SPEC v1.1 : une décroissance montrée nomme sa lecture

Un auditeur qui voit une confiance décrue ne peut pas la reproduire s'il
ignore quelle fonction l'a produite, dans quelle version, à quelle date.
Deux lectures divergentes du même verbatim se valent alors, sans qu'on
puisse dire pourquoi : c'est l'opposabilité qui se fissure, non le fait.

Champ 15 confidence_reading (§4.1), OPTIONNEL — présent seulement quand
l'émetteur EXPOSE une valeur qu'il a dérivée ; ses quatre clés sont alors
requises (policy, version, value, as_of). Le verbatim reste intact au
champ 8. Règle de conformité au §9 : une valeur dérivée non déclarée
n'est pas conforme. Additif et ignorable — un consommateur v1.0 le
préserve et passe, comme §8 l'exige de tout champ inconnu.

Relevé par une lecture extérieure du 2026-09-19 : « c'est une ligne du
contrat, pas une ADR ». Elle avait raison sur les deux points.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

envelope/SPEC.md

@@ -1,4 +1,4 @@
-# Assertion Envelope — Specification v1.0
+# Assertion Envelope — Specification v1.1
 
 **Status**: stable. Declared v1.0 upon the first real federated exchange
 between two distinct jurisdictions — openathle → Prismagram, endorsed
@@ -84,7 +84,7 @@ fields (§7).
 | 5 | `statement` | string | REQUIRED. What is asserted, in one sentence or few |
 | 6 | `evidence` | list of `{kind, ref}` | REQUIRED, MAY be empty. A conflict without evidence asks to be believed; evidence names where the fact lives |
 | 7 | `provenance` | string | REQUIRED. One of §6. Transported verbatim (§2.2) |
-| 8 | `confidence` | number | REQUIRED. `0.0`–`1.0`. Transported verbatim. Interpretation policies — decay, half-life, thresholds — are consumer-local readings and MUST NOT modify the transported value |
+| 8 | `confidence` | number | REQUIRED. `0.0`–`1.0`. Transported verbatim. Interpretation policies — decay, half-life, thresholds — are consumer-local readings and MUST NOT modify the transported value. A consumer that *exposes* such a reading declares it (field 15, §4.1) |
 | 9 | `endorsement` | object or null | REQUIRED. `{by, at, rite}`; `rite` is one of `pr_approval`, `ui`, `batch`. `null` means: no human has endorsed this — which is a fact, not a defect |
 | 10 | `jurisdiction` | string | REQUIRED. MUST equal the prefix of `id`. Lowercase ASCII, no separators |
 | 11 | `at` | string | REQUIRED. RFC 3339 timestamp of the asserted state |
@@ -97,6 +97,21 @@ fields (§7).
 assertion; `endorsement` records the proven event. The two are irreducible:
 a declared status is not an approval (ADR-070 §3.2).
 
+### 4.1 Declared readings (v1.1)
+
+| # | Field | Type | Rule |
+|---|---|---|---|
+| 15 | `confidence_reading` | object | OPTIONAL. Present only when the sender exposes a value it has itself derived from `confidence`. Keys: `policy` (string, the reading's name), `version` (string), `value` (number `0.0`–`1.0`), `as_of` (RFC 3339 timestamp). All four REQUIRED when the object is present |
+
+A decayed confidence is a reading, not a fact. Two auditors applying two decay
+functions to the same verbatim value, on two dates, would disagree without
+either being wrong — and neither could say why. This field makes the reading
+quotable: the verbatim value stays in field 8, the reading stands beside it,
+named, versioned and dated.
+
+It is OPTIONAL because a consumer that never exposes a derived value never owes
+one; it is not optional for those who do (§9).
+
 ## 5. Classes
 
 `invariant`, `step_realized`, `transition`, `traversal`, `stressor`,
@@ -132,6 +147,10 @@ a standard field is a contract change under §8.
   declared stable, nothing more. Consumers MUST treat `envelope: "0.1"`
   messages as v1.0 messages; the schema accepts both values. This equivalence
   is specific to this pair and will not be repeated across future MAJORs.
+- **v1.1 adds field 15 `confidence_reading`** (§4.1) and the consumer rule that
+  governs it (§9). Additive and ignorable: a v1.0 consumer that meets the field
+  preserves it and moves on, exactly as §8 requires of any unknown field. No
+  existing field, class, provenance or rule changed.
 - At most **two published versions per year**. Deprecation is announced in
   this file at least one version before removal.
 - Consumers MUST accept any message whose `envelope` shares their MAJOR and
@@ -155,7 +174,10 @@ MUST NOT emit an endorsement it did not witness as a dated event; MUST NOT
 emit `measured` provenance for anything a machine did not measure.
 
 **Consumer** — MUST NOT mutate `id`, `provenance` or `confidence` of a
-received assertion; MUST NOT reject messages carrying unknown classes or
+received assertion; MUST, when it presents or relays a confidence value it has
+derived from the transported one, carry the verbatim value unchanged **and**
+declare the applied reading in `confidence_reading` (§4.1) — an undeclared
+derived value is not conformant, because nobody can reproduce it; MUST NOT reject messages carrying unknown classes or
 unknown fields (preserve, expose, move on); MUST record received assertions
 append-only; MAY annotate, reference and aggregate received assertions under
 its own identity, and MUST NOT present the result as the origin's.
@@ -163,6 +185,7 @@ its own identity, and MUST NOT present the result as the origin's.
 ## 10. What this contract does not do
 
 It does not say how assertions are stored, projected, displayed or decayed —
-those are jurisdiction-local. It does not transport source documents: sealing
+those are jurisdiction-local. It says only that a decay, once shown, names
+itself (§4.1): the contract governs what is claimed, never how it is computed. It does not transport source documents: sealing
 and encrypting source payloads is storage, not exchange. It does not decide
 who is right: it keeps both parties quotable, at their own risk.