{"$schema":"https://mandateshield.com/schemas/formal-model-results/v1","schema_version":"1.0.0","model":{"name":"MandateShield Execution Authorization State Model","version":"1.0.0","reviewed_on":"2026-07-25","tla_source":"https://mandateshield.com/evidence/formal-execution-model/v1/MandateShieldExecution.tla","runner":"TypeScript breadth-first bounded state explorer"},"bounds":{"tenant_count":2,"budget_units_per_tenant":2,"purchase_amount_units":[1,2],"receipt_key_generations":2,"maximum_transition_depth":9,"frontier_truncated":true},"exploration":{"states_explored":10460,"transitions_explored":37354,"frontier_states":2950,"safe_transition_violations":0},"invariants":[{"id":"budget_conservation","statement":"reserved + committed never exceeds the tenant budget","passed":true},{"id":"consume_at_most_once","statement":"one authorization attempt has consume_count <= 1","passed":true},{"id":"revocation_prevents_reservation","statement":"revoked authority cannot create a new reservation","passed":true},{"id":"unknown_never_restores_authority","statement":"an unknown provider outcome never releases budget or restores submission authority","passed":true},{"id":"release_requires_confirmed_non_success","statement":"RELEASED requires a confirmed NOT_SUBMITTED or FAILED outcome","passed":true},{"id":"late_success_dominates_unknown","statement":"a late confirmed success resolves UNKNOWN to COMMITTED without returning budget","passed":true},{"id":"retained_key_rotation_preserves_receipts","statement":"every historical receipt key remains in the retained verification keyring","passed":true},{"id":"tenant_isolation","statement":"a tenant-scoped transition cannot mutate another tenant","passed":true}],"mutation_controls":[{"id":"overspend_reservation","detected":true,"violated_invariants":["budget_conservation"],"witness":"overspend"},{"id":"double_consume","detected":true,"violated_invariants":["consume_at_most_once"],"witness":"double consume"},{"id":"reserve_after_revocation","detected":true,"violated_invariants":["revocation_prevents_reservation"],"witness":"revoked reserve"},{"id":"restore_unknown_authority","detected":true,"violated_invariants":["unknown_never_restores_authority"],"witness":"restore unknown"},{"id":"release_without_confirmed_non_success","detected":true,"violated_invariants":["release_requires_confirmed_non_success"],"witness":"unsupported release"},{"id":"ignore_late_success","detected":true,"violated_invariants":["late_success_dominates_unknown"],"witness":"ignored success"},{"id":"drop_retained_historical_key","detected":true,"violated_invariants":["retained_key_rotation_preserves_receipts"],"witness":"drop old key"},{"id":"cross_tenant_write","detected":true,"violated_invariants":["tenant_isolation"],"witness":"cross tenant write"}],"outcome":"PASS","claims":{"mathematical_proof":false,"tla_model_checker_executed":false,"independent_audit":false,"bounded_executable_exploration":true},"limitations":["The explorer checks a finite abstraction with two tenants, two budget units, two purchase sizes, two receipt-key generations and the stated transition-depth bound.","The TLA+ source is a reviewable specification; this release does not claim that TLC or another TLA+ model checker was executed.","Passing this model does not prove the deployed database, network, payment provider, scheduler or customer gateway implementation correct.","Mutation detection demonstrates that the executable invariant checker rejects the listed intentionally unsafe transitions; it is not an independent audit."]}