Celest
Sections
Explore the demo

Celest Learn · Operating model

Evidence, authority, and receipts

Evidence describes what was observed. A proposal describes intended work. An authority decision records whether a specific actor approved that exact intent. A handoff identifies who or what received the work. Execution evidence records what was later observed to run. A receipt closes the review with the identities of those artifacts. None of these is interchangeable with another.

Published
Updated
Evidence
Celest-authored control model grounded in implemented lifecycle contracts and cited authorization guidance.

The one-sentence rule

A finding cannot approve its own remedy. Approval cannot prove that work started. A handoff cannot prove that work completed. A successful provider response cannot prove that the intended state now exists. Each boundary requires a new artifact created from the evidence available at that boundary.

The artifact chain

Seven artifacts with seven different claims
ArtifactWhat it may claimWhat it must never imply
Evidence contextWhat source-qualified state was observed and with what limitationsThat a problem exists or an action is justified
FindingWhat a versioned rule concluded from sufficient evidenceThat the proposed response is approved
ProposalWhat bounded work is suggested, with consequences and alternativesThat it carries authority or a provider command
Authority decisionWhat an identified principal decided about the exact proposalThat execution began or succeeded
HandoffWhich actor or work boundary received the approved intentThat the receiver acknowledged or performed it
Execution evidenceWhat reduced observation indicates ran, failed, succeeded, or remains unknownThat the desired postcondition was independently verified
ReceiptWhich correlated artifacts terminally close this reviewMore evidence than the referenced artifacts establish

The chain uses stable identities and one correlation identifier so a reviewer can determine exactly which evidence, proposal, decision, handoff, acknowledgement, and execution observation belong together. The receipt contains those identities rather than duplicating source payloads or manufacturing a more optimistic story.

Authority is data

Runtime authorization answers whether a request may reach a protected resource. The Model Context Protocol authorization specification, for example, requires protected servers to validate access tokens and ensure they were issued for the server. That is necessary, but operating authority also needs a durable answer to a different question: who decided that this exact work, against this exact scope, should happen now? [mcp-authorization]

In Celest's review contract, an authority decision identifies the principal, the correlated review, the outcome, the rationale, and the decision time. Approval is only one outcome. Reject, defer, request changes, and request more evidence are equally real decisions and must not be squeezed into a binary approval field.

A decision attempt is terminal

One review records at most one authority decision. If the decision requests changes or more evidence, that decision closes the attempt. A later approval must occur in a successor review that satisfies the terminal request: request_changes requires a new proposal, while request_more_evidence requires a newly observed collection and snapshot. Editing history in place would make it impossible to know what was actually reviewed.

Decision outcomes and honest next states
OutcomeMeaningPermitted next state
approveThe identified principal accepts this exact proposalBounded handoff may be created
rejectThe proposal is not authorizedClose with a decision receipt
deferNo current authority to proceedClose; revisit through a new review
request_changesThe proposal itself must changeCreate a successor with a new proposal
request_more_evidenceThe evidence context is insufficientCreate a successor grounded in fresh evidence

Handoff is not execution

A work item, queue message, or external-executor request proves only that work crossed a boundary. The receiver's acknowledgement is a separate fact. Observation that work ran is another separate fact. This separation matters most when systems are asynchronous, retryable, distributed, or operated by another team.

  • A created ticket is not acknowledged work.
  • An acknowledged ticket is not executed work.
  • An accepted API request is not a completed change.
  • A completed provider operation is not an independently verified postcondition.
  • A receipt is not permission to invent any missing link.

What a receipt proves

A receipt is an immutable terminal projection of the review. A decision-closed receipt proves that a specific authority decision closed the review. An execution-recorded receipt additionally correlates the handoff, acknowledgement, and reduced execution evidence. It does not retain raw provider responses, tenant secrets, or duplicate evidence.

Receipt outcomes
OutcomeRequired identitiesBounded claim
decision_closedReview, correlation, authority decisionA terminal decision occurred for this review
execution_recordedReview, decision, handoff, acknowledgement, execution evidenceSeparate work was observed and correlated
Fresh-state reconciliationNot yet represented by the current focused-review receiptFuture proof that the desired estate state was independently observed

What collapses when the boundaries collapse

Common state-collapsing failures
ShortcutFalse implicationControl response
Finding auto-creates a mutationDiagnosis grants authorityRequire a separate proposal and decision
Approval button invokes provider directlyUI identity equals bounded execution authorityBind decision, scope, actor, and adapter separately
HTTP 200 closes the findingTransport acceptance equals desired outcomeObserve execution and later reconcile fresh state
Proposal is edited after approvalThe approved digest still describes the workInvalidate approval and create a successor review
Receipt copies a success messageProvider prose is durable proofReference reduced, validated evidence identities

What Celest has proved today

Celest's dependency-free contracts and tests model bounded evidence grounding, proposals without commands or authority, five terminal decision outcomes, successor-review lineage, handoff, acknowledgement, reduced execution evidence, and terminal receipts. They reject mismatched correlations and artifact chronology that would imply work without proof.

The Microsoft-facing Estate Review API remains read-only. These contracts establish the control vocabulary and state machine; they do not claim that Celest currently executes Microsoft lifecycle mutations as a commercial production capability. The next honest proof is an inspect-only lifecycle plan, followed later by separately authorized execution and fresh-state reconciliation.

Limitations

  • An immutable receipt can preserve a false conclusion if its upstream evidence or validation policy is unsound; immutability is not truth by itself.
  • The current focused-review execution evidence is a reduced observation, not full independent postcondition verification.
  • Authority semantics must be adapted to the organization's identity, delegation, policy, and regulatory model.
  • The contract does not grant provider credentials or execution authority.
  • Customer-estate mutation remains outside the current commercial Estate Review boundary.

Sources

External claims on this page use the primary sources below. Celest-authored definitions and design criteria are identified as our operating model.

  1. 1
    Model Context Protocol authorization specification

    Model Context Protocol · Accessed 2026-07-27. Protected-resource token validation and audience binding; used here only for the runtime-authorization distinction.

Publication record
Author
Celest
Source revision
sha256:0400cb977f9cc1cf0a1de4a543219bfe56d30505bf38d618d8da4a06f2cf1906