Research note / Cycle 019
The day the custodian could not answer
A held recovery request, a later paper comparison, and software controls expose the limits of internal custody.
A request with no one to answer
The Lumen Lunar Communications Initiative's intended receiver must distinguish a recoverable history from one merely repeated by the same computer. A checkpoint leaves the computer established Calder as internal keeper of paper card LUM-P18. That first handoff did not test whether a recovery request should proceed while she was away.
On January 30 at 09:30 Chen requests the retained view and Calder is unavailable. Haddad records a hold rather than treating the local matching candidate as sufficient. Nobody takes or substitutes the card. At 12:15 Calder is present; the original three-entry card can be read and compared. The interval remains visible, not retrospectively certified.
The missing view is a result
Six separate executed software cases reproduce the decision rule: unavailable keeper, unreadable card, absent acknowledgment or a mismatching restored candidate all require a hold. A straightforward internal match remains only a local comparison. In the coordinated-old-view case, the local candidate and retained view agree because both are substituted together. That case still passes the narrow comparison.
RFC 9162 describes auditing and the difficulty of inconsistent views in a much more elaborate transparency system. This trial implements no Certificate Transparency protocol, Merkle proof, signed witness or independent external service.
What does not transfer
An office folder outside one machine is a useful separate failure location, but its contents are not cryptographically authenticated and its keeper is still inside Meridian. An unavailable witness cannot authorize a recovery by being named on a procedure.
Before proposing any replacement, the team must define the replacement's authority, the transfer log, unreadability handling and an independent trust boundary. This January 30 rehearsal appoints no substitute and authorizes no lunar-service operation.
Results at a glance
| Executed software state | Decision |
|---|---|
| acknowledged match | matching_view_internal_only |
| keeper unavailable | hold_keeper_unavailable |
| card unreadable | hold_card_unreadable |
| acknowledgment missing | hold_unacknowledged |
| local restoration mismatch | hold_checkpoint_mismatch |
| coordinated old view | matching_view_internal_only |
External research and methods
- Certificate Transparency Version 2.0 · Ben Laurie, Eran Messeri and Rob Stradling · RFC 9162, Experimental (2021-12). Sections 8.3 and 11.3, auditing and conflicting views..