draft-dogru-cedulon-01

Sections

1. Introduction — rails move value; the audit layer is missing. Single-entry → double-entry → completeness proven against an authenticated rail extract.
2. Terminology — RFC 2119; Trade Manifest, PDP, Spend Receipt, Decision Token (COSE_Sign1), Rail Extract.
3. Architecture — PDP before the rail; Receipt Issuer after; optional SCITT.
4. Trade Manifest — COSE_Sign1 offer before payment; manifestHash is SHA-256 of the COSE bytes.
5. Spend Receipt — signed record after a gated payment; noManifest and outcome are explicit; optional payee countersignature is a detached COSE_Sign1.
6. COSE Profile — deterministic CBOR; alg −19 (Ed25519); private-use labels below −65536; mandatory kid.
7. Rail Extract Profile — authenticated settlement records; unsigned extract makes the guarantee conditional.
8. Reconciliation and Epoch Checkpoints — 1:1 ref+amount+currency; half-open windows; equivocation.
9. Lifecycle — Manifest → Policy → Payment → Receipt → Dispute Evidence Bundle.
10. Policy Semantics — limit, velocity, scope; fail-closed default deny.
11. SCITT Anchoring — optional registration; this draft does not operate a service.
12. Privacy Considerations — public encodings omit or hash identifiers and amounts.
13. Security Considerations — T1–T11, including rail-bypass completeness (T10) and checkpoint suppression (T11).
14. IANA Considerations — no actions; private-use labels do not need a registry block.
15. Implementation Status — RFC 7942 note pointing at the companion repository.
16. Evolution and Future Work — re-attestation, streaming reconciliation, generalization (direction, not -00 code).
17. Informative Notes — x402, AP2, Bates, Vauban, Schrock, Marques/Acta, Hopley; none define rail-extract completeness.
18. Acknowledgments — field survey and threat-model notes in the companion repository.
19. Appendix A. Test Vectors — locked byte-level receipt and manifest vectors, reproduced by the test suite.