Velaru Standards · Sovereign Behavioral Evidence · v2.0

POSS-2 — Process Completeness Architecture

POSS-1 proved behavioral outcomes reconcile. POSS-2 names why lone generators cannot cryptographically prove completeness, distinguishes completeness classes, and specifies the quorum-aware architecture Velaru implements for EPL, carrier underwriting, and EU AI Act Art. 12 evidence.

Class B completeness Impossibility-aware Quorum observer model ISO/IEC FDIS 24970 aligned Successor to POSS-1

Two completeness classes

Class	Domain	Invariant	Example
Class A	Multiset / trading lifecycle	XOR: every attempt = exactly one terminal event	Order signal → fill; GEN_ATTEMPT = GEN + DENY + ERROR
Class B	Process / behavioral governance	Σ attempts = GEN + DENY + ERROR + SILENCE + unclosed	Hiring AI: permitted, refused, errored, silent, or pending

Class A and Class B are not competing standards. They answer different questions. Trading audit proves execution events. POSS-2 proves governance behavior — including refusals, silence, and pre-incident policy locks.

The completeness impossibility theorem

A lone generator — the same party that produces AI output — cannot cryptographically prove that no unlogged generation occurred. Any internal log can omit entries. Zero-knowledge proofs cannot fix this without external observers.

∀ lone generator G: ¬∃ proof π such that Verify(π) ⇒ complete(G)

IETF draft-kamimura-scitt-refusal-events-03 (VeritasChain, Aug 2026) states explicitly: "This demonstrates that a refusal was logged. It does not prove that no unlogged generation occurred." POSS-2 is the honest architecture that follows from that admission.

Reference: draft-kamimura-scitt-refusal-events-03 §5.3 · draft-noa-scitt-ai-agent-receipt-00 §9 (policy-replay out of scope)

Quorum observer architecture

Velaru implements impossibility-aware completeness with independent observers:

Velaru relay — signs every receipt; hash-chained append-only log
Employer BYOK — independent co-sign; neither party alone can forge
Vendor Tri-Receipt — model provider cosigns; 3/3 quorum for carrier export
External anchor — GitHub Gist tail; operator cannot reorder without detection
Handler Receipt — pre-incident policy frozen before dispute window

Honest quorum: ⌈(n+1)/2⌉ independent observers required for completeness claims

POSS-2 conformance tiers

Tier	Requirements
POSS-2 Crypto	Ed25519 + hash chain + /verify pass + DRP-1 deontic binding
POSS-2 Complete	Crypto + Class B invariant holds (unclosed = 0)
POSS-2 Sovereign	Complete + external anchor + Handler Receipt + BYOK or Tri-Receipt
POSS-2 Causal	Sovereign + TCB Counterfactual Receipt bound to frozen Handler Receipt

Standards alignment (Aug 2026)

ISO/IEC FDIS 24970 — tamper-evident AI event logging (stage 50.00 formal approval)
EU AI Act Art. 12 — high-risk logging enforcement effective Aug 2, 2026
AIUC-1 Q2 2026 — cryptographically verifiable agent identities + tool-call logging
SCITT RFC 9943 — profile: velaru-employment-companion-ai-v1 (Class B, not Class A trading)
Mayflower/Hadron affirmative EPL — governance evidence pack gated on documented proof

Companion specifications

POSS-1 — base behavioral completeness invariant
DRP-1 — deontic temporal logic receipt binding (O/F/P + STIT)
TCB — Temporal Causal Binding + Counterfactual Receipt (CCR)

Verify a receipt → DRP-1 spec → TCB spec → Pre-Dispute Bundle →