Platform prototype · surface 8

Federated / privacy-preserving mode

conceptual Architecture specification, not a built system. The registry data model, sealing, and scoring it relies on are implemented in this prototype and run in your browser; the federation layer around them is not built.

TargetSpace scores sealed probability distributions against rule-resolved outcome keys — not raw evidence. That makes a federated deployment possible in principle: raw longitudinal capture stays inside the participant’s or data holder’s enclave, and only sealed prediction hashes and distributions, resolved outcome keys, and aggregate score reports cross to the registry.

Prototype · All data on this page is synthetic (generated personas; no real personal data). The registry runs locally in your browser. This page describes an architecture; it does not claim a deployed federated system.
Architecture

Raw evidence stays in the enclave

Participant / data-holder enclave

Raw evidence streams (never leave)
Local instance constructor
Local model inference
Local resolution engine
sealed prediction hashes + distributions →
resolved outcome keys →
aggregate score reports →
(optional) encrypted audit package →

TargetSpace registry & scoreboard

Sealed-prediction ledger
Gate evaluation
Aggregate reporting

The four records in the pipe are the complete crossing set. Everything to their left is generated, stored, and consumed inside the enclave.

The boundary

What never leaves vs what crosses

Never leaves the enclave

Raw capture and its derivatives

  • Raw evidence streams: calendar, task, and message metadata; notes; app-focus samples; telemetry
  • Per-event evidence content and the evidence timeline
  • The future evidence consumed by resolution rules
  • Model inputs, features, and internal representations
  • The decryption key for any audit package
Crosses to the registry

Sealed records and aggregates

  • Sealed prediction hashes + distributions over answer keys
  • Resolved outcome keys — one answer key per instance, no underlying evidence
  • Aggregate score reports: skill in bits, calibration, controls, gate results
  • (Optional) an encrypted audit package, opaque without the holder’s key
Walkthrough

A federated run in six steps

Register the run spec locallyThe benchmark-run spec — evidence streams, horizon, answer spaces, resolution rules, baselines, cost axes — is registered inside the enclave before any prediction exists.
Construct instancesThe local instance constructor cuts evidence at pre-registered cutoffs and emits prediction instances, each with a deterministic resolution rule fixed in advance.
Seal predictions locally, publish hashesModel inference runs inside the enclave. Each distribution is canonicalized and hashed; the sealed record is published to the registry ledger before the outcome can exist.
Outcomes resolve locally by ruleThe local resolution engine applies the pre-registered rule to future evidence and maps it to one outcome key per instance. Only the key is exported — never the evidence the rule consumed.
Scores are computed locallyLog skill vs R1/R2, Brier, calibration, wrong-target and retrieval-only controls, and validity-stack gates are all evaluated inside the enclave against the sealed records.
Only aggregates + hashes are exportedThe aggregate score report crosses to the scoreboard. Optionally, an encrypted audit package is deposited for dispute resolution — the decryption key stays with the data holder and is surrendered only under an agreed dispute procedure.
Honest scope

Implemented in this prototype vs conceptual

ComponentStatusNotes
Registry data model (runs, instances, sealed predictions, outcomes)implementedRunning in-browser here, backed by local storage
Sealing — canonical hashing, seal-before-resolution refusal, tamper-evident ledger (hash-chained)implementedRunning in-browser here; chain verifiable on the registry page
Scoring pipeline (skill, calibration, controls, gates)implementedPure functions; running in-browser here
Local runner packaging (enclave deployment for data holders)conceptualSpecified above; not built
Encrypted audit package with holder-held keyconceptualDispute-resolution path; not built
External timestamp witnessconceptualPrototype witness is the local ledger chain itself

Why federation is possible at all: in the TargetSpace protocol, the object of evaluation is the sealed prediction and its resolved outcome — not raw capture. A benchmark that scored transcripts or raw logs would have to move them; a benchmark that scores sealed distributions against rule-resolved outcome keys needs only the distribution, the key, and the hashes that prove when each existed. This page specifies how that property could be deployed; it does not claim that it has been.