TITIP-007 Escalation
Status Accepted
Version 0.1
Stage 0 — Authority

Purpose

Specify the state machine that sits between a due check and a release candidate. Escalation collects evidence. It does not deliver vaults.

States

Canonical states:

ACTIVE
  → CHECK_DUE
  → REMINDER_1
  → REMINDER_2
  → ALTERNATE_CHANNEL
  → GRACE_PERIOD
  → TRUSTED_CONTACT_VERIFY
  → REVIEW
  → ELIGIBLE_FOR_RELEASE

Terminal or side states used by the same machine:

State When
ACTIVE Owner confirmed, or a new cycle has not started
CANCELLED Owner confirmed, or owner stopped the cycle, after it had left ACTIVE
HELD Policy cannot proceed (too few contacts, provider outage past a safety limit, global hold)
ELIGIBLE_FOR_RELEASE Evidence for eligibility is complete. Not delivered

RELEASED is not an escalation state. It belongs to the release case after manual approval and delivery (TITIP-008). Escalation stops at eligibility.

Any non-terminal state must accept owner confirmation and transition to ACTIVE, emitting life_check.confirmed and escalation.cancelled.

Prototype mapping

Using the default policy in TITIP-006:

Demo label State Evidence so far
Day 0 — life check sent REMINDER_1 none yet
Day 3 — reminder sent REMINDER_2 none yet
Day 7 — SMS sent ALTERNATE_CHANNEL alternate_channel_attempted when the provider accepts or the attempt is recorded as failed after retry
Day 21 — grace ended end of GRACE_PERIOD life_check_unconfirmed, grace_period_elapsed
Day 22 — trusted contact confirmed TRUSTED_CONTACT_VERIFY → REVIEW trusted_contact_confirmed
Day 23 — eligible ELIGIBLE_FOR_RELEASE the three eligibility codes below

Day numbers assume the default offsets: reminder at 0, second at day 3, SMS at day 7, grace 14 days after the alternate-channel point (day 7 + 14 = day 21). Implementers must compute from the policy version, not hard-code 21 October.

Eligibility evidence

A cycle may enter ELIGIBLE_FOR_RELEASE only when all of the following are recorded against that cycle and policy version:

manual_review_approved is not required to enter this state. It is required to leave a release candidate toward real delivery.

If trusted_verification.required is true and confirmations are insufficient, the state remains TRUSTED_CONTACT_VERIFY or moves to HELD. It must not skip to eligible.

Provider outage

If the alternate channel cannot be attempted, the cycle must not treat the outage as a successful attempt and must not start grace. It stays at ALTERNATE_CHANNEL and alerts operators. Accidental inactivity and provider failure are different (architecture/threat-model.md).

Versioning

Escalation reads the policy version frozen at CHECK_DUE. A newer owner policy does not rewrite the open cycle. The new version applies to the next cycle.

Acceptance