Semafide: evidence custody for automated valuations

Semafide: evidence custody for automated valuations An architecture diagram generated by Archify. Lender · Orders the valuation · Architecture component Lender Orders the valuation AVM cascade · Runs top model, stops on hit · Architecture component AVM cascade Runs top model, stops on hit Cascade configuration · Provider-held. Revised on cadence. · Provider boundary. Not instrumentable today. · GAP · FACT Cascade configuration Provider-held. Revised on cadence. GAP · FACT AVM model · Vendor weights and data · Vendor model. Not held. AVM model Vendor weights and data Capture and seal · Manifest at application boundary · Architecture component · SCAFFOLD Capture and seal Manifest at application boundary SCAFFOLD Append-only log · Merkle-chained, sequenced · Architecture component · BUILT Append-only log Merkle-chained, sequenced BUILT Custodian · Holds the assignment checkpoint · Outside the party being examined · OPEN Custodian Holds the assignment checkpoint OPEN Independent witness · Cosigns, refuses split views · Outside the party being examined · OPEN Independent witness Cosigns, refuses split views OPEN External time anchors · RFC 3161 upper, beacon lower · Architecture component External time anchors RFC 3161 upper, beacon lower Standalone verifier · Independent claims about a sealed run · Architecture component · BUILT Standalone verifier Independent claims about a sealed run BUILT Examiner or reviewer · Asks what produced the value · Architecture component Examiner or reviewer Asks what produced the value Repurchase review · Valuation is the contested item · Architecture component · FACT Repurchase review Valuation is the contested item FACT order run governs if captured commit checkpoint cosign bounds record report demand Vendor model. Not held. Provider boundary. Not instrumentable today. Outside the party being examined

What a single record establishes (code/seal/verifier.py)

  • • precedence — the evidence commitment predates the run seal naming it. Not that the analysis consumed it.
  • • witness_attestation — an independently trusted witness key signed an observed-execution attestation binding the run, evidence, action, and capture reference. Not a signature over a supplied bundle.
  • • recipe_available — a complete, version-pinned recipe is present and linked to the claimed evidence and action. Not that it ran.
  • • recipe_reproduced — a verifier reproduced the sealed output from the recipe. Not historical occurrence.
  • • historical_execution_established — true only via a valid observed-execution witness attestation. Never inferred from reproduction.

Reported separately from the five propositions

  • • external time bounds (Anchoring) — UPPER_ONLY from RFC 3161, LOWER_ONLY from a published beacon, BOUNDED where both resolve. Not the record's content.
  • • completeness and disclosure — completeness asks whether the supplied chain is whole; disclosure asks whether it is the whole assignment. Both default to UNCHECKED without an outside checkpoint.

Non-implication rule

  • • No claim upgrades another. Each is established on its own evidence.
  • • Reproduction does not prove historical execution.
  • • A valid chain does not prove the disclosed set is whole.
  • • The five propositions are boolean: ESTABLISHED or NOT ESTABLISHED, per EvidencePropositions.
  • • UNCHECKED is the honest default for completeness and disclosure only. It is not a fourth value on every proposition.

The wedge, and its likely first result

  • • Configuration sits with the provider and is overwritten on revision.
  • • The lender cannot timestamp what it does not hold.
  • • Likely first integration establishes precedence and witness_attestation only where a cooperating provider commits to a configuration digest at execution time. Absent that cooperation, none of the claims can be established for that configuration.
  • • That is a gap in what the provider makes available, not a value this instrument computes.

Claim status, distinct from build status

  • • FACT — a real execution-evidence problem exists.
  • • FACT — workflows exist where the operator cannot reconstruct execution state.
  • • THESIS — independent custody establishes more than logging or timestamping.
  • • HYPOTHESIS — a party bearing the loss will pay in advance to preserve it.
  • • UNKNOWN — whether any provider will expose a configuration digest at execution.

Open, and named rather than hidden

  • • Capture exists as an opt-in scaffold; nothing enforces that every run reaches it.
  • • Boundary establishment: nothing prevents execution outside the instrumented path.
  • • Who the witness is, and whether anyone checks what they signed.
  • • Money is spent because this evidence is absent. Established.
  • • That spend converts into a pre-loss purchase. Untested.