Portfolio Exposure Receipt: settling how concentrated a book is without disclosing who is in it

The problem

An insurer writes a book of policies covering artificial intelligence deployments. Two hundred insureds, each depending on some stack of base models, inference providers, evaluation administrators, data sources and hosting regions. The question that keeps the chief risk officer awake is simple: how much of this book falls over at once if one of those dependencies fails.

That question has an answer. Getting anyone to believe the answer is the hard part.

Name the parties. The cedent insurer asserts that its largest single dependency accounts for some fraction of the book, and that the fraction is comfortable. The reinsurer being asked to take a share asserts nothing, because it has no way to check, and prices the uncertainty into the treaty. A broker sits between them relaying numbers. A regulator asking about accumulation risk gets the cedent's spreadsheet.

The reinsurer's position is the interesting one. It cannot verify the concentration figure without the underlying book, and it cannot have the underlying book. The book contains the identity of every insured, which is confidential to those insureds, and it contains the specific technology dependencies of every insured, which is often more confidential than the identities. A company that has told its insurer which inference provider its core product depends on has not agreed to tell that provider's competitors, or its own competitors, or a reinsurance market that talks.

So the reinsurer gets a number in a slide. The number was produced by the party with the strongest interest in it looking moderate. It might be perfectly accurate. There is no way to tell, and the pricing reflects that.

The failure has a specific shape. It is not that the cedent is lying. It is that concentration arithmetic is easy to get wrong in ways that all point the same direction. Two insureds using the same provider through different resellers get counted as two dependencies rather than one. A dependency recorded at different granularity in different policies fragments into small groups that individually look harmless. A member with no recorded dependency drops out of the denominator instead of being carried as unknown. Each of these makes the top share look smaller, and none of them requires anybody to be dishonest.

There is also a privacy failure running the other way. Concentration reporting that is honest at fine granularity leaks. If a dimension has a group of two, and the reinsurer knows the market, the group of two is identifiable. A report that discloses every group down to size one is a report that discloses the book by inference, which is exactly what the insureds were promised would not happen.

When the insured entities are themselves autonomous systems, both failures get sharper. Dependency stacks change without a human filing an update. A book that was accurate at binding is stale within weeks, and the as of time becomes the most important field in the whole report. A concentration figure with no committed as of time is not a claim anyone can test.

What the receipt binds

The schema is at https://thehiveryiq.com/.well-known/schemas/portfolio-exposure-v1.json.

The dimension list is closed. Five values, enforced by schema enum. A caller cannot invent a sixth dimension and describe it in free text, which is one of the paths by which identifying information usually escapes.

What is deliberately not in the signed body

There are no names. No insured is identified, no dependency is named, no policy term appears. Every member of every dimension is present only as commitment_hmac_sha256, a 64 character lowercase hex value. The service groups equal digests and counts them, and equality is the only operation it performs on them. It never needs to know what any of them mean.

The salt that produced those commitments is not in the receipt either. What appears is salt_commitment_sha256, one distinct 64 hex value in book_ref. A party who holds the salt can confirm that this receipt was computed under that salt. A party who does not hold it cannot mount a dictionary attack against the commitments by trying candidate dependency names, because the keying material is absent.

Opacity is enforced by two gates instead of being trusted. COMMITMENT_OPACITY requires every commitment_hmac_sha256 in both the commitments array and the concentration array to match the strict 64 lowercase hex form, so no commitment slot can be repurposed to carry a readable label. It then scans a set of checked receipt values, which includes book_ref.book_digest_sha256, book_ref.salt_commitment_sha256 and every commitment digest from both arrays, against a vendor name pattern. The pattern is case insensitive and covers the word boundaries around openai, anthropic, google, microsoft, amazon, aws, azure, meta, bedrock, claude, gpt, gemini, llama and mistral. Any hit stops verification.

SALT_COMMITMENT_FORM requires salt_commitment_sha256 to be a valid 64 hex digest and requires it not to appear as any member commitment. That prevents the salt commitment being smuggled into the member set, where it would act as a known plaintext anchor against the rest.

The receipt envelope uses the shared typed receipt construction in src/typed/canon.js. The signed body is canonicalised with keys sorted recursively, arrays kept in order, no whitespace, and every code unit above U+007F escaped as a lowercase \uXXXX sequence, then digested as lowercase hex SHA-256 over the UTF-8 bytes. The Ed25519 signature covers the ASCII string

hive-receipt <receipt_id> <payload_sha256> <ts>

with hive-receipt as the domain separation label.

Grouping uses its own separator. The concentration computation keys each commitment as dimension followed by a NUL character, \u0000, followed by the commitment digest. The NUL cannot appear in either component, so two different dimension and digest pairs can never collide into one group.

The gates

Verification runs in this order and stops at the first failure.

1. SCHEMA. Validates the envelope against the portfolio exposure v1 schema, including the closed dimension enum and the boundary constant. A failure means the artifact is not a well formed instrument of this type.
2. ISSUER_KEY_MATCH. Resolves envelope.key_id in the trusted keyring. A failure means the key does not resolve there, or no resolver was supplied.
3. PAYLOAD_DIGEST. Recomputes the canonical digest of signed_body against payload_sha256. A failure means the body was altered after signing.
4. RECEIPT_ID. Requires the identifier to parse and its type segment to equal signed_body.receipt_type. A failure means the identifier and the body disagree.
5. SIGNATURE. Verifies Ed25519 over the signing string against the trusted key, then a caller supplied key if one is offered. A failure means no available key produced this signature.
6. SIGNER_IDENTITY. Fails when only a caller supplied key verified, reporting internally consistent bytes from an untrusted signer.
7. COMMITMENT_OPACITY. Requires every commitment digest to be an opaque lowercase SHA-256 form and rejects any recognisable model or vendor name in the checked receipt values. A failure means identifying information reached a field that must stay opaque.
8. MEMBER_COUNT_CONSISTENT. Counts commitments per dimension and rejects any dimension holding more commitments than the declared member_count. A failure names the dimension and both counts, and means the denominator is smaller than the population being divided by it.
9. MIN_COHORT. Requires every reported concentration row to have at least five members and names the offending dimension, digest and count. A failure means the receipt would disclose a group small enough to be reidentified.
10. CONCENTRATION_RECOMPUTE. Rebuilds the concentration rows from commitments and member_count, grouping by dimension and digest, computing share_ratio as the group count divided by member_count, dropping every group below five, and sorting by dimension then by digest. It then requires the receipt's rows to match row for row on all four fields and requires top_share_ratio to match. A failure means the reported concentration is not the concentration the commitments produce.
11. SHARE_RATIO_RANGE. Requires every share_ratio and the top_share_ratio to lie inside the inclusive range zero to one. A failure means a ratio was reported that cannot be a share of anything.
12. AS_OF_NOT_FUTURE. Requires book_ref.as_of not to follow evaluated_at. A failure names both instants and means the book was committed as of a moment that had not happened when it was evaluated.

The boundary

This receipt attests that concentration counts and share ratios were recomputed by this service over a set of opaque commitments supplied for one book as of a stated time, that no group smaller than five members was reported, and that this service received no insured identity, no dependency name, and no policy term. It does not attest that the commitments are correct, that they were computed honestly, that the book is complete, or that any member is insured at all. Because the commitments are opaque to this service by design, this service cannot detect a member that was omitted, duplicated, or mis committed. It does not measure, price, or opine on risk, does not constitute an actuarial analysis, a capital adequacy assessment, or a reinsurance recommendation, and it does not attest that a concentration reported here would produce a correlated loss.

That paragraph is a schema constant inside the signed bytes, checked at verification.

The middle sentence is the one that costs something to write and earns it back immediately. The design that makes this receipt privacy preserving is the same design that makes it blind. Because commitments are opaque, the service has no way to notice that one was fabricated, dropped or computed under a different rule. That is a real limitation and the instrument states it rather than letting a reader discover it.

Stating it makes the receipt more useful in a negotiation, not less. Consider the reinsurer. Without the enumeration, the reinsurer has to work out for itself what the receipt does and does not cover, and a cautious reinsurer will assume the smaller set. With the enumeration, the reinsurer knows exactly where to spend its diligence: it needs assurance about the commitment process at the cedent, and it does not need to re-audit the concentration arithmetic. The receipt tells the counterparty where the remaining risk lives. That is worth more than a broader claim nobody trusts.

The actuarial sentence does the same job in the other direction. A concentration of thirty percent in one dimension is a fact about counting. Whether it implies a correlated loss depends on the failure modes of the underlying dependency, on policy wordings and on judgment that belongs to underwriters. The receipt hands that judgment over untouched, so nobody can hold up a receipt as if it were an opinion on capital adequacy.

Adversarial cases

These are the real cases in test/portfolio-exposure.test.mjs.

A concentration group of three fails MIN_COHORT. The reporting party wants to show granularity and includes a group with three members. In a market where participants know each other, three is identifiable. The gate refuses the whole receipt rather than silently suppressing the row, so the failure is visible to the party who tried it.

A forged top share fails CONCENTRATION_RECOMPUTE. The direct attack is to leave the commitments honest and write a smaller top_share_ratio. The recomputation derives the rows and the top share from the commitments and the member count, compares row for row on dimension, digest, member count and share ratio, and finds the difference. The reported value is never an input.

A salt leaked as a commitment fails SALT_COMMITMENT_FORM. Placing salt_commitment_sha256 into the member commitment list would give an attacker a known value inside the commitment set to work from. The gate requires the salt commitment to be distinct from every member commitment.

A recognisable dependency name fails COMMITMENT_OPACITY. Somebody puts a readable provider name where a digest belongs, usually while debugging and never removed. The gate rejects both the wrong form and the recognisable name.

A future book time fails AS_OF_NOT_FUTURE. A book committed as of a moment after the evaluation is a book that was not observed. The gate compares book_ref.as_of to evaluated_at.

More commitments than the declared book count fails MEMBER_COUNT_CONSISTENT. This is denominator manipulation. Shrink member_count and every share ratio grows, or inflate the commitment list under one dimension and the same happens. The gate catches the case where any single dimension holds more commitments than the whole book is declared to contain.

Two positive cases anchor the arithmetic: a synthetic two hundred member book verifies, and the recomputed top share on that book is twenty two percent. The second is worth noting because it is a test on the value itself rather than on the plumbing.

Performance

From hive-verifier-api/benchmarks/results-latest.json, measured at 2026-08-09T22:28:01.099Z at commit e167719f7d815809c6f55c5dde4495edf1c5615f over 200 iterations:

Local harness measurement on one machine and one Node version. The run recorded Node v20.20.1 on linux/x64 with two Intel Xeon cores at 2.90 GHz. It is a reproducible measurement of this code, not a production latency guarantee. This is the fastest mint of the deployed types in this run, which follows from a verification path that does no nested receipt verification. The schema permits up to 500000 commitments, and the recomputation is linear in that count, so a large book will cost more than the benchmark fixture.

How to run it

• Host: https://thehiveryiq.com/v1
• Verify route: /verify/portfolio-exposure, no credentials required
• Mint route: /mint/portfolio/exposure, requires Authorization: Bearer $HIVE_TYPED_MINT_TOKEN

curl -sS -X POST https://thehiveryiq.com/v1/verify/portfolio-exposure -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

Mint fails closed with 401 when the token is missing or wrong.

Where it sits in the canon

Family: risk evidence. Category: typed receipt contract.

It shares a dimension vocabulary with the evaluation and provenance instruments. eval_administrator as a concentration dimension points at the same relationship that the Evaluation Administration Receipt records for a single subject, so a book with a heavy concentration of one administrator can be read alongside those receipts.

It does not replace an exposure management system. It signs a result computed over commitments that some other system produced.

It does not replace the underwriting file, the actuarial analysis or the capital assessment, and the boundary rules all three out in the signed bytes.

Status

production_deployed.