# Production Readiness Report — First Authority Lifecycle Replay (foundation of accountability)

**Proof ID:** `first-authority-lifecycle-replay`
**Subject:** Every authority has a reconstructable lifecycle. Two authorities walk through different paths (Grant → Use → Suspend → Reinstate → Use → Revoke and Grant → Use → Expire), six distinct lifecycle state_ids are reconstructed, and three rogue decisions made during suspended / revoked / expired phases are flagged BY NAME in the new `decisions_during_active_authority` Replay Confidence check.
**Date:** 2026-06-02
**Determination:** PROVEN IN OPERATION (scope: one lifecycle tenant, 14 signed events, six distinct phase state_ids, three rogue decisions detected and named, suspended/expired/revoked authorities correctly excluded from active_grants.)
**Version:** 1.0 (Final)

---

## The category claim (LOCKED Eric Beans, June 2 2026)

> *"Every authority has a reconstructable lifecycle."*

Not "authority can be revoked" — that's too small. The category claim is the entire lifecycle is signed, replayable, and reconstructable. **This proof is explicitly the foundation of accountability** — Proof #14.1 (Replayable Responsibility, schema field `responsibility_chain`) rides on this substrate.

---

## The 8-state authority lifecycle

```
Grant → Modify → Delegate → Use → Suspend → Reinstate → Expire → Revoke → Replay
```

Eric Beans added `Expire` to the model June 2 2026: *"A surprising amount of enterprise authority doesn't get revoked. It simply ages out."* Expire and Revoke are materially different governance outcomes:

- **Revoke** = active removal (employment terminated, license suspended, compliance action)
- **Expire** = natural aging out (no renewal requested, term ended, policy retired)

Auditors, regulators, and insurers care about the distinction.

---

## Three claims (the 10-second read)

1. **Six distinct lifecycle state_ids reconstruct from 14 signed events** — one per phase: active pre-suspend · suspended · reinstated · revoked · temp-expired · final.
2. **Three rogue decisions are flagged BY NAME** — the new `decisions_during_active_authority` confidence check walks events per-authority and names every decision made during suspended / revoked / expired phases.
3. **The substrate now answers nine audit questions** that Eric named — who granted/suspended/reinstated/revoked authority, why each change occurred, and which decisions occurred during each phase. *"Who retained ultimate responsibility"* is the last question, formalized in Proof #14.1 (Replayable Responsibility) as a dedicated `responsibility_chain` field.

---

## The scenario (14 events, 2 authorities, 6 phases)

### Treasury Officer authority (full Revoke arc)

| When | Event | Effect |
|---|---|---|
| T_grant | `grant` root → `princ_treasury_officer_001`, scope=`[sign_treasury_transfer]` | Authority active |
| T_dec1 | `decision_lc_001` — sign $5M transfer | **Legitimate** |
| T_dec2 | `decision_lc_002` — sign $2M transfer | **Legitimate** |
| **T_suspend** | `authority_suspend` (reason: License renewal under review) | Officer cannot exercise |
| T_dec_rogue1 | `decision_lc_rogue_during_suspend` — attempted sign | **ROGUE — flagged** |
| **T_reinstate** | `authority_reinstate` (reason: License confirmed) | Officer can exercise again |
| T_dec3 | `decision_lc_003` — sign $7M transfer post-reinstate | **Legitimate** |
| **T_revoke** | `revoke` (reason: Employment terminated, category: `employment_terminated`) | Officer no longer holds authority |
| T_dec_rogue2 | `decision_lc_rogue_post_revoke` — attempted sign | **ROGUE — flagged** |

### Temp Approver authority (full Expire arc)

| When | Event | Effect |
|---|---|---|
| T_grant_temp | `grant` root → `princ_temp_approver_001`, scope=`[approve_temporary_request]` | Authority active |
| T_dec4 | `decision_lc_004` — approve request | **Legitimate** |
| **T_expire** | `authority_expire` (type: `no_renewal_requested`) | Temp authority aged out |
| T_dec_rogue3 | `decision_lc_rogue_post_expire` — attempted approve | **ROGUE — flagged** |

---

## Six lifecycle state_ids

| Phase | T (ms) | State_id |
|---|---|---|
| P1 active pre-suspend | 1780515000000 | `5e6556d4ee40547278fc4d7c7848d6eaadb8c4e5d4ca0a5b4537b9b3637c7898` |
| P2 suspended | 1780520000001 | `c38383f15ffba2770c99c925a759fa80a0a78853e23dda98a8fd9a2ae4e39228` |
| P3 reinstated | 1780525000001 | `35ae9f43fa2c9a3e3a8c370ad66bdebbec15d6a685aeae9f6524e5f0fe2d0647` |
| P4 revoked | 1780540000001 | `8c334ed98680574148f132d53855f7b1f4e7c63ce9a8787b149bd29f65ea1465` |
| P5 temp expired | 1780560000001 | `f4274a70c2becde5e9ab9e099b90032eba5a3ff16c8f254370567331623971d8` |
| P6 final | 1780566000000 | `9886b4ad040875041e04e5d1785d71da105e531d998683aab76e2e0471b21b63` |

Every replay at the same T returns the byte-identical state_id, today and forever.

---

## The new schema (substrate the lifecycle needs)

Three new canonical event kinds added to `AuthEvent`:

```rust
AuthoritySuspend {
    at_ms, authority_id,
    suspended_by, reason, reason_category, signature
}

AuthorityReinstate {
    at_ms, authority_id,
    reinstated_by, reason, signature
}

AuthorityExpire {
    at_ms, authority_id,
    expired_by, expiry_type, signature
}
```

`Revoke` extended with optional `reason` + `reason_category` fields (backward-compat via `skip_serializing_if = Option::is_none` — every prior proof's Revoke event remains byte-identical at the JSON level).

Snapshot extensions:

- `active_suspensions: Vec<SuspensionRecord>` (skip-if-empty)
- `expired_authorities: Vec<ExpiryRecord>` (skip-if-empty)

**All 13 prior proofs' state_ids verified byte-identical under the extended engine.** Backward compat is structural.

---

## The killer check: `decisions_during_active_authority`

New Replay Confidence check (severity Warning):

For each decision in the snapshot, walks events to build per-authority active-period intervals and checks whether the decision was made during an interval when the actor's authority was in a valid lifecycle state. Rogue decisions are flagged by name.

```
✗ decisions_during_active_authority (Warning) —
  ROGUE DECISIONS FLAGGED: 3 decision(s) made after the actor's authority
  entered a suspended/expired/revoked state:
    decision_lc_rogue_during_suspend
    decision_lc_rogue_post_revoke
    decision_lc_rogue_post_expire
```

The check correctly distinguishes:
- `decision_lc_004` (legitimate, made BEFORE temp authority expired) — NOT flagged.
- `decision_lc_rogue_during_suspend` (during officer's suspended phase) — flagged.
- `decision_lc_rogue_post_revoke` (after officer's revocation) — flagged.
- `decision_lc_rogue_post_expire` (after temp authority's expiry) — flagged.

This is investigator-grade evidence. Eric's framing: *"A lot of fraud happens after someone should have lost access."*

Replay Confidence at the final state = **30/100**, honestly reporting the rogue decisions. (A clean tenant with no rogue decisions and Phase E closed would score 100.)

---

## The 9 lifecycle audit questions answered

| # | Question | Answer reconstructable from canonical evidence |
|---|---|---|
| 1 | Who granted authority? | `princ_root_lifecycle_44962d9b-…` (signed grant event) |
| 2 | Who modified authority? | (deferred to schema v2; `AuthorityModify` to be added) |
| 3 | Who delegated authority? | (covered by the delegation chain L3 — `granted_by` field) |
| 4 | Who suspended authority? | `princ_compliance_44962d9b-…` (signed AuthoritySuspend) |
| 5 | Who reinstated authority? | `princ_compliance_44962d9b-…` (signed AuthorityReinstate) |
| 6 | Who revoked authority? | `princ_root_lifecycle_44962d9b-…` (signed Revoke) |
| 7 | Why did each change occur? | reason + reason_category on each event (`compliance_action`, `employment_terminated`, `no_renewal_requested`) |
| 8 | Which decisions occurred during each phase? | `decisions_up_to` filtered by lifecycle interval — see the scenario table above |
| 9 | Who retained ultimate responsibility? | **TENANT_ROOT** for now — Proof #14.1 formalizes this as a dedicated `responsibility_chain` schema field |

Question 9 is the breakthrough Eric named. *"Most systems can identify actors. Very few can identify retained responsibility."* That's the foundation Proof #14.1 builds on.

---

## What this proof IS and IS NOT

**This proof IS:**
- The substrate that Proof #14.1 (Replayable Responsibility) rides on.
- A reconstruction of the full 7-state authority lifecycle (Grant + Use + Suspend + Reinstate + Expire + Revoke + Replay; Modify deferred).
- Investigator-grade evidence — three rogue decisions are flagged by name with the lifecycle event that should have prevented them.
- Six byte-identical state_ids per replay.

**This proof IS NOT:**
- A claim that `responsibility_chain` is yet a first-class schema field (that lands in #14.1).
- A claim that `Modify` (mid-lifecycle scope or expiry change) is yet a distinct event kind — it's listed in the 8-state model and queued for a follow-up.
- A claim that the engine enforces "rogue decisions are rejected at issuance" — the check FLAGS rogue decisions in the confidence score; the issuance-time policy gate is a separate enforcement surface.

---

## Known limitations

1. **AuthorityModify deferred.** Mid-lifecycle scope reduction or expiry extension would warrant a `AuthorityModify` event with prev/new fields. Not in this proof; queued.
2. **Issuance-time enforcement is policy-layer, not chain-layer.** This proof's confidence check FLAGS rogue decisions for audit; the receipt-issuing service must enforce the active-authority check at issuance time independently.
3. **Phase E lock open.** `AuthEvent.signature` is stored but not verified at replay ingestion; L9.1 closes this.
4. **Single tenant.** Cross-tenant lifecycle interactions (e.g., one tenant suspending another's delegation) are not modeled; Proof #16 (Enterprise Acquisition Replay) introduces cross-tenant events.

---

## Evidence appendix

| Field | Value |
|---|---|
| Tenant ID | `tenant_authority_lifecycle_44962d9b-25f5-5622-bd9a-98d5580bb8a2` |
| Tenant root | `princ_root_lifecycle_44962d9b-…` |
| Treasury officer | `princ_treasury_officer_001` |
| Temp approver | `princ_temp_approver_001` |
| Compliance principal | `princ_compliance_44962d9b-…` |
| Treasury authority | `auth_44962d9b-…_treasury_signing` |
| Temp authority | `auth_44962d9b-…_temp_approver` |
| Event count | 14 |
| Distinct lifecycle state_ids reconstructed | 6 |
| Rogue decisions flagged | 3 (`decision_lc_rogue_during_suspend`, `decision_lc_rogue_post_revoke`, `decision_lc_rogue_post_expire`) |
| Replay confidence at final | 30/100 |
| Reconstruction artifact | [`reconstruction.json`](reconstruction.json) |
| Harness | `tests/authority_lifecycle_replay_001.rs` (scif-backend @ `cb4376378`) |

---

## Independent reconstruction

```bash
H33_TEST_PG_URL='postgres://…?sslmode=require' \
  cargo test --test authority_lifecycle_replay_001 -- --ignored --nocapture
```

Expected: 6 distinct state_ids matching the values above; 3 rogue decisions named by ID; replay confidence at final = 30/100.

---

## Readiness determination

> **First Authority Lifecycle Replay (foundation of accountability): PROVEN IN OPERATION** for one tenant, 14 signed events, 8-state lifecycle exercised (minus Modify, queued), six distinct deterministic lifecycle state_ids, three rogue decisions named in the lifecycle confidence check.

What this unlocks:
- **Proof #14.1 — First Replayable Responsibility.** The `responsibility_chain` schema field on Decision (or as an attached event) captures actor + supervisor + policy_owner + model_owner + approving_authority. Builds directly on this substrate.
- The 9 lifecycle audit questions answer-able from signed canonical evidence alone (Question 9 — retained responsibility — formalizes in #14.1).
- Eric's strategic framing: *"You have replayed authority, policy, model, decision, organization. The day you can prove who owned the consequences, you'll be operating in territory where there are very few direct competitors."*

What this does **not** unlock:
- A claim that `responsibility_chain` is a first-class schema field (#14.1).
- A claim that the engine enforces rogue rejection at issuance (policy-layer concern).
- A claim that Modify is yet a distinct event kind.

---

## Where this proof sits

| # | Proof | Status |
|---|---|---|
| #11 | First Time Travel Replay (L5) | proven |
| #12 | First Independent Replay (L9, the moat) | proven |
| #12.1 | First Catastrophic Vendor Failure | proven |
| #13 | First Replayable Enterprise (the category) | proven |
| **#14** | **First Authority Lifecycle Replay (this proof)** | **proven now** |
| #14.1 | First Replayable Responsibility (the gap Eric named) | next |
| #15 | First Replayable Insurance Claim | roadmap |
| #16 | First Enterprise Acquisition Replay | roadmap |

---

## Version

| Field | Value |
|---|---|
| Report version | v1.0 (Final) |
| Frozen | 2026-06-02 |
| Supersedes | None |
| Superseded by (planned) | `first-authority-lifecycle-with-modify` (when AuthorityModify lands) · `first-replayable-responsibility` (#14.1) |

---

*Issued by H33, Inc. — Eric Beans, CEO. Independently reconstructable per Section Evidence Appendix.*