This is a deterministic behavioral replay checksum, not a digital signature and not independently attested. Verification applies exact schemas to the evidence object, the telemetry, and each injection entry, requiring every mandatory field per action, rejecting unknown properties at any level, rejecting nonpositive durations, and rejecting any injection scheduled at or beyond the sealed tick. It then recomputes the digest, confirms the frozen config hash, replays a fresh simulation from the same seed and injection schedule, and requires the entire replayed telemetry (board, epochs, statistics, ledger root) to equal the sealed telemetry field for field. It deliberately does not include or attest the per run capability identity (run identifier, grant tags, predecessor chain); that identity is verified in memory by the legitimacy and chain audits but is not part of the portable evidence. The evidence therefore proves that the public behavior reproduces from the stated inputs, not which run capability authenticated the grants and not who produced or last held the record.

Anchor: USAF CCA (A-GRA open architecture), human-machine teaming under human supervision. Framed by DoDD 3000.09. Governance and assurance only, no dynamics, no actuation, no targeting, no weapons.

Demonstrated model invariant: within the modeled scripted and seeded scenarios, the arbiter maintains exactly one eligible authenticated holder for each responsibility, never zero (a gap) and never two (split authority), and a failed supervisor is treated as ineligible. The untrusted allocator issues only requests; it cannot name a grantor, install a grant, or mint a valid capability tag.

Per-run capability (in-process, private): at run start the arbiter mints a random secret using the platform secure random source and holds it inside a private closure keyed to the run context. The whole engine runs inside a single private closure; the secret, the signing routine, the simulation state, and ledger mutation are never attached to the page global scope, and there is no global handle to mint or read capability material. The hash and random primitives are captured as immutable references at load, so replacing a global function later has no effect. Randomness is fail closed: if a secure random source is unavailable, run creation aborts rather than downgrading. Every grant the arbiter issues is bound by a keyed tag over all of its immutable authorization fields, namely holder, grantor, prior holder, epoch, issue time, lease deadline, reason, basis, run identifier, and the predecessor grant tag; changing any of these invalidates the tag. State and verification metadata such as the revoked flag are handled separately and are not part of the tag. An injected, stale, cross-run, or higher-epoch grant fails the tag or run-identifier check, is quarantined, and never becomes the effective holder. This is an in-process capability marker for the simulation, not a hardware-backed key or public-key credential.

Grant-chain audit: the legitimacy audit verifies the full per responsibility grant chain in memory: contiguous epochs from the initial grant, each grant bound to the previous grant tag and to this run identifier, one authenticated head matching the authority record, and a grant count matching the ledgered issuance events. It also reconstructs the effective holder before every issuance directly from the ledger and requires each grant, and its matching ledger event, to agree on the prior holder it moved from, the holder it moved to, and a recognized reason, basis, and grantor consistent with that transition. It further enforces an exact field set on each issuance event and cross-checks the event's own recorded basis, grantor, holder, target, and timestamp against the authenticated grant, so a tampered ledger event is rejected even when its hash chain is intact. State-clearing events that drop authority to none carry the prior holder and epoch they cleared, and the audit accepts a cleared state only after reconstructing member availability and override status from the ledger and confirming the clearing event was justified: a lease expiry needs a real active holder, an override expiry needs an active override past its deadline, and a supervisor-down void needs an active override with the supervisor recorded down. A transfer may never claim to originate from none. As a definitive backstop, a replay-consistency check confirms that the complete live state, both the exported telemetry and the private control state (override deadlines, emergency window, generator state, and normalized grant history), reproduces from the run seed and its recorded injections, so any out-of-band event, grant, or latent control-state change that did not arise from those inputs is rejected; deadlines are recorded so that an absent value is distinct from a present null or non-finite value, and each present deadline must be a safe integer, so an invalid hidden value cannot masquerade as an absent one. The identifier indexed control maps use null prototypes and their prototype integrity is audited, so a value reached through a polluted prototype is rejected rather than read as live state, and runtime eligibility decisions use own property checks throughout. Failed member entries are validated to be exactly the value true and are recorded by presence and value, and the reported failed set lists only members the runtime actually treats as failed, so a private value that contradicts the reported state is rejected; a lease expiry is legitimate only when it follows from a declared expiry injection. Monotonic issue times and a bounded lease are also required. A signed grant is never edited after issuance; lease expiry is modeled by revoking the grant through a ledgered transition. Because the tags are random per run, they are not written into the ledger or the exported evidence; the chain is audited on the live state rather than from the portable record.

Reassignment policy, not invented consent: the allocator only recommends. When the arbiter reassigns a responsibility it records itself as the deciding authority (grantor ARBITER) with an explicit basis; it does not record the prior holder as having consented. Supervisor authority is recorded with grantor SUP_OVERRIDE.

Reviewer identities are allowlisted, not authenticated: override and emergency authority require the reviewer to be on a fixed allowlist in the frozen config with the supervisor role, and require the supervisor to be available for a bounded deadline. This is allowlisting of a synthetic reviewer identity, not verification of a human credential.

Threat boundary: the adversary in this model is the untrusted allocator, that is the proposal and injection data entering the documented interface. The browser host is trusted. Unrelated scripts sharing the same page are treated as outside the trusted boundary to the extent a single file allows: the engine is encapsulated in a private closure, capability material is private with immutable primitive references, and randomness is fail closed. A single HTML file cannot fully defend against a co-resident script that executes before the engine or tampers with the runtime; for high-assurance use the engine would run as an isolated module or service. The capability service is not presented as a general same-process security boundary.

Not yet established: this build does not include formal model checking, concurrent-interleaving analysis, property-based adversarial testing, mutation testing, a digital signature, human credential authentication, implementation identity, a sealed release manifest, or an independent verifier. The single-holder property is demonstrated over the modeled scenarios, not proven over arbitrary distributed concurrency.

(c) 2026 Burak Oktenli, MBA. Georgetown University M.P.S. Applied Intelligence. ORCID 0009-0001-8573-1667. Washington, DC. CC BY 4.0.