Protocol Principles (Audit View)
A formal, auditable contract for system behavior: M = (S, E, V, δ, I).
Overview
PVERSE is defined as an auditable protocol rather than a UI narrative. Its guarantees are expressed through a formal model, explicit validation requirements, and forward-only records. Canonical outcomes do not come from presentation, operator preference, or cached interpretation.
The protocol is specified as the state-machine formalism M = (S, E, V, δ, I), where state is derived, events are append-only, validation gates acceptance, transitions are controlled, and invariants constrain every version of the system.
Scope
This page defines protocol guarantees and the audit model only. It does not attempt to describe every implementation detail. Instead, it fixes the non-negotiable rules that preserve determinism, scarcity, replay safety, and record integrity as the system evolves.
- Defines the formal audit model for canonical outcomes.
- Defines invariants that must hold across all versions and operating conditions.
- Defines append-only event and validation requirements for outcome-affecting actions.
- Defines the mandatory evidence standard when USD valuation influences outcomes.
Core Model
The protocol model is centered on a strict authority hierarchy. Chain anchors, validated events, and append-only records are authoritative. Derived states are projections. UI is informational only and may lag, fail, or misrender without changing canonical truth.
- S — derived state views reconstructed from accepted events and durable records.
- E — append-only evidence stream used as the only allowable input for outcome-affecting transitions.
- V — validation predicates that gate whether an event may influence state.
- δ — controlled transition function that applies validated events to produce new derived state under non-negotiable invariants.
Operational Behavior
No transition is valid without a validated event. The protocol must remain explainable under retries, restarts, replays, and partial failures. Idempotency prevents the same accepted evidence from producing duplicate outcomes.
If USD valuation affects eligibility, tiering, allocation, vesting, or any canonical result, then USD becomes an audit input and must be independently reconstructable from recorded oracle evidence, including oracle type, feed address, round id or equivalent pointer, and chain context.
Constraints
- Determinism: canonical outcomes come from rules applied to verified inputs, not discretionary edits.
- Scarcity preservation: supply and entitlement constraints are structural and cannot be bypassed by presentation or informal policy.
- Append-only history: corrections must be represented as new events, never silent rewrites of canonical records.
- Forward-only updates: ruleset changes apply prospectively and do not retroactively rewrite previous outcomes.
Integrity Considerations
PVERSE prioritizes replay safety and audit integrity over convenience. If ambiguity exists, the interpretation that best preserves determinism, scarcity enforcement, and record integrity takes precedence. Operator action may initiate workflows, but it cannot manufacture truth outside the validated event model.
- Truth hierarchy: chain anchors + validated events + append-only records are authoritative; UI is non-authoritative.
- Correction discipline: historical truth is preserved by referencing prior anchors through new corrective events.
- USD evidence clause: if USD affects outcomes, the valuation path must be reconstructable under deterministic replay.
Future Expansion
Operational thresholds, safeguards, balance parameters, and implementation details may evolve through forward-only ruleset updates. Those changes may affect future evaluation and execution, but they must not retroactively rewrite recorded allocations, ownership history, vesting records, or accepted evidence.
I — Invariants (Non-Negotiable)
Canonical outcomes are produced by system rules applied to verified inputs. Discretionary edits are not a valid mechanism for changing outcomes.
- All outcome-affecting inputs must be representable as E and validated by V.
- Derived views must be reconstructable from append-only records.
Scarcity is structural. Supply constraints are enforced by accounting, entitlement rules, and verifiable records.
- No informal policy can override on-chain or ledger-backed scarcity constraints.
- Allocation is defined by ruleset version plus validated evidence, not by UI display.
The history of accepted events and derived outcomes is preserved as an auditable trail. Deletion and mutation are not permitted for canonical records.
- Corrections are represented as new events, not rewrites.
- Idempotency prevents duplicate application under retries and replays.
Updates apply forward only. Parameter changes affect future evaluations and transitions, never past outcomes.
- Rules are version-bound; a ruleset version fixes interpretation for a given period.
- Past allocations and vesting records remain valid under the ruleset that produced them.
UI is informational. System truth is derived from authoritative sources: validated events, controlled transitions, and verifiable anchors.
- Chain anchors plus append-only records are authoritative.
- UI may lag, fail, or misrender without changing canonical truth.
When trade-offs exist, PVERSE prioritizes replay safety and audit integrity over operational convenience.
- Operator action is not a substitute for verifiable evidence.
- All privileged pathways must be observable as events.
E — Event Model (Append-Only)
Events are the canonical evidence stream. They are the only allowable inputs that can produce or change derived state. Every outcome-affecting action must correspond to an event with verifiable anchors.
Event families (minimum set)
- E_OBSERVED — Evidence observed from tx/log/receipt anchors.
- E_CONFIRMED — Confirmation threshold reached under chain-aware rules.
- E_PRICE_SNAPSHOT — USD valuation snapshot when USD affects outcomes.
- E_ENTITLEMENT_RECORDED — Allocation or eligibility recorded under a ruleset version.
- E_LEDGER_APPLIED — Append-only ledger application with idempotency.
- E_CORRECTION — Forward-only correction referencing prior anchors.
V — Validation Predicates
Validation predicates define the acceptance gate for events. If validation fails, the event must not influence derived state. Validation exists to support deterministic replay, consistency, and audit reconstruction.
Base evidence requirements
| Field | Requirement | Purpose |
|---|---|---|
| chain_type / chain_id | Required | Disambiguates chain semantics and confirmation rules. |
| event_uid | Required + unique under idempotency key | Prevents the same accepted event from being applied twice. |
| anchor | Required | Provides a verifiable reference to the authoritative source. |
| ruleset_version | Required | Binds interpretation to a declared forward-only ruleset. |
| observed_at | Required | Supports audit ordering and timeline reconstruction. |
USD valuation evidence clause
If USD valuation influences eligibility, tier selection, allocation, vesting, or any canonical outcome, then USD must be reconstructable from oracle evidence under deterministic rules. USD is treated as an audit input.
| Field | Requirement | Notes |
|---|---|---|
| oracle_type | Required | For example CHAINLINK; defines reconstruction method. |
| feed_address | Required | Canonical price feed contract address. |
| round_id | Required | Oracle pointer used to reconstruct the exact answer. |
| answer / decimals | Required | Exact numeric value used in computation. |
| updated_at | Required if available | Oracle-provided update timestamp. |
| block_number and/or block_hash | Required (prefer both) | Binds snapshot to chain context for deterministic replay. |
| anchor | Required | Verifiable evidence reference used during reconstruction. |
δ — Controlled Transition Function
Transitions are controlled: δ(S, E) → S′. The system must remain explainable under retries and failures. No transition is permitted without a validated event.
Transition outline
- observe: accept evidence into E only after V passes.
- confirm: apply chain-aware confirmation gates.
- valuate: if USD affects outcomes, require E_PRICE_SNAPSHOT with full evidence.
- entitle: record entitlement/allocation as append-only output bound to ruleset version.
- apply: apply to ledger idempotently.
- correct: represent corrections as new events that preserve prior truth.
S — Derived State Views (Non-Authority)
States are derived views reconstructed from the event stream and append-only records. They are useful and reproducible, but they are not authoritative by themselves.
- S_commit — lifecycle state of a participation or deposit commit.
- S_ledger — append-only application state keyed for idempotency.
- S_entitlement — allocation and vesting view bound to ruleset_version.
- S_evidence — evidence completeness and validation status.
Truth Hierarchy
PVERSE truth is hierarchical and explicit. Chain anchors, validated events, and append-only records are authoritative. UI is a convenience layer that may fail without changing canonical truth.
- Docs define meaning, boundaries, and intended guarantees.
- SSOT defines canonical numeric parameters and configuration.
- Code enforces V and δ to produce durable records.
- Verifiable logs anchor the evidence used to derive outcomes.
- UI is informational only.
Change Boundaries
Changes are classified by whether they can affect canonical outcomes retroactively. The protocol permits evolution only where invariants remain intact.
May change (forward-only)
- UX and presentation layout.
- Non-critical operational thresholds and safeguards.
- Game balance parameters under forward-only policy.
Must not be rewritten retroactively
- Recorded outcomes and historical logs.
- Executed allocations and vesting records bound to the ruleset that produced them.
- Ownership history once recorded under system rules.
Summary
- PVERSE is specified as M = (S, E, V, δ, I) for audit-grade explainability.
- Events are append-only, state is derived, and transitions are controlled.
- Invariants enforce determinism, scarcity preservation, append-only history, and forward-only updates.
- If USD affects outcomes, the valuation path must be reconstructable from oracle evidence.