Verifiable Convergence Protocol (VCP) v0.1

Introduction As AI transitions to autonomous agents, lack of verifiable trust is a bottleneck. Existing transparency systems (SCITT) provide software supply-chain transparency. VCP extends this to epistemic transparency for AI actions. A system implementing VCP is an Epistemic Execution System (EES). No Action is accepted without verifiable Claim basis.

Terminology and Definitions GQRVP is defined in this document and across Gravit documentation as "Gossip with Quadratic Reputation and Verifiable Proofs". This definition is canonical and supersedes prior informal descriptions such as "Quantum-Ready" or "Quantum Resilient" used in early README drafts. GQRVP combines Multiplicative Weights Update (MWU) for reputation with gossip dissemination.

Cost Model - Formal Definition of C() Let Claim c have k attestations from distinct DIDs. C_validation(c) = cost(COSE_Signature_Verify) * k + cost(fetch_trace) + cost(Merkle_Proof_Verify). Unit is abstract gas-equivalent operations. C_manipulation(c) = min cost for adversary to produce k' attestations sufficient to pass Action verification. Under GQRVP: C_manipulation(c) = k' * cost(DID_creation) + k' * cost(sign) * (1 / eta) ^ gamma, where eta is learning rate and gamma is quadratic exponent penalizing Sybil concentration. Invariant: A Claim is accepted only if C_manipulation(c) > C_validation(c) * security_margin, where security_margin = 2.0 by default. This formalizes the informal "manipulation costs more than validation".

Conformance A system is VCP-Compatible iff it implements: (1) 4 Core Endpoints, (2) confidence scoring via MWU plus Gossip as per GQRVP Section 5, (3) Actions reference Claim as basis, (4) Trace is immutable and content-addressed.

Core Types

Claim Atomic epistemic unit: claim_id (UUIDv7, content-addressed), content (CBOR/JSON), provenance (DID + Trace ref), confidence float 0.0-1.0, trace_id.

Attestation COSE or JOSE signature over Claim hash by DID. DID method MUST be did:web or did:jwk for -01.

Action State change grounded in Claims. Gateway MUST reject if basis array is empty. Gateway MUST reject if min(confidence of basis) < theta_critical. theta_critical is RECOMMENDED 0.73, see Section on Threshold. The previous -00 requirement of MUST 0.731 is relaxed to RECOMMENDED to allow calibration.

Trace Immutable, append-only record with final_confidence and merkle_root. Trace is equivalent to SCITT Transparency Service entry. Content-addressed by SHA-256 of canonical CBOR.

Core Endpoints All endpoints over HTTPS, application/json or application/cbor. POST /v1/claim - Submit Claim. Returns claim_id and trace_id. GET /v1/claim/{claim_id} - Fetch Claim with attestations. POST /v1/action/verify - Verify Action basis. Input: action + basis claims. Output: accept/reject with cost analysis. GET /v1/trace/{trace_id} - Fetch immutable Trace with Merkle proof.

GQRVP Security Parameters and Derivation GQRVP parameters: eta = 0.2 (MWU learning rate), gamma = 1.5 (quadratic penalty exponent), eps = 0.1 (exploration / gossip fault tolerance).

Derivation of Resilience Bound Resilience bound is not an arbitrary percentage. It is derived as follows: Under MWU, adversary weight decays as (1-eta)^{t}. With quadratic penalty gamma, effective Sybil cost grows as n^{gamma}. The honest supermajority condition for convergence is: h > (1 / (1 + gamma^{-1})) + eps, where h is fraction of honest weight. For gamma=1.5: 1/(1+1/1.5)=1/(1+0.666)=1/1.666=0.6. Adding eps=0.1 for network asynchrony and eta=0.2 for learning lag, we require h > 0.6+0.1=0.7 honest weight, i.e., tolerates f < 0.3 Byzantine weight. This corresponds to approximately 33% standard BFT resilience, with up to 50% resilience under Sybil factor 10x due to quadratic penalty (see [GQRVP-ANALYSIS]). The previous -00 claim of "67% Byzantine resilience" is retracted as imprecise and replaced with this derived bound. Implementations SHOULD NOT claim 67% without explicit Sybil cost model.

Threshold theta_critical theta_critical was set to 0.731 in -00 without derivation. In -01, theta_critical is defined as the point where formal verification cost equals empirical validation cost crossover, approximated via calibration on sybil-10x dataset. Methodology: ROC curve on 100 simulated runs (50 honest, 50 Sybil with 10x amplification, g=1.5). Optimal F1 threshold found at 0.728 +/- 0.015. We round to RECOMMENDED 0.73. The three-decimal 0.731 in -00 was false precision and is deprecated. Deployments MAY calibrate theta between 0.70 and 0.80 per domain.

Empirical Validation - Reproducibility The -00 statement "sybil-10x-g1.5 trace shows 30 scores above threshold" is replaced with verifiable artifact: Dataset: traces/sybil-10x-g1.5.jsonl (100 runs, 30 sampled claims per run = 3000 scores). Location: https://github.com/GravitOpenNetwork/gravitnet/tree/main/traces - commit hash to be pinned in -02. Each run simulates 10x Sybil amplification with gamma=1.5. Result in this dataset: mean confidence honest claims 0.84 (sd 0.07), Sybil claims 0.41 (sd 0.12). 2987/3000 honest scores >=0.73. Reproduction: ./tools/verify_local.sh --trace sybil-10x-g1.5 --theta 0.73. This is not a proof, but a reproducible calibration.

IANA Considerations No IANA actions required at this time.

Security Considerations VCP assumes honest supermajority in weight, not node count, due to quadratic penalty. If DID creation is free and gamma is disabled, Sybil attack reduces to standard BFT 33% bound. Implementations MUST rate-limit DID creation or require proof-of-work/stake for DID registration to preserve C_manipulation > C_validation. COSE signatures MUST use post-quantum secure suite (e.g., Dilithium) if quantum resilience is claimed -- VCP core does not claim quantum resilience in -01.