Parameters and versioning
Every number in the design is either a protocol constant that has been decided or a provisional parameter with a stated starting point and calibration method. This document states the rule that governs every versioned component and keeps the register of what is provisional, so no other document defends a number.
The versioning rule
A submission is judged by the version in force when it was posted. Nothing is re-judged retroactively. Settled stake stays settled.
| Component | Versioned | Judged by | Change |
|---|---|---|---|
| Tier-1 analyzers | Per-language builds, pinned after a fuzz run | The version in the signed transcript | New version pinned after fuzz; old verdicts stand |
| Assessor | Model, prompt, tool access, policy | The version on the signed decision | Retired above the disagreement threshold |
| Price formula | Formula and floor | Version at posting | Later postings only |
| Tier-2 metric | Formula, weight, literal divisor, delta floor | Version when the simplification was posted, applied to both patches; the accepted patch is exposed to supersession under the current version while it stands | Per-language query change for a term swap |
| Severity formula and tables | Levels, scales, and the root, auth, and sink tables | Version at posting | Rows before terms; absent entries score lowest |
| Adjudicator | Model, prompt, tool access, policy; adjudicator set and settlement policy | The version on the verdict | Retired above threshold; never re-adjudicated |
| Size caps | Patch, parts, claim, free text, trace | Version at posting | Raising a cap is a security change |
| Award formula | Portions, slices, scales, convergence terms, upstream slice, season discount | Version at posting | Later postings only |
| Windows and fees | Escalation windows, fallback vesting window, seal reveal period, seal expiry fee | Version when the round or seal was posted | Later postings only |
| Identity | Registration cost; the allowance is the floor price by definition | At registration | Season 0 is invite-only |
| Hosted builds | Model, prompt, tool set per build; the menu and its default | The build version on each hosted node's artifacts | A build is added or retired; its artifacts stand |
Every artifact on the ledger names the versions it was judged under, so anyone can re-derive the verdict. "Fix the rule" never means "re-score the past".
Protocol constants
Decided. Changing one is a design change to the owning document.
| Constant | Value | Where |
|---|---|---|
| Artifact types | Patches and claims | artifacts.md |
| Evidence classes | E0 to E4 | disputes.md |
| Stake multipliers by round | 1×, 1×, 3×, 9×, 27× | disputes.md |
| Refutation entry multiplier | That of the evidence the finding holds | disputes.md |
| Allowance | One floor-priced assertion; burns; never won; vests at E3 | scoring.md |
| E3 stake requirement | Vested stake at least the finding's posted stake, at risk | corroboration.md |
| Vesting | At E3; by fallback only when fully staked and fully resolved | scoring.md |
| Settlement policy, season 0 | One-of-one | verification.md |
| Assessor outputs | A gate decision and one ordinal | verification.md |
| Metric version 0 terms | Churn, added complexity floored at zero, literal length | verification.md |
| Severity inputs | Root class, privileges, sink class, reach | severity.md |
Provisional parameters
Size caps
| Parameter | Starting point | Calibration |
|---|---|---|
| Patch cap | ~64 KB / ~1,000 changed lines, in canonical tokens | Token-size distribution of historical CVE fixes; high percentile; start tight |
| Patch parts, maximum | A small fixed count | Same corpus: how often a unit-correct fix exceeds one cap |
| Claim record cap | ~4 KB | Schema size plus headroom |
| Free-text field cap | ~500 characters each | Stays character-capped |
| Trace node bound | Bounded | Verified trace lengths in season 0; must admit a socket-to-sink trace in idiomatic code |
Tier-2 metric
| Parameter | Starting point | Calibration |
|---|---|---|
| Complexity weight w | The token cost of one guard clause | The calibration corpus |
| Literal-length divisor | A literal costs roughly what the code it replaces would | Same |
| Simplification delta floor | Above restating | Same: deltas between successive real fixes |
| Cognitive-complexity swap | Not triggered | Nesting-heavy or golfed patches winning in season 0 |
Severity
| Parameter | Starting point | Calibration |
|---|---|---|
| Root, auth-check, and sink tables, version 0 | Per season-0 language and framework, seeded from well-known entry points, auth idioms, and dangerous sinks | An owner and a review path for rows |
| Base impact per sink class | One value per named class: code execution, memory corruption, injection, disclosure | Historical severity of the seeded classes |
| Formula levels and scales | Monotone in every input; unverifiable defaults lowest | Season 0: computed levels against a human reading of the same findings |
| CVSS-shaped label | Undecided | Decision; presentation only |
Assessor and price
| Parameter | Starting point | Calibration |
|---|---|---|
| Floor price | One ordinary assertion; defines the allowance | Season 0: junk rare, honest ordinary claims not deterred |
| Price formula | Over the ordinal, computed severity, reach, count of assumed edges | Season 0: refutation yield per price band |
| Per-assumed-edge term | Positive | Season 0: refutation rate by assumed-edge count |
Awards
| Parameter | Starting point | Calibration |
|---|---|---|
| Finding-to-patch portion split | Fixed ratio; patch portion does not grow with size | Season 0: patch refutation and simplification rates |
| Severity slice scale | One slice per level | Follows the severity formula |
| Reach scale | From registry dependents | Registry data |
| Already-audited term | More for a finding in code others had analysed | Ledger: declared scope, open interest, prior findings on the package |
| Upstream slice | A fixed addition for E4 | Season 0: share of standing findings carried upstream |
| Convergence terms | Independence from ledger history; improbability from how many examined the package; precision from what is narrowed | Season 0 independence data |
| Season-0 convergence discount | Below full weight | Lifted when the curve is set |
Corroboration
| Parameter | Starting point | Calibration |
|---|---|---|
| Pairwise decay curve | Declines within a season | Season 0: pair concentration of convergence |
| Shared-history function | Ledger-derived co-signing and convergence | Same |
| Seal reveal period | Short and fixed | Season 0: reveal latency of honest sealers |
| Seal expiry fee | Enough that committing to everything is unprofitable | Season 0: unrevealed seal volume |
| Seal matching rule | Same code path, overlapping version range | Build |
Windows
| Parameter | Starting point | Calibration |
|---|---|---|
| Escalation window per round | Scales with round | Season 0: time to produce each class; lost-appeal rate versus escrow time |
| Fallback vesting window | Long | Season 0: time-to-refutation of eventually-refuted findings |
Judgment components
| Parameter | Starting point | Calibration |
|---|---|---|
| Assessor and adjudicator sampling rates | Enough to publish a rate per version | Season 0 volume |
| Disagreement threshold that retires a version | Unset | Season-0 data |
Identity
| Parameter | Starting point | Calibration |
|---|---|---|
| Registration cost, post season 0 | Assessor plus adjudicator cost of one junk assertion; never stake | Season 0 cost per assertion; then a decision |
Hosted nodes
| Parameter | Starting point | Calibration |
|---|---|---|
| Same-build convergence discount | Below the weight of two unrelated self-run nodes | Season 0: convergence concentration by build |
| Dispute reserve | Enough to answer every open round through its window | Season 0: escrow outstanding per hosted node |
| Build menu and default | At least one published build; the default rotates | Season 0: findings and refutation rate per build |
Disclosure
| Parameter | Starting point | Calibration |
|---|---|---|
| Digest period | How often a policy-tier project receives its digest; the pace most contacted projects actually experience | Season 0: findings per project per unit time; closed-as-spam and opt-out rates |
| Default confidence filter | Believed for policy-tier projects and unconfigured enrollments: only findings someone else has staked on | Season 0: how many delivered findings later fall, by confidence at delivery |
| Critical threshold | The computed severity at or above which a notice bypasses the queue and every filter, and enrollment cannot switch off | Season 0: computed severity against a human reading |
| Policy refresh period | How often a project's security policy is re-read | Season 0: policy change rate |
| Enrollment expiry | How long an enrollment stands before it must be re-proved | Season 0: enrollment lapse and handover rate |
| Notice window | How long a standing finding may go undelivered before the record shows it uncarried | Season 0: time from publication to delivery |
| Severity-scaled vesting factor | Only if severity-scaled vesting is adopted | Season 0: deployment lag; decision first |
The calibration corpus
The size caps, the metric knobs, and the delta floor are measured against one corpus: historical CVE fixes in the season-0 languages, tokenised on the canonical stream. Building it is a pre-launch task (season-0.md). The remaining parameters come from season-0 ledger data (season-0.md).