Lifecycle

Lifecycle states are signals: named stages a record is in. They are not the rules that decide whether a record is admitted, scored, or closed.

How to read states

Use states for	Do not use states for
Filtering lists and dashboards	Inferring that Arbiter “approved” your posture
Partner / webhook change events	Claiming cryptographic finality
Agent tools that need current stage	Reconstructing internal review logic

For what fingerprints and seals prove, see Verification. For what stays private, see Disclosure Boundary.

Risks

Risk status values (framework-aligned register signals):

Status	Meaning (signal)
open	Identified; work not yet underway
investigating	Under active investigation
remediating	Remediation in progress
deviation-requested	Deviation from baseline requested
deviation-approved	Deviation approved
closed	Closed in the register

Controls

Control implementation status (component-definition values):

Status	Meaning (signal)
implemented	Implemented as stated
partial	Partially implemented
planned	Planned
alternative	Alternative implementation
not-applicable	Not applicable

Policies

Policy document status:

Status	Meaning (signal)
draft	Not yet approved
approved	Current approved version
superseded	Replaced by a newer approved version

What partners observe

Via Partner Read and webhooks, downstream systems typically see:

• Record identifiers and type
• Current named status
• Timestamps and change event type (e.g. risk status changed)
• Integrity fields such as evidence_hash / body_hash when present — see Records

Partners do not receive Arbiter’s internal scoring or admission decisions through these surfaces.

Maturity: Partner Read and core lifecycle events — Live (contract surfaces). Always confirm event names in the API reference / Partner Events OpenAPI before building hard dependencies. Surface matrix: Integration Surfaces. Disclosure: Disclosure Boundary.