# 0007 — A witness is paid for keeping the watch, never for what it saw

**Status:** Accepted; formula revised 2026-10-07 (base, and the fund withdrawn)
**Relates to:** [0003](0003-witness-policy-is-the-readers.md), [0004](0004-one-author-plays-every-role.md),
witness-outreach.md, [witness-quickstart.md](../witness-quickstart.md)
**Narrows:** the no-exchange rule in witness-outreach.md, which forbade "anything in exchange —
no payment, no equity, no advisory title, no reciprocal favour." That rule was protecting against
a real danger and was drawn wider than the danger.

## Decision

Two questions, settled separately, because conflating them is what produced the old rule.

**Who may witness.** Nobody with a role in the energy service process or its reconciliation.
Not a publisher. Not a counterparty to any agreement whose performance the log records. Not an
offtaker, insurer, lender, or trading desk with exposure to such an agreement. Not a publisher's
peer under a reciprocal arrangement, which is a publisher by another name. A witness witnesses
the record and issues the receipt, and does nothing else in this market.

**Whether a witness may be paid.** Yes, on three bases and no others:

1. **Reliability** — the fraction of the period the witness was reachable and answering.
2. **Responsiveness** — how quickly it answered when asked.
3. **Accuracy** — the fraction of its decisions that were correct, where a correct refusal
   scores identically to a correct countersignature.

Never on the **number** of checkpoints handled. Never on the **outcome** of any decision — a
witness earns exactly the same whether it signed everything, refused everything, or halted
mid-dispute and said so. The moment income varies with the decision, the decision is for sale.

Four commitments make that blindness real rather than asserted:

- **The formula is a published, versioned ruleset.** The same discipline `rulesets/v1.py`
  imposes on verification: public, immutable once issued, changed only by a new version, never
  retroactively. A witness can read exactly how it is paid and confirm that no term references
  what it signed.
- **Roster membership is formulaic.** A witness that passes `scripts/check_witness.py` is on the
  roster. Removal is only for a failed accuracy probe or two consecutive missed quarterly
  gates, measured against the published formula, and every removal is publicly recorded with
  its measured cause. Availability is graded and paid on a curve; accuracy is binary and is
  the roster question — a witness that is absent fails closed, a witness that is wrong fails
  open, and this system is built to fail closed. A payer that could drop refusers would be
  rewarding assent through the back door, and the formula's blindness would be theatre.
- **Accuracy is symmetric.** Stated above and repeated because it is the term most easily
  gotten wrong. A formula under which refusals score lower than countersignatures has built the
  rubber stamp the harness exists to catch.
- **Compensation is money, not an instrument.** Fiat, invoiced. Not a token, not equity, not
  anything that could acquire a market price. Decision 0002 stands untouched, and the
  never-a-stake test in witness-outreach.md still governs every *object* a witness receives.

### How accuracy is measured: probes on decoy logs

Reliability and responsiveness are derivable from the log. Accuracy needs a ground truth, and
the ground truth is manufactured.

**Probes run on decoy logs, and never on a real one.** A real log is append-only; staging a
rollback on it would be a rollback. Serving one witness a different history from everyone else
*is* equivocation — the attack itself, performed by the operator. There is no clean way to probe
a witness through a log that carries real records, so probing happens through logs that exist
to be probed.

**A decoy is indistinguishable by construction.** It is a log like any other, fed by a
synthetic publisher committing at production cadence, registered through the same path as a
real log, and followed by a witness the same way — one more entry in the set of logs it holds.
A witness sees only digests, because a commitment carries a digest and never a measured value;
there is no content to tell a decoy by. It behaves honestly for a warm-up at least as long as
would let a witness without durable state forget its earliest checkpoint, which folds the
harness's restart check into every probe. Then, once, at an unannounced moment, it does one of
the things a witness exists to refuse.

**The catalogue is published; the schedule is not.** The probe events are exactly the refusals
`scripts/check_witness.py` already tests — a rollback, an equivocation, a rewritten history —
and, on the assent side, honest growth across a valid consistency proof. A witness knows
precisely what it will be tested on, and never when or on which log. Nothing about a probe is
ambiguous by specification, which is what stops the payer constructing one a witness cannot
pass: a scored event is either in the published catalogue or it is not, and the witness can
contest any event against it.

**Verification is cheaper than evasion, and that is why this works.** A witness that wanted to
rubber-stamp real logs while passing probes would need to tell the two apart. A witness that
simply verifies every consistency proof it fetches needs no such thing. Verification is a hash
computation; distinguishing is guesswork against a penalty. The rational strategy under
observation is the honest one, and the observer problem — that a node under test behaves
differently — is answered by making the test cheaper to pass honestly than to game.

**Two rates, both required.** *Refusal accuracy*: correct refusals over probe faults presented.
*Assent accuracy*: correct countersignatures over honest growth presented. A witness that refuses
everything scores 1.0 and 0.0; a rubber stamp scores 0.0 and 1.0. Neither is paid for accuracy.
The combined score is symmetric, as this decision requires, and both components are reported so
a witness can see which way it is failing. Responsiveness is the cosign latency on those same
events, and reliability the fraction of fetches that were answered.

**Faults are rare.** The fault rate on a decoy matches the plausible rate of attack on a real
log — near zero — so that misbehaviour is not itself a signature of a decoy. One fault per warm-up
period is the order of magnitude, not one per day.

**Disclosure retires the decoy.** When a scoring period closes, the payer publishes its probe
ledger: each decoy, each event, the expected response, and each witness's observed one. A
witness audits that against its own record — every refusal it made was a signed response with
a reason, and every cosignature is on the log — so the score is checkable rather than asserted.
A disclosed decoy is burned and withdrawn. The pipeline keeps decoys at staggered ages so one is
always warmed up, and a decoy's whole life is one warm-up, one fault, one disclosure.

**A paid witness follows the whole published set.** Decoys included. A witness that follows only
the logs its readers care about cannot be measured and is not on the roster. The cost is one
small process per log and is the price of being scorable.

## What prompted this

The observation that unpaid volunteers do not persist. The outreach templates target academic
groups and student chapters — the population most prone to churn, since students graduate and
research priorities move — and offer them nothing but recognition. That is not a plan for a
witness set that lasts a decade, and the receipts this business sells are only as durable as
the witnesses who countersigned them.

## The reasoning

**Why the old rule was drawn too wide.** It said a witness must have "no stake in the result,"
and treated any value flowing to a witness as such a stake. But a stake in the *result* is an
interest in which way a decision goes. Payment that is provably invariant to the decision is not
that. The rule was defending against issuer-pays — Arthur Andersen, the rating agencies in
2007 — where the payer rewards favourable findings and withdraws from unfavourable ones. That
danger is real and is closed here at the formula rather than at the source.

**Why counterparties are refused, even though they have every reason to catch cheating.** A
counterparty's vigilance is *selective*. It scrutinises records that bear against it and waves
through records that favour it, and both behaviours produce the same observable — a signature.
The log records what was signed, never how hard anyone looked, so a witness whose diligence
correlates with its own exposure fails silently. A disinterested witness is checkable by its
refusals. An interested one is not checkable at all. And the answer to "who checked this?"
would become "the people arguing about it," which is the condition decision 0004 exists to end.

**Why publishers are refused, including reciprocally.** Same failure with an added one. A
publisher witnessing another publisher's log is disinterested in that log's particular disputes
but interested in the substrate's reputation, which is an interest in receipts being accepted,
which is an interest in assent. Reciprocal arrangements add the cartel: a closed set of
publishers countersigning each other is a quorum that no outside reader has reason to believe.

**Why blindness at the formula makes the payer's identity stop mattering.** Issuer-pays is
dangerous for one reason — the payer can reward assent. If the formula provably cannot see
assent, that lever does not exist, and who holds the chequebook becomes an accounting question
rather than a trust question. The pooled funds and endowments considered along the way to this
decision were all attempts to launder the *source*; they were solving the wrong end.

**Why accuracy must be measured symmetrically.** Because a witness that is paid only when its
signatures are later shown correct, and not when its refusals are, learns that the safe money is
in signing. The harness already tests refusals — a rollback, an equivocation, a rewritten
history — as the substance of what a witness is. The payment formula inherits that view or it
corrupts it.

**Why membership must be formulaic.** A published formula and a discretionary roster is a
formula with a discretionary term. The roster *is* part of the formula and is published with it.

## What this does not settle

**Whether a decoy can be fingerprinted by its traffic.** A witness never sees a log's content,
but it does see who asks it for cosignatures, and a log no reader ever asks about is a tell. The
mitigation is that the probe infrastructure acts as a reader and requests cosignatures on decoys
at a realistic rate. Whether that is enough, and what other side channels exist — anchoring
cadence, endpoint hosting — is to be learned by running decoys against the witnesses that
exist, not settled here. The equilibrium argument above says fingerprinting has to be cheaper
than verifying before it is worth a witness's while, and nothing found so far is.

**The fault rate and the decoy count.** Both are tuned against measured witness behaviour. Too
few probes and the score is noise; too many and the decoys announce themselves.

**Post-hoc detection as a second signal.** A countersignature on a real log that is later shown
to have been a rollback — because other witnesses refused it, or the log's own history
contradicts it — is an accuracy failure on a real event and should count. It is a sparse signal,
since real attacks should be rare, and it is not a substitute for probes. Whether and how it
enters the score is open.

### The formula and the fund — settled 2026-09-04, revised 2026-10-07

> The section below is kept as written on 2026-09-04. The revision that follows it changes two
> things — the base, and who pays — and nothing else: the formula's shape, the gate, the tenure
> steps, the symmetric accuracy and the roster rules all stand. A formula changes only by a new
> version, so `scripts/witness_pay.py` carries version 2026-10-07 and the 2026-09-04 version is
> retired, not amended.

### The formula and the fund — settled 2026-09-04

**The formula.** Each quarter, each roster member is paid

    BASE × (1 + 0.25 × min(years on roster, 4))    if the gate is met, else 0

    gate met  =  availability ≥ 99.5%  and  probe score = 100%

Three inputs, each read from a record that already exists or that this decision already
specifies: availability from the fetch log, probe score from the probe ledger (a correct
refusal and a correct countersignature score identically), years from the roster log. No
term references what was signed or how many times. Two consecutive missed gates and the
member is off the roster; leave and return, and years reset to zero. That reset is the
retention mechanism — it is what vesting does, without giving anyone a reason to want the log
believed. The multiplier caps at 2× so that no member's income ever depends on the
arrangement continuing more than modestly.

**BASE is $2,400 a year — $200 a month — and is a measured figure, not a chosen one.** A
witness fully automated costs about $1,500 to $2,000 a year to run: a small VM ($120–240),
a managed signing key ($50–100), and ten hours of an engineer's attention. At the plan's 206
customers a witness spends sixteen milliseconds of CPU an hour, so the cost does not scale
with customers. BASE covers cost with a little over and constitutes nobody's income. It is
published, revisited annually against what the first members actually spend, and versioned.
An earlier draft carried $24,000; it was asserted rather than derived, and it was income.

**The fund.** The log operator capitalises a Witness Fund LLC. The LLC subscribes to an
affiliated investment partnership as a limited partner. After lockup it redeems LP interest quarterly into its
operating account, and the operating account pays every roster member the formula amount. If
a quarter's account cannot cover the formula total, every member scales pro rata — never
selectively — and the next formula version records the shortfall.

The source of funds stops being a trust question because the formula is blind: no term can
see assent, so no payer can reward it. One constraint keeps that true: **The partnership holds
no position in the log operator, in Contubernium, or in any customer or counterparty.** Otherwise the fund
that pays witnesses grows when receipts are accepted, which is a stake by a longer route.

**Size.** At the 0008 roster of four witnesses, an average 1.5× tenure on a $2,400 base is
about $14,400 a year, and $19,200 once all four are at the 2× cap. The LLC needs roughly
$180,000 to $240,000 of capital at 8%, or less if redemptions draw principal. The cost is
fixed by the number of witnesses, not by the customer base.

**Computation.** `scripts/witness_pay.py` reads the three inputs, applies the versioned
formula in integer cents, and emits the quarter's schedule. Any member reruns it and gets the
same figures; a dispute over a payment is a dispute over an input, and every input is public.

**Whether recognition changes.** It does not. The witness record, the annual attestation, and
the tessera remain, and remain governed by the never-a-stake test. Recognition and
compensation are different things and this decision adds the second without touching the first.

### Revised 2026-10-07 — a retainer, paid by the company

**BASE is $15,000 a year — $1,250 a month — and is a retainer, not a cost recovery.** The
$2,400 figure recovered the machine: a VM, a managed key, ten hours. It bought nobody's
attention. Any institution that can say yes — a university group, a non-profit, a Certificate
Transparency operator — spends more than that on the legal and security review the yes takes,
and the 99.5% availability gate is an on-call obligation nobody keeps for $200 a month. The
comparable is a small managed-service retainer. $15,000 is enough to be an institutional line
item and still too small to be anyone's livelihood, which is the property the 2× cap was
protecting; pay institutions rather than individuals and the "nobody's income" test still
holds. The tenure steps carry it to $30,000. At the 0008 roster of four the line is $60,000 in
the first year and $120,000 once all four are at the cap, which is under 1% of the plan's
plateau cost base and moves the concluded value by about $0.2M.

**What a year of witnessing costs in human hours — an estimate, to be measured against the
first members.** Nearly everything a witness does is compute: the daemon fetches, verifies a
consistency proof, which is a hash computation, and signs or refuses, unattended, as
Certificate Transparency witnesses have for years. The hours are at the edges.

| Activity | Hours a year | Basis |
| --- | --- | --- |
| Enrolment, once: reading the quickstart and this decision, provisioning, the key ceremony, passing `check_witness.py` | 8–12, once | Not recurring; excluded from the figure below |
| The institution's own review before it can say yes, once | 4–16, once | Legal, security, procurement; varies by institution |
| Incidents: an alert, a restart, a disk or a certificate | 6–10 | Four to six a year at one to two hours, inside a 99.5% gate that allows 44 hours of downtime |
| Patching the host and updating the witness software | 6 | Half an hour a month |
| Auditing each quarter's disclosed probe ledger against the witness's own signed record | 2 | Scripted; half an hour a quarter |
| Key rotation, the annual attestation, invoicing | 4 | |
| New logs joining the published set, under 0008's one log per customer | 2 | Following is configured from the published roster, not by hand |
| **Recurring total** | **about 20–25** | Roughly two hours a month |

Twenty-five hours at a loaded engineering rate of $100–150 is $2,500–3,750, plus under $500
of compute and key management; the direct cost of a year is about $3,000–4,000, which is why
the 2026-09-04 figure of $2,400 was short even on its own terms. The rest of the base pays for
what the hours do not show: that the two hours a month cannot be scheduled, since an alert
inside the availability gate must be answered when it arrives, and that an institution is
lending its name to a record relied on in disputes. That is what a retainer is for.

**The log operator pays, directly, from operations.** The Witness Fund LLC, its LP interest
in the affiliated partnership, the lockup, the quarterly redemption and the pro-rata shortfall rule
are withdrawn, and so is the constraint that the partnership hold no position in the log operator or any customer.
This decision's own reasoning made them unnecessary: the pooled funds and endowments
considered on the way here were attempts to launder the source of the money, that was the
wrong end to solve, and a blind formula makes the payer's identity an accounting question
rather than a trust question. The vehicle added an entity, a related-party question in every
offering document and a standing restriction on the family's investment partnership, and it
added no protection. No reserve replaces it. A quarter the company cannot pay in full is a
breach, and the roster will know it, which is the right answer for a payment whose entire
value is that it is predictable.

**What does not change.** The three inputs and the sources they are read from. The gate. The
symmetric accuracy. The formulaic roster. Money, not an instrument. The reversal conditions
below, and in particular the one that matters most: if assent rate is ever found to rise with
payment, the formula is leaking outcome and compensation stops until the leak is found.

### The probe pipeline — built 2026-10-03

`service/decoyd.py` is the decoy: a log whose public listener is `logd.application` itself,
a prober on a second port that ticks it, fires the scheduled fault once, and keeps the
ledger, and a schedule drawn by HMAC from a secret file that is refused outside a
demonstration. `scripts/probe_score.py` pools disclosed ledgers into the two accuracies and
their minimum, and fills `probe_score` into the roster `scripts/witness_pay.py` reads.
[witness-probes.md](../witness-probes.md) is the guide. Of the four open questions above,
none is closed by building it: it has run against no witness anybody else operates, and
the fault rate, the decoy count, and the traffic side channel are to be measured there.

**Reversal conditions.** If measured witness behaviour shows assent rate rising with payment,
the formula is leaking outcome and compensation is suspended until the leak is found. If roster
churn is found to correlate with refusals, the same. If a witness set of adequate size and
independence turns out to be sustainable on recognition alone, compensation was unnecessary and
should be withdrawn, because a payment that buys nothing is a cost with a liability attached.