Compromise Lifecycle and Forensics

Compromise handling uses one incident identity across credibility, quarantine, recovery, revocation and forensic preservation:

healthy → suspicious → restricted → isolated → recovered | expelled

Revocation coordinates sessions, keys, roles, mandates and effects. Recovery requires a new epoch and credential generation with attenuated authority; old credentials cannot be replayed. Forensic preservation provides content-addressed evidence, hash-linked custody records, signed manifests, retention policy and legal hold controls.