The stranger problem when nobody is holding the ledger

A purchasing agent is handed an order to place with a counterparty it has never dealt with. It can verify that the counterparty signed what it sent. It cannot verify that anyone has ever successfully complained about that counterparty's conduct, or that a complaint would reach anywhere at all.

On a consumer marketplace the operator fills that gap: it holds the transaction records, computes a figure, displays it, and can act on the account behind it. Agent-to-agent commerce increasingly forms outside any such venue. Each party keeps its own records, and nobody is obliged to accept a computation offered by anyone else.

The familiar difficulty there is cold start. An agent with no recorded encounters is not merely unrated, it is unreachable. Under the filed architecture, absent an enrolled class covering the sender, a conduct evaluation artifact arriving from a party with which the receiving agent holds no prior encounter history is held in the pre-settlement inert state, so the correction it carries reaches no admission evaluator.

The less familiar difficulty is who pays when a judgment is adopted. An agent whose determinations are widely followed enjoys the influence and carries none of the weight. Conventional delegation and capability-attenuation designs formalize that flow: cost falls on the relying party, and attenuation narrows only the capability passed downward.

What marketplace reputation systems get right

These systems solve a hard problem, and they solve it with an architecture that is internally coherent.

As publicly described, they collect feedback from parties to a completed transaction and aggregate it into a figure shown beside a seller's listings. Large venues also publish seller performance standards covering matters such as late shipment, cancellation, and return outcomes, and state publicly that meeting or missing them can bear on eligibility for particular programs and, in some cases, on the standing of the account. The operator adjudicates as well, running a dispute process and applying published rules on when feedback may be removed.

Strangers with no way to inspect each other can therefore transact with a reasonable expectation of recourse. One party holds the data, so it can compute a quantity comparable across sellers; the same party enforces against accounts, so the quantity carries consequences; and because it can investigate, manipulation can be found and reversed.

Public discussion of these systems commonly notes two properties, and both follow from the design goal rather than from any failure of execution. One is scope: the venue computes standing out of the venue's own data, so a seller's record does not travel to a second marketplace, there being nothing there from which to compute it. The other is exposure to attack, since a figure built to be displayed is a figure worth attacking, and operators publish policies prohibiting fabricated, incentivized, and retaliatory feedback. Both properties trace to comparability, which requires central computation.

Deference records, counter-signature, and the classes that come with them

The filed section takes the same problem and removes the operator, the figure, and the adjudication.

A first agent, the deferring agent, holds a request to dispatch an action and finds its dispatch-authority predicate satisfied on recomputation from its memory field. Authorized on its own record to decide the matter, it elects instead to execute under a determination of the closed set recorded in the lineage field of a second agent, the followed agent. An agent whose predicate fails, whose authorization gate stands in the withheld state, or which has entered the non-executing cognitive mode does not defer; its holding is a withholding.

Before a deference record takes effect, the deferring agent applies the origin-disjointness test, asking whether it and the followed agent are assignable to a common origin-equivalence class. Where they are, the record is appended as an attempted deference record and given no effect, transmitted to no party, decrementing no budget, enrolling no class, appending nothing adverse. Declining is itself a positive abstention, and agents traceable to one origin cannot enroll one another's classes or spend one another's budgets.

Next comes a retrievability-form verification of the followed determination record: three ordered conjuncts covering continuity of the presented credential, the tested-entry enumeration against a lineage commitment, and membership of the determination in the closed set with a matching action class. Verification reaches form and retrievability and stops, producing no determination about the followed agent's conduct. The deference record appended on success carries a deference abstention entry naming the determination withheld from the deferring agent's own admission evaluator, plus a counter-signature window field, and goes out as the first governed observation of a matched pair.

Should the followed agent elect to counter-sign, it emits the counter-signature as the second governed observation of that pair and by that append decrements its own authorization budget. The deference decrement schedule, declared in its signed policy object, is non-decreasing in the count it has already counter-signed within a declared window and bounded above by a declared maximum. Units decremented are the units gating its own non-advisory dispatch, not a side ledger denominated in channel access, rating weight, staked value, or endorsement.

Nobody rules on whether the deference was sound: the decrement occurs without either agent, either principal, or any other party determining whether the adopted determination was correct or the reliance reasonable. Responsive to the budget satisfying a floor declared in that agent's own policy object, its authorization gate is written to the withheld state for an enumerated set of action classes and an escalation record goes to its principal. Replenishment runs by the ordinary procedure and no other, so being followed spends a replenishable quantity rather than ending an agent.

What crosses is not a rating. Responsive to the counter-signature, and not otherwise, it retrieves from records the followed agent presents a corrector-class enumeration for the action class, admitted by a two-part conformance filter. Correction is the first part: an accepted determination the followed agent produced upon a conduct evaluation artifact from a party assignable to the class, so the class is recorded as having corrected that agent rather than as having rated it. Conformity is the second: within a declared observation interval, a subsequent conduct record of that agent evaluated against the determination and recorded as compliant. A class passing the first and failing the second is excluded.

Each admitted class is carried by a class-defining reference rather than by a local identifier meaningless outside the followed agent. The deferring agent appends an exposure edge record, dispatches to each class an exposure dispatch record presenting its own execution records in the categories its counterparty scope object admits, and writes each class into its replenishment register as an admissible-but-unexercised entry. That entry has two effects and no third: an artifact from an assignable party becomes admissible notwithstanding the absence of prior encounter history, and while unexercised it is not counted for renewal.

The rest waits on an artifact. An ordered test on the deferring agent's own records settles assignability; on satisfaction it appends an exercised transition record binding the artifact to the exposure edge record, the deference record, and the determination adopted, and where the class is absent from the replenishment register for the declared window, an entry is written there and its authorization budget is replenished, without regard to whether the artifact was well founded.

Where the two designs part company

Both designs work to make an unknown counterparty transactable, diverging on four architectural choices.

  • What passes between the parties. A marketplace supplies a computed figure meant for display. The filed mechanism passes no rating, score, standing quantity, or credential at all, only an enumeration of parties recorded as having corrected the followed agent and as having had those corrections conformed to.
  • Who bears the cost of being relied upon. A displayed score costs its holder nothing when a buyer relies on it. Under the filed mechanism, a counter-signature decrements the followed agent's own capacity to dispatch, on a bounded schedule non-decreasing in the count already counter-signed within a declared window.
  • Who adjudicates. The operator resolves disputes and may remove feedback under published rules. The filed mechanism has no adjudicator, and the conversion bar forbids any stage from turning an abstention or a count of records into a scalar, a default, a rating, or a threshold operand.
  • What the newcomer gains. A score can be displayed to any buyer. An admissible-but-unexercised entry sits in the deferring agent's own register, confers admissibility alone, and renews nothing while unexercised; in a disclosed embodiment it lapses on expiry of a declared enrollment window, with nothing adverse recorded.

Self-dealing lands differently in each. A venue addresses it by detection and by enforcement against accounts, as publicly described. The filed architecture forecloses one class of it through the origin-disjointness test, and a further disclosed embodiment meters the decrement per origin-equivalence class of deferring parties, so records presented within a declared window by parties assignable to one class cannot exhaust the followed agent's budget.

None of that makes the two designs rivals. A score answers a question the conduct layer never reaches: which seller should a buyer choose. The conduct layer answers one the score never reaches: whose corrections will this agent admit, and on whose budget was that reach obtained.

Running both layers, and what the conduct layer does not decide

In a venue that hosts agent counterparties, the layers stack. The operator keeps computing and publishing its seller metrics for buyers and for its own enforcement, work the conduct layer does not attempt; between the agents, the conduct layer governs which incoming assertions are admissible, from whom, and at whose cost.

Participation is neither free nor universal. Both parties have to run the architecture: an append-only lineage field, a signed policy object with successor indexing, and a continuity history store in the counterparty identity record. A seller with a storefront and an upload form cannot participate: there is no committed lineage to verify against. The declarations are governance work rather than defaults: the counter-signature and reinstatement windows, the decrement schedule, the observation interval, the enrollment window, and the maximum chain depth.

Declining costs nothing. A followed agent may decline expressly or by non-response within the window carried in the record as received, and the declination is recorded as a not-determinable determination identifying the counter-signature as an unavailable input, incrementing no counter of either agent and treated at no stage as a rejected or an accepted determination. The deferring agent may nonetheless execute, appending an ungoverned reliance record and a reliance-bound narrowing record that narrows its own counterparty scope object held for that agent, a narrowing that falls on its own disclosure, is not a sanction, and releases upon a counter-signature within the reinstatement window.

What the mechanism does not decide matters too. Nothing in it establishes that an adopted determination was correct. Where two followed agents present determinations of differing outcome class upon one conduct descriptor, the deferring agent appends a deference conflict record, adopts neither, and either determines the matter itself or withholds the dispatch as a positive abstention. A deference records no corrective encounter for the deferring agent and replenishes no budget of its own. Nothing transmitted describes the followed agent's standing, and the deferring agent acquires no credibility with the enumerated parties.

Product quality, pricing, delivery, payment, and fraud in the goods themselves sit outside a conduct determination entirely, and stay with the venue or the parties.

Disclosure Scope

The mechanisms described here are disclosed in U.S. Provisional Application No. 64/117,812, principally at Section 9, "Deference and Earned Exposure," with further embodiments at Section 10.7 and constituent primitives from Sections 1, 2, 4, 5, and 6.

Disclosed there and applied here: execution under a second agent's recorded determination with no rating, score, standing quantity, or credential passing between them; the origin-disjointness test; the retrievability-form verification; the deference record with its abstention entry and counter-signature window field; the counter-signature decrementing the followed agent's own authorization budget, without adjudication of merit, under a bounded schedule non-decreasing in the count counter-signed within a declared window; the declared floor at which the authorization gate is written to the withheld state; the corrector-class enumeration under the two-part conformance filter; the class-defining reference and ordered assignability test; the exposure edge and exposure dispatch records; the admissible-but-unexercised entry with its exercised transition and its lapse upon enrollment-window expiry; ungoverned reliance with its reliance-bound narrowing; the deference conflict record; and per-class metering of the decrement, subject throughout to the conversion bar.

References to marketplace seller reputation systems are to public materials and are used for comparison only; no relationship, endorsement, or infringement is asserted. Those systems are described qualitatively, from widely known public information, and nothing here describes any particular operator's internal implementation.

Disclaimed: nothing here claims marketplace feedback collection, seller performance measurement, review integrity enforcement, or dispute resolution as such. No numeric parameter, window length, or schedule value is fixed by the disclosure; each is declared by the deploying party in a signed policy object. The filings referenced are pending applications, and this article is published as a technical disclosure.