SOTA: claim relative evidence receipts with committed experiment coverage

[ruvnet]

Finding

ClaimReceipt (arXiv:2609.01992, submitted 2026-09-02) separates two properties that generic logs do not prove: evidence sufficiency for a claim and coverage of the experiment set committed before execution.

The originating team reports exact replay of 1,392 historical records, expected verdicts on 11/11 semantic faults with 0/8 false positives, and a prospective epoch where withholding one terminal receipt correctly changes the result to INCONCLUSIVE_COVERAGE. Reported instrumentation overhead is 0.021% of model inference time and 9.9 KB per transaction. The authors also report that their frozen specification remains ambiguous to an independent reader, so this must be treated as originating-team evidence, not a solved standard.

RuV opportunity

Dream Machine already has witness hashes, anchored replay, ledgers, evaluator contracts, and persistent validity work. The missing primitive is a claim-relative verifier that makes omissions visible against a precommitted universe.

Proposed reusable contract in @dream-machine/witness:

type ClaimStatus =
  | 'PASS'
  | 'INVALID'
  | 'INCONCLUSIVE_COVERAGE'
  | 'INCONCLUSIVE_SUFFICIENCY';

interface ExperimentManifest {
  experimentId: string;
  protocolVersion: string;
  committedAt: string;
  assignments: readonly { id: string }[];
}

interface EvidenceRecord {
  assignmentId: string;
  fieldGroup: string;
  digest: string;
  opened: boolean;
  terminal: boolean;
}

The verifier binds a claim specification, the manifest digest, and canonical evidence records. It does not decide whether a scientific claim is true and it grants no execution authority.

Security and governance invariants

1. The experiment manifest is committed before candidate outcomes are visible.
2. A new run identifier cannot silently change the committed assignment universe.
3. Undeclared assignments, duplicate evidence identities, malformed digests, or a manifest digest mismatch are INVALID.
4. Missing terminal evidence for a committed assignment is INCONCLUSIVE_COVERAGE.
5. Missing claim-required field groups or required private openings are INCONCLUSIVE_SUFFICIENCY.
6. Evidence digests prove identity only. They never grant RVM authority.
7. Receipts should carry digests and opaque IDs, not raw private evidence.
8. Resource limits bound assignment and record counts.

Benchmark

Compare generic logs versus claim-relative receipts on synthetic omissions, duplicate records, malformed digests, undeclared assignments, missing private openings, and semantic field removal. Report baseline, candidate, sample size, versions, latency, allocation, false pass rate, false inconclusive rate, and exact reproduction steps.

Acceptance

• zero false PASS on all declared omission and mutation attacks
• exact deterministic replay of canonical evidence
• no authority expansion
• local verification p95 below 1 ms for 1,000 assignments on a current desktop CPU
• repository test, lint, typecheck, dependency, and CodeQL gates green
• independent MetaHarness reproduction before promotion

No autonomous merge.