Lifecycle State Machine
A digital persona moves through thirteen distinct states, from the moment a living person begins configuring their archive through final termination. Every transition requires a specific trigger, a satisfied guard condition, and an authorized actor. Nothing moves silently.
The thirteen states
Each state belongs to a phase. The phase determines what the system can and cannot do, and who holds authority at that moment.
1. Enrollment
The decedent is alive and actively configuring their archive: choosing what goes in, setting consent dimensions, and designating trustees.
2. Quiescent
Archive sealed, system waiting. Trustees confirm they still hold their shares on a regular schedule. The decedent can still revoke or modify consent.
3. Pending Verification
A death claim has been received and evidence is accumulating. Multiple sources must agree. The system gathers verifiable credentials from authorized issuers.
4. Manual Review Requested
Not enough automated evidence to proceed. The situation is under-documented or ambiguous, so a human review path is triggered with a slower trustee quorum.
5. Verified, Pending Challenge
The evidence threshold has been met and the challenge window is open. Anyone in a defined group can dispute the verification within this window.
6. Disputed
A valid challenge has been filed. Verification is paused while evidence is re-evaluated. The system does not proceed until the dispute resolves.
7. Delay Window
Unchallenged verification confirmed. The mandatory waiting period begins (for example, five years). Only clean time counts; disputes and suspensions pause the clock.
8. Key Assembly
Delay complete. Trustees submit their key shares to reconstruct the decryption key inside sealed compute. The quorum threshold must be met.
9. Active
The persona is operational. Requestors can interact within policy constraints. Every response carries citations and a signed bundle.
10. Suspended
Circuit breaker pulled; all interaction frozen. Can be triggered by any single trustee, by anomaly detection, or by a governance action. Lifting suspension requires a quorum.
11. Governance Foreclosed
The trustee quorum is mathematically impossible. Not enough trustees remain to form a quorum, and no recovery path exists. The archive is sealed permanently.
12. Permanent Preservation
Sealed time capsule, never interactive. The archive exists for historical record but the persona will never be activated. This may be chosen by the decedent while alive.
13. Terminated
Kill switch triggered. All material destroyed. Consent logs and structural metadata survive for audit, but content and key material are gone. Irreversible.
State diagram
The diagram below shows the primary transitions between states. Terminal states appear at the bottom. The "any state" transitions to Terminated and Governance Foreclosed are omitted from the arrows for clarity but apply universally.
Transition table
Every arrow in the diagram corresponds to a row in this table. The "Guard" column lists what must be true before the transition can fire. If the guard is not satisfied, the system stays put.
| From | To | Trigger | Guard | Who can trigger it |
|---|---|---|---|---|
| Enrollment | Quiescent | Archive sealed; all shares distributed | All designated trustees have confirmed receipt of their shares; consent record finalized | Decedent (via enrollment interface) |
| Quiescent | Pending Verification | Death claim submitted with initial evidence | At least one verifiable credential from an authorized issuer accompanies the claim | Any designated contact; authorized issuer |
| Pending Verification | Verified, Pending Challenge | Evidence threshold met | Required number of independent sources have submitted conforming credentials | System (automated evaluation) |
| Pending Verification | Manual Review Requested | Insufficient automated evidence after deadline | Evidence window has elapsed without reaching the automated threshold | System (timeout); any trustee |
| Manual Review Requested | Verified, Pending Challenge | Human review confirms death | Designated reviewer(s) have signed off; findings logged to transparency log | Designated human reviewer |
| Verified, Pending Challenge | Disputed | Challenge filed within window | Challenger is in the defined challenge group; challenge includes supporting evidence | Any member of the challenge group |
| Verified, Pending Challenge | Delay Window | Challenge window closes without dispute | Challenge period has elapsed; no valid challenges received | System (clock expiry) |
| Disputed | Pending Verification | Challenge upheld; evidence re-evaluated | Review panel has ruled; dispute resolution logged | Dispute resolution panel |
| Delay Window | Key Assembly | Delay period elapses | Full delay duration has passed with only clean time counted; no active suspensions or disputes | System (clock expiry) |
| Key Assembly | Active | Key reconstructed; persona ready | Quorum of trustees have submitted valid shares; key assembled inside sealed compute | Trustee quorum |
| Active | Suspended | Circuit breaker pulled | None (any single trustee can always suspend) | Any single trustee; anomaly detection; governance action |
| Suspended | Active | Suspension lifted | Trustee quorum votes to resume; root cause addressed and logged | Trustee quorum |
| Any state | Terminated | Kill switch triggered | Authorized by the decedent (while alive) or by a trustee supermajority (after death) | Decedent; trustee supermajority |
| Any state | Governance Foreclosed | Insufficient trustees remaining | Quorum is mathematically impossible; no recovery path (alternates exhausted) | System (automatic detection) |
| Enrollment / Quiescent | Permanent Preservation | Decedent chooses non-interactive archival | Decedent is alive; explicit opt-in to preservation-only mode | Decedent |
Key transitions in action
Six transitions illustrated as comic sequences. Each one shows the people involved, the mechanism that fires, and what changes.
Enrollment to Quiescent
The author seals the archive: artifacts chosen, consent set, shares distributed.
Each trustee confirms receipt of their key share. The seal is verified.
The system enters quiescent mode. Periodic liveness checks begin. The archive waits.
Pending Verification to Verified
Evidence documents arrive from independent issuers. Verifiable credentials accumulate.
The system tallies evidence against the threshold. Each credential is checked and logged.
Threshold met. The system announces verification is complete. The challenge window opens.
Active to Suspended
A trustee notices anomalous behavior in the persona's response patterns.
The trustee pulls the circuit breaker. One signature is enough. The system freezes immediately.
SUSPENDED. All interaction halted. Key material is zeroed. Resuming requires a quorum vote.
Delay Window to Key Assembly
The delay clock counts down to zero. Only clean, undisputed time is counted.
Trustees convene. Each one submits their key share to the sealed compute boundary.
Key shares combine inside sealed compute. The decryption key is reconstructed. The persona is ready.
Verified to Disputed
Verified → Disputed. A third party challenges the persona's authenticity, triggering the dispute-resolution process.
Any to Terminated
Any → Terminated. The kill switch bypasses normal transitions, moving the persona directly to a terminal state.