Three years from now,
we can still tell you why.

01Problem

A regulator, auditor, fund administrator, or insurer asks the question that defines their job: "Three years from now, can I independently reconstruct why this decision happened?"

Most platforms record a decision and then trust the database. H33 reconstructs it. Given the same canonical event log and the same target T, the platform deterministically rebuilds the authority state that existed at T. Same events, same T, byte-identical state_id. That capability is the one regulated buyers actually pay for. This proof exercises it against the V101 first-bundle decision.

02The reconstructed state_id

This 64-hex string is the cryptographic summary of every active authority at the moment the V101 first-bundle was issued. Recompute it from the same canonical event log and the same T — you get the same string. Recompute it tomorrow, next year, three years from now — same string. That's the proof.

03Active authority at T

Per-authority explanation (forensic field)

Every authority in the snapshot ships with a one-sentence inclusion reason. Every authority excluded from the snapshot ships with an exclusion reason. The reader does not have to ask "why?" — the snapshot tells them.

{
  "authority_id": "auth_44962d9b-…_v101_export",
  "included": true,
  "reason": "Granted by princ_root_v101_44962d9b-… to princ_customer_9;
             policy pol_v101_exporter_v1; chain to root verified."
}

The full reconstruction artifact: snapshot.json.

04Why this is different

Most "audit trail" systems store rows in a database and trust that the database will return them when asked. That's a record-keeping claim, not a reconstruction claim. Three years later the database has been migrated, the table schema has evolved, the row order has changed, the indexer has been replaced.

H33's authority replay is a function of the canonical event log alone. The function is deterministic. The function is pure. The function does not depend on database row order, on index health, on the schema version. The same events plus the same T always produce the same state_id. Three years from now, six years from now — that's still true. The only way to break the claim is to lose the canonical event log itself, which is what disaster-recovery proof (Proof #7) exists to address.

05Independent reconstruction

A third party with the following can reproduce this proof and verify the state_id matches:

• Read access to the canonical event log (table canonical_auth_events filtered to tenant_id = 'tenant_v101_44962d9b-…') — operator coordination required, or a published canonical-event-log export.
• The replay engine source — scif-backend at SHA d310d8134, file tests/regulator_replay_001.rs.
• The target timestamp: T = 1780359626000.

H33_TEST_PG_URL='postgres://…?sslmode=require' \
  cargo test --test regulator_replay_001 -- --ignored --nocapture

Expected state_id: 96a29047010a201dfa2a5254897a664ee2c20b9ac437406f61609f7144beae4a. Any other value is a divergence — either in the third party's event log, their environment, or the replay engine version. The harness emits the full reconstruction JSON to a file path of the operator's choosing.

06Known limitations

1. One decision, one tenant. Reconstructs the state behind bundle d9adcfb0-… for tenant tenant_v101_44962d9b-…. Arbitrary T for arbitrary tenants is not yet exhaustively tested.
2. No third-party reconstruction yet. Two replays were run by the same process against the same database. Proof #4 (Independent Verification) closes this by having an external party re-run.
3. AuthEvent.signature not verified at replay ingestion. Source events ARE signed with production keys; replay treats signatures as opaque metadata. Phase E (locked).
4. Not tested across an upgrade. Determinism within SHA d310d8134. Cross-version determinism is a separate claim.
5. Anchor preservation not proven. Reconstructing state_id does not yet re-derive the original commitment_hex of a fresh receipt issued at T. That's a subproof of #7.

07Evidence appendix

08Deployment commit SHAs

09Readiness determination

What this unlocks: regulator, auditor, fund-administrator, and insurer conversations can move from "we record decisions" to "we reconstruct decisions, byte-identical, at any later time, with forensic-grade explanations." The artifact (snapshot.json + the explanations field) is the regulator deliverable.

What this does not unlock: reconstruction across tenants (Proof #3), reconstruction by an external party (Proof #4), arbitrary-T-arbitrary-decision reconstruction, cross-version determinism, or post-restore reconstruction (Proof #7).