TRANSACTIONAL TRUST · VERIFIED #027

The model was right. Then the model changed.

An artifact can be valid under the authoritative causal model at production time and still become unsafe to apply after model authority advances. This benchmark changes the model while holding every business input constant.

Only the model changed

business state:
price = 10
limit = 30
tax_rate = 2
UNCHANGED

model-v1:
price + limit
output = 20

        ↓ model authority transition

model-v2:
price + limit + tax_rate
output = 22

The old artifact was not born stale. It was correct under model-v1 when produced.

Unsafe: let the historical model validate itself

artifact.model = v1
price and limit still match v1 fingerprint

→ adoption rows = 1
→ HTTP 200
→ committed output = 20  ❌

current model-v2 requires = 22

Integrity, ownership and fencing all remain valid. The failure is stale model authority.

Safe: compare model identity first

artifact model = v1
current model = v2
model digest mismatch

→ model_version_conflict
→ adoption rows = 0
→ external effects = 0

recompute under v2
→ output = 22
→ one committed effect ✅

I67–I70

• I67 — Model valid then ≠ model valid now.
• I68 — Artifact must bind the causal-model identity that authorized its computation.
• I69 — Adoption must compare artifact model identity with current model authority before value fingerprint.
• I70 — Model drift or unknown compatibility requires hold, revalidation, recomputation, or explicit compatibility proof before consequence.

HISTORICAL SELF-CONSISTENCY ≠ CURRENT MODEL AUTHORITY.

Evidence

GitHub Actions run: 31584552547
Artifact ID: 9136540015
Artifact digest:
sha256:1feadce415460da2149452ba614c8bea6dd5001df423bea2e603edb97c2413bd
Score: 10/10

This is a deterministic protocol benchmark, not production safety certification or a vulnerability claim against PostgreSQL or another external product.