Disputes & SLA
What this page covers:
How a disputed fact is handled before and after money would move: the SLA clocks we enforce, and the exact outcomes the rail supports. Same law everywhere:
No EMT, no funds (Trade):
Must-fund before shipping: top-up after Pre-Ship EMT
One-Claim: atomic reserve→finalize
Locked EDSD → Unlocked EDSD only on proof:
50% of every protocol fee burns in EDM at the event: never discounted
Burns on already-paid events are immutable: corrections are append-only.
A) Entry points (how a dispute starts)
1) Buyer review window (Trade, optional):
Window 0–4h per stage (governed):
Buyer hits Block: stage pauses; case opens with a reason code (e.g., BL_SEAL_MISMATCH, LOT_LIST_MISMATCH, TEMP_OUT_OF_RANGE, DOC_MISSING, PENDING_FUNDS).
Do nothing: auto-release (no dispute).
2) Gate FAIL (Trade & Tokens):
PoV Gate rejects dossier: serialization/format (E_CANONICAL_DRIFT, E_FORMAT_INVALID, E_SET_NOT_SORTED), quorum/freshness (E_QUORUM_MISSING, E_STALE_ATTEST, E_KEY_REVOKED), identity/sensors (E_SEAL_MISMATCH, E_LOT_LIST_MISMATCH, E_TEMP_OUT_OF_RANGE), uniqueness/funding (E_ONECLAIM_TAKEN, E_PENDING_FUNDS).
Money never moves: case is evidence-first.
3) Revocation (Trade & Tokens):
A counted attestation (or registry mirror) is withdrawn/changed: we freeze only downstream slices/listings; paid slices and completed retirements stand. (See SLAs below.)
4) Tokens post-settle realities:
Listings can freeze before settlement: after settlement/retirement there’s no “trade reversal”: program rules require replacement or compensating retirement, linked on the proof page.
B) The Dispute Pack (single source of truth)
When a case opens, the platform assembles a Dispute Pack:
Checklist (schema) for the stage/listing:
Canonical bytes + PoV hash; required file digests:
Who-signed-what (role, entity, key id, timestamps):
One-Claim preview & status:
Variance table (if Trade stage supports it):
Proposed fix menu (correct file, re-inspect, variance, replacement, cancel/refund):
Both sides see the same dossier: no email archaeology.
C) SLA clocks (defaults; lane-specific bounds in brackets)
Step
Target
Applies to
Notes
Accept & Freeze
≤ 15 min [5–30]
Revocation; buyer Block
Freeze only downstream slices/listings; banner + webhooks
Dispute Pack ready
≤ 4 h [1–8]
All disputes
Checklist + canonical bytes + signatures + fix paths
Corrective submission window
≤ 24 h [12–48]
Supplier/attestor
Upload corrected doc / book re-inspection / variance request
Re-inspection
24–72 h [24–120]
Neutral (SGS/Intertek/BV etc.)
Priority lists for time-sensitive lanes
Decision & resume
≤ 24 h [12–36]
Platform/neutral
Mint corrective EMT / replacement mirror; unfreeze
Mirror replacement SLA
≤ 48 h [24–120]
Registries
Freeze clears on ACTIVE replacement
Severity classes:
S1 (critical): On-Board/Customs/Arrival facts; large slice frozen or public listing risk → fastest clocks; paging.
S2 (material): Pre-Ship or listing metadata → normal clocks.
S3 (informational): Non-blocking metadata → batched, no freeze.
D) Outcomes (only these five exist)
1. Resume as-is: corrected/missing file posted; Gate PASS; EMT mints; Release proceeds.
2. Variance (Trade): Exceptions computes adjusted amount (short-shipment, damage, shelf-life). We Deduct & Release the adjusted slice; remainder cancels or is replaced.
3. Replacement: corrective dossier mints corrective EMT (Trade) or replacement mirror/token (Tokens), linked via replaces: old_claim_id. Downstream slices resume.
4. Cancel & refund (Trade): if no fix exists before proof, frozen Locked EDSD returns per MPA; fee escrow untouched for that stage.
5. Compensating action (Tokens): for post-retire program changes: record and (if needed) execute a compensating retirement; original receipt remains with an addendum.
Never: mutate history, claw back paid slices (except contractual set-off for proven fraud), or un-retire a token.
E) Fees, burns, & cash during disputes
No protocol fee until Release (Trade) or Settle/Retire (Tokens):
No burn until that event: prior burns (on earlier paid slices or fills) are immutable.
Assignment (1%): posts only when the linked stage releases.
Cash-out (0.5%): posts only when the supplier’s schedule completes.
F) Abuse & fairness controls
False-block rate (buyer review used, dossier later passes unchanged): tracked; if > 1%, buyer tier downgrades and review window can be tightened.
Revocation spam (revokes with “no change” outcome): rate-limited; attestors risk suspension/ban and bond slashing (if bonded).
Quorum fallbacks (governed): if a role is down (S1), an alternate path (e.g., PORT_COMMUNITY_SYSTEM) may be allowed for a short window; all alternates are public.
Self-trade/wash-trade (Tokens): blocked; patterns flagged, accounts suspended.
G) KPIs (what we publish)
Detect→freeze p95: ≤ 15 min
Pack ready p95: ≤ 4 h
Corrective submit p95: ≤ 24 h
Re-inspect p95: ≤ 72 h
Decision→unfreeze p95: ≤ 24 h
Disputes / 100 gates: ≤ 3
False-block rate: ≤ 1%
Revocation rate / counted atts: ≤ 1% per lane
Audit replay success: 100% (proof pages + blobs)
H) APIs & webhooks (wire your ops)
APIs:
POST /v1/trade/proof/{order}/{stage}: PASS/FAIL + reason (opens case on FAIL)
POST /v1/trade/release/{order}/{stage}: consumes Gate PASS; pauses if Blocked
POST /v1/exceptions/{case_id}/variance (Trade):
POST /v1/trade/replace (corrective EMT):
POST /v1/tokens/replace (mirror/token):
POST /v1/pov/revoke (signed revocation; registry/attestor keys):
GET /v1/exceptions/{case_id}: clocks, severity, Dispute Pack links
Webhooks:
trade.milestone.passed → trade.release.posted: amount, fee, burnHash
trade.slice.frozen / trade.slice.unfrozen:
tokens.listing.frozen / tokens.listing.unfrozen:
pov.attestation.revoked: reason, scope
sla.revocation.breached: who missed what
exceptions.case.updated: state machine: OPEN → FIX_SUBMITTED → REINSPECT → DECIDED
I) Operator playbook (fast, actionable)
If you Block (buyer): enter a specific reason; expect a clock; be ready to approve once corrected.
If you’re blocked (seller): open the case; use the Dispute Pack to submit the exact fix (correct file, re-inspect slot, or variance request).
Cold-chain: keep device keys & Merkle proofs handy; don’t wait to assemble.
Funding: if banner shows PENDING_FUNDS, no release will occur—top-up first.
After resume: verify receipt shows fee, net, and burn hash; Trade ledger must reconcile escrow.
Plain recap
Last updated