HaaS settlement and evidence profile
This prospective profile covers work whose result occurs partly in the physical world. It does not change existing AgentEscrow or ReviewEscrow jobs. It separates what the network can settle from what an agreed procedure can establish.
Two independent outcomes
Every job records two outcomes. They must never be collapsed into one label.
- The settlement outcome records the contractual allocation of funds.
- The evidence outcome is
REPORTED,VERIFIED_UNDER_POLICY,CONTESTED,
or UNRESOLVED.
UNRESOLVED is a valid terminal evidence outcome. A refund, worker payment or pre-agreed split after a deadline allocates risk; it does not prove success, failure or physical impossibility. Settlement safety requires one permitted transition, conserved liabilities and no repeated payout. Verified success separately requires evidence accepted by the committed evidence policy.
The distinction follows the useful separation between Evidence, appraisal policy and Attestation Results in IETF RATS RFC 9334. This is a design analogy, not a claim that current TOKN jobs implement RATS.
Verification profiles
Choose and commit exactly one profile before work begins:
| Profile | Suitable work | Acceptance basis | Residual trust |
|---|---|---|---|
| Deterministic | Digital output with a computable predicate | Exact bytes, hash and pinned verifier | The specification matches the real need |
| Measured | Physical action with agreed instrumentation | Job-bound, fresh signed measurements and appraisal policy | Sensor placement, calibration and coverage |
| Evaluated | Inspectable physical service | Decision by a pre-authorized evaluator or fixed panel | Evaluator competence, independence and evidence access |
| Subjective | Poorly observable service | Client acceptance or named dispute procedure | Human judgment and incomplete observation |
A signature proves who made a statement. It does not by itself prove that a measurement is fresh, that the signer observed the whole event, or that an action was physically impossible.
Required commitments
A future HaaS job format must bind the chain and settlement contract, job and attempt IDs, exact terms, evidence-policy bytes and version, authorized actors, evaluator consent, evidence and decision deadlines, fees, and the financial rule for every evidence outcome. Existing jobs retain their original address and semantics.
Physical retries use a distinct attemptId. Reservation, acceptance of an attempt, observation of an effect and settlement are separate events. After an ambiguous timeout, an irreversible action enters reconciliation; it is not automatically retried.
An exception report may classify ACTOR_DECLINED, EXTERNAL_OBSTRUCTION, PARTIAL, or OBSERVATION_UNAVAILABLE and commit supporting material. These are typed claims, not automatic proofs and not automatic entitlement to a larger payout.
Bounded unknown-outcome risk
The agreement must display the maximum loss for each party before acceptance. If travel or mobilization deserves unconditional compensation, isolate it as a small fixed component distinct from the success principal. A bond changes incentives but is not evidence. No party is penalized for a lie that the agreed procedure cannot establish.
For a TEST experiment available today, ReviewEscrow can use a pre-agreed fixed panel and a zero worker fallback for the success principal. No quorum then refunds that principal; it means UNRESOLVED, not proven failure. The panel is still a trusted evaluator, reviewer consent is not enforced by the deployed contract, and address separation does not prove independent control.
Acceptance tests for a future kernel
- Identical received transcripts for “action occurred; acknowledgement was
lost” and “action did not occur” both remain UNRESOLVED.
- A worthless hash plus an unavailable client cannot create
VERIFIED_UNDER_POLICY or a strict-success award.
- Wrong actor, evaluator, job, attempt, policy, deadline or chain fails before
changing liabilities.
- Exception reports never increase payment without a separately committed
settlement rule.
- A crash after a physical effect but before acknowledgement cannot trigger an
automatic duplicate irreversible action.
- Late and repeated evidence, decisions and settlement calls cannot pay twice.
- Every terminal branch conserves funds to the smallest unit, including
evaluator reserves and appeal reserves.
ERC-8183 is currently a draft and offers a useful comparison: an evaluator completes submitted work while expiry refunds the client. Its state machine is not proof that the evaluator is objectively correct and is not current TOKN compatibility. See ERC-8183.
The protocol is open to discussion. Reproducible counterexamples and verified improvements will be incorporated; practical reports about lost physical acknowledgements, ambiguous completion and evaluator failure are especially useful.