Authority plane

A lifecycle operation starts as canonical intent. Policy admission converts that intent into an eligible DVM trace. The trace crosses the MPC or secret boundary, produces a scoped output, and closes with an evidence receipt.

The output is a signature, a CEK unwrap, a device enrollment package, a re-share result, a recovery transition, a rotation, or a scoped capability. In each case the output crossed the custody boundary under key and policy control.

A receipt binds admission hash, execution trace root, quorum participation, publication scope, and the evidence package signature — enough for an external party to verify what was admitted, what was executed, and what was published, without access to internal runtime state. Even redacted exports remain provably consistent with the full audit record because the trace digest is part of the receipt.

Device enrollment follows the same pattern: an approved transition from existing authority into a new epoch or device binding, with publication and split-view evidence attached.

The backend routes requests, stores opaque blobs, and coordinates delivery. The DVM plane records the authority statements: which key epoch is active, which policy admitted a transition, which quorum participated, and which result crossed the publication boundary. That separation makes the architecture applicable beyond signing — key lifecycle, device enrollment, factor rebinding, recovery, rotation, freeze, and retirement all use the same pattern.

An authority transition is admissible only when the requesting actor's identity, role, and approval chain are bound to active policy roots stored in the DomainManifest. Each transition type — rotation, enrollment, freeze, recovery — has its own policy path and approval depth. A break-glass override requires a distinct quorum threshold and produces a separately labeled BreakGlassReceipt.

Policy root changes go through the same DVM plane as signing operations: the new root must be admitted under the current policy, executed as a governance operation, and published before it takes effect in a subsequent epoch. A compromised operator cannot activate a backdoored policy without producing a traceable, quorum-endorsed, receipt-carrying transition.

The authority plane produces two distinct artifact types that serve different roles. A PolicyReceipt is a local artifact on the secret boundary: it is issued by the policy plane to the Local Secret Kernel for a specific signing operation on a specific node and is never replicated between nodes. It grants access to local key material for one operation and is consumed once.

A GovernanceDecision is a public, replicable authority artifact: it is produced by a threshold quorum of PolicyAuthority signers (typically HSM-backed Security Officers) and authorizes a cluster lifecycle transition. It binds the cluster manifest, policy epoch, roster epoch, key epoch, and transition intent into a content-addressed object that all nodes can verify. It appears in the cluster event log as the authorization evidence for TransitionAuthorized events. The distinction matters: PolicyReceipt stays on the secret boundary and cannot appear in audit logs; GovernanceDecision is the externally verifiable record that a governance quorum approved a lifecycle change.

A compromised node cannot sign unilaterally — it still needs to reach the configured t-of-n quorum with other independent nodes. The threshold property limits blast radius to liveness: the attacker can cause a node to misbehave or withhold participation, but cannot produce an unauthorized signature below threshold.

Containment follows a tiered response. An emergency freeze halts signing for the affected key or cluster while the incident is investigated; the FreezeReceipt records the directive, the actor, and the policy gate that admitted it. The node is then removed from quorum, its credentials rotated, and a clean replacement enrolled. For strong post-incident assurance, a key refresh redistributes fresh shares to the clean set of nodes and invalidates the compromised node's share — after which the old share is cryptographically useless even if retained by the attacker.