<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE rfc [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude"
     version="3"
     docName="draft-condrey-rats-pop-appraisal-01"
     ipr="trust200902"
     category="std"
     consensus="true"
     submissionType="IETF"
     sortRefs="true"
     symRefs="true"
     tocInclude="true"
     tocDepth="4">

  <front>
    <title abbrev="PoP Appraisal">Proof of Process (PoP): Forensic Appraisal and Security Model</title>
    <seriesInfo name="Internet-Draft" value="draft-condrey-rats-pop-appraisal-01"/>
    <author fullname="David Condrey" initials="D." surname="Condrey">
      <organization abbrev="WritersLogic">WritersLogic Inc</organization>
      <address>
        <postal>
          <city>San Diego, California</city>
          <country>United States</country>
        </postal>
        <email>david@writerslogic.com</email>
      </address>
    </author>
    <date year="2026" month="February" day="14"/>

    <area>Security</area>
    <workgroup>Remote ATtestation procedureS</workgroup>

    <abstract>
      <t>
        This document specifies the forensic appraisal methodology and quantitative security model for the Proof of Process (PoP) framework. It defines how Verifiers evaluate behavioral entropy, perform liveness detection, and calculate forgery cost bounds. 
      </t>
    </abstract>
  </front>

  <middle>
    <section anchor="introduction">
      <name>Introduction</name>
      <t>
        The value of Proof of Process (PoP) evidence lies in the Verifier's ability to distinguish biological effort from algorithmic simulation. This document provides the normative framework for forensic appraisal, defining the appraisal logic required to generate a Writers Authenticity Report (WAR).
      </t>
    </section>

    <section anchor="behavioral-entropy">
      <name>Jitter Seal: Captured Behavioral Entropy</name>
      <t>
        Verifiers appraisal behavioral entropy (jitter) to establish a biological binding to the document.
      </t>
      <artwork type="cddl"><![CDATA[
      jitter-binding = {
          1 => entropy-source,                    ; 1=keystroke, 2=pause, 3=mouse
          2 => bstr,                              ; jitter-digest (compressed)
          3 => bstr .size 32,                     ; hmac-binding to content
      }
      ]]></artwork>
      <section anchor="entropy-thresholds">
        <name>Entropy Thresholds</name>
        <t>
          For a checkpoint to be considered "Biologically Bound," the JitterDigest MUST contain at least a minimum threshold of min-entropy (H_min). For ENHANCED profiles, this protocol RECOMMENDS <strong>H_min = 128 bits</strong> per 1,000 characters of input.
        </t>
      </section>
    </section>

    <section anchor="forensic-assessment">
      <name>Forensic Assessment Mechanisms</name>
      <dl>
        <dt>SNR (Signal-to-Noise Ratio) Analysis:</dt>
        <dd>Verifying the 1/f fractal noise signature of human motor signals to detect machine-clocked synthetic injection. Biological noise exhibits non-linear variance that is computationally expensive to simulate.</dd>
        
        <dt>Cognitive Load Correlation (CLC):</dt>
        <dd>To defeat high-fidelity AI jitter models, Verifiers MUST correlate timing patterns with semantic complexity. Human authors exhibit increased inter-keystroke intervals (IKI) during the composition of high-entropy segments (e.g., complex technical definitions).</dd>

        <dt>Mechanical Turk Detection:</dt>
        <dd>Analyzes intra-checkpoint correlation (C_intra) to detect "robotic pacing"—where an automated system maintains a machine-clocked editing rate regardless of content complexity.</dd>

        <dt>Error Topology Analysis:</dt>
        <dd>Human authors exhibit characteristic patterns: Localized corrections near recent insertions, and fractal self-similarity in revision patterns across different time scales.</dd>
      </dl>
    </section>

    <section anchor="economic-model">
      <name>Forgery Cost Bounds (Quantified Security)</name>
      <t>
        Forgery cost bounds provide a Verifier with a lower bound on the computational resources required to forge an Evidence Packet. The cost (<em>C_total</em>) is computed as:
      </t>
      <artwork><![CDATA[
  C_total = C_vdf + C_entropy + C_hardware
      ]]></artwork>
      <ul>
        <li><strong>C_vdf:</strong> Iterations * Joules per iteration * Energy Cost. The sequential nature of VDFs ensures time cannot be "bought" with parallel compute.</li>
        <li><strong>C_entropy:</strong> Effort required to synthesize biological noise that satisfies SNR and CLC constraints via high-fidelity AI modeling.</li>
        <li><strong>C_hardware:</strong> Pro-rated cost of discrete TPMs or high-bandwidth memory interfaces required for MHSF acceleration.</li>
      </ul>
    </section>

    <section anchor="absence-proofs">
      <name>Absence Proofs: Negative Evidence</name>
      <t>
        Absence proofs assert that certain events did NOT occur during the monitored session.
      </t>
      <dl>
        <dt>Type 1: Computationally-Bound</dt>
        <dd>Verifiable from the evidence chain alone (e.g., "Max single delta size &lt; 100 bytes").</dd>
        <dt>Type 2: Monitoring-Dependent</dt>
        <dd>Requires trust in AE monitoring (e.g., "No content was pasted from unauthorized sources").</dd>
        <dt>Type 3: Environmental</dt>
        <dd>Assertions about system state (e.g., "No debugger attached" or "Hardware temperature remained within T_min/T_max").</dd>
      </dl>
    </section>

    <section anchor="tool-receipt-protocol">
      <name>Tool Receipt Protocol (AI Attribution)</name>
      <t>
        When external tools contribute content, the PoP framework enables a "compositional provenance" model:
      </t>
      <ol>
        <li><strong>Receipt Signing:</strong> The Tool signs a "Receipt" containing its identity and a commitment to the generated content.</li>
        <li><strong>Binding:</strong> The Attester records a <strong>PASTE</strong> event in the transcript referencing the Tool Receipt.</li>
        <li><strong>Countersigning:</strong> The Attester binds the Receipt into the next human-driven checkpoint, anchoring the automated work into the linear human effort.</li>
      </ol>
    </section>

    <section anchor="privacy-and-accessibility">
      <name>Privacy and Inclusivity</name>
      <t>
        Verifiers MUST support <strong>Evidence Quantization</strong> to mitigate stylometric de-anonymization risks. Additionally, Verifiers MUST support <strong>Accessibility Modes</strong> for authors using assistive technologies, ensuring they are not systematically excluded.
      </t>
    </section>
  </middle>

  <back>
    <references>
      <name>References</name>
      <references>
        <name>Normative References</name>
        <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"/>
        <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/>
        <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9334.xml"/>
      </references>
      <references>
        <name>Informative References</name>
        <reference anchor="PoP-Protocol">
          <front>
            <title>Proof of Process (PoP): Architecture, Evidence Format, and VDF</title>
            <author fullname="David Condrey" initials="D." surname="Condrey"/>
            <date year="2026"/>
          </front>
          <seriesInfo name="Internet-Draft" value="draft-condrey-rats-pop-protocol-02"/>
        </reference>
        <reference anchor="Monrose2000" target="https://doi.org/10.1145/351427.351438">
          <front>
            <title>Keystroke dynamics as a biometric for authentication</title>
            <author fullname="F. Monrose" initials="F." surname="Monrose"/>
            <author fullname="A. Rubin" initials="A." surname="Rubin"/>
            <date year="2000"/>
          </front>
        </reference>
        <reference anchor="Goodman2007" target="https://doi.org/10.1007/978-3-540-77343-6_14">
          <front>
            <title>Using Stylometry for Biometric Keystroke Dynamics</title>
            <author fullname="A. Goodman" initials="A." surname="Goodman"/>
            <author fullname="V. Zabala" initials="V." surname="Zabala"/>
            <date year="2007"/>
          </front>
        </reference>
        <reference anchor="Sardar-RATS" target="https://www.researchgate.net/publication/380430034_Security_Considerations_for_Remote_ATtestation_procedureS_RATS">
          <front>
            <title>Security Considerations for Remote ATtestation procedureS (RATS)</title>
            <author fullname="Muhammad Usama Sardar" initials="M.U." surname="Sardar"/>
            <date year="2024" month="May"/>
          </front>
        </reference>
      </references>
    </references>
  </back>
</rfc>