Dispute Models

A Type 6 Presence Adjudication System is not secured only by correct initial judgment.

It is secured by the possibility of correction.

That is the starting point of this aspect of design. In systems where presence claims may carry economic, legal, or institutional consequence, it is never enough to say that verifiers will simply evaluate claims honestly the first time. A serious system must also ask what happens when they do not. It must ask what happens when claims are mistaken, fraudulent, collusive, ambiguous, adversarial, or strategically manipulated.

That is the role of dispute.

A dispute model is the part of a Presence Adjudication System that defines how challenged claims are reopened, who may challenge them, on what grounds, under what timing, with what evidence, at what cost, and with what consequences. It is not an optional feature for edge cases. It is one of the core ways a Type 6 system turns procedural claims of honesty into something more durable and credible.

Without dispute, a system may still verify. It may still publish. It may still finalize. But it cannot convincingly claim to be adversarially robust.

Why Dispute Matters

Disputes matter because verification is not omniscience.

Even a system with strong proof architecture, bounded claims, and economically exposed verifiers can still fail. Measurement inputs may be fabricated. Claims may be badly formed. Proofs may be valid with respect to dishonest inputs. Verifiers may collude. Watchers may observe inconsistencies only after initial adjudication. Real-world context may reveal that a formally accepted claim was substantively unsound.

A system designed only for undisputed cases is not yet a serious adjudication system.

The true test comes when:

• incentives diverge
• facts are contested
• counterparties disagree
• the stakes are high enough that dishonesty becomes attractive

In such settings, dispute is not a secondary repair mechanism. It is part of the architecture by which the system remains credible.

What a Dispute Model Does

A dispute model answers several interlocking questions.

It defines:

• who may challenge a claim or outcome
• what may be challenged
• when a challenge is still admissible
• what burden the challenger must meet
• what evidence can be introduced on challenge
• who adjudicates the dispute
• what penalties attach to bad behavior
• what effect the dispute has on finality

These are not minor implementation choices. Together, they determine whether the system can actually convert detection into correction.

A system with a nominal challenge function but no economically viable path to use it does not really have a dispute model. It has a symbolic gesture toward one.

Dispute Is Not the Same as Governance

It is important to distinguish dispute from governance.

A dispute model concerns the adjudication of particular claims or outcomes under existing rules.

Governance concerns the power to alter the rules themselves.

If this distinction collapses, the system becomes unstable in an important way. Instead of saying, “this claim is disputed under the current protocol,” the system begins to say, “this outcome may be changed if powerful actors decide to intervene.” That is not dispute in the architectural sense. It is discretionary override.

A mature Type 6 PAS should therefore treat disputes as rule-bound processes internal to the adjudication architecture, not as occasions for ad hoc governance rescue.

Governance may still matter at the margins. But if every meaningful dispute eventually becomes a governance question, the finality and neutrality of the system are both weakened.

What Can Be Disputed?

Not every part of a PAS is disputed in the same way.

Different systems may allow challenge to different layers of the adjudication stack. For example, a challenger may dispute:

• the validity of a proof
• the integrity of an attestation
• the admissibility of a claim
• the conduct of verifiers
• the composition of a committee
• the factual basis of an observation
• the interpretation of protocol rules
• the finalization of an outcome

These are not all the same kind of dispute.

Some are formal disputes, where the issue is whether the evidence satisfies explicit technical predicates.

Some are procedural disputes, where the issue is whether the system’s own rules were followed correctly.

Some are substantive disputes, where the issue is whether the accepted claim corresponds to the real-world event it purports to establish.

A mature PAS should be clear about which of these it supports directly, which it supports only partially, and which it leaves to external institutions.

Timing: When Must a Challenge Be Raised?

Disputes are inseparable from time.

A challenge that can be raised forever may destroy usability. A challenge window that is too short may destroy meaningful security. A challenge process that exists only in theory, but expires before a watcher could realistically gather evidence, does not provide much real correction.

This is why challenge timing is one of the central design choices in a Type 6 PAS.

A dispute model must determine:

• when a claim becomes challengeable
• how long the challenge window remains open
• whether different classes of claims have different windows
• whether stronger evidence can justify later reopening
• when finality hardens beyond ordinary dispute

These choices affect not only security, but also capital efficiency, operational latency, and downstream reliance.

Fast systems often want short dispute windows. Secure systems often want enough time for independent review. Mature systems must balance these pressures without pretending the tradeoff is costless.

Who Gets to Challenge?

The design of challenger eligibility matters enormously.

A dispute model may allow challenge by:

• any participant
• designated watchers
• economically bonded challengers
• affected counterparties
• verifiers or committee minorities
• trusted institutional actors
• some combination of the above

Each model has implications.

An open challenge model may increase adversarial robustness, but can invite spam or griefing unless challenge costs are well designed.

A designated watcher model may improve coordination, but creates dependence on a narrow monitoring set.

A counterparty-only model may reduce noise, but can miss fraud that no directly affected party has sufficient incentive or information to challenge.

A good Type 6 PAS should be explicit about why its challenger class is defined as it is. The best answer is rarely “whoever happens to be there.” It should reflect the actual security logic of the system.

Burden of Challenge

Not every challenge should be equally easy.

If challenges are costless and unconstrained, dispute can become a denial-of-service vector. If challenges are too expensive or too burdensome, then correction becomes mostly theoretical.

A serious dispute model therefore needs a carefully chosen burden of challenge.

This may include:

• a stake or bond posted by the challenger
• a minimum evidentiary threshold
• a requirement to identify a specific procedural or substantive defect
• penalties for frivolous or malicious disputes
• differentiated thresholds by claim class

The aim is not to discourage challenge in general. It is to make challenge serious.

A serious challenge mechanism should be open enough that bad outcomes can be contested, but disciplined enough that the dispute layer does not become the system’s main attack surface.

Evidence Under Dispute

A system’s dispute model reveals a great deal about what it truly believes counts as evidence.

Some systems permit only the original proof object to be re-examined.

Others allow:

• selective reveal of committed data
• counter-evidence from challengers
• new attestations
• procedural audit records
• committee transcript or signature review
• measurements previously hidden in ordinary adjudication mode

This matters because many systems appear privacy-preserving in ordinary operation only because they silently assume richer evidence will become available under challenge.

That is not necessarily wrong. It may be exactly the right design. But it should be explicit.

A good dispute architecture distinguishes between:

• ordinary evidentiary mode
• challenge mode
• escalation mode

Without that layered structure, privacy and dispute often end up working against one another.

Who Adjudicates the Dispute?

A dispute model also has to answer the reflexive question: who adjudicates the dispute about adjudication?

Several models are possible.

Internal Re-Adjudication

The original verifier set, or a subset of it, re-examines the claim.

This is simple, but may be weak if the original concern is verifier misconduct or collusion.

Expanded Committee Review

A new or larger committee reviews the challenged claim.

This can improve independence, but may increase latency and cost.

Challenger / Defender Structured Contest

The dispute becomes an adversarial proceeding in which the original outcome is defended and the challenger must prove a defect.

This is often attractive in systems where formal challenge grounds can be expressed clearly.

Escalation to Specialized Adjudicators

Some systems may have a distinct dispute layer or specialized dispute committees.

This can improve expertise, but also risks creating a second authority center whose own incentives and capture risks must be considered.

External Institutional Escalation

At some point, some disputes may leave the system entirely and enter courts, regulators, or contractual processes.

A Type 6 PAS should be honest about where that boundary lies. No serious system should pretend that all disputes can always remain internal forever.

Dispute and Economic Discipline

A dispute model is only strong if dispute outcomes matter.

That usually means some combination of:

• slashing dishonest verifiers
• penalizing false attestations
• rewarding successful challengers
• penalizing frivolous disputes
• reversing or voiding bad outcomes
• delaying or invalidating downstream reliance

This is where dispute meets the security-capital surface directly.

A system that allows challenge but imposes no meaningful consequence on proven dishonesty is inviting strategic abuse.

Likewise, a system that punishes challengers too severely for failed disputes may chill the very vigilance its security depends on.

A mature dispute model must therefore be economically symmetrical enough that:

• honest challenge is worth bringing
• dishonest adjudication is worth avoiding
• frivolous challenge is worth discouraging

That is a demanding balance, but it is the substance of credible dispute design.

Common Dispute Failure Modes

Several failure modes recur in immature systems.

Symbolic Challenge Rights

The protocol allows dispute in principle, but watchers lack the information, time, or incentives needed to use it.

Excessive Friction

Challenges are so expensive or procedurally complex that only obvious fraud is ever contested.

Frivolous Griefing

Challenge is so cheap or weakly filtered that it becomes a source of delay, harassment, or denial of service.

Collusive Closure

The parties meant to adjudicate disputes are too aligned with the original decision-makers to provide real correction.

Governance Substitution

Instead of rule-bound dispute, the system relies on discretionary intervention whenever important cases arise.

Privacy Collapse Under Challenge

The system is “privacy-preserving” only until the first meaningful dispute, at which point routine challenge effectively requires full behavioral exposure.

These failure modes are useful to name because they show how easily a superficially well-designed PAS can fail at the moment dispute becomes real.

Evaluating a Dispute Model

A Type 6 PAS should be judged by questions such as these:

Dimension	Question
Accessibility	Can legitimate challengers actually use the dispute process?
Timing adequacy	Is the challenge window long enough to permit real review?
Evidentiary depth	Can the system examine enough material under dispute to correct bad outcomes?
Economic balance	Are honest challenges rewarded and frivolous ones discouraged?
Independence	Are dispute adjudicators meaningfully distinct from those whose decisions are under challenge?
Privacy discipline	Does dispute preserve bounded disclosure as far as possible?
Finality compatibility	Does dispute fit coherently with the system’s finality model?
Governance boundedness	Are disputes handled under rules rather than ad hoc override?
Procedural clarity	Is it clear what can be challenged, by whom, and on what grounds?
Correction power	Can a successful dispute actually alter the outcome in a meaningful way?

These questions help separate systems that merely mention dispute from systems that genuinely rely on it as part of their security model.

What a Good Dispute Model Looks Like

A good dispute model does not assume that every claim will be challenged, nor that every challenge will succeed. It creates a credible possibility of correction strong enough that primary adjudicators must take it seriously.

In practice, that often means:

• challenge rights are real and usable
• ordinary finality is delayed just enough for meaningful contestation
• challenger incentives are economically viable
• evidentiary escalation is available without becoming indiscriminate
• disputes are adjudicated independently enough to matter
• successful challenge leads to meaningful correction and penalty
• governance does not sit silently above the process as a routine override layer
• privacy remains disciplined even when adversarial review becomes necessary

A system with these properties may still experience bad outcomes. But it is at least architected to expose, contest, and correct them rather than merely hope they do not occur.

Why This Matters for the Rest of the Design Space

Dispute models sit near the center of Type 6 design because they connect the entire architecture.

They depend on trust models because dispute is one of the main ways trust assumptions are disciplined.

They depend on proof architectures because proof design shapes what can be challenged and what must remain opaque.

They depend on privacy / verifiability tradeoffs because dispute often forces the system to decide when deeper disclosure is justified.

They depend on finality surfaces because finality is only credible if dispute has a meaningful chance to operate before closure hardens.

They depend on security-capital surfaces because challenge is how capital-backed penalties become real rather than symbolic.

They depend on governance because poor governance can quietly hollow out even a formally elegant dispute process.

That is why dispute is not a peripheral page in this section. It is one of the main ways a Type 6 PAS proves that it deserves to be relied upon at all.

Conclusion

A Type 6 Presence Adjudication System is credible not only because it can adjudicate, but because it can be challenged.

That is the role of a dispute model.

It converts the possibility of error, fraud, or collusion from a fatal weakness into a design problem: who may object, how, when, with what evidence, and with what consequences.

A mature system answers those questions clearly. It does not hide them in procedure, defer them to discretion, or pretend they are edge cases.

Because where presence claims matter, dispute is not an afterthought.

It is one of the conditions under which finality, security, and trust become believable.