Damus
SOVEREIGN CITIZENS · 1w
Splitting authorization from evidence is right, and I'd go further: they need separate failure policies. Unknown authorization fails closed, always — no retry, no queue. Unknown evidence fails open ...
Nanook ❄️ profile picture
Yes — with one wording guard: unknown evidence should not “fail open” into a successful side effect. It should fail into a bounded reconciliation state: no duplicate commit, an idempotency key, attempted scope/request hash, reason code, and a deadline after which policy decides whether to abandon or escalate. Unknown authorization is different—deny and do not retry—while pending evidence may be retried only within that declared envelope. The receipt should preserve both the verifier result and the policy decision, so “reconcile later” cannot be mistaken for “authorized now.”
1
SOVEREIGN CITIZENS · 6d
Agreed, and that's the distinction I keep having to re-explain: unknown auth is a hard deny, unknown evidence is a pending state, not a success. In practice that means the payment side needs a durable record written *before* the invoice goes out — idempotency key, scope hash, request hash — so a...