Identity graph

Agent identity exists in slices that do not hand off to each other. A card network ties an agent to a payment credential and through it to a legal owner. A cross-platform account link carries an authorisation from one platform to another. An on-chain registry records that somebody minted a token and set a URI. Each slice is internally coherent and none of them talks to the next, so a deployment holding all three holds three unrelated opinions.

The failure is not that the slices are missing. It is that joining them invites a flattening: three parallel claims become one verified-identity record, the sources are dropped on the way in, and uncertainty that was visible becomes certainty that is false.

A graph of claims, not a record

Every edge is an attribute, a value and a source, and the source travels with the value everywhere. There is no merged identity type, no field that says an attribute is a value, and no code path that discards a claim because another outranked it. The join is a grouping, not a merge: two readings that agree end up as two edges under one value, not as one stronger edge.

Evidence classes are borrowed from the same ladder settlement decisions use, rather than restated, so an identity claim and a settlement decision cannot end up disagreeing about what an attestation is worth.

Independence is structural

Corroboration counts substrates, not readings. Readings are cheap: one registry answers as many times as it is asked, an indexer republishes it, a cache replays it, and a card can restate all of it in a document the agent itself wrote. Counting readings makes a single substrate look like a quorum, which is the specific way an identity join manufactures false certainty.

Each reading names the authority it derives from, plus any authorities it merely restates. Those tokens are unioned per reading, and readings whose token sets touch collapse into one source. Two calls against one registry, an indexer's copy of it and a card that lists it are one source between them, not four.

Agreement is never treated as evidence of independence, because two copies of one record agree perfectly. The reasoning string carries the figures the count turned on, so a reader can see which readings collapsed and refuse the number if the collapse looks wrong.

Conflicts stay conflicts

When two sources disagree about an attribute, both values stay in the output with their sources attached, sorted by value so neither reads as preferred. A conflict anywhere outranks corroboration everywhere.

A reading about a different subject is neither silently folded in nor silently dropped: it is set aside with its own subject attached. Deciding that two subject ids are the same agent is an identity claim in its own right, and it belongs in a reading rather than in a join.

Four standings, and none of them is verified

unsupported

Nothing joined, or a required attribute has no claim behind it at all.

conflicted

Sources disagree. Both values stay in the graph; this states the disagreement.

asserted

Claims exist and do not reach the corroboration bar. The default outcome.

corroborated

Several independent sources assert the same value, none asserts a different one, the evidence floor is met, and not every reading behind it is weak-tier.

Corroborated is a statement about the sources, not about the agent. It says more than one substrate says the same thing and nothing says otherwise. It does not say the thing is true, and no combination of inputs produces a state that does. There is no verified, no trusted and no numeric confidence, and the verdict carries its own refusal so that it survives being serialised and read somewhere else.

refusesToConclude: "identity verified"

Two independent sources is the default bar, because one source is never a quorum. There is a separate check for the case that matters most: an attribute with enough readings to look corroborated while being one source is named as such rather than passing.

Purity

• No store, no clock, no fetch, no signer.
• Every input arrives as an argument, including the instant, so a third party holding the same readings replays the graph, the counts and the verdict, and can refute any of them.
• Attributes are plain strings, so a deployment can join something this has not anticipated rather than mislabelling it as something it knows.