# Checkable Sets

Registry continuity, settlement arithmetic, and batch inclusion

Published September 3, 2026.

## Quick answer

A set checkpoint proves relations over a supplied batch. The verifier canonicalizes unique entries, rebuilds the root and count, and checks profile specific relations. Registry, settlement, and voting profiles keep their legal boundaries separate.

## The problem

Batch systems are vulnerable to quiet changes in membership, order, totals, and continuity. A signed summary is weak if the signer also supplies the root, count, and outcome without independent recomputation.
These profiles reject caller supplied derived fields. Registry adds status transitions, settlement adds integer minor unit arithmetic, and voting adds manifest timing plus commitment inclusion.

## Primitive map

| Receipt | Bound inputs | Derived relation | Claim boundary |
| --- | --- | --- | --- |
| receipt.registry.sovereign | Unique entries, prior checkpoint, statuses, and jurisdiction metadata | Root, count, and allowed transitions recompute | Government authority or legal effect |
| settlement.feed | Unique settlement entries, prior checkpoint, and minor unit amounts | Root, count, continuity, and integer totals recompute | Funds moved, finality, or obligation validity |
| voting.verifiable | Manifest, timing, ballot commitments, inclusion proofs, and optional tally | Root, count, inclusion, and supplied tally consistency recompute | Eligibility, secrecy, coercion resistance, authority, or legal validity |

## Verifier gates

The verifier rebuilds derived values. It does not trust a caller supplied outcome, count, root, total, or relation.

- `UNIQUE_ENTRIES`
- `CANONICAL_ROOT`
- `COUNT_RECOMPUTATION`
- `CHECKPOINT_CONTINUITY`
- `STATUS_TRANSITIONS`
- `INTEGER_ARITHMETIC`
- `MANIFEST_TIMING`
- `BALLOT_INCLUSION`
- `TALLY_CONSISTENCY`

## Failure cases

### Duplicate entry

Canonical identity checks reject repeated members.
### Root substitution

The verifier rebuilds the root from canonical leaves.
### Count inflation

The verifier counts accepted entries.
### Checkpoint fork

The new checkpoint must reference the expected prior root.
### Total inflation

Settlement totals use integer minor units derived from entries.

## Claim boundary

- Jurisdiction metadata does not grant registry authority.
- A settlement receipt does not prove that funds moved or became final.
- A voting receipt does not prove voter eligibility, secrecy, or freedom from coercion.
- No profile creates legal validity by itself.

## Standards context

- [RFC 9162](https://www.rfc-editor.org/rfc/rfc9162.pdf)
- [SCITT architecture](https://datatracker.ietf.org/doc/html/draft-ietf-scitt-architecture-22)
- [Sigstore Rekor](https://docs.sigstore.dev/logging/overview/)

## Related research

- [Swarm incident receipt autopsy](https://thehiveryiq.com/autopsy/openai-hugging-face-agent-evaluation/)
- [Hive research index](https://thehiveryiq.com/papers/)