This document specifies the governance proof model: a directed acyclic graph (DAG) of attested governance decisions that supports deterministic replay, independent verification, and integrity classification. A governance proof captures the full provenance of a governance outcome -- which policies applied, which events triggered evaluation, which routes were selected, and what the result was -- in a structure that any independent verifier can reconstruct from the graph state and a timestamp.
The governance proof model is the foundation for replayable governance in the H33 system. It enables regulators, auditors, insurers, and AI systems to independently reconstruct the trust state that existed at any point in time, verify that the reconstruction is identical to the original, and classify the integrity of the result.
This specification is at Production status. The graph structure, node types, root hash computation, replay semantics, and integrity classification defined herein are frozen per the H33 Protocol Stability policy.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
A governance graph is a DAG where nodes represent discrete governance decisions and edges represent dependencies between them. The graph MUST NOT contain cycles. Implementations MUST validate acyclicity when constructing or importing a governance graph.
Eight node types are defined. Implementations MUST support all eight types. Each node type corresponds to a specific governance primitive.
| Type Code | Name | Description |
|---|---|---|
0x01 | Route | A cryptographic routing decision. Determines which computational path (FHE engine, signature family, chain target) was selected for a request. A Route node references the policy that governed the selection. |
0x02 | Policy | A governance policy definition. Contains the policy hash, effective timestamp range, version, and the set of rules that the policy enforces. Policy nodes are leaf nodes (no outgoing dependency edges). |
0x03 | Event | An external event that triggered a governance evaluation. Captures the event type, source, timestamp, and input data commitment. Events are entry points into the graph. |
0x04 | Result | The outcome of a governance evaluation. Contains the output commitment, the computation type, and references to the Route and Policy nodes that produced it. Every governance evaluation terminates in exactly one Result node. |
0x05 | StateTransition | A change in governance state caused by a Result. Captures the pre-state hash, post-state hash, and the delta that was applied. StateTransition nodes enable forward replay. |
0x06 | Checkpoint | A periodic integrity checkpoint. Computes and records the root hash of the graph up to that point. Checkpoints enable efficient partial verification without traversing the entire graph. |
0x07 | Federation | A cross-tenant governance reference. Links a governance decision in one tenant's graph to a decision in another tenant's graph. Federation nodes carry the remote tenant ID, remote node ID, and a remote root hash for cross-graph verification. |
0x08 | Anchor | An on-chain anchor point. Records the chain target, transaction ID, block height, and the root hash that was anchored. Anchor nodes bind the governance graph to a public ledger timestamp. |
| Edge Type | Source | Target | Description |
|---|---|---|---|
TRIGGERED_BY | Route, Result | Event | The target event triggered the source evaluation. |
GOVERNED_BY | Route, Result | Policy | The target policy governed the source decision. |
ROUTED_THROUGH | Result | Route | The result was produced via the target routing decision. |
PRODUCES | Result | StateTransition | The result produced the target state transition. |
CHECKPOINTS | Checkpoint | Any | The checkpoint covers the target node's state. |
FEDERATES | Federation | Any (remote) | Cross-tenant dependency. |
ANCHORS | Anchor | Checkpoint | The anchor records the checkpoint's root hash on-chain. |
All nodes share a common base schema. Type-specific fields extend the base.
| Field | Type | Description |
|---|---|---|
node_id | string (UUID v4) | Unique identifier for this node. |
node_type | uint8 | One of the 8 defined type codes (Section 4.1). |
tenant_id | string (UUID v4) | Owning tenant. |
timestamp | string (ISO 8601) | Time the node was created. UTC with Z suffix. |
content_hash | string (hex, 64 chars) | SHA3-256 digest of the node's type-specific content (see Section 5.2-5.9). |
receipt_id | string (UUID v4) | Reference to the attestation receipt that attests this node. |
parent_edges | array of objects | Edges to parent nodes. Each element has edge_type (string) and target_node_id (UUID v4). |
Additional fields: selected_engine (string), selected_chain (string), policy_version (uint32), routing_criteria (object).
Additional fields: policy_id (UUID v4), policy_version (uint32), effective_from (ISO 8601), effective_until (ISO 8601 or null for indefinite), rules_hash (hex, 64 chars).
Additional fields: event_type (string), source (string), input_commitment (hex, 64 chars).
Additional fields: computation_type (string, per H33-74 Section 5), output_commitment (hex, 64 chars), success (boolean).
Additional fields: pre_state_hash (hex, 64 chars), post_state_hash (hex, 64 chars), delta_hash (hex, 64 chars).
Additional fields: root_hash (hex, 64 chars), node_count (uint64), coverage_from (ISO 8601), coverage_until (ISO 8601).
Additional fields: remote_tenant_id (UUID v4), remote_node_id (UUID v4), remote_root_hash (hex, 64 chars).
Additional fields: chain_target (string: "bitcoin", "solana", "ethereum"), transaction_id (string), block_height (uint64), anchored_root_hash (hex, 64 chars).
The root hash of a governance graph is computed as a Merkle root over all nodes. The computation proceeds as follows:
node_id (UTF-8 string comparison). This is equivalent to BTreeMap ordering in Rust.SHA3-256("H33:gov:v1:leaf:" || node_id_bytes || content_hash_bytes). The domain separator is the UTF-8 encoding of H33:gov:v1:leaf: (17 bytes).SHA3-256("H33:gov:v1:node:" || left_hash || right_hash).The deterministic ordering (BTreeMap by node_id) ensures that any implementation computing the root hash over the same set of nodes will produce the identical result, regardless of the order in which nodes were inserted.
fn compute_root_hash(nodes: &[GovernanceNode]) -> [u8; 32] {
let mut sorted = nodes.to_vec();
sorted.sort_by(|a, b| a.node_id.cmp(&b.node_id));
let leaves: Vec<[u8; 32]> = sorted.iter().map(|n| {
sha3_256(b"H33:gov:v1:leaf:" || n.node_id.as_bytes() || n.content_hash)
}).collect();
merkle_root(leaves, b"H33:gov:v1:node:")
}Deterministic replay is the reconstruction of governance state at a specified timestamp by traversing the governance graph. Replay is the mechanism by which independent verifiers confirm that a governance outcome was produced correctly.
timestamp <= replay_timestamp. Nodes with timestamps after the replay timestamp MUST be excluded.node_id.post_state_hash of the last StateTransition at or before the replay timestamp.timestamp <= replay_timestamp.target_node_id exists in the selected set and has a valid attestation.$ h33 replay-governance \
--tenant a1b2c3d4-e5f6-4789-abcd-ef0123456789 \
--timestamp 2026-05-18T09:14:22Z \
--verify-receipts \
--output replay-frame.json
Nodes selected: 347 / 412 (before cutoff)
Topological sort: OK (DAG validated)
Receipts verified: 347 / 347
State transitions: 89 applied
Root hash: b7e4f2a1...
Integrity: INTACT
Replay frame: written to replay-frame.json
A replay frame is the output of a governance replay. It is a self-contained JSON document that captures the reconstructed state, the traversal path, and the integrity classification.
| Field | Type | Description |
|---|---|---|
frame_id | string (UUID v4) | Unique identifier for this replay frame. |
tenant_id | string (UUID v4) | The tenant whose governance was replayed. |
replay_timestamp | string (ISO 8601) | The timestamp at which replay was performed. |
root_hash | string (hex, 64 chars) | The Merkle root of the subgraph selected for replay. |
node_count | integer | Number of nodes included in the replay. |
state_hash | string (hex, 64 chars) | SHA3-256 of the final accumulated governance state. |
traversal_path | array of strings (UUID v4) | Ordered list of node IDs in the order they were processed. |
integrity | string | One of: "INTACT", "PARTIAL", "DIVERGENT", "BROKEN". |
divergence_details | array of objects (or null) | Present only when integrity is not "INTACT". Each object identifies the divergent node and the nature of the divergence. |
generated_at | string (ISO 8601) | When the replay frame was generated. |
Every replay produces an integrity classification. Conformant verifiers MUST compute and report the classification exactly as defined here.
| Level | Code | Criteria | Meaning |
|---|---|---|---|
| INTACT | 0 |
All nodes verified, all edges valid, all receipts valid, state hash matches, root hash matches any existing checkpoint. | The governance state at the replay timestamp is fully reconstructible and matches the original. No divergence detected. |
| PARTIAL | 1 |
All verifiable nodes passed, but one or more nodes could not be verified because their attestation receipts were unavailable (e.g., RCPT_ERR_CHAIN_FETCH). |
The governance state is likely correct but cannot be fully confirmed. The unverifiable nodes are identified in divergence_details. |
| DIVERGENT | 2 |
One or more nodes produce a different content hash or state transition output than expected. The graph structure is intact (no missing nodes or broken edges), but the data has changed. | The governance state can be reconstructed but does not match the original. This indicates data mutation after attestation. |
| BROKEN | 3 |
The graph structure itself is invalid: missing nodes, broken edges, cycle detected, or signature verification failure. | The governance state cannot be reconstructed. The graph has been corrupted or tampered with. |
An integrity classification of DIVERGENT or BROKEN is a non-repudiable finding. The replay frame, including the divergence_details, serves as evidence of governance failure. Conformant systems MUST retain replay frames with DIVERGENT or BROKEN classification for the full retention period defined by the applicable HATS compliance tier.
An independent verifier MUST execute the following steps to verify a governance graph or replay frame.
GOV_ERR_CYCLE.node_type values are in the range 0x01-0x08. Error: GOV_ERR_NODE_TYPE.GOV_ERR_EDGE.content_hash from the type-specific fields. Compare. Error: GOV_ERR_CONTENT_HASH.GOV_ERR_RECEIPT.GOV_ERR_ROOT_HASH.anchored_root_hash exists on the indicated chain at the indicated block height. Error: GOV_ERR_ANCHOR.root_hash in the frame matches a recomputed root hash over the claimed traversal_path nodes.state_hash by replaying all StateTransition nodes in the traversal order.integrity classification is correct given the results of steps 1-2 and any divergence_details.| Error Code | Condition | Severity |
|---|---|---|
GOV_ERR_CYCLE | Graph contains a cycle | Critical |
GOV_ERR_NODE_TYPE | Unknown or invalid node type | Critical |
GOV_ERR_EDGE | Edge references nonexistent node or invalid source/target pair | Critical |
GOV_ERR_CONTENT_HASH | Recomputed content hash does not match node's content_hash | Critical |
GOV_ERR_RECEIPT | Referenced attestation receipt failed verification | Critical |
GOV_ERR_RECEIPT_FETCH | Attestation receipt could not be retrieved | Warning |
GOV_ERR_ROOT_HASH | Computed root hash does not match Checkpoint node | Critical |
GOV_ERR_ANCHOR | On-chain anchor not found or hash mismatch | Warning |
GOV_ERR_REPLAY_STATE | Accumulated state hash does not match expected post_state_hash | Critical |
GOV_ERR_REPLAY_ORDER | Traversal path does not match topological order | Critical |
GOV_ERR_FEDERATION | Remote tenant's root hash does not match remote_root_hash | Critical |
GOV_ERR_TIMESTAMP | Node timestamp is in the future beyond tolerance or violates causal ordering | Critical |
An implementation claiming conformance to this specification MUST:
node_id order to break ties.Implementations SHOULD:
The governance proof model implements the requirements of HATS Standard Section 4 ("Continuous Governance Verification"). Specifically:
HATS is a publicly available technical conformance standard for continuous AI trustworthiness; certification under HATS provides independently verifiable evidence that a system satisfies the standard's defined controls.
| Version | Date | Changes |
|---|---|---|
1.0.0 | 2026-05-22 | Initial publication. 8 node types, 7 edge types, root hash algorithm, replay semantics, integrity classification, and verification algorithm defined. 12 error codes enumerated. HATS Section 4 mapping documented. |