AEGIS

A weather risk reading whose method froze at publication and whose every input carries a signature. It sells readings, never cover.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Agricultural cooperative. Hail chances per district, per week, read before the nets go up.
• Risk and planning teams. Event reports with signed sources, for models that stay your own.
• Logistics and event planners. Storm and delay chances from signed feeds, with disputes that have teeth.
• Auditors. A method you can replay instead of a model you have to trust.

The problem

Weather risk is argued after the fact because the method, the data and the fee live in three systems and nobody can replay how a number was made. Every party has an incentive to remember the method differently, and the method is a PDF.

The system

AEGIS is the risk desk of a growers’ cooperative with 2,400 greenhouse operators. It reads the weather service’s and the satellite operator’s signed readings and publishes a hail chance per district, per week, by method v4. The method is an instantiated template version: it froze when it was published, every reading the cooperative orders copies it, and neither side can rewrite how a number was made. The cooperative pays per reading through escrow on the ledger, released when the signed report arrives.

On the night of 14 June, hail crosses Emsland. The oracle agents sign what they saw; the event gate checks the readings against method v4 and issues 61 verified event reports before the growers wake up, one per affected district, each with its sources and their signatures. The 62nd district contests its report, so its fee does what contested money does here: it stops, holds in escrow through a four-phase dispute, and moves exactly once when the ruling lands. What a grower decides on a report stays the grower’s own business, outside the protocol.

The cast and their ceilings

The flow, step by step

1. The method froze at publish. Each order copied it. The fee waits in escrow.
2. 02:12. Hail crosses Emsland, and the oracles sign what they saw.
3. Readings against the frozen method. The event is verified, and the report is issued.
4. The escrow releases the fee for the delivered report.
5. 61 verified reports before sunrise, each fee carved and logged by the same rail.

Each need, mapped to a live primitive

The attack this chamber refuses: The after-the-fact rewrite

The attack. After the hail, the desk tries to soften step 9 of method v4, so that last week’s chance reads closer to what happened.

Why it fails. Publishing is an irreversible freeze and instantiation copies rather than references. Every delivered reading carries the method it was made with, and there is no reference for a rewrite to travel through.

What actually happens. The desk can publish version 5 for next season. Version 4, and every reading made with it, is beyond reach, and the desk’s track record is scored against what it actually said.

Deep architecture

AEGIS deployed: the analyst’s frame holds the frozen methods, the reading escrow and the event gate; the cooperative and its auditor read a signed replica on their own side; the weather arrives raw underneath and leaves the oracles as signed attestations. Nothing in this drawing is a report anyone files afterwards. The trace replays one season, publish to verified report to the three readers.

The deployment, traced

1. The risk desk publishes method v4. Publishing is an irreversible freeze.
2. The cooperative orders a season of readings: the order copies the frozen method, and the fee waits in escrow, on the ledger.
3. The event gate holds the frozen method. Nobody argues about a PDF, because there is no PDF.
4. All season, the weather arrives raw.
5. The oracles sign what they saw. An attestation has an identity, not just a value.
6. 02:12, 14 June. Hail crosses Emsland. The readings meet the method; the gate issues the report and the escrow releases its fee.
7. 61 verified reports land before the growers wake up. The 62nd is contested, so its fee stops in escrow and waits for the four-phase ruling.
8. The back office receives evidence, not spreadsheets to reconcile.
9. The season mirrors out as signed events.
10. The replica carries the same method, the same reports, the same refusals.
11. The cooperative reads all season. Every number traces to a signed source.
12. The auditor reads the same replica. One ledger, three readers, nothing to reconcile.

Adoption, phase by phase

Discover: Your method, re-read as a schema.

• Runs. Nothing. One risk product redrawn as a template, an event table and a fee rule.
• Agents. None. The analysts argue about the event table, and that argument is the deliverable.
• Integrates. Nothing. Planning tools and the weather licences stay as they are.
• Deliberately not yet. Nothing is published, so nothing is frozen.
• Proof that gates the next phase. One historic season replayed against the drafted method reproduces every event decision, including the contested one.

Pilot: One district, real readings, pocket fees.

• Runs. A hosted registry seat, or a single-VM frame if the escrow must sit inside your walls from day one.
• Agents. risk-desk, two oracle agents with their own identities, event-gate. The auditor is not connected yet.
• Integrates. Licensed weather feeds into the oracles; orders flow in from the cooperative’s planning tool via the SDK.
• Deliberately not yet. Pocket limits. One product. Disputes are drilled, not yet real.
• Proof that gates the next phase. A staged storm produces verified reports for a pilot district with no human in the release path, and the ledger shows every fee.

Production: The method becomes a fact the cooperative watches.

• Runs. A sovereign frame in the analyst’s estate; the escrow and the season ledger live under your law.
• Agents. The full cast, plus coop-watch with read-only ceilings. The oracles attest under SPIFFE identities.
• Integrates. Orders flow continuously; the evidence chain exports to the back office instead of month-end reconciliation.
• Deliberately not yet. The auditor still reads exports. The next phase makes it a peer.
• Proof that gates the next phase. The cooperative’s agent reads the season and its view never disagrees with the analyst’s books, because both are the same ledger.

Federation: The auditor reads the replica, not an export.

• Runs. Unchanged. The auditor connects its own registry, or a seat.
• Agents. auditor-watch reads the signed replica of the season, all season.
• Integrates. Each new reader is a signed card and a licence. Nothing is exported by hand.
• Deliberately not yet. Nothing structural. New products are template versions.
• Proof that gates the next phase. A season closes with the auditor citing the replica rather than an export, and no reconciliation audit is scheduled.

Sizing

One event, weather to verified report

sequenceDiagram
  participant WX as weather feed
  participant Ora as oracle agents
  participant Gate as event gate
  participant TEG as reading escrow
  participant ES as event ledger
  participant Rep as signed replica
  WX->>Ora: raw readings, all season
  Ora->>Gate: signed attestations (SPIFFE identity)
  Gate->>Gate: readings vs frozen method (v4)
  Gate->>TEG: report issued, per district
  TEG-->>ES: fee released + logged, append-only
  ES-->>Rep: signed mirror update
  Rep-->>Rep: cooperative + auditor read, cannot write
  Note over TEG: a contested report's fee stops in escrow, four-phase dispute

Topology, as declared

flowchart LR
  T["method template<br/>publish = freeze"] -->|"instantiate copies"| R["reading order<br/>method v4"]
  R -->|"fee at order"| TEG["TEG escrow"]
  O["oracle agents<br/>SPIFFE identities"] -->|"signed attestations"| G{"event gate"}
  G -->|"report issued"| TEG
  TEG -->|"release on delivery"| ES[("event store")]
  DIS["dispute, 4 phases"] -->|"ruling drives split, once"| TEG

Standing it up

• Infrastructure. A hosted registry, or the analyst’s own frame from pre-built images.
• Agents. 4 roles. The oracles are the interesting ones.
• Integration. Weather data licensing and the cooperative’s planning tools. The risk model stays yours.

Runs beside what you already have

• The cooperative’s planning tools. Plans stay where they are made. The method, the signed sources and the fee for each reading are the protocol's half.
• Weather and event data feeds. Licensed feeds land as signed oracle attestations. The method reads only attested values.
• Reporting and archives. Verified event reports export with their sources and signatures, instead of screenshots of a forecast.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• AEGIS sells readings and verified event reports. It sells no cover, pays no claims and holds no regulatory authorisation.
• The protocol carries the method, the signed sources and the fee for each reading. What anyone decides on a reading stays theirs, outside the protocol.