Mechanism
A matched pair comprises two credentialed parties, denoted Party A and Party B, each in possession of authority credentials issued under the governance chain. A bilateral exchange is initiated when one party emits an offer tuple bearing its credential signature; the counterparty evaluates admissibility against the offer's structural attributes and against its own admissibility policy. If admissibility holds, the counterparty co-signs the tuple, forming a joint observation. The joint observation, bearing both signatures, constitutes the settlement event. Finality is intrinsic to the joint signature: no further validation, propagation, or consensus operation is required to render the settlement effective between the pair.
The settlement event is appended to each party's lineage record. Lineage records are independently maintained, but each entry references the counterparty's credential, the observation tuple's structural hash, and the admissibility evaluation outcome. Downstream verification, by an auditor, regulator, or counterparty in a future exchange, proceeds by reconstructing the admissibility evaluation from the lineage entry and verifying the joint signature against the credentialing authority. No appeal to a global ledger, consensus checkpoint, or clearing record is required; the lineage entry is self-contained verification material.
Admissibility evaluation is the structural gate. Each party's admissibility function may be deterministic, learned, or hybrid; the function consumes the offer tuple, the counterparty's credential, and ambient context, and emits an admit/reject decision with rationale. Rationale is retained in lineage. The pair settlement is therefore not merely a signed agreement but a signed admissible agreement, with the admissibility rationale itself part of the evidentiary record.
Security Model
The security of pair settlement rests on three foundations: the unforgeability of the credential signatures, the integrity of the lineage record, and the soundness of the admissibility evaluation. Signature unforgeability is inherited from the chosen cryptographic binding mechanism. Lineage integrity is enforced through the governance-chain lineage field, which records each first observation, second observation, pairing determination, and binding event; a settlement may optionally be anchored to a content-addressed storage reference where applicable. Admissibility soundness is enforced through the credentialed declaration of the admissibility function and through the retention of admissibility rationale in lineage, allowing post-hoc verification that admissibility was correctly evaluated.
The threat model encompasses counterparty repudiation, lineage tampering, credential theft, and admissibility manipulation. Repudiation is countered by the joint signature, which constitutes non-repudiable evidence under the credentialing authority. Tampering is countered by the lineage's tamper-evidence properties; tampering is detectable, and the tamper-evident record is itself an audit artifact. Credential theft is countered by credential lifecycle controls including rotation and revocation, wherein a credentialing authority emits a revocation governed observation and a device whose credential has been revoked is ineligible to emit governed mesh messages under the revoked authority context. Admissibility manipulation, wherein a party signs an offer it should have rejected, is countered by retention of admissibility rationale, which permits post-hoc challenge.
Settlement liveness is bilateral. If either party becomes unresponsive, settlement does not occur; the offering party's lineage records the timeout and the operation may be retried with a different counterparty or under fallback policy. Liveness is therefore a property of the pair, not of a global network, and is recoverable through pair-level retry rather than network-level coordination.
Operating Parameters
Settlement reaches finality at mesh-propagation latency upon admission of the matched observation pair, in contrast to the block-commit-granularity, minutes-scale finality of distributed-consensus settlement. Latency is bounded by the signature exchange between the two parties plus the admissibility evaluation at each side. Throughput across a population of pairs scales with the number of active pairs, since pairs do not contend for shared consensus resources.
Settlement size is bounded by the observation tuple's structural specification, which is application-dependent. Tolling exchanges, freight handoff records, and energy-charging events each define their own tuple schema. Lineage growth per party scales linearly with settlement count; lineage compaction policies are governed by retention requirements declared at the credentialing layer. Verification complexity at audit time is constant per settlement, since each lineage entry carries its own verification material.
Failure modes are explicit. If admissibility fails on either side, no signature is exchanged and no settlement occurs; the rejection is recorded in the offering party's lineage with rationale. If a party signs but the counterparty fails to deliver its signature within a declared window, the offer expires and the offering party's lineage records the timeout. Partial settlements, single-party signatures without counterparty co-signature, do not constitute settlement events under the protocol.
Alternative Embodiments
The cryptographic binding mechanism is not constrained to a single scheme. The non-repudiation binding supports a plurality of patterns, including simple-signature binding wherein each party signs its own observation and the pair binds both signatures, threshold-signature binding wherein a governance-policy-defined threshold of authorized signers attest the pair, zero-knowledge binding wherein the pair is verifiable without disclosing underlying transaction content, ring-signature binding, hash-commit-reveal binding, timelocked-release binding, and post-quantum cryptographic primitives substituted for equivalent long-term-secure attestation. The protocol requires only that the binding support verifiable attestation over the first and second signed observations.
Credential issuance supports multi-authority admissibility, including a single governance authority or a federation of authorities under cross-jurisdictional co-existence on a single physical location. The admissibility function evaluates against whichever credential structure the embodiment carries.
Lineage is recorded in the governance-chain lineage field and may be anchored to a content-addressed storage reference where applicable. Anchoring is optional and orthogonal: the settlement's finality does not depend on anchoring, but anchoring may be elected to strengthen the verification material.
Multi-attester signatures may participate for high-assurance transactions when present. A multi-attester consensus composer produces optional multi-attester signatures under the same credential framework as the pair. The multi-attester attestation is supplementary; it does not gate settlement and is not required for finality.
Composition
Pair settlement composes with the broader mesh through the lineage primitive. A party that has settled with multiple counterparties accumulates a lineage record that, when surfaced selectively, demonstrates a pattern of admissible exchange. Reputation, throughput entitlement, and downstream credentialing decisions consume this lineage. The lineage is bilateral in origin but aggregable in use.
Pair settlement composes with N-party coordination patterns by serving as the atomic unit beneath higher-order patterns. A ratified handoff among three parties decomposes into pair settlements between each adjacent pair, with the handoff's coherence checked against the union of pair lineages. Joint-witness patterns invoke pair settlement between the witnessed parties and the witness. Federated patterns invoke pair settlements across the federation under declared admissibility models.
Pair settlement composes with governance-chain operations through credential validity. If a credential is revoked subsequent to settlement, prior settlements remain valid as historical events but new settlements under the revoked credential cannot occur. The lineage carries the credential's validity at settlement time, not at audit time, preserving temporal integrity.
Distinction From Prior Art
The primitive is structurally distinguished from prior settlement architectures in several respects. Prior centralized payment processors settle through a third-party intermediary with intermediary-held counterparty risk, whereas the present primitive settles directly between transacting parties without intermediary. Prior blockchain settlement architectures settle through distributed consensus producing block-commit-granularity finality with minutes-scale latency, whereas the present primitive produces observation-granularity settlement at mesh-propagation latency. Prior paired-authentication protocols produce transient authentication outcomes without persistent settlement artifact, whereas the present primitive produces a governance-chain-preserving settlement record. Prior clearing-house and settlement-network architectures operate through regulated intermediaries with counterparty-risk management overhead, whereas the present primitive operates without intermediary. Prior transactional architectures bind consent at account-level setup producing implicit per-transaction consent, whereas the present primitive produces explicit per-transaction bilateral consent through per-transaction paired observations. Prior architectures address abstract digital addresses without physical-space grounding, whereas the present primitive requires parties to be co-located within the governance-policy-defined spatial window, producing physical-reality-grounded transactions.
Application Scenarios
Roadway tolling is a paradigmatic application. A vehicle operator and a tolling authority constitute a matched pair, paired by spatial-coincidence at the tolling marker plus temporal-coincidence within the vehicle's pass-through window. Passage events generate paired observations; the cryptographic binding is the settlement; lineage retention furnishes the audit record. Throughput scales with pair-evaluation capacity rather than consensus-network throughput.
Energy transfer is a second application. The matched-pair primitive operates across energy transfer as a bilateral exchange admitting paired-observation settlement, with energy denominated in commodity units such as kilowatt-hours per the cross-unit settlement mechanism. Pair settlement avoids the latency penalty of distributed consensus.
Freight handoff is a third application. Adjacent custodians in a supply chain constitute pairs at handoff points; observation tuples encode cargo identifiers, custody attributes, and condition attestations. The pair-settlement record at each handoff composes into a custody chain; no global consensus over the supply network is required for individual handoff finality.
Adversarial-degraded operation is a fourth application. When external consensus services are unavailable due to network partition, denial-of-service, or jurisdictional restriction, pair settlement continues unaffected. Lineage accumulated during the degraded period furnishes evidence for later reconciliation when external services are restored. The architecture therefore supports continuity under degradation that would halt consensus-bound architectures.
Disclosure Scope
This disclosure is described in U.S. Provisional Application No. 64/049,409. The disclosure encompasses the matched-pair settlement primitive, the cryptographic settlement binding, the governance-chain lineage retention scheme, the spatial and temporal proximity windows, the counter-offer and negotiation mechanism, the escrow and chained-settlement mechanism, the settlement-failure and rollback mechanism, the dispute-resolution mechanism, and the cross-currency and cross-unit exchange mechanism. The primitive is disclosed independent of any specific cryptographic binding scheme, credential framework, lineage storage technology, or admissibility-function realization. Embodiments across tolling, commerce, chain-of-custody, capacity reservation, energy transfer, and any bilateral exchange admitting paired-observation settlement are encompassed within the disclosure. Variations in observation content schema, binding pattern, lineage anchoring strategy, and credential-issuance hierarchy are likewise encompassed.
The disclosure further encompasses methods of operation comprising: (a) emitting an admissibility-evaluated offer tuple from a first credentialed party; (b) evaluating the offer against a second credentialed party's admissibility policy; (c) co-signing the offer to form a joint observation; (d) appending the joint observation to each party's lineage with admissibility rationale; and (e) verifying the settlement at audit time through reconstruction of admissibility evaluation against retained lineage. Variations on these method steps, including iterated counter-offer exchange before terminal settlement, escrow and chained-settlement dependencies, settlement failure and rollback handling, and governance-credentialed dispute resolution, are within scope.
