calchis-determination/1

Determination Standard

Status: proposed. One implementation exists. It has not been reviewed by any standards body, adopted by any counterparty, or referenced in any offering document. Published for review and criticism — at this stage those are more useful than adoption.

The problem

Parametric insurance and catastrophe bonds settle on whether a public observation crossed a stated number, at a stated place, at a stated time. In practice that question is adjudicated from bespoke prose in an offering circular, by a paid calculation agent, over weeks. Disputes are expensive, and “did it fire?” remains the most common complaint about parametric cover.

The underlying observations are already public. USGS publishes ShakeMaps, the National Hurricane Center publishes advisories, NOAA publishes gauge readings. What is missing is not the data. It is a citable, independently checkable record that a sponsor and an investor can both point at without either having to trust the other.

What a determination asserts

Deliberately one narrow thing: that at a given instant, a named public source reported a given value, obtained a given way, and that compared against a stated threshold it stood in a stated relation — together with everything needed to check that claim.

It is not a settlement determination. It does not establish that recovery is owed; an indenture and whoever it appoints does that. Every record restates this limitation in its own text, so the qualification cannot be separated from the number by someone quoting it.

Two documents

A specification says what would count. It is agreed once, before anything happens, and is what a contract would reference. A determination says what was observed, and cites the specification it was evaluated against. Both are named by the hash of their own canonical content:

spec_id          = "cts1-" || hex(SHA-256(canonicalize(specification)))
determination_id = "cdt1-" || hex(SHA-256(canonicalize(evidence)))

An identifier therefore cannot be minted for a record that does not exist, and any alteration — by the issuer, by an operator, by a restore from a doctored backup — produces a different identifier than the one already published.

Why canonicalization is the hard part

JSON.stringify orders keys by insertion, so the same logical record serializes differently depending on how it was built, and hashes differently. A standard whose identifier depends on construction order is not a standard. The format uses the subset of RFC 8785 this requires, and refuses values with no deterministic form rather than coercing them — NaN would silently become null and make two different records hash alike.

Verification is not generation

The verifier is meant to be given away. It is a pure function over a record’s own JSON: no database, no network, no credentials. The hosted endpoint below reads nothing from any database and returns nothing the caller did not already submit, which is why it needs no account — and why the same openness does not extend to the hazard data itself.

A party who does not wish to trust this endpoint should not. The identical check runs offline, and the specification is written to be reimplemented without reference to the source. An arbiter you must ask permission to audit is not an arbiter.

Verify a record

Paste a determination record

Nothing is stored. The check runs against the record you paste.

The worked example is openly fictional — there is no storm by that name, and the record says so in its own caveats. Load it, verify it, then load the tampered copy: one number is changed, and the identifier stops naming the evidence.

Backdating, and the transparency log

Content addressing stops a record being altered without changing its identifier. It does not stop backdating. The capture time is asserted by whoever issued the record, and an issuer who wanted to could compute a determination after an outcome was known and stamp an earlier time on it. For a settlement dispute, “we said this before the answer was known” is the entire question.

So every closed UTC day’s determination identifiers are hashed into a Merkle root and published at /api/v1/determinations/log, with inclusion proofs at /api/v1/determinations/{id}/proof. Both are unauthenticated: a proof is the caller’s own identifier plus opaque sibling hashes, carrying no evidence.

This is not a trusted timestamp. The log is published by the same party it constrains. We could publish one root and later publish another, and anyone comparing only against us would not notice. What it gives is narrower: anyone who recorded a root at the time can afterwards prove a determination was or was not covered by it, and that is a check we cannot pass retroactively. It makes silent alteration into something we would have to be caught doing.

Which leads to the one thing worth asking of a reader: record a root when you see one. Proving time to a party who was not watching needs an external witness — a counterparty countersigning roots, or another organization mirroring them. Mirroring costs almost nothing: fetch the log periodically and keep what you fetched. If you would be willing to do that, it is the single most useful contribution available, and it does not require our cooperation, which is precisely the point.

Specification

The full document — canonical form, identifier construction, record structure, the required verification checks and their finding codes, the versioning policy, and test vectors — is docs/determination-standard-v1.md in the Calchis repository. The hosted verifier is POST /api/v1/determinations/verify, documented in the API reference.

Machine-readable schemas

JSON Schema draft 2020-12 for both documents: docs/determination-record.schema.json and docs/trigger-specification.schema.json. A test holds the schemas and the implementation together, because a published schema that disagrees with the code is worse than none — it tells an outside implementer to build something that will be rejected.

Governance

A standard controlled by one company is a vendor format. Two things would materially strengthen this and neither has happened yet: independent reproduction by a third party, and neutral stewardship — the natural home being the Oasis Loss Modeling Framework ecosystem, which already convenes this industry and whose exposure format Calchis already speaks.

Corrections and attacks on the scheme are welcome. If you can break it, that is the most useful contribution available right now.