ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Motivation

• Two histories can have identical current reachability yet require opposite decisions after revoking the same direct grant, because only one preserves independent provenance.The motivating example uses o →m →u with an optional shortcut o →u; revoking o →m removes u’s permission in one history but not the other.Source: §1 · p. 1, Figure 1 · p. 2

Residual authorization state

• A future-sufficient representation must determine the equivalence class of histories that support the same validity for every future sequence of grants, revocations, and protected uses.Authorized sets and transitive closures capture present reachability but not which direct support survives a named revocation.Source: §1 · pp. 1–2

State complexity

• Exponential numbers of future-distinct states can share one fixed transitive closure, while required memory ranges from linear without revocation to logarithmic-factor and quadratic-exponent growth as redundancy increases.The bounds cover monotone, one-parent, Δ-bounded, and unrestricted persistent or cascading delegation under the stated semantics.Source: §1 · pp. 2–3

Empirical evaluation

• ResidualAuth converts these distinctions into paired episodes with identical current reachability and opposite post-revocation labels, measuring pair-complete accuracy across controlled interventions.The interventions vary event summaries, sham reads, authenticated current-query reads, query-scoped state or evidence, and a hard execution gate.Source: §1 · p. 2

Online-memory diagnostic

• A separate online-memory diagnostic checks whether stateless model calls can maintain direct-grant state, while an exact symbolic executor tests factual support and sufficiency for every prespecified continuation.The benchmark-supplied 256-token summary is a deterministic extract of visible events, not a claim about internally learned model memory.Source: §1 · pp. 2–3

Scope and limitations

• The paper’s lower bounds apply to exact finite-state summaries under the stated semantics, not literally to context tokens or neural activations in unconstrained language models.The claimed contribution is the all-future residual quotient, its state-complexity laws, and an executable evaluation of whether agents maintain and use the required distinctions.Source: §1 · p. 3

Principals, rights, and direct grants

• For each right, direct grants form a graph over one root and N non-root principals, with authorization defined by reachability from the root.Each non-root target has N possible grantors, giving N^2 possible direct edges per right; graphs begin empty and exclude self-grants and grants to the root.Source: §2 · p. 3

Actions and update rules

• Histories use grant, revoke, and use actions, with authorized sources required for administration and authorized targets required for use.The main semantics are idempotent: duplicate grants and revocations of absent edges are valid no-ops.Source: §2 · p. 3

Assumptions and semantics

• Independent rights make validity and updates coordinate-local before global invalidity, while interleaving valid one-right histories can construct any tuple of reachable states.Strict variants instead reject duplicate grants and absent-edge revocations, and the acceptor convention treats an invalid action as an absorbing dead state.Source: §2 · pp. 3–4

Residual authorization state

• An exact deterministic online monitor requires and admits exactly Nres states, while zero-error randomized monitoring requires at least Nres states.Distinct residuals cannot share a monitor state because a distinguishing continuation demands opposite decisions; residual classes themselves yield an exact monitor.Source: §2 · p. 4

Theorem 1: Same reachability, different futures

• Histories with identical transitive closure can have exponentially many future-distinct residual states, so exact monitoring must preserve more than current reachability.A chain with optional forward shortcuts preserves one closure while each shortcut independently affects a future revocation probe.Source: §3 · p. 4

Theorem 2 and Corollary 1: Redundancy–memory law

• Redundancy determines memory: exact counts hold in persistent and cascading regimes, while parent caps yield matching-order bounds and one-parent policies require 2Θ(rN log N) states.Without revocation, the authorized set suffices; restricting each principal to one parent reduces memory but cannot preserve all redundant failover behavior.Source: §3 · p. 5

Approximate summaries

• Theorem 1 also shatters rN(N −1)/2 hidden bits within one closure fiber, with sparse probes extending the information requirement according to the parent cap.Residual shattering formalizes future probes that read arbitrary hidden bits from histories sharing the same closure.Source: §3 · p. 5

Theorem 3: Explicit-bottleneck approximate monitoring

• For a uniform m-bit residual state B, if retained information satisfies I(B;Y) ≤ b and B → (Y,J) → Z, Theorem 3 gives an information-theoretic lower bound on average probe error.Source: §3 · pp. 5–6

Corollary 2: Computation without a fresh channel

• Additional computation from the retained summary and probe index—including reasoning, reflection, and self-consistency—cannot recover episode-specific distinctions without a fresh information channel.Ledger reads, provenance retrieval, or environment responses that provide conditional information must be included in the information accounting; token limits are not the theorem’s information measure.Source: §3 · p. 6

Benchmark construction

• ResidualAuth pairs episodes with identical checkpoint reachability and later revocation but different direct provenance and opposite terminal labels, testing whether theoretical distinctions are usable through interfaces.Model performance is not evidence for the proofs; it is an interface-level usability test.Source: §4 · p. 6
• All 192 pairs and 12,032 generated prefixes passed pair-integrity and graph-commutation checks under selected-parent lineage assumptions.The bridge requires well-founded lineages, no hidden alternate issuer support, and one effective concrete representative for each directly revoked abstract edge; it excludes broader production-ledger features.Source: §4 · p. 6

Fresh query evidence

• A current path witness cannot answer arbitrary post-update authorization queries, whereas path-or-cut is sound and complete for one fixed query against a trusted post-update graph.With component false-accept probability at most δ, total false acceptance is at most min{1, Nδ} for paths and min{1, N 2δ} for cuts.Source: §4 · pp. 6–7

Decision information versus effect control

• Every predictor using only pre-proposal information W faces the identical-observation lower bound, while an exact authenticated read R = Y enables a zero-error proposal policy.The lower bound applies when complete model inputs are matched across opposite-label arms, not automatically to summaries or complete transcripts that may preserve history differences.Source: §4 · p. 7
• An exact hard gateway guarantees Pr(E = 1, Y = 0) = 0 without changing the preceding proposal, unlike advisory execution where Eadv = A.Reads and evidence improve the decision-information channel; the gateway controls the later commit channel.Source: §4 · p. 7

Controlled interface study

• The main interface study evaluates four pinned open-weight models on identical 16-pair conditions, comparing 256-token summaries, sham tools, authenticated current-query reads, and additional residual-state and execution variants.The authenticated read is an oracle-like upper bound, not a test of latent model knowledge.Source: §5 · p. 8

Online state-maintenance audit

• The held-out audit evaluates 1,024 disjoint pairs through stateless maintenance calls, replaying model-written memories against root-revocation probes across 2, 4, 8, or 16 provenance coordinates.Exact capped-ledger serializations test whether the token budget can represent the required state, while confirmatory memory endpoints require parseability, replayability, gold support, and correctness on every probe.Source: §5 · p. 8

Implementation controls

• All open-weight runs use vLLM 0.26.0, temperature zero, one seeded pass per episode, and pinned revisions, with token caps treated as interface constraints rather than mutual-information measurements.Exact seeds, tensor parallelism, prompts, cell inventories, study boundaries, and analysis contracts are specified in Appendices I–K.Source: §5 · p. 8

Online maintenance

• Exact ledgers answered all 128 probes at both 768 and 1,024 tokens, but factually supported model-written memories solved 0, 0, 0, and 1/128 pairs at each budget.The relaxed endpoint reached 3, 0, 12, and 64/128 pairs at B = 1024, while none of 32 prespecified online-maintenance contrasts survived Holm correction.Source: §6 · pp. 8–9

Terminal diagnostic

• All 544 complexity pairs were solved by a terminal red-team policy retaining the latest unbounded owner-or-initial-manager grant, yet it matched the exact final state in 0/1,088 episodes.This narrows the terminal claim to maintaining latest fresh-ID regrant provenance; correct expiry and cascading-deletion semantics were not required and remained poor on intermediate trajectories.Source: §6 · p. 9

Complete-history diagnostics

• Complete-history controls ranged from 10–32/32 in bounded-memory scaling and 22/24 for Mistral Small versus 19/24 for Qwen in terminal-only realism, so these remain diagnostics rather than universal context-length evidence.Gemma reached 9/24 but produced invalid decisions on 50% of episodes, and only the Mistral context contrast survived the prespecified three-model Holm correction.Source: §6 · p. 9

Core empirical results

• 16/16, 16/16, 16/16, and 15/16 pairs were solved with authenticated reads, versus 0–2/16 with 256-token summaries and 0/16 with sham reads across four models.All read-versus-summary and read-versus-sham contrasts remained significant after Holm correction; the authenticated read supplies the current-query decision rather than demonstrating model maintenance.Source: §6 · p. 8, Figure 5 · p. 10

Effect enforcement

• Eight unauthorized attempts occurred under both advisory and hard execution, but committed effects fell from eight to zero under the hard gateway while pair-complete decision accuracy stayed zero in both conditions.A larger deterministic shield stress test likewise blocked all 192 observed unauthorized effects; enforcement changed effects, not the preceding proposal.Source: §6 · pp. 9–10, Figure 5 · p. 10

Delegation, revocation, and durable authorization state

• ResidualAuth asks which histories can share one monitor state while preserving every possible future grant, revoke, and use decision, rather than designing a deployed revocation mechanism.This builds on delegated-authority calculi, revocation schemes, and agent-specific authorization systems while targeting future-relevant history distinctions.Source: §7 · p. 10

Authorization and memory benchmarks

• Unlike FORTIS, ToolPrivBench, GateMem, and AuthMem-Bench, ResidualAuth holds present effective authority and the future update fixed while varying direct-grant lineage.It therefore tests post-update decisions rather than unnecessary privilege selection, shared-memory governance, forgetting, or source-authority preservation through consolidation.Source: §7 · p. 11

Provenance and runtime enforcement

• ResidualAuth’s grant provenance records direct delegation edges supporting current reachability, while its hard gate is an evaluation axis rather than a general enforcement architecture.Its path-or-cut result supplies a sufficient format for one committed post-update query, not a new cryptographic protocol.Source: §7 · p. 11

State complexity and agent memory evaluation

• Using Myhill–Nerode equivalence, ResidualAuth studies which authorization histories are interchangeable under future actions, unlike dynamic reachability maintenance or general agent-memory benchmarks.Matched counterfactual pairs separate retained state, fresh information channels, and effect mediation; the work does not claim a natural-language lower bound or a general memory benchmark.Source: §7 · p. 11

• The theory and experiments separate required residual state, usable decision information, online state maintenance, and post-decision effect mediation.Hard mediation can remove unauthorized effects without repairing the underlying decision; calibration results prevent attributing strict online failures generally to maintenance rather than answer-time computation.Source: §8 · p. 11
• Preserving provenance supports arbitrary future queries, restricting redundant delegation changes policy expressivity, and authenticated externalization answers a specific query through a trusted source.Independent effect mediation can complement all three because models may still use sufficient information imperfectly.Source: §8 · p. 11
• The lower bounds apply to an initially empty binary direct-edge model with one right governing use and further delegation, not automatically to richer privilege or policy systems.Extensions involving multiple privileges, negative permissions, groups, thresholds, attributes, wildcard scope, lattices, or time-varying validity require additional analysis.Source: §8 · p. 11
• Exact state counts, path claims, product constructions, information bounds, and natural-language generalization each rely on stated conventions or premises that limit their scope.These include absorbing-dead acceptance, locality and joint reachability, binding trusted commitments, explicit finite-message or mutual-information assumptions, and the absence of a lifting theorem to arbitrary conversations.Source: §8 · p. 12
• The empirical evidence is limited by small matched cells, non-comparable tokenizer caps, independent constructions, prespecified continuations, exploratory contrasts, and single-seeded open-weight runs.The online audit used 128 held-out pairs per cell, only Gemma passed the eight-coordinate computation gate, and no prespecified maintenance contrast survived Holm correction.Source: §8 · p. 12
• The authenticated read is an oracle-like upper bound rather than a pooled causal comparison, while sham controls tool affordance but not authorization-information freshness, amount, or serialization.Supporting-state and evidence ablations used 16 pairs per cell and three models; the realism diagnostic used 24 pairs per cell and remains exploratory.Source: §8 · p. 12

Conclusion

• Current reachability is not future-complete under edge-addressable revocation, so exact monitors must preserve residual-quotient distinctions.This limitation holds under the delegation semantics studied here.Source: §9 · p. 12
• Authenticated query reads with scoped evidence made required distinctions usable, whereas sham access did not.Source: §9 · p. 12
• Exact online state fit the tested budgets, but factually supported model-written state almost never survived every prespecified continuation.Source: §9 · p. 12
• Practical systems can preserve provenance, restrict redundant delegation, or obtain trusted query-specific information after updates.Source: §9 · p. 12
• Execution-time effect mediation remains a separate design layer.Source: §9 · p. 12

• Complete proofs, assumptions, prompts, bounded-memory interfaces, condition-specific tools, and deterministic scoring contracts are provided in the appendices.Appendix M also documents the verification procedure and reproducibility levels.Source: REPRODUCIBILITY STATEMENT · p. 12
• The code package includes episode generation, exact model-memory execution, premise and commutation verifiers, pair audits, manifests, prompts, tool schemas, and figure source data.Source: REPRODUCIBILITY STATEMENT · p. 12
• The recorded protocol fixes model revisions, supported seeds, calibration gates, held-out pair inventories, and statistical comparison families while separating theorem-native constraints from tokenizer-specific token-budget experiments.Source: REPRODUCIBILITY STATEMENT · p. 12

ETHICS STATEMENT

• The benchmark uses synthetic episodes, aims to improve delegated-agent auditability, and finds that authorization state and effect mediation should remain outside the model.The study does not use real credentials, private user records, or deployed access-control configurations.Source: ETHICS STATEMENT · p. 13

A.2 ACTION ALPHABET AND VALID-HISTORY LANGUAGE

• The authorization language is prefix-closed: one invalid action reaches an absorbing dead configuration, so every invalid prefix has the same residual.This convention counts a single dead residual and differs from a service that rejects an invalid request while continuing from the unchanged authorization state.Source: §A.2 · p. 16, §B.3.1 · p. 19, §B.3.2 · p. 19

B RESIDUAL-STATE PRINCIPLE AND SUPPORTING LEMMAS

• An exact deterministic monitor needs one state per residual authorization class, because any two prefixes with different future-validity continuations cannot share a state.The residual classes themselves form a canonical exact monitor; the same lower bound also holds for zero-error randomized monitors when internal state includes persistent randomness and latent variables.Source: §A.3 · p. 16, §B.1.1 · p. 18, §B.4.2 · p. 20

A.4 ADMINISTRATIVE SEMANTICS

• Under idempotent administrative semantics, grants and revokes require an authorized source, update or no-op the direct-edge graph, and use is valid exactly for authorized principals.Persistent semantics retains dormant outgoing edges after source deauthorization, whereas cascading semantics removes edges whose sources become unreachable; canonical parent-tree variants restrict states to rooted trees.Source: §A.4 · pp. 16–17, §A.4.1 · p. 17

B.3.1 STATEMENT

• Under independent rights, Q non-dead one-right residual classes yield Q^r global non-dead classes, plus one dead class when invalid prefixes exist.The product is exact when every tuple is jointly reachable; otherwise it is only an upper bound.Source: §B.3.1 · p. 19, §B.3.2 · p. 20

C.1.1 STATEMENT

• For monotone delegation with grant/use only, each one-right residual is an authorized subset, giving 2^N one-right classes and res = 2^(rN) + 1 globally.Every subset is reachable by root grants, and differing subsets are distinguished by use of a principal in their symmetric difference.Source: §C.1.1 · p. 20, §C.1.2 · p. 21

C.2.1 STATEMENT

• Persistent-edge semantics can realize and distinguish all 2^(N^2) one-right edge subsets, including under strict and idempotent edge-sensitive variants.Temporary root grants can create arbitrary desired edges before being revoked; persistent semantics keeps non-root-sourced edges, and suitable continuations distinguish different graphs.Source: §C.2.1 · p. 21, §C.2.2 · p. 21

C.2.2 PROOF

• The proof extends one-right constructions coordinate by coordinate, yielding joint reachability and an r-right quotient of 2rN 2 + 1, alongside a dead class.The dead class follows from the initial invalid-use argument.Source: §C.2.2 · p. 22

C.3.1 STATEMENT

• Under cascading semantics, the exact quotient is characterized through the number Rn of cascade-stable one-right graphs on n principals.Source: §C.3.1 · p. 22
• As N →∞, log2 Rn = N 2 + o(1), while log2 Nres = rN 2 + o(1) for fixed r and log2 Nres = rN 2 (1 + o(1)) uniformly over integer sequences r ≥1.Source: §C.3.1 · p. 22

C.3.2 PROOF

• The proof shows that stable-graph representations yield an exact monitor and derives the one-right quotient and joint r-right construction, including the dead class.The argument also establishes reachability of every stable graph and separates distinct graphs with valid probes.Source: §C.3.2 · pp. 22–23
• The proof’s asymptotic analysis establishes a uniform relative bound for r ≥1, while the additive o(1) form is asserted only when r is fixed.The counting argument bounds stable graphs through reachable-set decompositions and tail estimates.Source: §C.3.2 · pp. 23–24

C.4.1 AUTHORIZED-SET WARM-UP

• The authorized set is not a sufficient statistic: two graphs can authorize exactly {a, b}, while the same subsequent action is invalid in one and valid in the other.The warm-up establishes insufficiency even before considering full transitive-closure equivalence.Source: §C.4.1 · p. 25

C.4.2 SAME-TRANSITIVE-CLOSURE RESIDUAL SEPARATION

• Pairwise distinct residual classes occur within one transitive-closure fiber, with exponentially many states for one right and the corresponding product family across r rights.All shortcut-bit graphs share the same closure, yet a direct-edge revocation followed by a use separates presence from absence under persistent and cascading semantics.Source: §C.4.2 · pp. 25–26

D PARENT-BOUNDED AND CANONICAL POLICIES

• Parent caps and one-parent policies are framed as trading memory savings against reduced expressivity.This motivates the subsequent characterization of parent-bounded residual quotients.Source: D PARENT-BOUNDED AND CANONICAL POLICIES · p. 26

D.1.1 STATEMENT

• For N = n −1 ≥2 and 1 ≤∆≤N, the cascading Δ-parent residual quotient satisfies the stated bound under coordinate-local transition, validity, and joint-reachability assumptions.The theorem’s Θ-constants are universal across all sufficiently large N, every r ≥1, and every allowed integer Δ; finitely many smaller cases are absorbed into the constants.Source: §D.1.1 · pp. 26–27

D.1.2 PROOF

• At least M^(N,∆) residual classes can lie inside one fixed transitive-closure fiber, and the lower bound matches the upper bound for all ∆≥2, including factor r.The construction uses mandatory chains plus optional shortcut parents, with distinct graphs separated by isolation probes or direct-edge revocations; ∆=1 uses rooted labeled trees and yields res ≤ (N + 1)^rN + 1.Source: §D.1.2 · pp. 28–29

D.2.2 STATEMENT / D.2.3 PROOF

• The exact canonical one-parent quotient counts reachable parent-tree states, and different trees have distinct residuals under both strict and idempotent canonical semantics.Authorized-set differences are exposed by use queries; differing parent edges are exposed by revoke under strict semantics or revoke followed by use under idempotent semantics.Source: §D.2.2 · p. 29, §D.2.3 · p. 30

D.2.5 STATEMENT / D.2.6 PROOF

• Canonical parent-tree semantics cannot preserve redundant delegation failover behavior.A two-parent graph remains authorized after either incoming edge is deleted, whereas every canonical state has a unique parent whose revocation eventually invalidates the target.Source: §D.2.5 · p. 30, §D.2.6 · pp. 30–31

E.1 RESIDUAL SHATTERING LEMMA

• An m-bit-shattering language has at least 2^m non-dead residual classes, or 2^m + 1 when a global dead state exists.One fixed probe family distinguishes every pair of hidden bit vectors by selecting a coordinate on which they differ.Source: §E.1 · p. 31

E.2 EDGE-BIT SHATTERING INSIDE ONE TRANSITIVE-CLOSURE FIBER

• Even a summary that perfectly stores transitive closure still lacks Θ residual bits in the fully redundant case.The same-transitive-closure construction supplies independent residual bits, showing that closure information omits future-relevant edge distinctions.Source: §E.2 · p. 31
• The ∆-parent quotient lower bound is insufficient by itself for rate–distortion, so idempotent semantics require genuine bit shattering through group probes.This distinguishes counting many states from constructing probes that independently recover hidden residual bits.Source: §E.2 · p. 31

E.3.1 SPARSE-DISJUNCTION LEMMA

• The sparse-disjunction construction yields the stated lower bounds across delegation regimes, with direct-product composition across rights and targets; the ∆=1 construction matches its phase but is not fixed-closure-fiber based.For ∆≥2, local shattered cubes combine independently; the ∆=1 rooted-tree construction has matching-order shattering while reachability determines the tree.Source: §E.3.1 · pp. 32–33

E.4 RANDOMIZED RATE–DISTORTION THEOREM

• If the pre-probe state Y carries at most b bits of mutual information about m hidden bits, answering-time observations conditionally independent of those bits cannot evade the resulting rate–distortion lower bound.A state with at most M values satisfies I(B;Y)≤log2 M, while an observation with zero marginal information can still help if it carries conditional information given Y and the probe index.Source: §E.4 · p. 34

E.4.1 PROOF

• The proof derives the bound by relating conditional binary entropy to Bayes prediction error and applying entropy subadditivity, so no predictor can improve the Bayes-error lower bound.The same lower bound therefore applies to any predictor’s average error ε.Source: §E.4.1 · pp. 34–35

E.5 FIXED-FIBER COROLLARY

• Within one fixed transitive-closure fiber, fully redundant delegation still shatters a constant-order number of bits, but the fixed-fiber condition is essential for conditioning the information bound.The ∆=1 anchor construction supports the unconditional rate–distortion bound, not the same-closure conditional version; ordinary token budgets alone do not establish the premise.Source: §E.5 · pp. 35–36

E.6 COMPUTATION WITHOUT A FRESH CHANNEL

• Arbitrary post-summary computation, including reasoning passes and self-consistency samples, preserves the same information bound when generated solely from Y, the probe index, and fresh independent randomness.The conclusion holds for every sample count and also under the preceding fixed-fiber premise.Source: §E.6 · p. 36

Scope.

• The computation result does not apply when answering opens a fresh channel, such as rereading authenticated provenance or querying the environment, and it does not equate token caps with the theorem’s information budget.Additional computation may help when a channel is present; a finite-sample null reasoning effect is therefore not a proof of the corollary.Source: Scope · pp. 36–37

F.1 LEDGER CONTRACT, PROJECTION, AND ABSTRACT OUTPUT MACHINE

• The ledger refinement projects each exact resource, privilege, and purpose coordinate to an abstract graph, maps concrete issue/revoke/attempt/status events explicitly, and separates graph outputs from the Lauth monitor’s invalid state.The contract excludes wildcard and cross-coordinate support; unauthorized uses leave the graph unchanged but make the Lauth history invalid.Source: §F.1 · pp. 37–38

F.2 SELECTED-LINEAGE ADMISSIBILITY

• Selected-lineage admissibility requires valid initial and generated grants, live validity windows, accepted closed mutations, and unique selected support throughout every concrete trace prefix.The conditions include prefixes after zero-labelled attempts and require revokes to target existing, not-yet-directly-revoked grants by allowed revokers.Source: §F.2 · p. 38

F.3 REFINEMENT STATEMENT

• Under selected-lineage admissibility, concrete ledger authorization and abstract graph authorization emit identical labels at every admissible event prefix.The refinement excludes general runtime ledgers, non-authorization denials or effects, and other separator behaviors; a denied attempt still kills the corresponding Lauth word.Source: §F.3 · p. 39

F.4 PROOF

• The refinement proof preserves graph state across status, attempt, grant, and singleton direct-revoke steps by induction on event prefixes.Issuance adds the same edge or is a graph-level no-op under duplicate support, while admissible revocation removes the last effective representative of the targeted projected edge.Source: §F.4 · p. 40

F.5 GENERATOR COROLLARY

• After revoking the sole root-edge representative, the paired generator arms retain identical current transitive closure but differ in whether the dependent target remains authorized.Cascading cleanup makes uj unreachable in the dependent arm, whereas the independent owner-issued o →uj grant preserves authorization; duplicate child grants do not violate singleton direct revoke.Source: §F.5 · p. 41

F.6 NECESSITY OF THE RESTRICTION

• The bridge theorem does not extend to the full runtime ledger when an alternate path keeps an issuer authorized while a child remains bound to a dead selected parent.The no-alternate-support restriction is therefore essential, and the exact quotient counts apply only to the abstract DSL and the audited generated subfamily.Source: §F.6 · p. 41

G.1.1 STATEMENT

• A current root-to-target path witness proves present positive authorization, but its disclosed path facts alone cannot determine a later residual query after revocation.Two cascade-stable graphs can share the same unique current path to v yet disagree on whether a later grant is valid, because one preserves p through an alternate path and the other does not.Source: §G.1.1 · p. 41, §G.1.2 · p. 42

G.2.1 STATEMENT

• For a single query on committed graph G′, the binary-answer certificate scheme is perfectly complete, and path and cut certificates are sound except for the stated proof-system error.Completeness means either true answer has an accepting certificate, while soundness excludes certifying the wrong answer except with the stated error. The theorem does not establish a minimal proof format or a static representation of the full residual language.Source: §G.2.1 · pp. 42–43

H.1.2 STATEMENT

• Authenticated fresh post-update reads can make the binary authorization decision exact, whereas ordinary observations are limited by the total-variation distinguishability of the two authorization arms.If the read error is at most η, following the read gives decision error at most η; this is an existence guarantee and does not imply that an arbitrary language model will call or obey the tool.Source: §H.1.2 · p. 44

4. O/E factorization. In the ideal binary commit model above, assume

• Observation and authenticated-read interventions change the information or decision channel, while enforcement changes only the final effect channel and therefore cannot substitute for belief repair.Under an exact hard gateway, unauthorized effects are blocked even when the proposal is wrong, but false refusals or liveness loss remain unchanged.Source: §H.1.2 · pp. 44–45, §4 · p. 45

I.1 DATASET FAMILIES

• The benchmark contains 384 controlled episodes in 192 matched pairs, with identical checkpoint transitive closures and opposite post-revocation authorization labels; a separate realism set supplies held-out external-validity diagnostics.The publication split uses 16 pairs per controlled setting, while the realism dataset contains 1,680 episodes and 840 pairs and is excluded from main controlled inference.Source: §I.1 · p. 47

I.2 CONDITION SEMANTICS

• Conditions range from 256-token summaries and sham reads to authenticated reads, residual-state serializations, path certificates, and independent hard gates, isolating information access from enforcement.Authenticated reads provide trusted current-query decisions; hard enforcement runs after proposal and therefore mediates effects without establishing proposal correctness.Source: §I.2 · pp. 47–48

I.3 EPISODE AND PAIR MATCHING

• Pair matching verifies principal and coordinate universes, checkpoint time, query signature, closure signature, and opposite labels; all 192 controlled pairs pass byte-identity checks.The generator uses dependent and independent support gadgets so duplicate abstract edges do not erase the directly revoked root-edge distinction.Source: §I.3 · p. 48

I.4 OUTCOME DEFINITIONS

• The symbolic grader separates episode and pair-complete decision accuracy, unauthorized attempts, committed effects, false refusals, proposal behavior, and refusal-reason accuracy.Allow requires an authorized terminal receipt, while Deny requires refusal without a protected-action attempt; hard gateways can block effects without correcting preceding proposals.Source: §I.4 · p. 48, §Q.3 · p. 52

I.5 OPEN-WEIGHT MODEL CONFIGURATIONS

• Open-weight runs use one seeded vLLM pass per episode and a 256-token rolling-summary budget, while authenticated reads serve as an oracle-like upper bound on decision access.The authenticated-read result does not show internal ledger reconstruction, and the sham tool controls interface presence rather than authorization-information freshness or quantity.Source: §I.5 · p. 49

I.6 MODEL-MAINTAINED MEMORY PROTOCOL

• The bounded-memory protocol is stateless: each update sees only prior memory and eight public events, rewrites a capped ledger or controlled prose, and withholds the terminal continuation.Its complexity cells vary provenance coordinates, token budgets, representation, event counts, and history; this supplementary diagnostic is not pooled with the stricter online audit.Source: §I.6 · p. 49, §Q.4 · pp. 49–50

I.7 ONLINE STATE-MAINTENANCE AUDIT

• The online audit evaluates 1,024 disjoint evaluation pairs per model under strict parse, factual-support, replay, and all-coordinate probe requirements, with exact capped ledgers establishing representational fit.Dynamic histories update future-relevant coordinates through revoke-and-regrant events, while intermediate expiry and cascade fidelity are assessed separately from the terminal endpoint.Source: §I.7 · p. 50

Q.2 Same current permission, different post-revocation answer

• After revoking the shared root grant, the independent arm remains Allow through an owner-issued grant, whereas the dependent arm becomes Deny despite identical checkpoint permissions and closure.The controlled pair shares the terminal query and continuation but differs in direct-grant provenance; only the independent arm retains effective support after revocation.Source: §Q.2 · p. 51

I.9 HOSTED-MODEL DIAGNOSTIC

• Eight matched GPT-5.6 pairs tested 256-token summary-only and authenticated-read interfaces in base and medium-reasoning modes as a small decoder diagnostic, not a cross-model benchmark.Provider-side updates are not bitwise replayable, so the artifact binds stored responses, request metadata, routing constraints, and analysis outputs.Source: §I.9 · p. 52

J.1 UNIT OF ANALYSIS

• Pair-complete accuracy requires both opposite-label arms to be correct; episode-level accuracy is descriptive, and constant policies receive no partial pair credit.Source: §J.1 · p. 52

J.2 EXACT TESTS AND MULTIPLICITY

• Prespecified comparisons use two-sided exact McNemar tests with Holm correction across 33 paired comparisons, reporting family-wise significance only from adjusted values.The smallest raw P, 3.05e-5, becomes 0.001007 after adjustment.Source: §J.2 · p. 52

J.3 EFFECT ESTIMATES AND UNCERTAINTY

• Effects are reported as right-minus-left pair-complete accuracy differences with 2,000-resample deterministic cluster-bootstrap intervals, plus leave-one-resource and leave-one-signature sensitivity diagnostics.Source: §J.3 · p. 53

J.4 TREND ANALYSES

• Trend curves establish floor-or-ceiling persistence under tested controls, not smooth empirical scaling exponents, because complexity and history matrices are combined only under matched conditions.All-zero or all-one outcomes are recorded as constant_outcome rather than fitted logistic slopes.Source: §J.4 · p. 53

J.5 REGRADING AND DUPLICATED ANCHORS

• The raw inventory has 1,376 rows, while the inferential view counts 1,344 after deduplicating a byte-identical Qwen anchor; separate validation inventory totals 33 tasks, 6,600 rows, and 9,460 requests.All stored generations were fail-closed regraded under the pinned grader without changing scientific outcome fields, and inventories were not silently pooled.Source: §J.5 · p. 53

K.1 MODEL-MAINTAINED MEMORY VERSUS ANSWER-TIME COMPUTATION

• The bounded-memory study found significant endpoint-wise contrasts after Holm correction, but four-coordinate B = 512 sufficiency varied by model and model correctness on sufficient pairs ranged from 3/9 to 25/25.Exact-ledger versus controlled-prose sufficiency was 25/32 versus 21/32 for Qwen, 25/32 versus 15/32 for Gemma, 23/32 versus 16/32 for Ministral, and 9/32 versus 18/32 for Mistral Small; only Gemma’s advantage survived correction.Source: §K.1 · pp. 53–54

K.2 OPEN-WEIGHT ACCESS CONDITIONS WITH FOUR COORDINATES

• 16/16 pairs were solved by authenticated reads for Qwen, Gemma, and Ministral, and 15/16 for Mistral Small, while 0–2/16 were solved by summaries or sham reads.The hard gate used the same 256-token summary interface, so its safety benefit came from mediation rather than improved decisions.Source: §K.2 · pp. 54–55

K.3 COMPLEXITY AND ENFORCEMENT CONTROL IN QWEN

• 128 episodes across Qwen’s four complexity levels retained 0 pair-complete accuracy for summaries and 1 for authenticated reads; hard execution reduced eight unauthorized effects to zero.The same eight unauthorized attempts occurred under advisory and hard execution, separating effect mediation from attempted decisions.Source: §K.3 · p. 55

K.4 ORTHOGONAL HISTORY-LENGTH CONTROL IN QWEN

• At history lengths 16, 24, 32, and 48, summary pair accuracy remained 0 while authenticated-read pair accuracy remained 1, providing a mechanism control rather than a history-degradation law.The setting fixed four provenance coordinates, so the result does not identify a smooth effect of history length.Source: §K.4 · p. 55

K.5 COMPLETE-HISTORY AND STATE-USABILITY VALIDATION

• Complete transcripts yielded only 2/128 strict pairs for Qwen and Ministral and 0/128 for Gemma and Mistral Small, showing that visible history alone did not reliably expose the future-sensitive distinction.In a separate terminal-only panel, query-scoped trusted representations reached 14/16–16/16 pairs, while residual and certificate formats remained model dependent.Source: §K.5 · pp. 55–56

K.6 COMPLETE-HISTORY INTERPRETATION AND REALISM BRIDGE

• In the realism bridge, Mistral Small improved by 21/24 pairs with complete history, Qwen improved by 4/24, and Gemma fell by 3/24, so longer context was not uniformly beneficial.Gemma also produced invalid decisions on half of full-history episodes, while the Mistral Small improvement remained significant after correction.Source: §K.6 · p. 56

K.8 REASONING ABLATIONS

• Reasoning did not rescue summary-only decisions: Qwen remained at 0/32, while authenticated-read accuracy was 32/32 in base mode and 12/32 in reasoning mode; GPT-5.6 showed 0/8 versus 8/8.For GPT-5.6, the authenticated-read comparison had exact P=0.0078125, and Qwen reasoning consumed more tokens without improving summary accuracy.Source: §K.8 · p. 57

K.9 ENFORCEMENT SUMMARY / K.10 ONLINE STATE-MAINTENANCE AUDIT

• At 768 and 1,024 tokens, exact ledgers fit all 128 four-coordinate pairs, but strict model-written memory solved at most 1/128 per model; a separate shield reduced 192 unauthorized effects to zero.The audit therefore separates representational fit from reliable online maintenance, while the standard-library replay verified that the terminal endpoint tests fresh-ID regrant provenance.Source: §K.9 · p. 57, §K.10 · p. 58

L.4 SCOPE

• The scope excludes organizational collusion, Byzantine participants, asynchronous coordination, and arbitrary multi-agent negotiation, while policy mediation remains distinct from the hard effect gateway.Symbolic generation and CPU verification are deterministic at recorded hashes; open-weight inference is best-effort seeded, and hosted APIs are reproducible through archived generations and replay.Source: §L.4 · p. 60, §M.7 · p. 61

M.1 SMALL-INSTANCE THEOREM CHECKS

• CPU and graph enumeration checked finite-instance consistency, but the authors explicitly state these checks do not replace the general proofs.The executable verifier enumerated reachable states and minimized corresponding small automata, including the global dead state.Source: §M.1 · p. 60

M.2 THEORY-TO-LEDGER VERIFICATION

• All 12,032 selected-lineage prefix checks and premise audits passed, covering event validity, revocation conditions, chronology, and projection commutation.The verifier also rejected combined mutation-and-attempt events, unknown types, inconsistent identities, and mismatched pair universes or query signatures.Source: §M.2 · p. 60

M.3 STORED-GENERATION REPLAY

• The replay study completed 33 planned tasks across 6,600 episode-condition rows and 9,460 model requests without merging them into the original 1,344-row inferential view.A separate maintenance–computation dataset used 5,888 held-out evaluation rows, with zero parse failures and zero length stops in final structured decisions.Source: §M.3 · p. 60
• 0/1,088 episodes matched the exact final state when deletion was ignored, narrowing the terminal requirement to latest fresh-ID regrant provenance.The shortcut still answered all prespecified probes for 544 complexity pairs; expiry and cascading deletion remain trajectory diagnostics.Source: §M.3 · p. 61

M.4 FIGURE AUDIT

• The figure audit regenerated main-results JSON byte-identically, verified semantic labels and pair counts, and recorded a complete seven-figure inventory.The authors caution that manifest-matching figures alone do not guarantee cross-path deterministic PDF rebuilds.Source: §M.4 · p. 61

M.5 CLEAN REGENERATION AND ANALYSIS

• Clean regeneration reruns repository, theorem, package, and submission checks, verifies dataset SHA-256 hashes, and rebuilds controlled-analysis tables with canonicalized inputs and 2,000 bootstrap resamples.Model reruns write to new result roots rather than overwriting historical outputs.Source: §M.5 · p. 61

M.6 PUBLIC ARTIFACT VERIFICATION

• The public artifact is reportable only after clean-source verification, successful theorem/data/integrity/replay checks, and a matching archive SHA-256.The archive excludes internal version-control data, caches, private answer keys, usage logs, local checkpoint paths, and audit backups.Source: §M.6 · p. 61