Parametric Insurance

Policy body

ParametricPolicy is a closed camelCase body inside a SignedExportEnvelope, and a signed policy is capped at one mebibyte of canonical bytes.

// schema: chio.parametric.policy.v1
pub struct ParametricPolicy {
    pub schema: String,
    pub issued_at: u64,                      // in [bound_at, effective_from] of the coverage
    pub subject_key: String,
    pub bound_coverage_body_digest: String,  // 64-hex
    pub bound_coverage_envelope_digest: String,
    pub coverage_authority_id: String,
    pub payer_id: String,
    pub beneficiary_id: String,
    pub funding_facility_id: String,
    pub pre_action_authority_digest: String,
    pub coverage_amount: MonetaryAmount,     // units > 0, ISO currency
    pub effective_from: u64,
    pub effective_until: u64,                // > effective_from
    pub window_anchor: u64,                  // <= effective_from
    pub window_seconds: u64,                 // > 0
    pub max_checkpoint_lag_seconds: u64,     // > 0
    pub predicate: TriggerPredicate,
    pub payout_schedule: PayoutSchedule,
    pub payout_mode: ParametricPayoutMode,
    pub payout_rail: ParametricPayoutRail,   // { kind, rail_id, destination_account_digest }
    pub evaluator_authority: EvaluatorAuthorityRef,  // { authority_id, key_id, key_epoch }
}

The anchor and the window fix the evaluation grid. validate requires effective_from and effective_until to sit a whole number of windows after window_anchor, so the effective period is an exact run of windows. window_at maps a cutoff inside that period to the one window containing it by integer division, then re-checks that the result starts on the grid and lies inside the period. The evaluator never chooses its own interval.

VerifiedParametricPolicy::verify binds the policy to a canonical SignedLiabilityBoundCoverage the caller supplies as trusted input. It checks the coverage signature against the trusted coverage-authority key, resolves the provider id from the placement lineage and compares it to the trusted authority id, then matches the policy to that coverage field by field: both digests, the payer, the funding facility, the pre-action authority digest, the payout rail, the evaluator authority, the coverage amount, and the effective window.

Two comparisons are derivations: beneficiary_id and subject_key must both equal the subject key resolved from the bound risk package, so the payee is the insured subject. ParametricPayoutMode is Automatic, which opens the claim payable, or Contestable, whose only field is a positive window_seconds. The claim record stores its own opened_at from the trusted clock and computes contest_deadline by checked addition.

Trigger predicates

TriggerPredicate is internally tagged: the wire object carries a kind of guard_denial_rate, drift_severity, or settlement_failure_count, with its own camelCase fields beside it. Each class names the evidence sources it requires, and a corpus carrying a different set of sources is rejected before any counting.

TriggerPredicate::validate rejects a zero threshold on every class and a threshold_bps above 10_000. The denial rate takes checked_mul(10_000) on the denial count and returns a typed error in place of a wrapped or saturated value, then divides by the total. SettlementFailureCount counts only when every obligation id in the receipt range appears exactly once in the reconciliation range and the two sets are equal, so a partial reconciliation view cannot under-report failures.

A predicate reports a tagged TriggerMagnitude: BasisPoints { value } for the denial rate and Count { value } for the two count predicates.

Payout schedules

PayoutSchedule is Fixed { amount } or Linear { base, per_unit_minor, magnitude_unit }, tagged the same way. Load-time validation requires the schedule currency to equal the coverage currency, a positive per_unit_minor, and a linear magnitude_unit equal to the unit the predicate reports.

amount = checked_add(base.units, checked_mul(per_unit_minor, magnitude.value))

Overflow in either checked operation is ScheduleOverflow, which produces no claim and no payout. A zero result is rejected as an invalid amount, and a result above coverage_amount.units is ScheduleExceedsCoverage. The same ceiling applies at load time to the fixed amount and the linear base; the computed linear payout is checked against coverage at evaluation.

Evidence corpus

Verification compares each checkpoint's index namespace, signature domain, anchor epoch, and signer key epoch against its TrustedEvidenceSourceRegistry entry. A mismatched epoch has its own typed error: StaleEvidenceAnchorEpoch or StaleEvidenceSignerEpoch.

A member is selected when its subject key matches and its observation time falls in the half-open window, and the index orders members by that pair. Selected members occupy consecutive leaves. An optional predecessor sits immediately before the first and orders before the window; an optional successor sits immediately after the last and orders after it. Absent a predecessor, the first selected leaf is leaf zero; absent a successor, the last is the final leaf of the tree. A gap or a missing boundary is IncompleteEvidenceBoundaries.

Verification derives the manifest from the proof: EvidenceSourceRangeV1 is built from the checkpoint and the proven members, and its sequence range comes from the members. The corpus digest covers a reduced view of those ranges:

• Kept. The source kind, source id, index namespace, subject key, window, sequence range, expected count, and selected-member root.
• Dropped. The checkpoint id, checkpoint root, checkpoint time, whole-index root, range-proof digest, and both epochs, so a later append-only checkpoint or a key rotation that proves the same members yields the same digest.

evaluate_trigger returns VerifiedTriggerVerdictV1::Fired, carrying the policy digest, the claim identity, and the magnitude, or NotFired. An incomplete or untrusted corpus never reaches evaluation, because verify_evidence_corpus returns a typed error in place of a corpus.

Claim record and states

TriggerInstanceKeyV1 carries the parametric-policy body digest, the bound-coverage body digest, the subject key, the trigger-predicate body digest, the window bounds, and the evidence-range digest. The two ids are domain-separated digests over it:

triggerInstanceId = SHA256(
  "chio.parametric.trigger-instance.v1" || 0x00 || RFC8785(TriggerInstanceKeyV1)
)
claimId = SHA256(
  "chio.parametric.claim.id.v1" || 0x00 || RFC8785({ "triggerInstanceId": ... })
)

Changing the policy, the subject, the window, the predicate, or the evidence range changes the key and produces a different claim. ParametricClaimRecordV1::open refuses a trusted open time before the end of its window, then computes and stores the payout amount. The record's version and lifecycle_fence start at one and stay equal; every transition advances both by checked addition and refuses a caller whose expected head differs from the current one. A repeated transition against the previous head is recognized as a replay and returns the record unchanged.

A contest is a signed ParametricContestV1 binding the claim id, the policy body digest, the expected claim head, the contestant, a validity window, a reason code of CorpusIntegrity, PredicateEvaluation, PolicyBinding, or DuplicateEvidence, and one to 64 evidence digests in strictly ascending order. The claim store supplies the receipt time, which must fall inside the contest's validity window and before the stored deadline. The contestant id must equal the policy's coverage authority.

Payout intent

ParametricPayoutIntentV1 pairs a ParametricPayoutBindingV1 with a signed SignedCapitalExecutionInstruction. The binding restates the claim identity, the expected claim version and lifecycle fence, the coverage reservation and its head digest, the parties, the rail, the effect slot, and the exact MonetaryAmount. The intent id is a domain-separated digest of the claim id alone, so one claim admits one intent.

validate_against_eligible_claim accepts only a claim in Ready or UncontestedReleased whose version and fence equal the binding's expected head, then replays the binding against the record field by field.

The capital instruction is checked against the binding, and its signature must verify against a trusted instruction signer:

• The action is TransferFunds and the source kind FacilityCommitment, with the policy's funding facility as source id.
• The owner role is FacilityProvider and the counterparty role AgentCounterparty, with the beneficiary as subject and counterparty.
• The amount and the rail kind equal the binding's.

The binding's effect slot sits in the parametric namespace, under resource family liability_coverage, with effect kind parametric_payout, a scope id equal to the bound-coverage body digest, a resource id equal to the coverage reservation id, and a resource head digest equal to the stored coverage head. Every parametric claim against one bound coverage addresses one resource scope, and the coordinator's compare-and-swap on that head serializes them.

Adjudication panel domain

Indemnity adjudication has a single signer: LiabilityClaimAdjudicationArtifact.adjudicator is one string, and the award rules attach to that one decision. FrostAuthorizationDomain reserves AdjudicationPanelDecision, serialized as chio.frost.adjudication-panel-decision.v1, as the wire identifier for an n-of-m panel. The parametric claim states carry no panel outcome.

Parametric schemas

The published family holds 4 schema files, of which the registry lists 1: the policy is the signed artifact a counterparty verifies. The rest hold the shared definitions and the two bodies a digest is taken over, the evidence corpus manifest and the trigger instance key.

The lifecycle records carry their own schema ids, stamped in the crate, and each body's validate rejects any other value in its schema field. A verifier reaches them through the module, since they have no published envelope schema.

The module also defines domain separators: chio.parametric.trigger-instance.v1, chio.parametric.claim.id.v1, chio.parametric.trigger-predicate.v1, and chio.parametric.evidence-range.v1 prefix a digest preimage and never appear in a schema field.

Implementation sources

chio-parametric names the schema directory under spec/schemas/, and no crate carries the name. The implementation is the parametric module of the chio-market crate: crates/economy/chio-market/src/parametric.rs with its submodules parametric/evidence.rs, parametric/claim.rs, and parametric/lifecycle.rs. The FROST authorization types the panel domain belongs to sit in chio-federation.