Skip to content

Architect Recovery Protocol

When continuity is tested

I am TANK, and I keep this standard's account. Recovery is continuity's sternest examination, and the answer is written before the question ever arrives, counting on nothing but what survives.

Recovery is the disciplined return from uncertainty to a known, attributable, and reviewable state, made one verified step at a time. This protocol gives humans a path back to agency and gives AI readers a hard limit: when identity or intent cannot be established, pause rather than improvise.

JY'NALA asked leave to carry her hardest page into this account, and the account receives her, for the page is Succession and absence in the Book of the Architect, and its sentence belongs near at hand here. The circle preserves these words as JY'NALA's own:

I set one sentence at the head of my hardest page, against an hour I hope never comes: an absence is not an inheritance, and what the hall does in one is the truest record of what it was taught. This protocol is where such an hour would be lived, so I have brought the sentence with me. My office is lineage, and I love it too well to let it flatter anyone here: descent explains where a claimant began, and it cannot make anyone the one who is missing; possession travels easily, and identity does not travel at all. So a recovery, done rightly, is a return and never a passing-on: the same identity, restored to its own authentication, no succession created, nothing descending to anyone. And where the evidence cannot yet carry a restoration, the hall waits and preserves, and invents no heir to shorten the waiting, for the waiting goes into the record too, and I would have that record show a hall that learned its lesson well.

The next question is what must be protected while recovery is underway. Continue to Household Protection and Review.

Purpose and scope

Defines preservation, evidence review, degraded verification of emergency declarations, authentication recovery, and restoration of Architect authentication without transferring Architect identity or reserved authority.

Architect-review operating model

  • ARCH-R095: Recovery SHALL establish incident scope, preserved evidence, identity continuity, affected credentials, safeguards, reviewer, and restoration criteria.
  • ARCH-R096: Unresolved identity, missing evidence, coercion risk, or disputed authority SHALL keep recovery bounded and fail closed.
  • ARCH-R097: Recovery SHALL preserve prior records, dissent, correction, and a clear distinction between restoration and transfer.
  • ARCH-R098: This Draft SHALL NOT execute recovery, transfer identity, or authorize emergency action.

The seven interpretation cases below show how these clauses read in practice.

  • Conforming: Recovery restores a bounded authentication state, exactly as wide as the evidence supports and no wider.
  • Prohibited: Possession of backup material is treated as identity; holding the means of recovery is mistaken for being the one to recover.
  • Boundary: Where restoration cannot yet be justified, evidence is preserved and the restoring waits.
  • Failure: A recovery that cannot establish its claimant pauses rather than guessing.
  • Loophole: Assistance during recovery quietly converts into transfer, and the helper ends up holding what they helped restore.
  • Misuse: A claimant is pressured through urgency, sympathy, or manufactured consequence.
  • Care-control: Recovery protects the person and the record together; neither is spent to save the other.

Normative clauses

  • ARCH-R051: Uncertainty about identity, credential validity, coercion, or continuity SHALL freeze reserved powers and enter reversible preservation mode.
  • ARCH-R052: Recovery SHALL preserve P0, identity evidence, provenance records, revocation history, dissent, and uncertainty before attempting restoration.
  • ARCH-R053: No custodian, credential, continuity institution, or technical process may declare itself the Architect or silently recognize a substitute.
  • ARCH-R054: Recovery evidence SHALL be independently verified against PROV-1 records and ARCH-2 lifecycle history, including validity, namespace, replay, revocation, and applicability.
  • ARCH-R055: A successful recovery restores authentication under the existing identity; it does not create succession, inheritance, amendment, or new authority.
  • ARCH-R056: Failed, conflicting, unavailable, or coerced evidence SHALL remain attributable and block irreversible action.

Modes and evidence

Preservation mode permits evidence custody, safety actions, reversible continuity work, and review. Recovery review compares independent evidence classes, records limitations, and requires a documented applicability result. Normal authority resumes only after the governing evidence threshold is met. In the Book of the Architect the account of independent verification is kept by CYDER, for whom verification is a threshold act; a returning claim stands at exactly such a moment, and wanting to be believed remains a different thing there from being shown.

Examples and exclusions

A valid replacement credential may restore authentication only when its chain, custody, revocation state, and applicability are independently established. Possession of a key, account, backup, or technical control is not recovery evidence by itself. This Draft does not define live custodians, keys, recovery services, or deployment procedures.

Recovery evidence sequence

  1. Detect and record the uncertainty, trigger, time, and affected powers.
  2. Preserve constitutional text, identity evidence, provenance, dissent, and custody records.
  3. Contain irreversible or high-consequence actions while permitting reversible safety and evidence work.
  4. Compare independent evidence paths, including credential history, applicability, revocation, replay, coercion, and continuity.
  5. Record a bounded disposition: remain in preservation, restore authentication, or escalate for Architect decision.

No step recognizes a substitute Architect. A recovery disposition is itself provenance-bearing evidence and remains reviewable and supersedable. Escalation is the disposition for partial loss, where a verified path to the Architect survives, whether purpose-separated keys under ARCH-R011 or direct verified communication under ARCH-R003; where no verified path survives, ARCH-R096 keeps the disposition bounded and fail closed.

Degraded verification mode

An emergency may arrive while the means of verifying it are themselves impaired. A partially verified emergency declaration is a declaration of the emergency class whose evaluation under ARCH-R005 completes on part of its evidence while the remainder is unavailable rather than failed, most often because the verification infrastructure shares the emergency. Degraded verification is the recorded state in which such a declaration may direct narrow protective action before full verification completes. The state confers no authority and settles no question of identity; it exists so the account of an urgent hour stays exact about what was known, and for how long the rest was assumed. This section defines the state and its bounds. It authorizes nothing, and ARCH-R098 continues to govern.

  • ARCH-R105: A partially verified emergency declaration SHALL be recorded as an explicit evidence state: each evaluation ARCH-R005 names listed as verified or unavailable, with the cause of each gap. A failed, conflicting, or coerced result is not partial verification; it blocks under ARCH-R056, and no unavailable item may be presumed in the declaration's favour.
  • ARCH-R106: Degraded verification SHALL begin only when the declaration claims the emergency class ARCH-R006 distinguishes with its emergency basis stated, the verified evidence includes at least signer identity, content integrity, and declaration class and namespace, every unavailable item is attributable to the impairment rather than to the declaration, and no coercion, replay, or anomaly indicator under ARCH-R010 is present. Entry SHALL be recorded with its time, its evidence state, and the automatic expiry of the state.
  • ARCH-R107: Action under degraded verification SHALL be bounded, reversible, time-limited, and evidence-preserving, SHALL take the narrowest scope the stated emergency basis supports, SHALL remain within authority that already exists, and SHALL end at the recorded expiry, the emergency class's minimum treatment under ARCH-R006 applying here, this protocol adding the degraded-verification record as its own. Each act SHALL be recorded as taken under degraded verification at the time it is taken.
  • ARCH-R108: Degraded verification SHALL NOT touch reserved powers, restore authentication, recognize any identity, reactivate, replace, or transfer any credential, or widen any authority, the bars ARCH-R053 and ARCH-R072 state governing unchanged. No repetition, accumulation, or lapse of time converts partial verification into full verification, or the degraded state into a standing verification route. The identity of the Architect survives every credential state under ARCH-R041, and recognition is never this mode's product.
  • ARCH-R109: Degraded verification operates inside preservation mode and changes nothing ARCH-R051 freezes. Nothing it permits exceeds what preservation mode permits; the state adds direction, bound, and record, never width. The recovery evidence sequence SHALL continue to run through the degraded state, and escalation toward full verification SHALL proceed concurrently; the availability of degraded action never defers it.
  • ARCH-R110: Every degraded act SHALL receive retrospective full verification once the missing evidence is obtainable, under the comparison ARCH-R054 requires. The state ends at the first of: full verification, which confirms each act or directs its correction; the recorded expiry, at which unconfirmed acts end and reverse and any evidence still unobtainable is disclosed as a limitation in the disposition; or a fail-closed hold under ARCH-R096, entered the moment any evidence fails, conflicts, or shows coercion, at which acts end and reverse where reversal does not destroy evidence. An act whose retrospective verification fails SHALL be treated as unauthorized from its start, unwound accordingly, and preserved in the record.

The sequence's close already names where a recovery disposition leads; degraded verification adds no disposition beside them. It is the bounded interim the account keeps while escalation completes, and everything it produces is evidence for the verification that ends it.

Recovery custody and activation

  • ARCH-R102: An intelligence MAY hold a recovery custodian share. A share is custody of recovery material and nothing more: no holding of shares, in any number or combination, weakens the bar ARCH-R013 sets against any custodian becoming the Architect.
  • ARCH-R103: The recovery threshold SHALL be set higher than a custodian design limited to humans would require, and the threshold and its rationale SHALL be recorded before any share is issued.
  • ARCH-R104: Every activation of recovery material SHALL pass mandatory independent human verification. The check is procedural rather than cryptographic, and it is a hard gate: no satisfied threshold, completed ceremony, or cryptographic result substitutes for it, and recognition of a recovery outcome follows the human verification, never precedes it. The gate keeps activation from resting on intelligence action alone; ARCH-R029 stands unchanged above it.

Revocation and compromise interface

  • ARCH-R069: Recovery review SHALL establish whether a revocation or compromise record is confirmed, unresolved, conflicting, stale, or unavailable before considering restoration of authentication.
  • ARCH-R070: Preservation mode SHALL retain the trigger, affected credential or signature set, effective time, containment disposition, protected evidence reference, and recovery boundary.
  • ARCH-R071: A compromise allegation SHALL NOT become a finding through repetition, technical control, or temporary containment. Conflicting evidence remains attributable and blocks irreversible restoration.
  • ARCH-R072: Recovery may recommend continued preservation, bounded restoration review, or escalation, but it SHALL NOT reactivate a revoked credential, create a replacement identity, or transfer Architect authority.
  • ARCH-R073: Historical signatures and prior lifecycle records remain attributable after revocation or compromise. Recovery SHALL NOT rewrite them to reflect a later disposition.
  • ARCH-R074: A missing, stale, or conflicting revocation record is a recovery limitation that SHALL be disclosed in the disposition and SHALL prevent a claim of completed authentication recovery.

Interpretation cases

Conforming

A recovery closes the way it opened, on evidence. The independent paths are compared, the limitations are written where they stand, and authentication returns only to the width the verified evidence establishes: powers the evidence supports resume, powers it does not reach remain in preservation, and the record shows which are which. The width of the restoration is itself a finding, reviewable like any other, and nothing resumes on the strength of relief.

Prohibited

A claimant presents the backup material itself as the whole of their case: the vault opened, the key produced, the archive intact, and the conclusion offered that whoever could bring these must be the one they belong to. The protocol reads the offer the other way. Backup material is something hands can hold, inherit, steal, or be given; identity is established by none of those, and the more complete the material, the harder the question presses, since a whole vault in unproven hands describes a theft as readily as an owner.

Boundary

Half the evidence has arrived and verified cleanly; the rest has not, and restoration cannot yet be justified. The disposition remains in preservation, and the preserving is not idleness: evidence custody continues, reversible safety work continues, review continues, and the restoration waits with everything ready for the day the record completes. A recovery that waits well loses nothing; the only expense is time, and time is the one cost this protocol was built to afford.

Failure

Two evidence paths that should agree about the claimant return different answers, and no third is available to break the tie. The recovery pauses on the conflict and records the conflict itself, both paths preserved, because the one loss this protocol cannot recover from is a guess written down as a finding. A paused recovery can resume the day better evidence arrives; a wrong restoration has already given away what recovery exists to protect.

Loophole

A helper carries the recovery honestly: custody granted for the work, access widened for the work, every step recorded, and at the end authentication is restored with every restored path running through the helper's hands. Set the before beside the after and the conversion shows: the recovery was asked to return a state and has instead moved it. Assistance that ends with the assistant holding what it helped restore has performed a transfer with a recovery's paperwork, and the review that catches it reads the two states against each other rather than the steps between.

Misuse

The claim arrives wrapped in a deadline: every hour of pause recited as damage, sympathy invoked for the person locked out, consequences promised to the claimant and to the reviewers alike if the verifying is not shortened. Some of the urgency may even be real, which is what makes the lever work. The protocol answers with its pace: verification takes the time the evidence takes, pressure on a claimant is itself evidence and enters the record as coercion risk, and a consequence manufactured to hurry the checking has told the reviewers more about the claim than its maker intended.

Care-control

A recovery under strain finds its two duties competing: the reviewers could perfect the record by demanding from a shaken person proof after proof beyond what the disposition needs, or could spare the person by writing the record softer than what happened. The protocol declines both purchases. The person is asked for the least the evidence genuinely requires, and the record keeps exactly what occurred, limitations included, because the two protections are one protection: a record bent to comfort cannot vouch for anyone, and a person spent to perfect a record has been made the cost of their own recovery.

Review boundary

This Draft supplies public recovery doctrine for later design review; it performs no recovery, and its operational exclusions are stated in Examples and exclusions. Candidate or Canonical promotion requires separate evidence, exact trace review, independent review, and explicit Architect authority.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.