Non-Prescriptive Multi-Signal Accountability Architecture¶

A Deterministic Governance Framework for Bounded Procedural Coherence and Multi-Party Verified Outcomes¶

Working Paper v1, for review and iteration. Not ratified.

This working paper extends Curry (2026), SSRN 6184939.

Author: Ryan Curry Affiliation: Last1 (501(c)(3)) Contact: contact@last1.org Date: 2026

Recommended Citation: Curry, Ryan (2026). Non-Prescriptive Multi-Signal Accountability Architecture: A Deterministic Governance Framework for Bounded Procedural Coherence and Multi-Party Verified Outcomes. SSRN Working Paper.

Keywords: accountability architecture; multi-signal coherence; multi-party verification; verified outcomes; verified cost; governance protocol; deterministic state machine; institutional transparency; non-prescriptive systems.

Abstract¶

This paper presents a deterministic, non-prescriptive accountability architecture based on bounded multi-signal coherence assessment and multi-party verified outcomes. The framework formalizes a coherence function over structured signal sets within discrete temporal windows; a required-verifier-set primitive under which no outcome is established by a single source and the party the outcome belongs to is always a required verifier; and a deterministic translation of bounded conditions into governance states. It extends the same verification discipline to the cost of delivered outcomes (establishing what an outcome cost, with provenance and a declared corroboration tier) without introducing cost-effectiveness ranking. The architecture prohibits predictive scoring, comparative ranking, optimization objectives, and automated sanctioning; it preserves mandatory human oversight for escalations, version-controlled governance, arm's-length standards authorship, and structured remediation with notice and appeal. By separating coherence assessment and multi-party verification from causal inference and behavioral prescription, and by requiring that every result return to the party who produced it, the framework provides a structurally bounded, implementation-neutral alternative to scoring-based accountability that is forkable across domains under a single governing standard.

Keywords: accountability architecture; multi-signal coherence; multi-party verification; verified outcomes; verified cost; deterministic state machine; governance protocol; institutional transparency; non-prescriptive systems.

Executive Summary¶

Modern accountability systems in the social sector rely heavily on narrative reporting, episodic audits, or outcome-based scoring. These approaches introduce interpretive bias, administrative burden, optimization distortion, and incentives for signal manipulation, and they frequently collapse complex activity into simplified performance metrics, reshaping behavior rather than validating process integrity. Underneath these failures sits a more basic one: single-source closure, in which the party that delivers a service also attests to its outcome and self-reports its cost, grading its own homework with nothing independent between claim and record.

This whitepaper introduces a non-prescriptive architecture for continuous accountability grounded in multi-signal coherence analysis and multi-party verified outcomes. Rather than evaluating effectiveness or assigning performance scores, the system measures bounded procedural alignment across diverse signal classes, and it establishes an outcome only when a governance-defined set of structurally independent verifiers has attested to it. Two verification invariants hold universally (at least two verifiers, and the party the outcome belongs to always among them) with an independent third party required where an outcome's realization lies outside what the deliverer and recipient can establish alone. Verification strength is a property of the independence and count of required verifiers, not of the volume of self-reported data. The same discipline extends to cost: what an outcome cost is established as a verified, provenance-bearing fact carrying a declared corroboration tier, never as a cost-effectiveness score.

Machine-learning techniques may be employed solely for bounded detection of absence, drift, and anomaly; statistical outputs never assign governance states directly. All conditions are translated through deterministic, version-controlled governance rules into discrete confidence states. The architecture prohibits optimization loops, predictive scoring, recommendation engines, causal attribution, and comparative ranking; it does not measure effectiveness or replace independent audits. State transitions are subject to notice, remediation windows, and human adjudication, and every result returns to the party who produced it (the return path).

Two institutional commitments frame the whole. First, the body that authors the standard is held at arm's length from any entity whose outcomes it evaluates: an author does not grade its own conformance, and the commitment is symmetric across all implementers. Second, the standard is designed to be forked: a neutral core defines the roles, close conditions, and invariants, and each domain implementation binds concrete parties to roles and selects its verifier sets within those invariants, so one governing standard spans many domains while remaining auditable. The architecture is implementation-neutral and product-agnostic, capable of integration across public, private, or hybrid environments.

Section 1: Problem Framing¶

Accountability mechanisms in social systems have historically relied on narrative reporting, periodic audits, financial compliance disclosures, and outcome-based performance claims. These methods were designed to ensure transparency and responsible stewardship. However, they frequently introduce interpretive bias, administrative burden, and structural distortions. Narrative reports allow for selective framing and rhetorical emphasis. Audit processes are episodic rather than continuous, often identifying irregularities long after operational realities have shifted. Outcome-based scoring systems collapse multidimensional activity into simplified performance metrics, creating incentives to optimize for measurable proxies rather than underlying integrity. As accountability infrastructures scale, the need for continuous validation mechanisms increases; yet most existing systems either centralize interpretive authority or deploy algorithmic scoring mechanisms that risk opaque optimization and unintended behavioral shaping.

1.2 Structural Risks of Existing Models¶

Several structural risks emerge from prevailing approaches. First, optimization distortion: when entities are scored or ranked, measurable indicators become targets for strategic manipulation, shifting behavior toward metric maximization rather than procedural integrity. Second, signal gaming: entities may selectively report favorable indicators while suppressing contextual signals. Third, governance opacity: algorithmic scoring often relies on proprietary weighting or predictive models that cannot be independently audited or replicated. Fourth, administrative asymmetry: smaller organizations face disproportionate compliance burdens relative to well-resourced institutions. These risks erode institutional trust and reward behavior that aligns with scoring logic but diverges from operational coherence.

Fifth, single-source closure. Most prevailing systems permit the party that delivers a service to also attest that its outcome occurred, and to self-report what it cost. An entity that both performs and validates its own work grades its own homework; the structural conflict is present regardless of the entity's honesty, because nothing independent stands between the claim and the record. Self-reported cost compounds it: the same party that benefits from a favorable cost figure is the sole source of the inputs behind it. This single-source closure is the root gaming vector (upstream of optimization distortion and signal gaming alike), and it is the specific failure the multi-party verification primitive (§2.7, §3.12) is built to close.

1.3 Design Objective¶

The objective is to establish a non-prescriptive baseline for continuous accountability that validates procedural coherence and establishes multi-party verified outcomes without assigning performance scores, causal attribution, or behavioral recommendations. Rather than optimizing for outcomes, the system measures bounded alignment across multiple signal classes within defined temporal windows and requires independent multi-party attestation to establish an outcome. It prioritizes detection of absence, drift, and structural inconsistency while preserving human oversight and deterministic governance translation. The goal is not to replace audits, certify impact, or rank entities, but to provide a scalable, transparent mechanism for identifying procedural coherence conditions and establishing verified outcomes while minimizing incentive distortion and algorithmic opacity.

1.4 Scope, Audience, and Contribution¶

This paper is a normative architecture specification and working paper, not an empirical study. It defines a framework, its formal properties, and its governance; it does not report deployment data, and the worked examples are illustrative rather than evaluative. Empirical and simulation validation is identified as future work, and the paper's claims are scoped accordingly.

The architecture establishes that a claimed outcome occurred and was independently corroborated, and, where in scope, what it cost. It deliberately does not establish that the outcome was effective, impactful, or causally attributable to the intervention. This narrowing is a strategic first position, not a limitation to apologize for. The framework occupies the verification layer, the one layer beneath every impact claim, which no existing method has made trustworthy. Effectiveness estimates, cost-effectiveness ratios, and social-return figures built on unverified occurrence rest on unestablished facts; a rigorous impact number computed on top of an unverified count is a castle on sand. By refusing to make the impact claim, the framework makes the impact claim possible, for whoever builds on its substrate. The restraint is the source of the credibility, not a cost of it: what cannot be attacked as an effectiveness estimate is the plain statement that an outcome occurred, corroborated by parties other than the one reporting it.

This first position (Posture A, the verification layer) has a governed evolution path. A later stage, Posture B, may report movement in a validated instrument (the single agreed measure already captured at close), stopping short of causal attribution. Posture B is a version-gated extension of the standard (§7.5), adopted deliberately if and when governance supports it, not a scope-creep and not a present claim. The paper specifies A and names B as the standard's intended maturation, so that adding instrument-movement later reads as the standard advancing on schedule rather than reaching beyond itself. Effectiveness attribution (a hypothetical Posture C) is permanently out of scope: it would reintroduce the causal inference §2.5 forbids and collapse the neutrality the framework runs on.

Posture A is honest only if its denominator is airtight. "We verified that outcomes occurred" is worthless (and actively misleading) if the verified outcomes are reported without the count of outcomes attempted. Verified occurrence and the required denominator (§10.10) are a matched pair: the first is a claim, the second is what stops the claim from being a survivorship artifact. Posture A rests on both or on neither.

The intended audience is threefold: funders and oversight bodies who need trustworthy occurrence and cost before they can responsibly evaluate impact; independent evaluators who require a verified substrate to build effectiveness estimates upon; and standards bodies seeking a forkable, implementation-neutral accountability baseline. The framework's contribution is not a new impact-measurement method but a verification layer that existing impact methods can stand on.

The framework's specific contribution relative to existing independent-validation practice (notably outcomes-based commissioning and Social Impact Bonds, which already employ independent outcome validators) is developed in §12.8. In brief, the contribution is the combination of a continuous standard rather than a per-contract arrangement, the beneficiary as a required verifier, the return path, forkable implementation-neutrality, and the extension of verification discipline to cost.

Section 2: Design Principles & Constraints¶

The architecture is defined by a fixed set of constraints. The first six are inherited from the framework's non-prescriptive foundation; the next three (multi-party verification, the return path, and cost verification) govern how outcomes are established, to whom their results are owed, and how their cost is verified; and the tenth, chosen transparency, governs how the system discloses its own limits. Together they bound what the system may do, and they are not severable: relaxing any one reintroduces a failure mode the others assume is closed.

2.1 Non-Prescriptive Architecture. The system does not recommend actions, assign behavioral guidance, optimize organizational decisions, or produce ranked outputs. Its function is limited to detecting bounded procedural coherence conditions and establishing verified outcomes. Any remediation guidance originates from human governance, never from the system.

2.2 Deterministic Governance Translation. Statistical and machine-learning methods may inform intermediate coherence calculations, but final accountability states are assigned exclusively through deterministic, version-controlled governance rules. Model outputs may not directly assign governance states.

2.3 Human Oversight Requirement. Escalated states require structured human oversight with notice, review, and appeal. Adjudication authority is auditable and separated from rule authorship.

2.4 No Optimization or Recommendation Functions. No optimization loops, predictive scoring, or recommendation engines. The system does not forecast performance or maximize output variables. Excluding optimization objectives reduces incentives for metric gaming and behavioral distortion.

2.5 No Impact Attribution. The system does not attribute causality between signals and outcomes, certify effectiveness, or measure impact. It evaluates procedural coherence and establishes verified outcomes only. This preserves the role of independent evaluators and domain experts.

2.6 Transparency and Version Control. All governance rules, thresholds, signal classifications, verifier-set definitions, and amendment procedures are transparently documented and version-archived with effective dates. Historical determinations are reproducible under the rule set in effect at the time of evaluation.

2.7 Multi-Party Verification. No outcome is established by a single source. An outcome is established only when a governance-defined set of structurally independent verifiers has each attested to it: the required verifier set for that outcome class (§3.12). Two invariants hold universally: at least two verifiers are required, and the party the outcome belongs to (the Recipient) is always among them. Where an independent third party holds knowledge of the outcome's realization that neither the delivering party nor the recipient can establish alone (a hiring manager confirming a placement, a licensing body confirming a credential), the standard requires that party's attestation as well. Verification strength is a property of the independence and count of required verifiers, not of the volume of self-reported data; this is the architecture's structural answer to signal gaming. A single party, however well-instrumented, cannot grade its own homework, and no party can be compelled into an attestation it does not hold.

2.8 The Return Path. No signal enters the system without a designed return to the party that produced it. Because the Recipient is a required verifier of every outcome (§2.7), the party the outcome belongs to is never a passive data point in someone else's report: they attest to the outcome, and the outcome returns to them, denominated in their own terms. Measurement directed at a person without return is extraction; measurement returned to that person is a record they hold. This principle is a hard constraint on system design, not a reporting courtesy, a data flow whose result terminates only in an institutional dashboard, never visible to its source, does not satisfy the architecture. Its governance consequence is stated in §7; its formal consequence (that Recipient ∈ V_req for every class) is stated in §3.12.

2.9 Cost Verification. Verification discipline applies to what an outcome cost as much as to whether it occurred. A delivered outcome carries a resource expenditure (program funds, staff time, equipment, facilities), and that expenditure is subject to the same multi-party, provenance-bearing discipline as the outcome event: it is a verified attested fact, not an evaluative score. The system establishes what an outcome cost; it never divides outcomes by cost to rank them, never declares a cost excessive, and never optimizes toward cheaper outcomes. This firewall is identical in kind to the outcome non-prescriptive boundary (§2.5, §10.9) and is as hard: a verified cost is an input to whatever evaluation a reader chooses to perform, and the framework performs none. The input of record is actual attributable expenditure, not funds received; the two are distinct quantities (§3.16), and reporting one as the other is the primary cost-gaming vector the framework closes.

2.10 Chosen Transparency. (Formally, elective disclosure.) The system is designed to surface its own unflattering facts on an avenue it chooses, before they can be extracted adversarially or discovered later. Transparency here is elective and structural: the framework does not wait to be audited into honesty; it volunteers the fact that would otherwise be used against it, as a required output rather than a discretionary one. This principle is the common root of several mechanisms defined elsewhere, and is stated once so they are read as one idea rather than as separate accommodations: the denominator that exposes survivorship in any verified count (§10.10); the tier label that exposes how corroborated a cost figure is (§3.18); partial-state honesty that exposes an incomplete close rather than rendering it as done (§10.3); and the earned-graduation disclosure that exposes the framework's own founder-conflict rather than papering over it (§7.9). Chosen transparency also does analytical work the other principles cannot: it is the correct response to manipulations the framework cannot structurally prevent. Selection and creaming (§11.9) cannot be prohibited, but a framework built on chosen transparency requires the denominator that makes them visible, converting an unpreventable gaming vector into a disclosed one. The distinction the principle draws is between exposure the system elects and exposure imposed upon it: the first is accountability; the second is merely getting caught.

Section 3: Formal Definitions¶

This section defines the core primitives and formal constructs used throughout the architecture. These definitions constrain interpretation, ensure determinism in governance translation, and prevent prescriptive or evaluative overreach.

3.1 Signal. A Signal (Sᵢ(t)) is a time-indexed observable input representing a declared, observed, structural, or operational attribute of an entity. Each signal must include a timestamp and provenance metadata. Signals are not independently determinative; no single signal may assign a governance state.

3.2 Signal Class. Signals are categorized into non-exclusive classes to prevent over-reliance on any single reporting channel, declarative, observational, activity-based, temporal, and structural. Signal classification is governance-defined and version-controlled.

3.3 Evaluation Window (Δt). A bounded time interval within which signal coherence is assessed. Windows may be fixed, rolling, or context-dependent as defined by governance rules.

3.4 Absence Event. An Absence Event (Aᵢ) occurs when a signal fails to emit within its defined expected cadence threshold. Absence is descriptive and does not imply intent or misconduct.

3.5 Drift. Drift (Dᵢ) is a statistically bounded deviation of a signal's behavior relative to its historical pattern within an evaluation window. Drift detection may use statistical or machine-learning methods, but outputs must remain bounded and cannot directly assign governance states.

3.6 Coherence. Coherence (C(Δt)) is a bounded measure of temporal and structural alignment across a defined set of signals within an evaluation window, constrained to [0,1]. Coherence is not a performance score and does not evaluate effectiveness; it measures procedural alignment only.

3.7 Governance Rule. A Governance Rule (Rⱼ) is a deterministic mapping between defined coherence conditions and discrete accountability states. All rules must be documented, version-controlled, and publicly accessible.

3.8 Confidence State. A Confidence State (Γ) is a discrete governance classification derived through deterministic translation of coherence conditions under rule set R. Confidence states reflect procedural status, not performance or impact.

3.9 Deterministic Translation Function. The Deterministic Translation Function (g) maps coherence outputs and governance conditions to discrete confidence states. Machine-learning outputs may inform coherence calculations but may not directly assign states.

3.10 Attestation. An Attestation (αᵥ) is a timestamped assertion by a verifier v that a defined outcome condition obtains, scoped to what that verifier has direct knowledge of. Attestations are descriptive and bounded; an attestation does not assign a governance state and no single attestation may close an outcome.

3.11 Verifier Role. A Verifier occupies a defined structural role relative to an outcome: Deliverer (the party that provided the service or intervention), Recipient (the party the outcome belongs to), or Independent Third Party (a party with direct, independent knowledge of the outcome's realization who is neither deliverer nor recipient). Roles are defined by relationship to the outcome, not by identity; one identity may not occupy two roles for the same outcome.

3.12 Required Verifier Set (V_req). For each outcome class, the governing standard defines the set of verifier roles whose attestations are required to close. Two invariants hold across all classes: |V_req| ≥ 2 (no outcome closes on a single source), and Recipient ∈ V_req (the party the outcome belongs to is never a passive data point, and their inclusion carries the return path: §2.8). The standard specifies the condition under which |V_req| ≥ 3 is required: when an independent third party holds knowledge of the outcome's realization that neither deliverer nor recipient can independently establish.

3.13 Verifier Independence. Members of V_req must be structurally independent: distinct incentives, no shared control. An added verifier whose incentives align with an existing verifier increases the count without increasing verification strength; the standard defines the count and the independence criteria, and only independent additions defeat collusion. Independence is not asserted but tested against declared failure modes: financial dependence (a landlord paid by the housing program, a hiring manager sourced through and compensated by the training organization), relational dependence (a beneficiary reliant on continued services from the deliverer: §13.10), and common control (verifiers under shared ownership or direction). For each outcome class the standard declares which independence criteria the required verifiers must satisfy and records, per verified outcome, the independence basis claimed. Residual entanglement that cannot be eliminated is disclosed rather than presumed absent; a verifier whose independence is partial is recorded as such, not counted as fully independent.

3.14 Verified Close. An outcome reaches Verified Close only when the set of received attestations satisfies V_req for its class, every required role has attested, within the outcome's evaluation window, with no unresolved contradiction across attestations. No necessary role can produce a Close alone; this is the anti-gaming property, and it strengthens monotonically as V_req widens.

3.15 Verified Outcome. The record produced at Verified Close: the bounded outcome payload together with its complete attestation set. A Verified Outcome is a fact with provenance, not a performance score: it asserts that a verified condition obtains, never effectiveness, causality, or rank.

3.16 Cost Input. A Cost Input is a typed, timestamped resource quantity attributable to a program or outcome. Two types are distinguished and never conflated: Fund-In (monies a program received) and Expenditure (monies actually spent). Expenditure is the input of record for cost verification; Fund-In is reported alongside it, never as a substitute. Fund-In and Expenditure are different quantities, and the difference between them is itself reportable signal, not evidence of misconduct.

3.17 Allocation Method. An Allocation Method is the declared, deterministic procedure by which shared program cost (staff, equipment, facilities, time) is apportioned across outcomes. The framework does not select the correct method; that would be prescriptive. It requires that whatever method is used be declared, version-controlled, deterministically applied, and publicly disclosed, so the resulting figure is reproducible under the method in effect at the time of calculation.

3.18 Cost Tier. A Cost Tier is the declared level of cost completeness and corroboration attached to a cost figure:

Tier 1: Direct. Only expenditure directly attributable to an outcome without apportionment. No allocation judgment; the honest floor. Understates true cost by excluding the shared infrastructure that made the outcome possible.
Tier 2: Direct + Allocated. Tier 1 plus a share of shared program cost apportioned under a declared Allocation Method (§3.17).
Tier 3: Corroborated. Tier 2 in which allocated per-outcome cost sits within a total-expenditure envelope that ties to independently audited financials, and the allocation method itself is reviewed under an independent attestation or agreed-upon-procedures engagement. This tier does not claim that an auditor verified each per-outcome figure: a financial-statement audit opines on the financials as a whole, not on outcome-level allocations. What Tier 3 asserts is narrower and accurate, that the total from which costs are allocated reconciles to audited figures, and that the allocation procedure has been independently examined for faithful, consistent application.

Every cost figure declares its tier. A lower-tier figure may never be presented as a higher-tier one; the tier is on the record, which prevents understatement-by-tier-selection from becoming a hiding place. The tier label is an instance of chosen transparency (§2.10): the figure discloses the limit of its own corroboration rather than leaving that limit to be discovered.

3.19 Cost Provenance. Cost Provenance is the attestation set establishing a Cost Input, recorded under the same append-only discipline as outcome attestations (§3.10). Cost verification carries its own required verifier set (§3.12 applied to cost): the delivering organization attests expenditure and allocation; the funder's disbursement record independently establishes Fund-In; at Tier 3, an independent attestation engagement ties the total-expenditure envelope to audited financials and examines the allocation method (§3.18). The |V_req| ≥ 2 and independence invariants apply. A precision the framework does not overstate: the funder's record independently establishes what was disbursed, which is not the same as what was spent on a given attested outcome. Disbursement corroborates Fund-In and bounds total funds available; it does not by itself corroborate outcome-level expenditure, which is why direct-cost figures (Tier 1) carry weaker independent corroboration than allocated-and-attested figures (Tier 3), and the tier label records exactly that difference. The Recipient-inclusion invariant does not transfer: cost is a property of inputs, not an outcome that belongs to the recipient, and the beneficiary is not a natural cost verifier.

3.20 Verified Cost. A Verified Cost is a cost figure whose provenance satisfies the required verifier set for its declared tier, produced through the attestation lifecycle (§6.2), and carrying its Cost Tier label. A Verified Cost is a fact with provenance (what an outcome cost, and how independently that figure is corroborated) never an assertion that the cost was appropriate, efficient, or comparatively favorable.

Section 4: System Architecture¶

The architecture is a layered system that separates signal ingestion, statistical pattern detection, deterministic governance translation, and human oversight. This separation ensures transparency, bounded interpretation, and resistance to optimization-driven distortions.

4.1 Signal Ingestion Layer. Aggregates time-indexed inputs from multiple signal classes, each carrying provenance metadata sufficient to assess origin and reliability. No transformation at this layer may assign evaluative meaning; its function is limited to structured collection and normalization.

4.2 Signal Taxonomy and Classification. Signals are categorized according to governance-defined classes, preventing over-reliance on any single channel and ensuring diversity of evidence. Signal classes and required categories are version-controlled and publicly documented.

4.3 Coherence Evaluation Layer. Computes bounded alignment measures across signals within evaluation windows, applying component functions including cadence, coverage, congruence, stability, and structural consistency. Outputs are bounded numerical values and intermediate indicators, not governance states.

4.4 Pattern Detection Layer. Statistical or machine-learning techniques may detect absence events, drift conditions, and structural anomalies; all outputs remain bounded and interpretable. This layer may not assign confidence states, recommend actions, predict outcomes, or optimize behavior.

4.5 Deterministic State Translation Layer. Maps coherence conditions and defined thresholds to discrete confidence states according to governance rule set R. This mapping is rule-based, transparent, and reproducible. No probabilistic model may directly assign or override a governance state.

4.6 Human Governance and Oversight Layer. Escalated states require structured human oversight; authorities may extend remediation windows, validate signal restoration, or adjudicate appeals. The system prohibits fully automated enforcement without review and appeal, and governance authority remains institutionally separated from statistical model development.

4.7 Architectural Separation of Concerns. Strict separation between data collection, statistical analysis, deterministic governance rules, and human adjudication reduces the risk of optimization feedback loops and governance opacity. Each layer is independently auditable and version-controlled.

4.8 The Proof Substrate. The ingestion and audit-logging layers are made concrete by a single append-only event stream: the proof substrate, serving as the system of record. Signals, attestations, state transitions, and outcome events are recorded once, as immutable events carrying provenance and timestamp; corrections are new events, never mutations of prior ones. From this one spine, every reporting surface is a read over the same events: nothing is rendered that the substrate did not record. Read surfaces resolve in a fixed order of priority: the Recipient first (§2.8), then the delivering entity, then the funder, then administrative oversight, so the return path is a property of the architecture rather than an added feature. The substrate carries no personally identifying or protected content by construction: it records statuses, timestamps, category codes, and bounded measure deltas, never the underlying sensitive record, so analytics read the proof stream and never the record store. This gives §7.6's audit logging and §3.14's Verified Close a concrete home while remaining fully implementation-neutral (§8): the requirement is an append-only, provenance-bearing, read-many event record, not any particular technology for producing one. "Append-only" and "tamper-evident" are integrity properties, not self-evident guarantees, and the standard states them as a requirement the implementation must meet by a declared mechanism rather than by assertion: events must be integrity-anchored such that undetected retroactive alteration or deletion is infeasible to the party operating the substrate, for example, by hash-chaining with periodic external anchoring (independent timestamping or third-party notarization). The property must hold against the operator itself, since the operator is precisely the party a beneficiary or funder might otherwise have to trust. The specific mechanism is implementation-defined; the property it must achieve is not optional.

Section 5: Coherence Function (Formal Model)¶

This section defines the bounded coherence function f used to evaluate multi-signal alignment within a defined evaluation window. The function produces a value in [0,1] and is explicitly non-evaluative; it measures procedural alignment only and does not represent impact, effectiveness, or performance.

5.1 Notation. Let S = {S1, …, Sn} denote the signals in evaluation, each emitting time-indexed events within Δt = [T0, T1]. The coherence function is C(Δt) = f(S, Δt), bounded 0 ≤ C ≤ 1. Intermediate statistical methods may inform component calculations but may not directly assign governance states.

5.2 Component Structure. Coherence is a weighted aggregation of bounded component scores: C(Δt) = G(Δt) × [ w1·c_cad + w2·c_cov + w3·c_cong + w4·c_stab + w5·c_struct ] where weights w1…w5 are governance-defined, non-negative, and sum to 1, and G(Δt) is a governance gating factor that prevents required signal absence from being averaged away.

5.3 Cadence Coherence (c_cad). Measures whether signals emit within expected frequency thresholds; observed emissions compared against expected cadence, bounded [0,1].

5.4 Coverage Coherence (c_cov). Evaluates whether required signal classes are represented within Δt, ensuring diversity of evidence.

5.5 Cross-Signal Congruence (c_cong). Evaluates governance-defined, version-controlled consistency constraints across signals; each satisfied constraint contributes positively.

5.6 Stability / Drift Coherence (c_stab). Measures bounded statistical deviation relative to historical patterns; drift detection may use statistical or ML techniques, outputs bounded and descriptive only.

5.7 Structural Consistency (c_struct). Evaluates continuity indicators such as operational presence, financial continuity, and governance disclosures, identifying contradictions without asserting causality. A Verified Outcome (Λ_verified, §6.2) contributes positively to structural consistency; a contradicted outcome (Λ_contradicted) registers here as a cross-signal contradiction and is a source of Γ4 (§6.3).

5.8 Governance Gating Factor (G(Δt)). Ensures required signal absence cannot be masked by other positive indicators; if a required signal is absent within Δt, G(Δt) proportionally reduces overall coherence. A lapsed required verification (Λ_lapsed on a required class, §6.3) is precisely such an absence, and the gating factor prevents it from being averaged away by unrelated positive signals.

5.9 Bounded Output Properties. The function satisfies boundedness, monotonicity under signal restoration, and reproducibility under version-controlled rule sets. Coherence is not a ranking metric and must not be interpreted as a comparative score.

Section 6: Deterministic Accountability State Machine¶

This section defines the discrete accountability states and deterministic transition logic that translate bounded coherence conditions into governance classifications, and specifies how outcome verification, the accumulation of attestations toward a Verified Close (§3.14), feeds the state machine. Two lifecycles operate at different granularities: an entity-level coherence state (Γ) that describes an entity's procedural standing over an evaluation window, and an outcome-level verification state (Λ) that describes a single outcome's progress toward Verified Close. The outcome lifecycle produces signals; the entity lifecycle consumes them. State assignment is rule-based and reproducible; no probabilistic model may directly assign or override a state.

6.1 Entity Coherence States (Γ)¶

Γ0: Verified Coherence. All required signals emit within cadence thresholds; no sustained drift or structural inconsistency in the window.
Γ1: Minor Drift Observed. Localized or temporary drift below escalation thresholds.
Γ2: Persistent Drift. Drift beyond governance-defined tolerance intervals.
Γ3: Signal Absence. A required signal fails to emit within its cadence threshold.
Γ4: Structural Inconsistency. Cross-signal contradiction or structural discontinuity within the window. (Verification contradiction: §6.3, is one source of this state.)
Γ5: Remediation Pending. Notice issued; the entity is within a defined remediation window.
Γ6: Under Human Review. Escalated condition requiring structured human adjudication. Automated reassignment prohibited while in this state.

6.2 Outcome Verification Lifecycle (Λ)¶

Each outcome instance progresses through a bounded verification lifecycle defined over its required verifier set V_req and its evaluation window. The lifecycle is descriptive: it records whether the required attestations have arrived, not whether the outcome was good.

Λ_open: Open. The outcome exists (a loop is created, a milestone is defined). No attestations recorded.
Λ_partial: Partially Attested. One or more, but not all, roles in V_req have attested. The record honestly reflects which roles are satisfied and which remain pending (§10.3). A partial state is never rendered as a close.
Λ_verified: Verified Close. Every role in V_req has attested within the window with no unresolved contradiction. The Verified Outcome record (§3.15) is produced. This is the only terminal state that asserts the outcome.
Λ_contradicted: Contradicted. Two or more attestations conflict on the outcome condition. The outcome cannot close; it routes to human review and raises a structural-inconsistency signal at the entity level (§6.3).
Λ_lapsed: Lapsed. The evaluation window expired without V_req being satisfied. Lapse is descriptive absence, not misconduct; it raises an absence signal at the entity level and does not, by itself, assert that the outcome failed to occur.

Λ transitions are monotonic in attestation: an attestation, once recorded, is append-only (§4.8). A correction is a new attestation with provenance, never a mutation of a prior one. Withdrawal of a required attestation moves an outcome out of Λ_verified only through a recorded, adjudicable event, a Verified Close is not silently reversible.

6.3 Coupling: How Verification Feeds Entity Coherence¶

The two lifecycles couple through the coherence function's signals, not through direct state assignment:

A Λ_verified outcome contributes a positive structural-consistency signal (c_struct, §5.7): required outcomes are being established under multi-party verification.
A Λ_contradicted outcome raises a structural inconsistency condition, a source of entity state Γ4. Contradiction across independent verifiers is exactly the cross-signal discontinuity the coherence function is built to surface.
A Λ_lapsed outcome on a required class raises an absence condition, a source of entity state Γ3, subject to the governance gating factor G(Δt) (§5.8) so that a required verification lapse cannot be averaged away by unrelated positive signals.

Verification states never bypass the deterministic translation function: Λ produces bounded signals, and only the governance rule set R (§3.7) translates the resulting coherence conditions into a Γ state. No count of Verified Outcomes assigns a Γ state directly, and no verification lapse enforces a sanction without passing through notice, remediation, and (where escalated) human review.

6.4 Transition Rules (Entity)¶

State transitions are governed exclusively by deterministic rule set R and are reproducible under the rule version in effect at evaluation time.

From Γ0: → Γ1 if minor drift exceeds thresholds · → Γ3 if a required signal (including a required verification, via Λ_lapsed) is absent · → Γ4 if structural inconsistency (including Λ_contradicted) is detected.
From Γ1: → Γ0 if drift resolves within tolerance · → Γ2 if drift persists · → Γ3 on signal absence.
From Γ2: → Γ5 automatically.
From Γ3 or Γ4: → Γ5 automatically upon notice issuance.
From Γ5: → Γ0 if signals/verifications are restored and coherence thresholds met within the remediation window · → Γ6 if the window expires without restoration.
From Γ6: human adjudication determines restoration, extended remediation, or confirmation of the condition. A contradicted outcome (Λ_contradicted) is resolved only here, never by automated tie-breaking between verifiers.

6.5 Remediation Window¶

A governance-defined interval during which an entity may restore signal emissions, obtain a pending required attestation, or resolve inconsistencies without escalation. Duration and documentation requirements are publicly documented.

6.6 Human Adjudication¶

Human review authorities evaluate escalated conditions (including verifier contradictions) against standardized, documented criteria. Rule authorship and adjudication remain institutionally separated (§7.4).

6.7 Time Decay and Restoration¶

Historical drift, absence, or lapse conditions do not permanently determine state. On restoration within thresholds, an entity may return to Γ0. The system imposes no cumulative penalties. A lapsed outcome whose required attestation later arrives is recorded as a late Verified Close, with the lateness visible in provenance.

6.8 Prohibited Behaviors¶

The state machine may not: rank entities relative to one another; generate predictive performance forecasts; recommend operational adjustments; bypass human review for escalated conditions; assign states directly from probabilistic outputs; close an outcome without a satisfied V_req; or resolve a verifier contradiction by automated selection among conflicting attestations.

6.9 Cost Verification Rides the Λ Lifecycle¶

Cost verification introduces no new state machine. A Cost Provenance set (§3.19) accumulates attestations toward a cost Verified Close exactly as an outcome does: an unattested cost is Λ_open; a cost with some but not all required attestations is Λ_partial (reported as partial: §10.8), never rendered as complete; a cost whose provenance satisfies its verifier set for its declared tier is Λ_verified; conflicting cost attestations are Λ_contradicted, routing to human review rather than automated reconciliation; and a cost figure whose required corroboration never arrives within window is Λ_lapsed. A Verified Outcome and its Verified Cost are two attestation-bearing components of one record (§10.6), each with its own realized verifier set and its own honest partial-state reporting. Cost verification therefore inherits, unchanged, the coupling into entity coherence (§6.3): a contradicted cost is a structural-inconsistency source (Γ4); a lapsed required cost corroboration is an absence source (Γ3), gated so it cannot be averaged away.

Section 7: Governance Protocol¶

This section defines the procedural governance that operationalizes the state machine and the verification model. It specifies due process (notice, remediation, appeal), the separation-of-duties that keeps rule authorship independent of adjudication, and (new in this version) the institutional separation between the body that authors the standard and the entities that conform to it, together with the mechanism by which a neutral standard is forked and bound to a concrete domain without being rewritten.

7.1 Notice Mechanism. A transition into Γ5 or Γ6 issues a formal notice stating the triggering condition, the rule version applied, the evaluation window referenced, the specific required attestation or signal at issue, and the remediation deadline. Delivery is documented and verifiable; delivery failure is logged.

7.2 Remediation Process. During the remediation window the entity may restore signal emissions, obtain a pending required attestation, submit clarifying documentation, or identify technical error. Restoration criteria are defined in advance by rule set R. Guidance is procedural, never strategic, the system does not prescribe operational change.

7.3 Appeal Pathway. Entities may appeal transitions into Γ6 or sustained Γ5 conditions to an authority independent of rule authorship and model development. Appeal outcomes are documented and tied to the rule definitions in effect at evaluation time.

7.4 Separation of Duties. Governance responsibilities are institutionally separated across at least three roles: Rule Authors, Rule Approvers, and Review Authorities. No single individual or body may define, apply, and adjudicate rules. This intra-standard separation is distinct from, and additional to, the standards-authority separation in §7.9.

7.5 Rule and Verifier-Set Versioning. All governance rules, including outcome-class definitions and their required verifier sets V_req (§3.12) and independence criteria (§3.13), are version-controlled. Amendments require documented proposal, review, and approval. Each version carries an effective date and change log, and historical determinations remain reproducible under the version in effect when they were made. A change to a V_req (for example, adding a required third-party verifier to an outcome class) is a versioned amendment, not a silent configuration change.

7.6 Audit Logging. All state transitions, rule applications, attestations, notices, remediation submissions, and adjudication decisions are recorded in tamper-evident, append-only audit logs supporting independent review and regulatory inquiry.

7.7 Conflict of Interest Controls. Participants in rule approval or adjudication disclose conflicts; recusal procedures and disclosure records are maintained.

7.8 Transparency Requirements. Rule definitions, signal classifications, verifier-set definitions, threshold parameters, and amendment histories are publicly accessible. Transparency reduces the risk of governance capture and is what makes the standard auditable by parties who do not trust its author.

7.9 Standards-Authority Independence and Earned Graduation. The body that authors and governs the standard must be institutionally separate from any entity whose outcomes the standard evaluates. The standards authority defines roles, close conditions, verifier sets, and coherence rules; it does not deliver the services being measured, does not close loops, and does not certify its own operations under a standard it controls. An operating entity is a conforming implementer of the standard, never its author. This separation is the institutional form of the framework's non-prescriptive discipline: an author that graded its own performance under its own standard would collapse the independence on which every downstream state assignment depends.

Common founding must be treated candidly, because disclosure alone does not cure it. Where the standards authority and one or more operating entities share a founder or common control (as is the case at this framework's origin) independence cannot be asserted; it must be earned, and observably so. The standard therefore specifies independence not as a status conferred by an event but as a maturity demonstrated through observed conduct, the coherence model applied to the framework's own governance. This is a published, forkable pattern: any founder-controlled standards body inherits a good-faith path to earn its way out of the self-dealing critique, with the qualifying conduct visible rather than claimed.

Stage 1: Declared Safeguards. The authority seats an independent-majority governing body (founder in a minority, non-controlling position on standards decisions), writes a founder-recusal policy covering any conformance determination, adjudication, or verifier-set change affecting an affiliated implementer, defines personnel separation between the authority's rule-authorship/adjudication functions and the operating entities' management, and publishes the common-control relationship on every conformance claim it touches. At Stage 1 the authority states its separation as aspirational and in-progress, the honest posture where this framework currently stands.

Stage 2: Demonstrated Safeguards (probationary). Across a minimum observation window of twelve months, with at least one external implementer and one external funder present throughout, the Stage 1 safeguards are shown operating, not merely declared: recusals honored on the record, the independent-majority board exercising real authority including at least one substantive founder-override, disclosures published, and the governance decisions themselves recorded on an auditable ledger. The window is a checksum, not a deadline: the qualifying conduct must remain continuously true across it. Conduct that appears and is later reversed (a founder-override in month two quietly undone in month nine) fails the checksum regardless of elapsed time. The organization is earning independence at this stage, not yet holding it.

Stage 3: Earned Independence. On demonstrated Stage 2 conduct, the standards authority graduates to governance the founder genuinely does not control: an independent board that appoints its own successors, with the founder stepped back from standards decisions. Independence is granted because it was earned and observed, never because a date passed.

This structure is itself a Verified Outcome under the paper's own primitive (§3.14): graduation closes only on multi-party, independent attestation of observed conduct across a window, the framework proving itself by being the first thing it verifies. The commitment throughout is symmetric: the authority holds conforming implementers, including any affiliated one, to a standard none of them individually control, and holds itself publicly accountable, under chosen transparency (§2.10), for the maturity stage it currently occupies.

7.10 Conformance and the Fork Model. The standard is designed to be inherited, not rewritten. The neutral core defines the abstract machinery: verifier roles (§3.11), the close condition and its invariants (§3.12), the coherence function, and the state machine. A domain implementation forks the standard and performs two bindings, and only these two:

Role binding. It maps abstract roles to concrete parties for each outcome class (e.g., care coordination binds Recipient→beneficiary, Deliverer→provider; job placement additionally binds Independent Third Party→hiring manager).
Set binding. It selects V_req per outcome class within the standard's rules, always honoring |V_req| ≥ 2 and Recipient ∈ V_req, and adding the independent third party where the standard's tertiary-verification condition applies.

An implementation may bind parties and select verifier sets; it may not weaken an invariant, redefine a role, or alter the close condition. Because the base is inherited rather than reauthored, a conformance claim is checkable: an auditor verifies that the fork's bindings sit within the base standard's constraints and that its declared V_req per class satisfies the invariants. This is what lets multiple domains (health coordination, workforce placement, housing, credentialing) operate as instances of one standard while a single authority governs the base. The reference conformance (Appendix A) works one such fork end to end.

7.11 Allocation-Method Governance. Because allocation is the judgment-laden step in cost verification and therefore its primary attack surface, the framework governs the method, not the number. Any Allocation Method (§3.17) in use must be declared, version-controlled, deterministically applied, and publicly disclosed, under the same versioning discipline as governance rules (§7.5). A change of allocation method is a versioned amendment carrying an effective date and change log; historical cost figures remain reproducible under the method in effect when they were calculated. The framework does not adjudicate whether a method is the right one, it requires that the method be open and reproducible, so that a reader who distrusts the method can inspect and recompute it. Simplicity is permitted and encouraged as a floor (Tier 1); it is never a substitute for disclosure. A hidden simple method is less trustworthy than an open complex one, the mutability and privacy of a model, not its complexity, are what make it gameable.

Section 8: Implementation Neutrality¶

The architecture is implementation-neutral and product-agnostic. It does not prescribe specific technologies, vendors, infrastructure providers, or deployment models. The coherence function, state machine, verification model, and governance protocol may be implemented across public, private, or hybrid environments.

8.1 Product and Vendor Neutrality. The framework does not require centralized control, proprietary data pipelines, or exclusive platform dependencies. Multiple systems may independently implement the architecture provided they adhere to the formal definitions, coherence constraints, deterministic state translation, verification invariants, and governance requirements defined herein.

8.2 Infrastructure Neutrality. The architecture may operate within cloud-based, on-premise, federated, or decentralized environments. Signal ingestion, verification, and governance layers may be distributed provided version control and auditability standards are preserved.

8.3 Compatibility with Independent Oversight. The framework coexists with traditional audit mechanisms, third-party evaluations, regulatory review, and independent oversight bodies. It does not replace or supersede external accountability systems.

8.4 Separation from Capital or Certification Functions. While the architecture may inform institutional decision-making, it does not itself allocate capital, grant certification, or assign comparative rankings. Any downstream use must remain institutionally separated from rule authorship and governance adjudication. Neutrality is preserved precisely because the fork cannot alter invariants: an implementation binds concrete parties to roles and selects a required verifier set per class (§7.10), but the standard (not the implementer) defines the roles, the close condition, and the |V_req| ≥ 2 and Recipient-inclusion invariants. The implementer chooses within the standard; it cannot rewrite it.

Section 9: Worked Example¶

This section illustrates how the coherence function, verification lifecycle, and deterministic state machine operate within a bounded scenario. The example is hypothetical and demonstrates procedural flow rather than evaluative judgment.

9.1 Scenario Definition. An organization declares quarterly service delivery. Signals include: (1) declarative service report, (2) activity logs, (3) financial disbursement records, (4) structural continuity indicators.

9.2 Evaluation Window. Δt = Q1. Expected cadence: quarterly declarative report, weekly activity logs, monthly financial records.

9.3 Normal Coherence Condition. All signals emit within cadence; drift within tolerance; congruence constraints satisfied. Result: C(Δt) approaches 1, state Γ0 (Verified Coherence).

9.4 Drift Condition. Activity logs decline significantly while declarative reporting remains constant. Stability component decreases, reducing C(Δt); minor-drift threshold exceeded. Result: transition to Γ1.

9.5 Persistent Drift. Drift persists across intervals; tolerance window expires. Result: automatic transition to Γ5 (Remediation Pending); notice issued.

9.6 Restoration. Activity logs return to cadence and congruence is satisfied within the remediation window; C(Δt) returns above threshold. Result: restored to Γ0.

9.7 Structural Inconsistency Example. Declarative service volume increases while no corresponding activity or financial signals are present; congruence fails. Result: transition to Γ4 (Structural Inconsistency), then Γ5. Throughout, no scoring, ranking, or predictive attribution occurs; all transitions are deterministic and subject to governance oversight.

9.8 Verified Outcome Example: Two-Source Close. Consider a care-coordination outcome. Class V_req = {Deliverer, Recipient}; roles bound as Deliverer→service provider, Recipient→beneficiary. The loop is created: Λ_open. The provider attests service delivered and the resolved disposition: one required role satisfied: Λ_partial. At the beneficiary's next check-in, the beneficiary confirms the service occurred and reports the single agreed measure; the set now satisfies V_req with no contradiction: Λ_verified. A Verified Outcome record (§3.15) is produced, and the beneficiary sees the closed loop first (§2.8). Had the beneficiary instead reported the service did not occur, the attestations would conflict (Λ_contradicted) routing to human review (Γ6) and registering a structural-inconsistency signal (Γ4); no automated tie-break selects between the provider's and the beneficiary's accounts.

9.9 Verified Outcome Example: Three-Source Close with Verified Cost. Consider a job-placement outcome, whose realization lies outside what the deliverer and recipient can establish alone. Class V_req = {Deliverer, Recipient, Independent}; roles bound as Deliverer→training organization, Recipient→participant, Independent→hiring manager. Training completion (deliverer) and the participant's confirmation move the loop to Λ_partial; the hiring manager's independent attestation that the placement occurred and persisted completes V_req, Λ_verified. The added verifier is not a formality: it establishes a fact neither the training organization (which benefits from claiming placement) nor the participant alone can independently corroborate, raising the cost of gaming from one party's report to collusion across three parties with distinct incentives (§11.7). The outcome carries a Verified Cost (§3.20). At pilot, the training organization attests direct expenditure and the funder's disbursement record corroborates it: a Tier 1 figure, reported as Tier 1. As shared program costs are apportioned under a declared, versioned allocation method, and the total-expenditure envelope is tied to audited financials with the allocation method independently examined (§3.18), the same outcome's cost figure advances to Tier 3, the advance visible on the record, never presented as though it were Tier 3 from the start. Fund-In is reported alongside Expenditure, never as a substitute (§10.7). Throughout, no scoring, ranking, or cost-effectiveness judgment occurs.

Section 10: Verified Outcomes and Reporting¶

10.1 The Verified-Outcome Record. The record binds a bounded outcome payload to an extensible attestation set, not a fixed pair of fields. Each attestation carries { role, verifier_ref, attested_at, scope, contradiction_flag }. The set is append-only and holds N attestations, so a class requiring tertiary (or higher) verification is expressed by the required set, not by a schema change. Two-source and three-source outcomes are the same record shape at different V_req.

10.2 Required Verifier Sets per Class. V_req is governance-defined and version-controlled per outcome class. The two-source floor applies universally; the tertiary trigger is independent third-party knowledge of realization. Illustratively:

Outcome class	V_req	Independent third party
Care coordination loop	{Deliverer, Recipient}	None (both internal parties observe the close)
Job placement	{Deliverer, Recipient, Independent}	Hiring manager, confirms placement occurred and persisted
Housing stability	{Deliverer, Recipient, Independent}	Landlord / housing authority
Credential attainment	{Deliverer, Recipient, Independent}	Licensing or issuing body

10.3 Verification Integrity. The reported metric is the share of outcomes whose realized verifier set satisfies V_req for their class. Partial verification (e.g., deliverer + recipient closed, independent pending) is reported honestly as partial, never hidden and never rounded up. Verification integrity is itself an audited figure, held to the same standard the framework asks of everyone else. Partial-state honesty is an instance of chosen transparency (§2.10): the incomplete close is disclosed as incomplete rather than rendered as done.

10.4 The Proof Artifact. Reporting outputs are generated from the verified-outcome records, timestamped, with every metric traceable to a specific Verified Close. Proof artifacts are generated, never hand-authored; the reporting layer cannot assert a figure the attestation set does not support.

10.5 Non-Prescriptive Boundary (Outcomes). Verified outcomes report bounded, attested conditions with provenance. They do not measure effectiveness, attribute causation, or rank entities. A verified outcome is the coherence framework's audit-grade terminal fact (the point at which a claimed outcome has survived independent, multi-party attestation), and nothing more.

10.6 The Verified-Cost Record. A Verified Outcome (§3.15) may carry a Verified Cost (§3.20) as a parallel, attestation-bearing component. The record binds the cost figure to its Cost Provenance set (§3.19), its declared Allocation Method reference and version, its Cost Tier, and (reported alongside, never merged) the corresponding Fund-In. The cost component is append-only and tier-labeled; a correction is a new attestation, not a mutation of a prior one. Outcome verification and cost verification are independent: an outcome may reach Verified Close while its cost remains partially verified, and the record reports each state honestly rather than gating one on the other.

10.7 Fund-In and Expenditure Are Reported Distinctly. The record reports Expenditure (the verified cost of record) and Fund-In (monies received) as separate figures. Cost-per-outcome, where reported at all, is computed on Expenditure, never on Fund-In: dividing funds received by outcome count reports a cost that may never have been incurred, and rewards raising more and counting more rather than delivering. The gap between Fund-In and Expenditure is disclosed rather than hidden. It is legitimate signal (retained operating capacity, timing differences, multi-year or restricted funds), not evidence of wrongdoing, and the framework attributes no intent to it.

10.8 Verified-Cost Integrity. The reported metric is the distribution of cost figures by realized tier and verifier-set completeness, the share of outcomes carrying Tier 3 corroborated cost, Tier 2 allocated cost, Tier 1 direct-only cost, and cost still pending independent corroboration. Partial and lower-tier figures are reported honestly as such and never rounded up to a completeness they do not have. Verified-cost integrity is itself an audited figure, held to the same standard the framework asks of everyone.

10.9 Non-Prescriptive Boundary (Cost). This boundary parallels §10.5 and is enforced with equal hardness. Verified cost reports a bounded, attested input figure with provenance and a corroboration tier. The framework does not compute cost-effectiveness scores, does not rank entities or outcomes by cost, does not declare any cost excessive or efficient, and does not optimize toward lower-cost outcomes. A verified cost is the audit-grade terminal fact of what an outcome cost and how independently that is established, and nothing more. Cost-effectiveness evaluation, if a reader wishes to perform it, is the reader's act upon a trustworthy figure, never the framework's.

10.10 Denominator and Attrition (Required). A count of verified outcomes reported without its denominator is a survivorship-biased artifact: it counts the cases that reached a close and is silent on those that did not. The framework therefore requires that verified-outcome counts never be reported alone. Each reported figure carries its denominator (the number of outcomes attempted or enrolled in the same class and window), together with the disposition of the difference: how many are still open, how many lapsed (§6.2), and how many exited through attrition. Verification integrity (§10.3) is a ratio within closed outcomes; this denominator is the distinct and equally required ratio of closed to attempted. Reporting the first without the second is precisely the cherry-pick the framework exists to prevent, and it is prohibited. The denominator is not an impact measure and attributes no intent (a low close rate may reflect a hard-to-serve population, a slow independent verifier (§13.7), or an honest program encountering honest difficulty), but it must be visible, because a verified-outcome rate is uninterpretable without it. This requirement is also the structural check on selection gaming (§11.9): creaming and adverse attrition are legible only against the denominator. The required denominator is the central instance of chosen transparency (§2.10), the framework electing to expose the survivorship a bare count would conceal, before an adversary can.

Section 11: Threat Model & Abuse Resistance¶

This section defines the threat landscape relevant to a multi-signal, multi-party accountability architecture and outlines structural safeguards designed to resist manipulation, governance capture, privacy compromise, and over-automation.

11.1 Threat Actors. Threat actors may include: (1) participating entities attempting to game signal outputs, (2) colluding entities coordinating artificial congruence, (3) insiders manipulating rule definitions or adjudication, (4) external attackers targeting data integrity or confidentiality, and (5) governance actors seeking to alter rule thresholds for selective advantage.

11.2 Signal Manipulation Risks. Signal flooding, retroactive backfilling, selective omission, and synthetic event generation are common strategies. The architecture mitigates these through coverage requirements, cross-signal congruence constraints, provenance metadata, and governance gating.

11.3 Governance Capture Risks. Capture may occur if rule authorship, approval, and adjudication authority consolidate. Separation of duties, version-controlled rule sets, public documentation, and conflict-of-interest disclosures are required safeguards.

11.4 Privacy and Re-Identification Risks. Multi-signal aggregation introduces re-identification and metadata-inference risk. Mitigations include data minimization, separation of identity and signal layers, encryption at rest and in transit, access controls, and tamper-evident audit logging.

11.5 Over-Automation Risk. Automated systems may create false impressions of objectivity or finality. The architecture prohibits fully automated enforcement or adjudication; escalated states require structured human review.

11.6 Residual Risk Statement. No accountability system can eliminate coordinated fraud, high-quality signal fabrication, or institutional governance failure. This architecture reduces, not eliminates, such risks; independent audits and regulatory oversight remain necessary complements.

11.7 Multi-Party Verification as Collusion Resistance. Single-source closure (§1.2) is the root manipulation vector: where one party both delivers an outcome and attests it, no independent record stands between claim and ledger. The required verifier set (§3.12) answers this by raising the floor of manipulation from one party's self-report to coordinated collusion across parties with distinct incentives. The strength of the safeguard is a function of verifier independence (§3.13), not count alone: an added verifier whose incentives align with an existing one raises the number without raising the cost of gaming. The independent third party required for outcomes whose realization lies outside the deliverer–recipient relationship: a hiring manager, a landlord, a licensing body, is specifically a collusion-resistance mechanism, chosen because it holds knowledge the interested parties cannot fabricate without implicating an outside actor who does not share their incentive. This safeguard is bounded and must be stated as such: multi-party verification defeats unilateral gaming and raises the cost of collusion proportional to the independence of the required set; it does not defeat fully coordinated fraud across all required verifiers, which remains a residual risk (§11.6, §13.4). Its contribution is to move the dominant real-world failure (a single interested party grading its own work) outside the space of easy manipulation.

11.8 Cost-Gaming Vectors. Cost verification introduces its own manipulation surface, each vector closed by a specific structural control. Fund-in substitution (reporting monies received as though they were monies spent: is closed by typing the inputs and making Expenditure the figure of record (§3.16, §10.7). Hidden or mutable allocation) apportioning shared cost by a private, adjustable method: is closed by requiring the method be declared, versioned, deterministically applied, and disclosed (§7.11). Tier inflation (presenting a direct-only figure as a corroborated one) is closed by putting the tier on the record (§3.18), so misstatement by tier selection is visible rather than concealed.

11.9 Selection and Creaming. The verification safeguards above harden the close against fabrication. They do not, by themselves, address a different and more sophisticated adaptation: once verified outcomes become the reward, the incentive relocates from faking closes to selecting which cases enter the system. A strategic actor can cream the easy-to-verify cases, avoid beneficiaries whose outcomes are hard to corroborate, steer toward outcome classes with a weaker required verifier set, and allow adverse attrition to quietly remove those who will not produce a clean close. This is Goodhart's law relocating rather than being defeated: the target moved from the reported metric to the population selected against it. The framework's own non-prescriptive firewall (§10.9) offers no protection here, because the distortion does not require the framework to rank anyone: funders will rank on verified-outcome counts regardless, and the incentive re-enters through the funder while the framework stays formally pure. The structural check the framework does provide is the required denominator and attrition disclosure (§10.10): creaming raises the verified-outcome rate while shrinking or skewing the denominator, and adverse attrition appears as exits concentrated among harder cases, both visible only when attempted, closed, lapsed, and exited counts are reported together. Verifier-independence typing (§3.13) further limits steering toward captured verifiers. These are mitigations, not a solution: selection gaming is a residual risk the framework surfaces and bounds rather than eliminates, and its honest treatment is continued in §13.11.

Section 12: Comparative Analysis¶

This section situates the architecture relative to prevailing accountability models.

12.1 Comparison to Charity Rating Systems. Rating systems assign numerical scores or rankings based on financial ratios, self-reported metrics, or weighted indicators. This architecture does not rank entities and does not collapse procedural coherence into comparative scores.

12.2 Comparison to Outcome-Based Scoring. Outcome-based models frequently attempt causal attribution between activity and impact. This framework explicitly avoids causal inference and measures only procedural alignment within bounded windows, while additionally requiring multi-party verification to establish that a claimed outcome occurred at all.

12.3 Comparison to Audit-Only Compliance Systems. Traditional audits are episodic and retrospective. This architecture introduces continuous, bounded monitoring of signal coherence while preserving the role of independent audit functions.

12.4 Comparison to Predictive Optimization Platforms. Predictive systems often incorporate optimization loops and behavioral nudging. This architecture prohibits optimization objectives, recommendation engines, and predictive scoring outputs.

12.5 Structural Differentiation Summary. Defining characteristics: (1) bounded multi-signal coherence rather than scoring, (2) deterministic state translation rather than probabilistic classification, (3) mandatory human oversight for escalations, (4) explicit non-prescriptive constraints, (5) public rule versioning and governance transparency.

12.6 Comparison to Single-Source / Self-Reported Outcome Measurement. The dominant practice in the social sector is for the delivering organization to report its own outcomes. This architecture departs at the primitive: an outcome is not established until a governance-defined set of structurally independent verifiers, always including the beneficiary, has attested to it (§2.7, §3.12). The differentiator is not richer self-reporting but the structural removal of single-source closure, the organization can no longer be the sole author of the record of its own results.

12.7 Comparison to Cost-Effectiveness Accounting. Cost-per-outcome analysis is not novel: activity-based costing, cost-effectiveness analysis, and social-return-on-investment methods all compute cost against results, and overhead-ratio metrics are widely used. This framework does not claim to invent cost measurement, and it explicitly declines the ranking those methods invite. Its contribution is narrower and specific: applying the same multi-party verification, provenance, and tier-labeling discipline to cost that it applies to outcomes, so a delivered-cost figure becomes audit-grade and independently corroborated (§10.6–10.8) without manufacturing the cost-effectiveness ranking incentive that distorts behavior (§10.9). Verified cost is a trustworthy input to whatever analysis a reader chooses; it is not itself an analysis.

12.8 Comparison to Outcomes-Based Contracting and Social Impact Bonds. Independent third-party verification of social outcomes is not new. Outcomes-based commissioning, Pay-for-Success arrangements, and Social Impact Bonds routinely engage an independent evaluator or validator who confirms that contracted outcomes occurred before payment is released. Any contribution claim this framework makes must be stated against that prior art rather than around it. The framework does not claim to introduce independent outcome verification; it differs in five structural respects. First, it is a continuous, reusable standard rather than a per-contract, per-deal arrangement negotiated and dismantled around a single financing instrument: verification here is an ongoing property of an organization's operations, not an event procured for one contract. Second, it makes the beneficiary a required verifier of every outcome (§3.12); outcomes-based contracting almost never treats the recipient as a verifying party, typically validating through provider records and an independent evaluator while the beneficiary remains a subject of measurement rather than a party to it. Third, it carries the return path (§2.8): the result is owed back to the person who produced it, a commitment absent from validation-for-payment models. Fourth, it is forkable and implementation-neutral (§7.10, §8): one governing standard spans domains and implementers, where SIB validation is bespoke to each deal. Fifth, it extends the same verification discipline to cost (§10.6), which outcome-validation models generally do not. The honest boundary: for the narrow function of "did the outcome occur, confirmed by someone other than the payee," this framework and SIB validation overlap, and the framework should not be sold as inventing that function. Its distinct value is turning a per-deal validation event into a continuous, recipient-inclusive, returnable, forkable standard that also verifies cost.

Section 13: Limitations¶

This architecture establishes a bounded framework for procedural coherence assessment and multi-party verified outcomes. It is intentionally constrained.

13.1 No Measurement of Effectiveness. The coherence function does not evaluate program effectiveness, social impact, or outcome quality; independent evaluative methodologies remain necessary for impact assessment.

13.2 No Attribution of Intent. Absence, drift, lapse, or structural inconsistency do not imply misconduct or intent; the architecture detects bounded conditions only.

13.3 Dependence on Governance Integrity. Integrity depends on transparent rule authorship, separation of duties, and institutional oversight; weak governance may undermine reliability of state assignments.

13.4 Incomplete Fraud Detection. Coordinated fraud, sophisticated signal fabrication, or external corruption may evade detection. Multi-party verification raises the cost of manipulation but cannot eliminate fully coordinated cross-party collusion.

13.5 Data Availability Constraints. The coherence function relies on observable signals; sparse-data environments may limit resolution without implying wrongdoing. Governance must define minimum signal requirements to avoid disproportionate burden.

13.6 Non-Comparative Design. The system does not support comparative ranking between entities; any downstream comparative use is an external interpretation not intrinsic to the architecture.

13.7 Verifier Availability. A required independent third party may be unreachable, unwilling, or slow to attest: a hiring manager who does not respond, a licensing body without a return channel. The framework does not resolve this by weakening V_req; it resolves it by honest partial-state reporting (the outcome remains Λ_partial and is reported as such, §10.3) and by governance-defined escalation and remediation windows (§6.5, §7.2). An outcome that cannot obtain a required attestation is not silently upgraded to closed; the gap is visible. This preserves the anti-gaming property at the cost of some outcomes remaining formally unclosed, which the framework treats as the honest result rather than a defect to engineer around.

13.8 Allocation Judgment and the Risk of False Rigor. The framework verifies cost provenance, tier, and method-consistency; it does not verify that an allocation method is the correct one, because no such correctness exists to certify (§3.17, §7.11). This limitation is more serious than a comparability caveat and is stated bluntly: a per-outcome cost is frequently not a real, well-defined quantity. Two defensible allocation methods applied to the same program can yield materially different per-outcome figures, both reproducible and both "verified" in this framework's sense. The discipline the framework imposes: declaration, versioning, deterministic application, disclosure, makes a figure reproducible and inspectable, which is a genuine improvement over hidden allocation, but it does not make the figure meaningful in a way it is not. The risk is that verification lends an allocated cost an appearance of precision the underlying accounting cannot support. The mitigations are the tier label (which caps what a figure claims), the requirement that the method be inspectable so a reader can recompute under an alternative, and the explicit statement (here) that reproducibility is not accuracy. Cost figures produced under different methods are not freely comparable, and the framework does not manufacture comparability the accounting does not support.

13.9 Administrative Burden and the Asymmetry the Framework Critiques. The highest corroboration tier presumes independently audited financials, which many smaller organizations do not maintain, so Tier 3 is aspirational for parts of the sector; the tiered design is deliberate, letting an organization stand honestly at Tier 1 or Tier 2 rather than forcing a corroboration it cannot support or inviting a fabricated one. This connects to a tension the framework must own rather than sidestep. Section 1.2 criticizes administrative asymmetry, that resource-constrained organizations bear disproportionate compliance burden. Multi-party verification, cost tiering, and independent attestation are, in aggregate, heavier than the status-quo self-reporting they replace, and the organizations best able to bear that weight are the well-resourced ones. The framework therefore risks reproducing the very asymmetry it names. Three design choices bound but do not erase this: the two-source floor is deliberately light (deliverer plus the beneficiary who is already present, no third party procured); tiers let small organizations participate honestly at a lower rung rather than being excluded; and the return path gives the beneficiary something back for the added verification effort rather than extracting it. The honest position is that the framework shifts burden toward verification and must be deployed with proportionality (minimum viable verifier sets, funded verification infrastructure for small implementers) or it will advantage large organizations, and that is a real limitation, not a solved problem.

13.10 Recipient Non-Neutrality. The architecture treats Recipient ∈ V_req as anti-gaming strength, but the recipient is not a neutral oracle. Beneficiaries can be coached, may be grateful, may depend on continued services, or may simply acquiesce to a provider's account: and a recipient whose incentives align with the deliverer reduces a two-source close toward an effectively single-source one. This matters most precisely where the framework is weakest: the two-source floor (V_req = {Deliverer, Recipient}) is the only protection for outcome classes that do not require an independent third party, so the framework's strong collusion-resistance guarantees (§11.7) genuinely bind at the three-source level and are materially softer at two. The relational-dependence failure mode is named in the independence typology (§3.13) and should inform class design: where recipient acquiescence is a live risk and the outcome's realization admits an independent witness, the standard should lean toward requiring the third verifier rather than resting on the two-source floor. The framework does not claim the beneficiary's attestation is incorruptible; it claims that requiring it is strictly better than excluding it, and that its weight should be assessed honestly per class.

13.11 Verification Relocates the Incentive. Consolidating the concession made in §11.9: multi-party verification does not eliminate gaming, it moves it. Attestation fraud is hardened; case-selection and attrition become the adaptive frontier. The framework's contribution is to make the dominant, unsophisticated failure: a single party grading its own work, structurally difficult, and to render the next-order failure (creaming, adverse attrition) visible through the required denominator (§10.10) rather than invisible. It should be represented as raising the cost and lowering the concealment of manipulation, not as defeating it. A framework that claimed to end gaming would be making exactly the kind of overclaim it was built to resist.

Section 14: Ethical & Legal Positioning¶

This section clarifies the ethical and legal posture of the architecture to ensure due process, transparency, and non-coercive application.

14.1 Due Process Protections. Transitions into remediation or review require formal notice, defined remediation windows, and structured human adjudication; appeals must be permitted and documented.

14.2 Non-Coercive Design. The architecture does not prescribe operational changes, strategic decisions, or policy directives; its outputs are descriptive and bounded, not behavioral mandates.

14.3 Transparency and Public Rule Disclosure. Governance rules, thresholds, signal classifications, verifier-set definitions, and version histories must be publicly accessible; transparency mitigates governance capture and enhances institutional trust.

14.4 Accountability of the Accountability System. The framework itself remains subject to oversight; rule amendments, adjudication outcomes, and audit logs must be reviewable by independent authorities where applicable.

14.5 Regulatory Compatibility. The architecture operates within existing regulatory environments and may complement, but does not replace, statutory reporting obligations, audit requirements, or compliance frameworks.

14.6 Ethical Guardrails. The system prohibits predictive behavioral scoring, automated sanctioning without review, and opaque model-driven state assignment; human oversight remains a structural requirement.

14.7 The Recipient's Standing. Because the Recipient is a required verifier of every outcome and the outcome returns to them in their own terms (§2.8), measurement under this architecture is not performed on the beneficiary but with them and returned to them. This is an ethical posture with due-process weight, not a courtesy: the party whose outcome is recorded has standing in the record's creation and a right to see what their participation produced. A system that measured a person without granting them either role would satisfy neither the verification invariant nor the return path, and would fall outside the architecture.

14.8 Arm's-Length Authorship as Conflict Governance. An entity that authored an accountability standard and then certified its own conformance under it would hold an unresolved conflict of interest, whatever its intentions. The standards-authority separation (§7.9) forecloses this structurally: the body that authors and governs the standard does not operate the services it evaluates, and the commitment is symmetric, every conforming implementer, including any affiliated with the authority, is held to a standard none of them individually control. The framework applies its own non-prescriptive, separation-of-duties discipline to itself, which is the minimum condition for asking others to accept it.

Addenda¶

Addendum A: Formal Mathematical Specification. Let S = {S1…Sn} be the signal set and Δt the evaluation window. Coherence: C(Δt) = G(Δt) × Σ (wi × ci(Δt)), with Σ wi = 1 and each ci(Δt) ∈ [0,1]. Deterministic translation: Γ = g(C(Δt), A, D, R), where Γ is a discrete confidence state and no probabilistic model may directly assign Γ. Boundedness (0 ≤ C ≤ 1) and monotonic restoration hold: signal restoration cannot reduce coherence under identical rule sets. Verifier-set formalism. For an outcome o of class κ = class(o), let V_req(κ) be the required verifier set and attest(o) the received attestations. Define the close predicate: close(o) ⇔ (∀ r ∈ V_req(κ) : ∃ α ∈ attest(o) with role(α) = r ∧ time(α) ∈ Δt(o)) ∧ ¬contradiction(attest(o)), subject to the invariants |V_req(κ)| ≥ 2 and Recipient ∈ V_req(κ). The verification lifecycle Λ(o) ∈ {open, partial, verified, contradicted, lapsed} is determined by attest(o) relative to V_req(κ) and Δt(o): verified iff close(o); contradicted iff contradiction(attest(o)); lapsed iff Δt(o) elapsed ∧ ¬close(o); partial iff a nonempty proper subset of V_req(κ) has attested with no contradiction; open otherwise. Verified Cost. The same predicate applies over Cost Provenance with a cost-specific verifier set (Recipient-inclusion does not transfer, §3.19); a Verified Cost additionally carries a declared tier τ ∈ {1,2,3}. No probabilistic model assigns Λ, close(o), or τ.

Addendum B: State Transition Tables. Entity transitions under R: Γ0, Minor Drift→Γ1 (no review); Γ1, Drift Persists→Γ2 (no); Γ2, Threshold Exceeded→Γ5 (no); Γ3, Absence→Γ5 (no); Γ5, Remediation Success→Γ0 (no); Γ5, Remediation Failure→Γ6 (yes); Γ6, Adjudication→Γ0/Γ5/Γ4 (yes). Λ transitions: Λ_open, attestation received→Λ_partial; Λ_partial, V_req satisfied ∧ no contradiction→Λ_verified; Λ_partial, window expiry→Λ_lapsed (raises a Γ3 source); any, conflicting attestation→Λ_contradicted (raises a Γ4 source, requires review, →Γ6); Λ_lapsed, late required attestation→Λ_verified (late close, lateness in provenance). Cost provenance follows the identical Λ table over its own verifier set.

Addendum C: Governance Rule Schema. Each rule Rj must include: (1) Trigger Condition, (2) Threshold Parameters, (3) Escalation Pathway, (4) Remediation Duration, (5) Documentation Requirements, (6) Version Identifier, (7) Effective Date. Amendments must preserve reproducibility of historical determinations. For outcome-class rules, each rule additionally includes: (8) Required Verifier Set V_req, (9) Verifier Independence Criteria, (10) Allocation Method reference and version, (11) Cost Tier policy. Changes to fields (8)–(11) are versioned amendments (§7.5, §7.11).

Addendum D: Threat Model Matrix. Threat categories: Signal Manipulation, Governance Capture, Privacy Compromise, Over-Automation, Collusion. Each assessed by likelihood, impact, and mitigation under version-controlled documentation; controls mapped to architectural layers and auditable. An additional category (Verifier Capture / Coordinated Multi-Party Collusion) is assessed explicitly: the risk that required verifiers coordinate a false attestation. The mapped control is verifier-independence criteria (§3.13); the residual risk of fully coordinated collusion across all required verifiers is documented, not claimed defeated (§11.6, §11.7, §13.4).

Addendum E: Privacy & Data Protection Architecture. Data minimization, separation of identity and signal layers, encryption at rest and in transit, strict access controls, tamper-evident audit logging. Public-facing analytics must avoid small-n disclosures and prevent re-identification. Consistent with the proof substrate (§4.8), the event record is free of personally identifying and protected content by construction: public-facing analytics read the proof stream, never the record store.

Addendum F: Governance Amendment Process. Structured lifecycle: (1) Proposal Submission, (2) Impact Assessment, (3) Public Disclosure (if applicable), (4) Governance Review, (5) Formal Approval Vote, (6) Effective Date Publication, (7) Archival of Prior Version. Amendments must not retroactively alter historical state determinations. Amendments to required verifier sets (§7.5) and allocation methods (§7.11) follow this same lifecycle, including archival of the prior version and non-retroactivity of historical determinations.

Addendum G: Reference Implementation Blueprint (Non-Binding). High-level modules: Signal Ingestion, Coherence Computation Engine, Deterministic State Engine, Governance Rule Repository, Audit Log Store, Human Review Interface. Implementations may vary technologically provided they adhere to the formal constraints in Sections 3–7. This non-binding blueprint is instantiated as a concrete worked fork in Appendix A: Reference Conformance: A Worked Fork, which performs the two permitted bindings for two outcome classes and demonstrates conformance (§7.10) end to end. Addendum G remains the abstract module list; Appendix A is its worked realization.

Appendix A. Reference Conformance: A Worked Fork¶

This appendix demonstrates that the standard is forkable by working one implementation through the conformance test of §7.10. It is a conformance demonstration, not a capabilities showcase. Its purpose is to show that a concrete implementation's bindings sit inside the base standard's invariants and that its conformance claim is therefore checkable. It deliberately does not name entities, argue that any particular implementation is effective, or present the implementation as the standard's endorsement of itself; the standard endorses no implementer, including one affiliated with its author (§7.9). The reference implementation is referred to throughout as "the fork."

A.1 What this appendix establishes, and what it does not. It establishes: that the two permitted bindings (role binding and set binding) can be performed for real outcome classes without altering any invariant; that the abstract proof substrate (§4.8) has a concrete form; and that a Verified Outcome and a Verified Cost can be produced end to end under the standard. It does not establish: that the fork is well-run, that its outcomes are impactful, or that its cost figures are favorable. Those are outside the standard and outside this appendix.

A.2 The proof substrate, instantiated. The fork records signals, attestations, state transitions, and outcome events as immutable, timestamped entries on a single append-only event stream, the loop ledger. The ledger holds statuses, category codes, timestamps, and bounded measure deltas; it holds no personally identifying or protected content, so reporting reads the ledger and never a sensitive record store (§4.8). Integrity is anchored so that retroactive alteration is infeasible to the operator itself, satisfying the property §4.8 requires rather than asserting it. Every reporting surface is a read over this one stream, and the read surfaces resolve in priority order with the beneficiary first: the party the outcome belongs to sees their own loop close before any institutional surface renders it. That ordering is the return path (§2.8) made concrete, a property of the substrate rather than an added feature.

A.3 The two bindings, made explicit. The fork performs role binding and set binding for two outcome classes, and only these two operations (§7.10):

Outcome class	Role binding	Set binding (V_req)
Care coordination	Deliverer: service provider; Recipient: beneficiary	{Deliverer, Recipient}
Job placement	Deliverer: training provider; Recipient: participant; Independent: hiring manager	{Deliverer, Recipient, Independent}

The conformance claim is checkable against the base invariants: each set satisfies |V_req| ≥ 2; each set includes the Recipient; the job-placement class adds the Independent Third Party because the placement's realization lies outside what deliverer and recipient can establish alone, which is the standard's stated tertiary-verification condition (§3.12). The fork defines no new roles, weakens no invariant, and alters no close condition. An auditor confirms conformance by checking these two rows against §3.11 and §3.12, which is the entire test.

A.4 A verified close, on the ledger. The two closes walked abstractly in §9.8 and §9.9 occur here as ledger events. For a care-coordination outcome: a loop-created event (Λ_open); a provider attestation event (Λ_partial); a beneficiary confirmation event that satisfies {Deliverer, Recipient} with no contradiction (Λ_verified), producing the Verified Outcome record. For a job placement: provider and participant attestations (Λ_partial), then the hiring manager's independent attestation completing {Deliverer, Recipient, Independent} (Λ_verified). A conflicting attestation writes a contradiction event (Λ_contradicted), which routes to human review and never resolves by automated selection between verifiers. Attestations are captured through a single mechanism: an opaque, expiring, verification-gated link issued to each required verifier, one mechanism reused across roles rather than a bespoke channel per party.

A.5 Verified cost, at the honest tier. At pilot, the fork reports cost at Tier 1 (direct attributable expenditure), with Fund-In reported alongside Expenditure and never as a substitute (§10.7). The figure is labeled Tier 1; it is not presented as more corroborated than it is. Tier 3 is forward-defined: as the fork's shared-cost allocation method is declared and versioned, and as its total-expenditure envelope becomes tied to audited financials with the allocation method independently examined (§3.18), specific cost figures advance to higher tiers, with each advance visible on the record. The tiered design lets the fork stand honestly at Tier 1 today rather than claim a corroboration it does not yet have.

A.6 Governance stage, stated plainly. The fork's standards authority currently occupies Stage 1 of the earned-graduation model (§7.9): declared safeguards, separation stated as aspirational and in-progress, not graduated to earned independence. This single fact is what keeps the appendix honest. The fork is presented as an implementation at the beginning of the maturity path the standard defines, not as a certified or independent authority. Reporting the fork's own governance stage, unprompted and unflattering, is itself an instance of chosen transparency (§2.10).

A.7 Conformance summary. The fork binds two outcome classes to concrete parties, selects a required verifier set for each within the standard's invariants, instantiates the proof substrate with a beneficiary-first return path, produces Verified Outcomes and a tier-labeled Verified Cost, and discloses its own governance stage. Every one of these sits inside the base standard; none alters it. That is what conformance means under §7.10, and it is the whole of what this appendix claims.

Appendix B. Notation¶

Symbols used in the formal sections (§3, §5, §6, and Addendum A). Subscripts index a series (Sᵢ a generic signal, wᵢ a generic weight); n counts signals and N counts attestations.

Symbol	Meaning
State machines
Γ	Entity coherence state, one of Γ0 to Γ6: Γ0 verified coherence, Γ1 minor drift, Γ2 persistent drift, Γ3 signal absence, Γ4 structural inconsistency, Γ5 remediation pending, Γ6 under human review.
Λ	Outcome verification state: Λ_open, Λ_partial, Λ_verified, Λ_contradicted, Λ_lapsed.
Core quantities and functions
S, Sᵢ(t)	A signal; signal i at time t. S = {S1 … Sn} is the set of n signals.
Δt	Evaluation window, the bounded time interval assessed.
Aᵢ, Dᵢ	Absence event (a required signal did not emit on time); drift (deviation from historical pattern).
C(Δt), f	Coherence, a value in [0,1]; f is the coherence function, with C = f(S, Δt).
G(Δt)	Governance gating factor, which lowers coherence when a required signal is absent.
Rⱼ, R	A governance rule; R is the full, version-controlled rule set.
g	Deterministic translation function mapping coherence conditions to a Γ state.
Coherence-function components
wᵢ	Weights (w1 … w5), non-negative and summing to 1.
c_cad, c_cov	Cadence (signals on schedule); coverage (all required signal classes present).
c_cong, c_stab	Congruence (signals agree); stability (low drift).
c_struct	Structural consistency (absence of contradictions).
Σ, ×, ·	Sum of; multiply; multiply.
Verification and logic
αᵥ, α	An attestation by verifier v; role(α) and time(α) are its role and timestamp.
V_req, \|V_req\|	Required verifier set for an outcome class; its size (so \|V_req\| ≥ 2).
o, κ	An outcome; its class, κ = class(o).
r, v	A verifier role; a verifier.
close(o), attest(o)	Close predicate (true when o is verified); the set of attestations received for o.
∈, ∀, ∃, ¬, ∧, ⇔	Member of; for all; there exists; not; and; if and only if.
≥, ≤, [0,1], { }, →	At least, at most; the range 0 to 1 inclusive; a set; maps to (Recipient→beneficiary; Γ0 → Γ1).
Cost
τ	Cost tier, τ ∈ {1, 2, 3}: 1 direct, 2 allocated, 3 corroborated.