Parametric Insurance

The Parametric Coverage Tier

Indemnity coverage in chio-market binds a policy against an assessed loss and settles a claim through a single adjudicator. The parametric tier replaces that discretionary assessment with a deterministic rule: a chio.parametric.policy.v1 (ParametricPolicy) declares one typed TriggerPredicate over receipt-observable events, a policy-anchored evidence-corpus window cadence, and a PayoutSchedule. Any holder of the declared corpus recomputes the same verdict.

A ParametricPolicy carries a subject_key, a coverage MonetaryAmount, an effective window, the window fields window_anchor, window_seconds, and max_checkpoint_lag_seconds, the exact canonical SignedLiabilityBoundCoverage body and envelope digests, payer and beneficiary identities, a typed payout rail with a destination-account digest, a funding-facility id, a pre-action authority digest, and one EvaluatorAuthorityRef { authority_id, key_id, key_epoch }. The bound liability coverage is the sole aggregate economic allocation; the policy cannot declare a second, independent coverage limit.

The v1 beneficiary is not caller-selected. It must equal the insured subject resolved from the canonical bound-coverage lineage, specifically the bound risk-package subject_key; verification derives that identity and compares it rather than trusting the policy copy. A payout mode is declared on the policy:

• Automatic: removes discretionary adjudication after a deterministic trigger, but does not replace dispatch authority.
• Contestable { window_seconds, panel_election_ref }: prohibits dispatch until the durable contest window closes without a contest, or a valid panel decision authorizes it. The claim record stores contest_opened_at from the trusted runtime clock and computes contest_deadline by checked addition, so an evaluator-supplied timestamp cannot shorten the window.

Receipt-Observable Trigger Signals

TriggerPredicate is a tagged enum with four v1 classes. Each is a deterministic function of the declared corpus and policy-declared parameters, and each emits a tagged TriggerMagnitude: guard-denial rate is BasisPoints { value } and the three count predicates are Count { value }.

Load-time validation rejects a zero threshold on every class (min_events = 0, min_critical = 0, min_failures = 0, min_breaches = 0) and rejects threshold_bps above 10_000. GuardDenialRate evaluation widens the numerator to u128 and divides before a checked conversion to u64, never relying on wrapping or saturating arithmetic. The SlaBreachCount signal is emitted by Outcome-Based Pricing (WS3) as the canonical chio.outcome.sla-breach.v1 record, and the predicate stays disabled until that source lands.

PayoutSchedule is Fixed { amount } or Linear { base, per_unit_minor, magnitude_unit }, where load requires the linear unit to equal the predicate's unit. The payout is checked_add(base, checked_mul(per_unit_minor, magnitude.value)), with no floats; either checked operation returning overflow is a typed error that produces no claim or payout intent. The block below is illustrative and partial, not a signed wire schema: the enum variant tags and their inner fields track the record bodies, while the outer key names are inferred serialization. Here a GuardDenialRate policy pays a Linear schedule in basis points:

{
  "schema": "chio.parametric.policy.v1",
  "subject_key": "80f2b577472e6662f46ac2e029f4b2d1300f889bc767b3de1f7b63a4c562fd8f",
  "coverage": { "units": 5000000, "currency": "USD" },
  "window_anchor": 1720569600,
  "window_seconds": 86400,
  "max_checkpoint_lag_seconds": 3600,
  "trigger_predicate": {
    "GuardDenialRate": { "min_events": 500, "threshold_bps": 2000 }
  },
  "payout_schedule": {
    "Linear": { "base": 100000, "per_unit_minor": 50, "magnitude_unit": "BasisPoints" }
  },
  "payout_mode": {
    "Contestable": { "window_seconds": 172800, "panel_election_ref": "pel-9f2c..." }
  },
  "evaluator_authority": { "authority_id": "auth-ws7-eval", "key_id": "k-3", "key_epoch": 7 }
}

The Auto-Assembled Claim

Before computing any predicate the evaluator verifies a corpus manifest with one SourceRange per collection the predicate reads: receipt store, reconciliation sidecars, drift reports, and, once enabled, SLA records. Each range names its checkpoint, inclusive first and last sequence, subject and time window, and an authenticated index-root or range proof, and it proves both query boundaries. The verdict is one of Fired { magnitude }, NotFired, or Incomplete { reason }. An incomplete corpus yields Incomplete, reports no magnitude, and cannot authorize payout or deny coverage; NotFired is reserved for a complete verified corpus whose predicate evaluates false.

A signed chio.parametric.trigger-evaluation.v1 (TriggerEvaluation) carries the policy digest, the typed corpus manifest, the exact policy-derived evaluation_window, the verdict, and the evaluator signature via SignedExportEnvelope. On a Fired verdict, the evaluator assembles a ClaimEvidence whose supporting_receipts are exactly the corpus fingerprints and emits a chio.parametric.auto-claim.v1 (ParametricAutoClaim) with no adjudicator. It never calls the stateless BoundPolicy::file_claim as its replay or aggregate-coverage boundary.

Claim identity is semantic, not envelope-bound. ParametricAutoClaim carries a TriggerInstanceKeyV1 (the parametric-policy body digest, canonical bound-coverage body digest, subject key, trigger-predicate body digest, canonical window bounds, and canonical evidence-range digest) and derives both trigger_instance_id and claim_id from it:

trigger_instance_id = SHA256(
  "chio.parametric.trigger-instance.v1\0" || RFC8785(TriggerInstanceKeyV1)
)
claim_id = SHA256(
  "chio.parametric.claim.id.v1\0" || RFC8785({ trigger_instance_id })
)

Because the evidence-range digest excludes checkpoint ids, evolving whole-index roots, signatures, and key epochs, a later append-only checkpoint or key rotation that validly proves the same source, index, subject, window, sequence, count, and selected-root tuple produces the same claim_id. Duplicate or concurrent evaluations for one semantic trigger create one claim and one payout intent; changing the policy, subject, canonical window, predicate, or evidence range changes the key.

The n-of-m FROST Adjudication Panel

Every adjudicator in the standard claim chain is a single signer: LiabilityClaimAdjudicationArtifact.adjudicator is one string. The panel is an opt-in n-of-m replacement that supersedes that single signer on contested claims, and it applies to disputes generally, both parametric contests and non-parametric claim disputes, never to trigger evaluation itself.

Opt-in is carried by a signed chio.adjudication.panel-election.v1 rider that binds the exact canonical bound-coverage body and envelope digests, the eligible claim class, the FROST authority scope, the group key id and epoch, the chio.frost.adjudication-panel-decision.v1 domain, a validity window, and the electing coverage authority. Existing non-parametric coverage opts in through the same rider; without it, its single-adjudicator behavior is unchanged.

A contest opens as a chio.parametric.contest.v1 (ParametricContest) that binds the claim_id, policy and evaluation body digests, a bounded reason code, and the authorized contestant signature; the trusted receipt time is recorded by the claim store, not supplied by the contestant. The ruling is a canonical chio.adjudication.panel-decision.v1 action body carried with one FrostAuthorizationV1. chio_federation::frost::verify_for_execution resolves the trusted active roster, group-key epoch, and completed authorization slot and checks the exact action-body digest, authority scope, resource id and version, lifecycle fence, action class, and domain. The claim store consumes the private VerifiedFrostAuthorization in the same batch that advances the Contested claim to PanelReleased or PanelDenied.

Award validation matches the live single-adjudicator semantics: ClaimUpheld requires a positive same-currency award no greater than the filed schedule-computed amount, PartialSettlement requires a positive same-currency award strictly less than it, and ProviderUpheld stores no payable amount. Panel authority rides only the strict chio.market.claim-payout-instruction.v2 path, whose tagged reference is either SingleV1 { adjudication_envelope_digest } or FrostPanelV1 { panel_election_digest, panel_decision_body_digest, frost_authorization_digest }. A v1 instruction cannot carry panel authority, and a lossy v2-to-v1 conversion rejects the FROST variant. The ladder class adjudication.panel_decision is receipt_backed, destructive: true, co_sign: n_of_m, consistency_model: quorum-required, with co_sign_quorum { n: 2, m: 3, scope: treaty }, mirroring settle.commitment. It cannot supersede the single signer or execute while FROST Phase 3 is absent, and the single adjudicator remains the default.

Recomputable Eligibility, One Allocation

Eligibility is recomputable, but dispatch is not free. One shared LiabilityCoverageLedger row per canonical SignedLiabilityBoundCoverage body digest stores the currency, aggregate coverage limit, reserved units, reconciled-paid units, and version. Legacy filed claims and parametric claims reserve through that same row; a second ledger or a policy-digest-only allocation is forbidden. Payout-intent creation checked-adds reserved_units + reconciled_paid_units + payout_amount and rejects above the policy limit, so aggregate legacy plus parametric reserved and reconciled payouts can never exceed the one bound-coverage allocation.

A chio.parametric.payout-intent.v1 (ParametricPayoutIntent) binds the auto-claim, a SignedCapitalExecutionInstruction (action TransferFunds, source FacilityCommitment, unreconciled), and an exact PayoutBindingV1. Every field of the binding (claim id, expected claim version and lifecycle fence, coverage reservation id and version, payer, beneficiary equal to the v1 canonical insured subject, facility id, rail profile, destination-account digest, capital-instruction body digest, and exact MonetaryAmount) is derived from verified state; before signing and again before dispatch the capital instruction must equal the binding byte for byte. The intent is issuable only from claim state Ready, UncontestedReleased, or PanelReleased, and only after the payout action carries fresh capability, policy, guard, and ladder authority for parametric.trigger_payout (receipt_backed, destructive: true, co_sign: bilateral_required).

A policy signature or a Fired trigger evaluation by itself is never fund-movement authority. No retry, alternate evaluation, or second signature can exceed the aggregate bound coverage or create a second intent for one trigger instance.

See Also

• Liability & Insurance Market : the indemnity coverage and the SignedLiabilityBoundCoverage allocation the parametric tier shares.
• Claims Lifecycle : the standard single-adjudicator claim chain the FROST panel opts into superseding.
• Outcome-Based Pricing : the WS3 source of the chio.outcome.sla-breach.v1 signal the SlaBreachCount predicate reads.
• Underwriting Risk Taxonomy : the risk inputs that price the premium behind the bound coverage.