01The timeline (11 signed events)
02The schema extensions (the L5 substrate)
| New event kind | Records |
|---|---|
| policy_amend | (policy_id, prev_version, new_version, content_hash, amended_by, at_ms) |
| model_register | (model_id, version, weight_hash, training_fingerprint, registered_by, at_ms) |
| decision | (decision_id, actor_principal, capability, subject, model_version_ref, policy_version_ref, outcome, parent_decision_ids, at_ms) |
Three new snapshot fields are added with #[serde(default, skip_serializing_if = "Vec::is_empty")]. Backward compatibility verified: every prior proof's published state_id was reverified under the extended engine and matched byte-for-byte (V101 96a29047…, Tokenized cc0d4369…, L1 1cbd6979…, L2 b52fe565…, L3 5aefda52…, L4 2a4bf5f6…).
03The time travel · five distinct state_ids
T10 and T∞ share the same content but have distinct state_ids because timestamp_t_ms is a field in the snapshot. Asking "what was true at T10" returns a different artifact than asking "what is true now" — even when nothing else has changed. That's the right behavior.
04Decision lineage (the causal chain)
approve_underwriting · model_v1 · policy_v1↑ consumed
▸ princ_ai_underwriter_001 → recommend_approve · capability=
recommend_underwriting · model_v1 · policy_v1→ Encoded as
decision_002.parent_decision_ids == ["decision_001"]
Three years from now a regulator asks "why was application_001 approved?". The chain is reconstructable from the event log: human approved (decision_002) ← AI recommended (decision_001) ← (model v1 + policy v1 in effect at T) ← (grant chain to root). Every output has a causal chain.
05Replay Confidence Score (honest completeness metric)
The honesty is the feature. A regulator/insurer/auditor needs to know HOW COMPLETE a replay is — not just that it ran. The 72/100 score reflects the one open critical gap (Phase E signature verification) directly. L9 Evidence Survivability closes that gap with a standalone verifier. Weighted scoring: Critical = 3× · Warning = 2× · Info = 1×.
06Why this matters
"Most companies can tell you what their organization looks like today. H33 can prove what it looked like when a decision was made five years ago and replay why that decision occurred."
That's the sentence this proof earns. Time travel + decision lineage + replay confidence + ASL (from L4) = the substrate. The next proof — First Replayable Organization — composes the L1-L5 substrates and names what they describe: a company as a reconstructable graph.
07Known limitations
- Phase E lock — signatures stored but not verified at replay ingestion. Honestly reported in the Replay Confidence score. L9 closes it.
- Policy content referenced by hash, not stored. Full policy text lives in a content-addressable store.
- Model weights referenced by hash, not stored. Same pattern.
- Reconstruction-only, not live decision issuance. Decisions seeded via the signing CLI for demonstration.
- ASL time-travel syntax (
descendants(p) AS OF T_past) not in v1. Engine supports time travel; ASL gets the syntax in v1.1.
08Where this proof sits in the ladder
09Evidence appendix
| Field | Value |
|---|---|
| Tenant ID | tenant_time_travel_44962d9b-25f5-5622-bd9a-98d5580bb8a2 |
| Tenant root | princ_root_time_travel_44962d9b-… |
| Human | princ_customer_9 |
| AI | princ_ai_underwriter_001 |
| Policy | pol_underwriting (v1 → v2; content hashes in reconstruction.json) |
| Model | model_underwriting (v1 → v2; weight + training fingerprints in reconstruction.json) |
| Event count | 11 |
| Time-travel snapshots | 5 |
| Decisions (with lineage) | 4 (002→001, 004→003) |
| Reconstruction artifact | reconstruction.json |
| Harness | tests/time_travel_replay_001.rs (scif-backend @ d29cc7c33) |
10Readiness determination
First Time Travel Replay (L5): PROVEN IN OPERATION for one underwriting tenant, 11 signed events, 2 model versions, 2 policy versions, 4 decisions with causal lineage, 5 distinct deterministic state_ids at 5 distinct T values, Replay Confidence reported honestly.
What this unlocks: L6 (Counterfactual), L7 (Drift Detection), L10 (Regulator Mode), L11 (Organizational Memory), and the next proof — #12 First Replayable Organization, the meta-proof that frames the corpus's capability as describing a company as a reconstructable graph.
What this does not unlock: live decision issuance; ASL time-travel syntax; policy/model content payload storage; standalone independent verification (L9).
Issued by H33, Inc. · Eric Beans, CEO · 2026-06-02
Independently reconstructable. Inputs: canonical event log access · scif-backend @ d29cc7c33 · harness tests/time_travel_replay_001.rs.