Cognition Market Threat Model

Proposed market threat model

ADR-0017 analyzes the proposed Cognition Market. Its mitigations are design requirements, not a claim that the market is shipped.

Assets at Stake

These six assets are at risk in a sale. S2 and X2 each affect more than one asset and remain open:

A1, finding content. The plaintext itself, positive or null_result.
A2, buyer funds. The buyer's payment, escrowed against a purchase in flight.
A3, seller bond. The collateral a fabrication slash draws against.
A4, market truthfulness. The claim that a listed guarantee class matches its evidence.
A5, buyer memory or state. What a buyer, or a swarm's shared pool, now holds, the asset a leak or resale devalues after the fact.
A6, reputation capital. The track record C1 tries to counterfeit cheaply.

Trust Roles

The market has four trusted parties:

Role	Trusted party	What it is trusted for
`T1`	The mediating kernel	Sees revealed content
`T2`	The status-feed operator	Liveness of the retraction feed; checkable for safety via signed epoch roots
`T3`	The adjudication roster	Resolving disputes a mechanical check cannot settle
`T4`	The crypto-context signer	Signing the context a hidden-predicate claim is checked against

Chio builds a signature from the exact output preimage,what-you-sign-is-what-you-see. The kernel that kernel mediates a read_finding call necessarily observes the plaintext it signs a receipt for. Within one operator this is the existing trust model. In cross-organization sales, the mediating operator learns the finding revealed by that sale. A TEE-hosted kernel can reduce who else sees the plaintext, but the kernel still sees it. T1 is an explicit trust assumption.

Adversary Categories

The catalog uses five adversary categories:

rust

enum Adversary {
    Seller,
    Buyer,
    CollidingRing,
    MarketOperator,
    Observer,
}

A colluding ring can be a seller and buyer faking a sale, a seller and challenger suppressing a dispute, or a sybil cluster posing as independent counterparties. C1 covers the sybil case; O1 covers an operator acting with a seller.

Attack Catalog

These eleven attacks cover the categories above. The disposition records the current mitigation or residual:

ID	Attack	Disposition
`S1`	Fabricated evidence bundle	Mitigated: fail-closed re-verification catches a bundle that does not reproduce, and a confirmed fabrication slashes the seller's bond through `FabricatedFindingEvidence`.
`S2`	Honest-cost fabrication	Open for `metered_attested` findings. The design allocates this residual to the bond, guarantee-class discount, and reputation; it does not claim a formal proof.
`S3`	Bait-and-switch payload	Prevented structurally: the digest gate binds a reveal to the exact output a buyer priced, so a substituted payload fails the gate before settlement, not after.
`S4`	Selling a stale or retracted finding	Mitigated by a purchase-time non-inclusion check against the status feed. Residual is the freshness-window race: retraction publishes after the check clears but before settlement lands.
`S7 / O5`	Non-delivery or attest-and-withhold	Within one operator: structurally mitigated. Cross-org with a seller-aligned mediator: high residual. The escrow profile requires a neutral or mutually-trusted mediator for that topology, or the sale is disallowed.
`B1`	Take the reveal, refuse payment	Prevented structurally within one operator: funds reserve before the capability that unlocks the reveal is ever minted, so no ordering exists where a buyer holds content unfunded.
`B2`	Resale or republication after reveal	A buyer that receives plaintext can copy it. The proposed economic response is decay and versioning; cryptography does not prevent republication.
`B3`	Probing without purchase	Mitigated by a deliberately thin pre-purchase descriptor: enough to price the finding, not enough to make buying it pointless.
`C1`	Wash trading to inflate reputation	Mitigated by the metered cost floor plus Sybil-gated tiers, which raise the cost of the identities a ring needs. Residual medium.
`O1`	Front-running or leakage by the mediating operator	T1 in attack form: an operator positioned to mediate a reveal is positioned to act on it first. Not mitigated beyond what T1 already states.
`X2`	Evidence-metadata side channel	The generalized ZKCP lesson: public evidence about a sale can itself signal a failed-immediately result. Mitigated by bucketed cost disclosure and leakage-ledger accounting. A listing's existence is itself one bit that cannot be hidden, priced through an existence tier, not denied.

S2 remains open: metering proves that compute was spent, but not that it produced a relevant result. The bond, guarantee-class discount, and reputation price that residual. S7 / O5 is limited to cross-organization sales. Within one operator, a reveal is a governed call and cannot reconcile a charge with an unexecuted effect. A seller-aligned mediator can attest to a reveal and withhold it, so that topology requires a neutral or mutually trusted mediator; the sale is otherwise disallowed.

X2 generalizes a zero-knowledge-contingent-payment lesson: public evidence about a sale, a suspiciously small evidence_cost, a short receipt chain, can itself signal a failed-immediately result. Chio uses coarse cost bands and records the residual in a leakage ledger:

json

{
  "listing_id": "fnd_8f2c1a",
  "evidence_cost_bucket": "low",
  "existence_tier": "listed",
  "leakage_ledger_ref": "led_2a91"
}

A listing's existence leaks one bit that no bucketing scheme hides. The existence tier prices that leakage.

Residual risks

S2 (honest-cost fabrication), B2 (resale after reveal), and X2 (the evidence-metadata side channel) remain open. A bond, decay curve, and bucketed disclosure allocate their costs in the market.

Residual-Risk Register

These six residuals have production severity. The design prices them instead of eliminating them:

Risk	Severity
Honest-cost fabrication of `metered_attested` nulls	High
Post-reveal resale or leakage	High, by nature
Operator sees revealed content cross-org	Medium-high
Reputation purchasable at metering cost	Medium
No revenue clawback in v1	Medium
Paid non-delivery under a seller-aligned cross-org mediator	High, cross-org only

Invariant Inheritance

The Cognition Market uses the kernel's settlement invariants. Its mitigations do not change these inherited properties:

Invariant 9, slash proceeds. The S1 fabrication slash cannot pay the operator, mediator, or a party positioned to have caused the fabrication.
Invariant 10, no discretionary settlement. A dispute resolves through the mechanical check or the T3 roster; an operator's judgment cannot substitute for either.
P1, capability attenuation. A reveal capability cannot carry more authority than the mandate that spent to mint it.
P4, receipt integrity. A sale's receipt is exactly as tamper-evident as any other governed call's receipt.
P10, evidence-class truthfulness. A finding's guarantee class cannot be phrased stronger than the evidence lane backing it, the same discipline the claim registry applies to Chio's own proofs.

Next Steps

Status & Retraction · how a sold finding is revoked, and S4's freshness window
Reveal & Settlement · the governed call this threat model is scored against
Trust Boundaries & Limits · the BoundaryClass vocabulary T1 borrows from
Formal Assurance · the claim registry P10's discipline is scoped inside
The Cognition Market · the design this threat model is written against

PreviousStatus & Retraction NextBilateral Federation