K11 · state, custody, decision, and release evidence
Protocol State Machine
Direct answer
K11 defines a ten-state, eighteen-transition reference protocol model and verifies declared and generated transcripts with two independent decoding algorithms, while preserving an explicit boundary between deterministic conformance and real security.
Claim-level evidence boundary
VERIFIED PROJECT IMPLEMENTATION
Protocol state behavior is model-tested across two decoders
K11 executes declared state transitions, invalid-transition rejection, downgrade and retirement behavior, replay persistence, recovery, and canonical transcript comparison using reference and independently implemented decoders.
Model and decoder agreement do not establish authentication, authorization, security completeness, performance, or deployment.
State-machine coverage
The reference interpreter and an independently implemented list-scan decoder must produce byte-identical canonical transcripts. Illegal transitions fail closed, unsafe downgrade does not establish a session, replay rejection persists through synthetic recovery, and retired critical meanings cannot disappear silently.
| State | Terminal | Meaning |
|---|---|---|
| IDLE | False | No session contract is active. |
| NEGOTIATING | False | Version, profile, and extension capabilities are being compared. |
| ESTABLISHED | False | A bounded reference session contract is selected. |
| DEGRADED_COMPATIBILITY | False | A lower compatible version or reduced extension set is active and visibly recorded. |
| RETIRING_EXTENSION | False | An extension is being removed under a declared retirement rule. |
| RECOVERING | False | A session is restoring state after bounded interruption. |
| REPLAY_REJECTED | False | A transcript or message was rejected by the persisted replay-state fixture. |
| DOWNGRADE_REJECTED | False | A requested downgrade violated the declared minimum contract. |
| FAILED | True | The bounded state machine reached a non-recoverable reference error. |
| CLOSED | True | The reference session ended under an explicit close transition. |
| From | Event | To | Outcome |
|---|---|---|---|
| IDLE | START | NEGOTIATING | OK |
| NEGOTIATING | COMMON_VERSION | ESTABLISHED | OK |
| NEGOTIATING | COMPATIBLE_FALLBACK | DEGRADED_COMPATIBILITY | NOTICE_DOWNGRADE |
| NEGOTIATING | NO_COMMON_VERSION | FAILED | ERR_NO_COMMON_VERSION |
| NEGOTIATING | UNSAFE_DOWNGRADE | DOWNGRADE_REJECTED | ERR_DOWNGRADE_POLICY |
| DOWNGRADE_REJECTED | RENEGOTIATE | NEGOTIATING | OK |
| ESTABLISHED | RETIRE_EXTENSION | RETIRING_EXTENSION | NOTICE_EXTENSION_RETIREMENT |
| DEGRADED_COMPATIBILITY | RETIRE_EXTENSION | RETIRING_EXTENSION | NOTICE_EXTENSION_RETIREMENT |
| RETIRING_EXTENSION | RETIREMENT_ACCEPTED | DEGRADED_COMPATIBILITY | OK |
| RETIRING_EXTENSION | RETIREMENT_REJECTED | FAILED | ERR_CRITICAL_EXTENSION_RETIRED |
| ESTABLISHED | INTERRUPTION | RECOVERING | NOTICE_SESSION_RECOVERY |
| DEGRADED_COMPATIBILITY | INTERRUPTION | RECOVERING | NOTICE_SESSION_RECOVERY |
| RECOVERING | STATE_RESTORED | ESTABLISHED | OK |
| RECOVERING | STATE_RESTORED_DEGRADED | DEGRADED_COMPATIBILITY | NOTICE_DOWNGRADE |
| RECOVERING | REPLAY_DETECTED | REPLAY_REJECTED | ERR_REPLAY |
| REPLAY_REJECTED | RENEGOTIATE | NEGOTIATING | OK |
| ESTABLISHED | CLOSE | CLOSED | OK |
| DEGRADED_COMPATIBILITY | CLOSE | CLOSED | OK |
Declared transcript cases
Clean 1 1
START → COMMON_VERSION → CLOSE
CLOSEDCompatible Fallback
START → COMPATIBLE_FALLBACK → CLOSE
FAILEDNo Common Version
START → NO_COMMON_VERSION
CLOSEDUnsafe Downgrade Recovery
START → UNSAFE_DOWNGRADE → RENEGOTIATE → COMMON_VERSION → CLOSE
CLOSEDExtension Retirement
START → COMMON_VERSION → RETIRE_EXTENSION → RETIREMENT_ACCEPTED → CLOSE
FAILEDCritical Retirement Failure
START → COMMON_VERSION → RETIRE_EXTENSION → RETIREMENT_REJECTED
CLOSEDSession Recovery
START → COMMON_VERSION → INTERRUPTION → STATE_RESTORED → CLOSE
CLOSEDDegraded Session Recovery
START → COMPATIBLE_FALLBACK → INTERRUPTION → STATE_RESTORED_DEGRADED → CLOSE
CLOSEDReplay During Recovery
START → COMMON_VERSION → INTERRUPTION → REPLAY_DETECTED → RENEGOTIATE → COMMON_VERSION → CLOSE
FAILEDIllegal Transition
START → CLOSE
REPLAY_REJECTEDReplay State Persistence
START → COMMON_VERSION → INTERRUPTION → REPLAY_DETECTED
CLOSEDCross Version Verification
START → COMPATIBLE_FALLBACK → RETIRE_EXTENSION → RETIREMENT_ACCEPTED → CLOSE
Failure taxonomy
| Code | Class | Severity | Public meaning |
|---|---|---|---|
| ERR_NO_COMMON_VERSION | NEGOTIATION | TERMINAL | No mutually supported version exists. |
| ERR_DOWNGRADE_POLICY | DOWNGRADE | RECOVERABLE | The proposed fallback is below the declared minimum or violates a pinned capability. |
| ERR_UNKNOWN_CRITICAL | EXTENSION | TERMINAL | A critical extension meaning is unknown. |
| ERR_CRITICAL_EXTENSION_RETIRED | RETIREMENT | TERMINAL | A required critical extension has been retired without an accepted replacement. |
| ERR_REPLAY | REPLAY | RECOVERABLE | A persisted replay-state check rejected the message or transcript. |
| ERR_TRANSCRIPT_MISMATCH | TRANSCRIPT | TERMINAL | Independent decoders produced different canonical transcript records. |
| ERR_RECOVERY_STATE | RECOVERY | TERMINAL | Required persisted session state was absent or inconsistent. |
| ERR_CANONICALIZATION | ENCODING | TERMINAL | Equivalent input did not reduce to one canonical representation. |
A deterministic state machine can prove declared transition behavior. It cannot by itself prove authentication, authorization, confidentiality, safety, semantic truth, or production interoperability.