its predecessor, and which sits at a new index under either form – the digest changes with the pinned inputs, and an occupied corridor index admits no second signature. And where a challenge surfaces two same-index verdicts, interpretation dissolves into integrity: the certificate is complete in itself, and the demotion consequence follows from the corridor’s pre-agreed rules rather than the forum’s discretion.

Deterrence

Assemble the pieces. Verdicts are signed and index-keyed. Logs are append-only, watched, and beyond the issuer’s editorial reach. Same-index contradictions yield certificates any holder can verify against the key registry and the canonical encoding. Certificates, and validly signed verdicts that fail replay, floor the corridor’s trust level, and the rebuild horizon prices the offense. Integrity questions resolve mechanically before interpretation questions reach a forum independent of the issuer.

The intended effect is that equivocation stops paying. The claim has a precise shape: deterrence holds when the one-shot gain from a contradictory verdict is smaller than the cost of demotion – the friction of the limits at each level along the promotion path, heaviest at the floor and easing with each level regained, and of local re-evaluation while recognition is withheld, integrated over the rebuild horizon and discounted however the jurisdiction weighs its future. Whether the inequality holds depends on stakes, detection lag, and discount rates. This note specifies the mechanism that makes the cost side large; it does not construct the payoff model under which deterrence would be a theorem.

The mechanism’s limit deserves the same plainness as its promise. It binds a sovereign to consistency, not to truth. A jurisdiction that applies a bad rule uniformly never contradicts itself. One that attests fabricated facts with discipline replays cleanly against its own fabrications. No consistency check reaches either case, and nothing here claims otherwise. What the mechanism removes is the ability to say different things to different parties, or to the same party at different times, and still be believed.

That is the sense in which sovereignty and accountability coexist. No jurisdiction is forced to agree with any other; every jurisdiction is held to agreeing with itself. Disagreement between sovereigns is a policy fact to be priced. Disagreement of a sovereign with itself is a provable fault to be made expensive. The line between the two – and the ability to prove the second from signed artifacts alone – is the foundation on which cross-jurisdictional cooperation rests.

References

Buchman, E. (2016). Tendermint: Byzantine Fault Tolerance in the Age of Blockchains. MSc thesis, University of Guelph.

Buterin, V. and Griffith, V. (2017). “Casper the Friendly Finality Gadget.” arXiv:1710.09437.

Haeberlen, A., Kouznetsov, P. and Druschel, P. (2007). “PeerReview: Practical Accountability for Distributed Systems.” ACM Symposium on Operating Systems Principles (SOSP 2007).

Jøsang, A. and Ismail, R. (2002). “The Beta Reputation System.” 15th Bled Electronic Commerce Conference.

Kamvar, S. D., Schlosser, M. T. and Garcia-Molina, H. (2003). “The EigenTrust Algorithm for Reputation Management in P2P Networks.” WWW 2003.

Laurie, B., Langley, A. and Kasper, E. (2013). Certificate Transparency. RFC 6962.

Li, J., Krohn, M., Mazières, D. and Shasha, D. (2004). “Secure Untrusted Data Repository (SUNDR).” OSDI 2004.