Human membership
The production tenant retained two active humans—one owner and one auditor—with no pending invitations.
PUBLIC EVIDENCE
Inspect the records behind an authority decision.
Start with a portable MCP2 example that reconstructs one selected decision without MCPaios access. The preserved September 3 production proof below documents a separate historical deployment; it is not a live inventory of today’s tenant.
EVIDENCE / PORTABLE EXAMPLE / HISTORICAL PROOFEXTERNAL REVIEW
One decision. The applicable evidence. A runnable verifier.
The bundle supplies the original verification request, its complete one-grant chain, policy material and digest binding, decision receipt, and historical verifier time. After obtaining the repository, run this command from its root:
node examples/portable-reconstruction-v1/verify.mjsThe example needs no database, network service, MCPaios account, or operational secret. It does not imply that arbitrary live receipts are automatically exportable in this shape or independently signed. A decision receipt alone is not the complete evidence package.
Open the pinned portable example →01PROPOSE
02RATIFY
03GRANT
04ALLOW
05EXECUTE
06COMPLETE
07RECONSTRUCT
08REVOKE
09DENY
WHAT WAS DEMONSTRATED
Concrete behavior, not a diagram presented as proof.
The public evidence is deliberately bounded to the path that was actually exercised.
Machine identities
Separate production operator and fence credentials were provisioned with one-time plaintext handling and hash-only persistence.
Receipted ALLOW
The fence committed an ALLOW before the harmless local demo.echo action executed and later bound SUCCESS completion evidence.
Human revocation
The owner revoked the exact bounded grant with a recorded human reason.
Post-revocation DENY
The same fence request class returned GRANT_NOT_ACTIVE; local execution and completion were skipped.
Credential retirement
Both temporary production service credentials were revoked; active production service credentials returned to zero.
Reconstruction
Both the successful pre-revocation path and later denial remained reproducible with identities, scope, protocol, and authority state.
DECISION RECEIPTALLOW
- grant
- MCPAIOS-PROD-SMOKE-001
- action
- demo.echo
- target
- urn:mcpaios:demo:echo
- receipt
- 65e047bc…38f0
- completion
- SUCCESS / external-fence
- local execution
- performed after receipt
DECISION RECEIPTDENY
- grant
- MCPAIOS-PROD-SMOKE-001
- authority state
- revoked
- reason
- GRANT_NOT_ACTIVE
- receipt
- 38b1ce0a…f4928
- completion
- none
- local execution
- skipped
HISTORICAL STATE · SEPTEMBER 3, 2026
Authority stopped. Evidence remained.
That historical deployment’s final state retained the historical record while leaving no active grant or service credential from the demonstration.
2active humans
0active grants
0active service credentials
2decision receipts
1bound completion
0authority link errors
WHY RECONSTRUCTION MATTERS
It preserves the differences an ordinary activity log loses.
Requested: the machine proposed exact demo.echo authority against one target.
Approved: the authenticated owner ratified that proposal with a recorded reason.
Granted: the operator issued only the exact ratified scope.
Decided: the fence committed a durable ALLOW against authority revision 14.
Completed: the external fence reported SUCCESS after local execution.
Stopped: human revocation advanced authority state; the later request received durable DENY without execution.
EVIDENCE BOUNDARY
What this production proof does not claim.
It does not prove arbitrary remote target execution safety.
It does not claim protection against every compromised infrastructure dependency.
It does not claim hardware-backed trusted time or universal Byzantine independence.
It does not claim readiness for every possible target connector.
OPERATE THE BOUNDARY
Inspect authority evidence inside the protected product.
The Control Plane exposes receipts, completion evidence, reports, and full reconstruction only to authenticated members.