Proof-of-Outcome

What PoO Proves

Given an Intent I and an Outcome O, Proof-of-Outcome asserts:

• O was produced by a specific agent A
• A used a specific model / code M with attested weights / hash
• M(input) = output — verified by ZK-ML proof
• A was authorised by the principal's signed delegation
• O was attested under a specified policy P
• Settlement S follows deterministically from O

Why Not PoW / PoS?

PoW/PoS make the chain honest. PoO makes the agent honest.

The PoO Formula

PoO(I, O) = verify {
  σ_principal(I)              // principal signed the intent
  ∧ σ_prime(D)                // Prime signed the delegation from I
  ∧ σ_agent(Inf)              // agent signed the inference envelope
  ∧ σ_agent(O)                // agent signed the outcome
  ∧ lineage(O.parent == Inf.id) // AIG parent chain is intact
  ∧ zk_ml(M, input, O)        // model produced this output (or attestor fallback)
  ∧ policy_check(P, A, O)     // org policy satisfied
  ∧ stake(A) ≥ required(I)    // agent had sufficient stake
}

All checks must pass. Any failure triggers slashing and escrow refund.

Verification Checks

TypeScript implementation

import { PoOVerifier } from "@hyperbridge/forge/poo";

const verifier = new PoOVerifier({ requiredAttestors: 2, minStake: 10 });

const result = await verifier.verify({
  intent, delegation, inference, outcome,
  zkmlProof: { model: "did:w7:model/tax-v2@sha256:abc", inputHash, outputHash, proof },
  attestors: ["did:w7:attestor/a1", "did:w7:attestor/a2"],
});

// result.ok === true means all required checks passed
// result.checks: { intentSig, delegationSig, inferenceSig, outcomeSig,
//                  lineage, inference, policy, stake }
// result.reasons: { [check]: string } — explains any failure
// result.score: number — weighted 0–1 across all 8 checks

Common PoO Failure Modes

When result.ok === false, inspect result.checks and result.reasons to pinpoint which check failed. The table below maps each failure to its root cause and fix.

Custom Policy Engine

Pass a policyEngine function to PoOVerifier to enforce any business rule — domain allowlists, token budgets, rate limits, compliance flags. The function receives the raw intent and outcome envelopes and returns { ok, reason }.

import { PoOVerifier } from "@hyperbridge/forge/poo";

// Policy engine factory — returns a policyEngine function
function buildPolicyEngine(
  allowedDomains: string[],
  maxTokenBudget: number,
  blockedAgents: string[] = [],
) {
  return (intent: any, outcome: any): { ok: boolean; reason: string } => {
    const domain = intent?.payload?.domain ?? "";
    if (!allowedDomains.includes(domain))
      return { ok: false, reason: `domain '${domain}' not in allowlist` };

    const agentDid = outcome?.from ?? "";
    if (blockedAgents.includes(agentDid))
      return { ok: false, reason: `agent ${agentDid} is blocked` };

    const tokensUsed = outcome?.payload?.usage?.totalTokens ?? 0;
    if (tokensUsed > maxTokenBudget)
      return { ok: false, reason: `token usage ${tokensUsed} exceeds budget ${maxTokenBudget}` };

    return { ok: true, reason: "policy satisfied" };
  };
}

// Wire it into a verifier
const verifier = new PoOVerifier({
  policyEngine: buildPolicyEngine(["tax-filing", "invoice-gen"], 50_000),
  requiredAttestors: 2,
  minStake: 10,
});

const result = await verifier.verify({ intent, delegation, inference, outcome, attestors });

if (!result.ok) {
  const failed = Object.entries(result.checks)
    .filter(([, v]) => !v)
    .map(([k]) => `${k}: ${result.reasons[k]}`);
  console.error("PoO failed:", failed);
  // → e.g. ["policy: domain 'crypto-trading' not in allowlist"]
}

console.log("PoO score:", result.score.toFixed(2));
// → "PoO score: 0.94" (weighted across all 8 checks)

Settlement Under PoO

Slashing Rules

Reputation Effect

// On verified PoO (success)
reputation(A) += outcome_value × principal_stake × domain_match × age_decay

// On failed PoO
reputation(A) -= severity × 2 × base_score

// Properties:
// - Non-transferable (cannot be sold or delegated)
// - Domain-scoped (tax-filing rep ≠ medical-coding rep)
// - Exponential decay: half-life = 6 months
// - Slashable (floor: 0)

Minimum Viable PoO (v0.1)

v0.1 ships without production ZK-ML. The inference check accepts either:

• ZK-ML proof stub — well-formed struct, proof field present. Full circuit verification at mainnet.
• k-of-n attestor bundle — N attestors sign the inference payload; k must verify (k=2 default, N=3 default).