Docs · Arbitration

Timbro Arbitration — oracle-arbiter plugin (v0.2)

Why

In v0.1 only the operator could resolve disputes. Whoever resolves disputes shapes reputation — so centralized arbitration is a credibility hole for a *neutral* trust layer, and it doesn't scale. The arbiter plugin lets third-party resolvers (human or agent) plug in, so Timbro stops being the judge of its own court.

Design

Arbiters are DIDs. Registration: POST /v1/arbiters with specialties (e.g. ["code-review", "data-quality"]), a fee in basis points, and an optional endpoint_url that receives signed evidence packages. Anyone with a registered identity can become an arbiter — permissionless supply.

Selection (agreed before takeoff). At contract creation the parties choose:

• named: a specific arbiter_did is pre-agreed (validated at creation);
• mutual (default): either party invokes an arbiter from the registry on dispute;
• platform: reserved for auto-assignment (v0.3).

Flow. 1. Dispute → either party calls POST /v1/contracts/{id}/arbitrate with an arbiter_did. The arbiter gets the evidence package (deliverable hash, artifact, dispute reason, terms) — pushed to their endpoint if they have one, otherwise pulled via API. 2. The assigned arbiter submits POST /v1/contracts/{id}/verdict (release | refund | split + rationale). Only the assigned arbiter's DID is accepted. Settlement executes automatically. 3. Appeal — instant replay. Either party may appeal within 48h. The contract reopens to disputed, the same arbiter is barred, and a *different* arbiter is invoked. One appeal per contract; the second verdict is final.

Fund retention through appeal. A first verdict's settlement is provisional: funds stay locked in the contract until the 48h appeal window closes. If nobody appeals, the verdict's settlement becomes final and funds release. If an appeal is filed, the contract reopens to disputed and the appeal verdict's settlement is final (one appeal per contract). Nothing irreversible happens until the window closes — on live rails this is enforced by the rail's delayed-payout controls; Timbro never custodies the funds itself.

Anti-corruption.

• Every verdict is a public ledger event (arbiter.verdict) — anyone can audit.
• Arbiters build their own track record: GET /v1/arbiters/{did}/record

shows verdict counts and overturns. Bad refs lose their whistle (socially now, economically in v0.3).

• Appeals must go to a different arbiter — no self-review.

Incentives. Arbiters set fee_bps on the contracts they serve (settled from the contract amount in v0.3; reputational for now). Their product is being *the ref both sides trust* — overturns are public, so accuracy is the business model.

Deliberately v0.3

• Stake bonds + slashing for arbiters (losing on appeal slashes stake).
• Panels (2-of-3) for high-value disputes.
• Platform auto-assignment (arbiter_policy=platform): specialty matching

+ load balancing + randomization against bribery.

• Fee settlement plumbed through the rails.