\documentclass[letterpaper,10pt,conference]{ieeeconf}
\IEEEoverridecommandlockouts
\overrideIEEEmargins
\usepackage{amsmath,amssymb,amsfonts}
\usepackage{graphicx,algorithm,algpseudocode,booktabs,listings}
\usepackage{cite}
\title{\bf Commit-Time Governance: Enforcing Recoverability at the Point of Action}
\author{[Authors anonymized for submission]}

\newcommand{\x}{\mathbf{x}}
\newcommand{\xt}{\tilde{\mathbf{x}}}
\newcommand{\A}{\mathcal{A}}
\newcommand{\Rset}{\mathcal{R}}
\newcommand{\Rrob}{\mathcal{R}_{rob}}
\newcommand{\Cset}{\mathcal{C}}
\newcommand{\Scert}{\mathcal{S}_{cert}}
\newcommand{\Phiop}{\Phi}
\newcommand{\Lam}{\Lambda}
\newcommand{\Ri}{R_i}
\newcommand{\Rigel}{\mathbf{R}}

\begin{document}
\maketitle
\thispagestyle{empty}
\pagestyle{empty}
\begin{abstract}
We introduce commit-time governance: a minimal enforcement mechanism that checks whether an action can be recovered from at the exact moment it becomes irreversible. Current systems separate governance into pre-action policy and post-action audit, leaving the commit—the point of no return—ungoverned. We close this gap with four contributions: (1) a commit admissibility condition based on recoverability rather than static legitimacy alone; (2) an executable constant-time gate with reproducible traces; (3) a barrier-certificate proof that the gate is sound with respect to a certified safe subset; and (4) an adversarial analysis showing fail-closed degradation under bounded attacks. The framework operates on a four-dimensional state space $(g,c,a,t)$ and is deliberately narrow: it governs commits, not trajectories.
\end{abstract}
\section{Introduction}
Governance systems usually act either before execution (policy, guardrails, authorization) or after execution (monitoring, audit, remediation). Both approaches miss the critical moment at which intention becomes irreversible effect.
We define \emph{commit-time governance} as follows: an action is allowed if and only if the post-commit state remains robustly recoverable under lag. This reframes governance from a static question—whether the current state is legitimate—to a transition question—whether the system can still recover after the proposed action takes effect.
\section{Minimal Formal Setup}
Let the system state be
\[
\x=(g,c,a,t)\in[0,1]^4.
\]
Define the legitimacy capacity
\[
\Lam(\x)=K g^\alpha c^\beta t^\gamma,
\]
with $K>0$ and $\alpha,\beta,\gamma>0$. The admissible region is
\[
\A=\{\x: m(\x)\ge 0\},\qquad m(\x)=\Lam(\x)-a.
\]
Let $\Rset(0)$ denote the set of states from which there exists a recovery control driving the system back to $\A$ while avoiding collapse. Let $\Rrob(\tau)$ denote the robust recoverable region under total lag
\[
\tau=\tau_{obs}+\tau_{dec}+\tau_{act}.
\]
Normalize nonzero states by
\[
\xt=\frac{\x}{\|\x\|_1}\in\Delta^3,
\]
where $\Delta^3=\{y\in\mathbb{R}^4_+:\sum_i y_i=1\}$. Let the Rigel point be
\[
\Rigel=\left(\tfrac14,\tfrac14,\tfrac14,\tfrac14\right),
\]
and define
\[
d_F(\xt)=\min_i \xt_i,\qquad d_\Delta(\xt,\Rigel)=\|\xt-\Rigel\|_2.
\]
\section{The Commit Gate}
The commit operator is
\[
\Phiop(\x,u)=\mathrm{clip}_{[0,1]^4}(\x+u).
\]
The ideal admissibility condition is
\[
\mathrm{ALLOW}_{ideal}(u;\x,\tau)\iff \Phiop(\x,u)\in\Rrob(\tau).
\]
\textbf{Commit Safety.} If every executed action satisfies $\mathrm{ALLOW}_{ideal}$, then no committed transition places the system in a state from which collapse is unavoidable under the modeled lag and disturbance assumptions.
\textit{Proof sketch.} By induction over commit events. The base state is assumed robustly recoverable. Each allowed transition preserves membership in $\Rrob(\tau)$, so unrecoverable states are never entered without violating the gate condition. \hfill $\blacksquare$
\section{Executable Evidence}
The executable reference implementation evaluates a post-commit state against
\[
\Scert(\tau)=\{\x: B_F(\xt)>0\ \wedge\ B_D(\xt)>0\},
\]
where
\[
B_F(\xt)=d_F(\xt)-\epsilon_{crit}(\tau),\qquad
B_D(\xt)=d_{max}(\tau)-d_\Delta(\xt,\Rigel).
\]
Membership in $\Scert(\tau)$ is sufficient, but not necessary, for membership in $\Rrob(\tau)$.
\begin{table}[h]
\centering
\caption{Gate Performance}
\begin{tabular}{lcccc}
\toprule
Scenario & Actions & Allowed & Denied & Recovery \\
\midrule
Drone & 4 & 3 & 1 & 100\% \\
Human & 9 & 8 & 1 & 100\% \\
Consensus & 11 & 10 & 1 & 100\% \\
\bottomrule
\end{tabular}
\end{table}
\section{Certified Approximation}
Under calibration assumptions C1 (face safety) and C2 (recoverability),
\[
\Scert(\tau)\subseteq\Rrob(\tau).
\]
Therefore
\[
\mathrm{ALLOW}_{impl}(u;\x,\tau)\Rightarrow \mathrm{ALLOW}_{ideal}(u;\x,\tau).
\]
The approximation error set is
\[
\mathcal{E}(\tau)=\Rrob(\tau)\setminus\Scert(\tau),
\]
which contains recoverable states rejected by the implementation.
\section{Adversarial Robustness}
Within a calibration envelope, bounded perturbations preserve soundness with respect to an expanded certified subset. Inflated lag only makes the test stricter. Boundary surfing does not violate pointwise safety, but it can exploit the absence of trajectory-level monitoring. Recovery disruption can be tolerated when disturbance remains within the contraction budget of the recovery controller.
Outside the calibration envelope, the intended behavior is fail-closed: denial, safe mode, or external intervention. The residual risk is operational slowdown or false negatives, not silent catastrophic allowance.
\section{Conclusion}
Commit-time governance enforces recoverability at the point of action. It is a minimal, constant-time mechanism that closes the gap between pre-action policy and post-action audit. Its scope is intentionally narrow and therefore auditable: it governs commits, not trajectories.
\end{document}
