Observability Is The Usage Graph Nobody Has To Declare: Check Events Belong In The Issuer's Own Lane
Summary
The observability layer, and the one decision inside it that separates a security property from a surveillance product. Observability goes in at the beginning, not because it is good practice but because the case for declared mandates is that they produce the evidence saying where enforcement earns its cost — and without check events they produce none. The correction the proposal needs: a verification is not a use, and the error runs both ways, since a party that uses a mandate without verifying generates nothing while a resolver walking the chain generates an event with no usage behind it. So the primary output is the missing edges — the parties holding a mandate that have never once checked it — which the issuer can compute because it holds both halves. Where the events are written decides what this is: a central log accumulates who is evaluating whom across parties that never consented; the issuer's own lane makes it an owner observing their own asset. And because nothing is pushed, the interval between a party's checks is its effective revocation latency, measurable before anything is ever revoked.
Key concepts
- A verification is not a use — the party that never verifies is the weakest relying process, and the one this cannot see
- The missing edges are the product — issued-to minus has-checked, computable by the issuer alone
- The location of the log is the design — rule 1 applied to telemetry: the asserter appends to its own record
- Effective revocation latency — no push means propagation happens at the rate parties check — so the rate is measurable in advance
Key ideas
- The design that protects the positioning is the design that destroys the dataset, and it should be chosen deliberately.
- A thousand pending files per token makes draining an obligation that fails silently.
- Whether a lane with no anchors accepts any token holder is absent from the reference, and it gates the whole layer's coverage.
- “Verify this mandate at least once every twenty-four hours” is one of the very few mandate clauses that is actually decidable.
On this site
Became document 11 of the registry MVP pack, and answers a question the mandate page had been raising since it was published — by refusing it: nobody can say who is using a mandate, and the issuer can say who has never checked one.