Ukiyo Network · Evidence layer
Fulfillment Oracle roadmap
Detailed plan: private prototype → Sepolia → multi-source industrial truth
1. Mission & boundaries
Never moves funds · Never sets policyFuses plant signals into a continuous Fulfillment Probability Score and publishes cryptographically attested evidence. Agency and SPOOL consume it; Oracle never advances capital.
| Holds | Produces | Never does |
|---|---|---|
| Connectors, scorers, attestation keys, feed health | Attested scoreBps, explanations, oracle state | Move funds, decide credit policy, hold capital |
2. Current state
Private prototype · Local MVP stubs- Site brief + white paper published
- Local MVP (MVP workspace): ERP fixture, weighted score, fail-closed, attest stub, tests
- Missing: live EIP-712 on Sepolia, real ERP connector, vision/logistics
Pilot locked: Electronics · SUP-ACME-01 · PO-2026-0001 · Arbitrum Sepolia 421614
3. MVP scope (deep)
In scope
- Single ERP/CSV fixture (units, due date, defects, supplier history)
- Weighted FPS 0–10000 bps + explanation
- EIP-712 Score: orderId, scoreBps, timestamp, dataRoot
- Fail-closed: Normal / Degraded / Paused / Recovering
- ScoreRegistry on Sepolia + off-chain API
- Freshness window 900s
Out of scope
- Vision · logistics multi-source · multi-plant · L1 root · full PyTorch model
Score weights
| Feature | Weight | Source |
|---|---|---|
| Deadline slack | 35% | dueDate, remaining units |
| Production velocity | 30% | unitsCompleted vs elapsed |
| Quality proxy | 15% | defectRateBps |
| Supplier history | 15% | on-time rate |
| Lead-time risk | 5% | plannedLeadDays |
Fail-closed
| State | Trigger | Publish | Effect |
|---|---|---|---|
| Normal | ≤5 min | Yes | Full score |
| Degraded | 5–15 min | Yes + uncertainty | −500 bps haircut downstream |
| Paused | >15 min / invalid | No | Advances blocked |
| Recovering | Fresh after pause | Yes + haircut | −500 bps one cycle |
4. Phases
Phase 0 · Foundation
Schema, fixture, score, fail-closed, local attest, tests. Exit: stale path demo green.
Phase 1 · Weeks 1–2 · Sepolia rail
- Real EIP-712 + ECDSA
- Deploy ScoreRegistry
- Publisher: ingest→score→sign→publish
- Read API for Agency/dashboard
Exit: Agency reads verified Sepolia scores.
Phase 2 · Months 3–4 · Real plant
- One mid-market ERP connector
- Plant-scoped credentials
- Replay logs + silent-feed alerts
- SLO: score age p95 < 5 min
Phase 3 · Months 5–8 · Multi-source
- Vision throughput/stoppage
- Logistics milestones
- Fusion + agreement threshold
- Calibration / drift monitors
- Optional k-of-n signatures
Phase 4 · Months 9–12+ · Production network
- L2 freshness + L1 Merkle root
- Multi-node weighted publish
- Vertical models · key rotation
5. Tickets
| ID | Work | Acceptance |
|---|---|---|
| ORC-1 | ERP schema + fixture | Validates; orderId stable |
| ORC-2 | Score engine | High/mid/low tests |
| ORC-3 | EIP-712 attest | Recovers oracle address |
| ORC-4 | Fail-closed FSM | Stale → no publish |
| ORC-5 | ScoreRegistry Sepolia | Publish/read on-chain |
| ORC-6 | ERP production connector | Phase 2 |
| ORC-7 | Replay + auditor export | Phase 2 |
| ORC-8 | Vision adapter | Phase 3 |
| ORC-9 | Logistics adapter | Phase 3 |
| ORC-10 | Fusion threshold | Phase 3 |
| ORC-11 | Calibration/drift | Phase 3 |
| ORC-12 | L1 root anchor | Phase 4 |
| ORC-13 | Multi-node median | Phase 4 |
6. Tech notes
Score(bytes32 orderId,uint16 scoreBps,uint64 timestamp,bytes32 dataRoot)
Services: ingest-worker · score-service · attestor · publisher · health-monitor
7. Risks
| Risk | Mitigation |
|---|---|
| ERP poisoning | Multi-source later; anomaly; fail-closed |
| Silent feed | Age → Paused |
| Key compromise | Dedicated key → HSM/MPC |
| Overconfidence | Explainability; Degraded uncertainty |
| Cross-chain replay | EIP-712 chainId + verifyingContract |
8. Next 2 weeks
- ORC-5 ScoreRegistry on Sepolia
- Real EIP-712 verify in publisher
- Oracle signer runbook