Decision Gate Threat Model

Security theorem

DG treats specifications, evidence, commands, stored bytes, provider output, operator input, generated artifacts, and external authority witnesses as hostile at their owning boundaries.

hostile source material
  -> source-specific acquisition witness
  -> admitted evidence
  -> condition-use-policy witness
  -> pure semantic candidate
  -> exact-head accepted successor or rejection
  -> dispatch eligibility only after acceptance

Operational acquisition failure mints no semantic candidate. A stale candidate changes no accepted state. An accepted intent is not a performed external effect. Deployment authority is imported through exact witnesses and never inferred from namespace, route, cache, or local configuration.

Protected assets

Canonical scenario laws, graphs, conditions, policies, and identities.
Acquisition, admission, use-policy, progress, readiness, and completion witnesses.
Evidence values, references, provenance, scope, time, sensitivity, and retention metadata.
Accepted run heads, immutable history, idempotency receipts, governance-evidence intents, and dispatch records.
Authentication, authorization, attribution, provider contract, and external deployment admission facts.
Runpacks, verification reports, audit records, credentials, and signing keys.
Capability, authority, decision, proof, and release registries.

Adversaries

Assume malicious or compromised callers, scenario authors, evidence sources, providers, storage, dispatch sinks, operators, plugins, proxies, CI, SDKs, and qualified node populations. Assume replay, reordering, duplication, omission, equivocation, stale reads, rollback, forged provenance, schema confusion, confused deputy, partial failure, path traversal, symlink races, SSRF, subprocess injection, resource exhaustion, and credential disclosure.

A compromised host/kernel is outside the process’s ability to neutralize, but its authority, retained material, and blast radius remain explicit.

Boundary map

Boundary	Sole admission owner	Permanent result
Scenario syntax	scenario-law constructor	`ValidatedScenarioLaw`
RET syntax and refinements	RET	validated/satisfiable/monotone requirement
Dependency topology	Xarxa	graph identity, progress, readiness, completion delta
Caller evidence	caller-source constructor	caller acquisition witness
Time/env/document evidence	local-source constructors	source-specific acquisition witness
Evidence use	condition policy evaluator	policy-satisfaction witness and canonical snapshot
Candidate acceptance	accepted-run authority	accepted revision or closed rejection
Storage bytes	local storage rehydration	reconstructed accepted values or rejection
Accepted audit export	selected accepted-run backend	exact accepted-head checkpoint plus bounded checkpoint-bound pages
Runpack bytes	runpack-v6 constructors	exact manifest/object/tree identities or typed rejection
RET evaluation	validated requirement/plan and bound executor	semantic outcome or typed operational failure
`file://` broker source	explicit `AdmittedFileRoot`	retained directory capability or typed denial
Local runpack publication	capability-rooted repository	create-new exact object/manifest outcome
Verification material	supplied-material constructor	bounded local/bundled material set with no resolver authority
Verification claims	closed claim registry and independent verifier	total dependency-checked report
Intent execution	dispatch authority	exact journal/receipt result
Auth and deployment facts	external/embedding authority adapters	exact operation admission witness

Scenario and graph threats

Threat	Required control
Forged graph or witness	Sealed construction; hostile bytes reconstruct through constructors.
Graph/law substitution	Every progress, frontier, delta, run, record, and runpack binds exact graph/law identity.
Dangling, self, cyclic, duplicate, non-monotone, or exhausted topology	Xarxa/RET rejects before minting validated law.
Progress regression or wrong graph	Graph-bound progress and completion delta compare identity and monotone inclusion.
Duplicate opening/completion	Sealed lifecycle plus accepted-run idempotency/conflict.
Implicit fan-out, branch selection, or cancellation	Frontier is descriptive only; operator explicitly opens a stage.
Stage opening interpreted as assignment	Attribution remains outside graph/stage ownership; coordination is external.
Structural leaf interpreted as success	Explicit scenario completion law only.
Hidden recursive execution	Evaluation never starts/evaluates another scenario.
Stale external-run fact	Evidence binds exact external law/run/head and currentness policy.

Representation and identity threats

Threat	Required control
Invalid identity constructed by API or deserialization	Private domain storage, private hostile carrier, fallible constructor, and constructor-mediated Serde.
Identifier normalization or aliasing	Exact case-sensitive ASCII grammar; no trimming, Unicode folding, case folding, or coercion for authored DG identifiers.
Nominal identity substitution	Distinct Rust domain types; no generic string identifier or unchecked conversion.
Closed vocabulary token drift	One generated total variant/token table owns parse, display, Serde, OpenAPI, and JSON Schema.
Surplus fields smuggled into a fieldless closed-sum state	Internally tagged fieldless states use exact empty-object variants plus hostile-wire rejection evidence; Serde unit variants are not admitted for closed object sums.
Caller-only request provenance	Shared provenance constructor returns a typed error unless a server-issued request identity is present.
Caller request identity treated as authority or idempotency	Transport provenance remains non-authoritative and nominally separate from semantic operation identity.
Digest width/encoding ambiguity	Fixed SHA-256 bytes internally and exact lowercase 64-character wire projection.
Cross-subject digest substitution	Nominal subject identity plus fixed domain separator and format revision; generic content digests cannot enter scenario-law identity consumers.
Old format accepted through an alias or migration	`dag-v2` and older, runpack v5 and older, and every SQLite schema other than 12 reject as unsupported hostile inputs.

PF-04 closes protocol-owned run, attempt, open, submission, intent, accepted- record/head, and idempotency identities through nominal constructor-mediated types. Stored or runpack projections remain hostile and reconstruct through those constructors.

Condition and evidence threats

Category and authority confusion

The implementation must prevent:

acquisition channel being interpreted as source authority or trust rank;
locator/reference being interpreted as an acquisition channel;
attestation being interpreted as universal truth or transport;
condition identity being merged by equal provider query text;
provider/query being treated as inherent condition semantics;
caller-supplied status, trust, provenance, absence, or comparator result;
missing evidence being interpreted as observed absence;
provider error being stored as semantic evidence;
contract violation being relabeled as semantic Unknown.

Only factorized facts plus an exact condition-use-policy witness authorize use.

Caller submission

Threats include caller identity forgery, oversized material, cross-run/condition substitution, self-assigned provenance or observation time, same-principal retry inflation of a source quorum, stale assertions, and sensitive-data over-retention. Admission binds authenticated or embedded authority context, reviewed request provenance, stable principal/profile authority, exact content, bounds, target scope, boundary-owned receipt time, and disclosure/retention policy. Request identities never define source independence. Caller claims remain distinguishable from verified facts.

Time

Ambient clock reads can make replay nondeterministic or permit freshness forgery. Evaluation receives explicit time context. Time used as evidence comes from a named authority and binds interval, resolution, uncertainty, and clock domain. Failure never fabricates a timestamp.

Environment

Threats include secret leakage, mutable reads, unconfigured key access, encoding/size exhaustion, and false absence. The initial profile uses validated allowlisted keys and an immutable startup snapshot by default. Every observation binds snapshot identity, key, an explicit present-or-observed-absent result, sensitivity, and disclosure/retention. Optional/null encodings cannot mint absence, and an incomplete hostile snapshot claim cannot substantiate either content form.

Rooted JSON/YAML

Threats include parent traversal, absolute path, symlink race, root escape, device/FIFO/socket access, replacement after check, oversized files, deep or wide trees, YAML alias/tag amplification, duplicate keys, trailing documents, network includes, partial parse, and false absence.

Controls require registered roots, validated relative paths, canonical containment, regular opened objects, exact opened-byte digest, bounded complete parse, duplicate/trailing policy, no network/include escape, and complete parse before absence. Named-time, environment, and document witness constructors share the core crate’s privacy boundary with sealed evidence construction; a separate Rust crate cannot call those constructors to self-mint a local-source fact.

Snapshot and policy

Duplicate evidence identity, arrival-order dependence, zero-quorum fabrication, incomplete candidate assessment, cross-target reuse without a witness, stale revocation, and lineage Sybil inflation fail closed. A canonical snapshot and total use-policy assessment own the result.

Excluded-capability threats

The former network, remote-MCP, subprocess, and executable-provider runtime lineage is absent from the initial implementation. If any excluded family is reintroduced, it remains unsupported and unreachable from all supported configuration and tool paths until its independent PF-08 track closes.

Network acquisition

Threats include SSRF, DNS rebinding, redirects, private/link-local access, credential exfiltration, proxy confusion, response smuggling, unbounded bodies, retry storms, stale DNS/policy, contract drift, and remote source equivocation. DG-DECISION-NETWORK-ACQUISITION-001 must approve the source witness law, egress/credential authority, limits, and qualification before support.

Subprocess and arbitrary execution

Threats include command/argument injection, executable replacement, inherited environment/secrets, working-directory confusion, orphan processes, output forgery, resource escape, and host compromise. Initial DG loads no arbitrary native provider code and supports no MCP stdio/subprocess acquisition. Future execution prefers isolated process, WASM, or versioned remote protocol with signed manifest, capabilities, resource/network budgets, hostile output validation, and qualification.

Remote evaluation

Serialized sealed-looking proposal bytes do not prove evaluation. A remote worker can claim every stage passed. Initial profiles co-locate evaluation and commit. Remote proof verification or attested execution requires an independent profile; attestation proves only its exact measured execution claim, not world truth or mathematical correctness.

Accepted-run threats

Threat	Required protocol property
Caller chooses reused run identity	DG mints opaque non-reusable `RunId` from idempotent creation request.
Same request, different content	Typed idempotency conflict.
Same request replay	Exact original result; no duplicate attempt or intent.
Two candidates race from one head	At most one direct successor; loser is stale and changes nothing.
Response lost after acceptance	Resolve by stable operation identity.
Crash before/after transaction	Backend refines approved model and preserves atomicity/receipt behavior.
Forged head	Hostile validation; no state mutation.
Stored head/history disagreement	Integrity failure, quarantine/recovery; never local repair by guess.
Authorization/attribution confusion	Adapter derives exact witness; semantic request cannot self-select principal/agent.
Receipt lookup occurs after stale comparison	Accepted receipt lookup is first; a later head cannot hide an accepted result.
Accepted receipt or RunId tombstone deletion	Permanent indexed authorities; compaction requires dependency proof and cannot weaken replay/non-reuse.
Split state/history/receipt/head/intent commit	One atomic accepted tuple or complete authoritative stutter.
Accepted mutation lacks governance evidence	The atomic accepted tuple carries one sealed `GovernanceEvidenceIntent` identity and returns `CommittedWithGovernanceIntent`.
Audit or usage outcome is discarded	Every authority sink returns a stable receipt or typed failure; non-durable sinks reject, and primary plus governance failure remain a composite.
False known-unaccepted result after a possible commit	`Unavailable` requires proof of non-acceptance; ambiguity is `Indeterminate`.
Caller or ambient clock supplies commit time	Named injected time authority mints a typed witness before commit; revision alone orders history.
Replay resamples acceptance time	Accepted receipt returns the original time witness.
Integrity quarantine bypass	Quarantine blocks every later acceptance for the affected authority.
Unauthorized receipt probing/result disclosure	Authorization precedes receipt lookup and governs exact result disclosure.
Cross-namespace creation-receipt probing	Creation resolution binds the authorized namespace before receipt lookup; a foreign receipt is indistinguishable from scoped absence.
Semantic operation identity used under a different operation family	Nominal operation families remain distinct; abstract outcomes and accepted receipts satisfy the checked family-scope invariant.
Direct construction of claimed admission material	The accepted-run admission witness has private state, no raw deserializer, explicit boundary constructors, and read-only persistence projection.
Backend-specific encoding changes limit admission	Core-owned canonical semantic limits are identical for memory and SQLite; persistence-envelope overhead has a separate immutable ceiling.
Receipt/tombstone storage exhaustion	Named immutable limits and capacity failures fail known-unaccepted before commit; semantic facts are not silently evicted.
Coherent rollback of a complete local database	Explicit external-anchor nonclaim; local self-hashes do not fabricate rollback resistance.
Formal `VIEW` or constraint hides a violating successor	Authoritative configs reject `VIEW`, `SYMMETRY`, and state constraints; TLC fingerprints complete model state.
Unapproved toolchain coordinates reach download or execution	Bootstrap validates the complete approved closure before network or Java use, then permits only exact upstream release namespaces and digest-pinned artifacts.
Modeled action has no PF-04 refinement trace	Trace schema, action map, and observed corpus vocabularies must be exactly equal; an independently wrong transition must fail the TLA oracle.

PF-03 closes the abstract property/model decision with bounded TLC evidence, expected mutation counterexamples, and deterministic PF-04 traces. PF-04 implements the relation and replays sixteen protocol-generic traces against memory and SQLite plus two durable restart traces against SQLite. Memory has explicit negative restart evidence. This local refinement does not establish distributed ownership, external rollback resistance, or dispatch recovery.

Dispatch threats

The PF-06A candidate model treats these as explicit adversarial cases:

Threat	Permanent control/claim boundary
Dispatch of an unaccepted intent	Only an accepted owning mutation can enter eligibility.
Target, executor, authorization, or recovery-profile substitution	One immutable one-target binding is retained in every journal record.
Forged journal head, attempt, or ABA completion	Exact heads and never-reused attempt identities make stale actions stutter.
A worker completes another worker’s live reservation	The journal binds worker and never-reused attempt identities together; progress records must present the exact pair.
Forged, cross-effect, or conflicting receipt	Qualified receipt authority and exact effect/key binding; conflict quarantines.
Journal self-mints receipt or witness qualification	Journal actions consume exact pre-admitted qualification facts; storing an identifier cannot create source authority.
Receipt identity is reused	Receipt ownership is functional and identity reuse across accepted journal facts fails closed.
An authoritative-query result is substituted for an effect receipt	Performed-query, not-performed-query, and stable-receipt material are distinct typed witness families with exact owners.
Resolver falsely reports performed or not performed	PF-06A checks only the exact imported qualification relation and carries the witness; the external verifier remains a named premise requiring PF-06C qualification.
False pre-effect or non-occurrence claim	Exact named witness is required; post-boundary ambiguity remains indeterminate, and a later pre-boundary failure cannot erase earlier unresolved occurrence debt.
Reused or unnamed non-occurrence witness	Pre-effect, authoritative-query, and expiry/currentness witness identities are retained, family-typed, single-owner, and never reused.
`NoResolver` is mistaken for “cannot succeed”	Qualified live success receipts are independent of post-ambiguity resolution; all profiles may record witnessed synchronous success, but only qualified resolvers may close ambiguity automatically.
Unsafe retry or changed invocation binding	Retry requires the qualified exact-key profile and preserves logical identity, target, content, executor revision, authorization binding, recovery profile, and idempotency key.
Duplicate logical effect after response loss	DG invocation count, external physical-execution count, and one logical occurrence are separate; exact-key idempotency bounds physical execution only for a qualified executor profile.
Boundary invocation is treated as proof of occurrence	Invocation count and external occurrence are independent; performed implies invocation, but invocation may remain not performed until a qualified resolver closes knowledge.
Crash forgets `Started`, receipt, or terminal state	Durable profile preserves journal knowledge; memory explicitly makes no restart claim.
Crash after domain/governance-intent commit but before first sink append	The committed domain and governance-intent tuple is monotone and restart reconciliation resumes from the retained intent.
Governance acknowledgement before durable append	Acknowledgement requires exact stable receipt after durable sink commitment.
Governance identity/payload substitution	Independently keyed governance records and exact redelivery relation.
Incomplete imported domain/governance-intent tuple	PF-06A requires the complete monotone PF-04 tuple and does not falsely claim to re-prove PF-04 atomic commitment.
Compensation is admitted from hidden occurrence truth or erases original history	Compensation requires DG-known performed state and is a separately fully bound linked effect with an independent journal.
Unqualified compensation profile	Compensation creation requires the exact admitted effect-family profile in addition to DG-known performance.
Quarantine bypass or cross-effect owner/index mutation	Quarantine is monotone; effect ownership indexes and journal/version projections agree; independently journaled effects do not mutate each other.
Fair progress or memory durability is assumed implicitly	Named assumption registry plus executable no-fairness and false-memory-durability countermodels; neither claim follows from safety.
Unauthorized receipt/status probing	PF-06B must authorize before disclosure; PF-06A does not model authentication internals.
Coherent dispatch-journal rollback	External-anchor nonclaim; local self-hashes cannot prove freshness.

DG-DECISION-DISPATCH-MODEL-001 remains open. Candidate v5 is InvalidatedForApproval; its bounded report is historical regression evidence, not an approval subject. No permanent journal/recovery runtime exists yet. Accepted intent, a local lock, bounded model satisfaction, and at-most-once invocation are not exactly-once external effect.

Formal-assurance boundary threats

Threat	Permanent control/claim boundary
A reachable-state property is mislabeled inductive	TLAPS must discharge exact initialization, preservation, and implication obligations; TLC reachability alone cannot mint `InductivelyProved`.
Refinement is mislabeled induction	Model-to-model proof rows report `RefinementSatisfied`; production correspondence remains a separate protocol-owned claim.
Empty/unreachable model yields a green property	Initial-state, action, branch, and antecedent non-vacuity require coverage plus expected-counterexample reachability oracles.
Bound matrix is described but not executed	Every compiled profile row produces an exact positive agreement or witnessed disagreement execution.
Mutation denominator omits a guard or authoritative write	Every registered state-machine conjunct has one exact mutation point and every property owns at least one kill operator.
Parser ambiguity admits hidden assumptions or quotients	Exact module-owned assumption rows; closed config syntax; indentation-insensitive rejection of `VIEW`, `SYMMETRY`, constraints, overrides, and dual initialization modes.
Proof proposition is replaced while tactic tokens look valid	Exact canonical proposition ownership rejects comments, `LET`, unknown theorem rows, and unproved/omitted leaves.
Both semantic paths share the same transition bug	Exhaustive finite TLA/Python relation comparison, explicit import-graph separation, and deliberate disagreement detection; authorship independence remains a human-review nonclaim.
Mutable checkout changes after admission	Every tool executes an immutable external digest-verified source snapshot and the live source denominator is rechecked after execution.
Tool installation or evidence is substituted	Official archives/installers, manifests, install receipts, runtime trees, reports, and artifact manifests are separately digest-bound.
Nondeterministic TLAPS tree is falsely called reproducible	The candidate subject binds the pinned official installer policy; every execution report binds its exact installed tree; raw installed-tree reproducibility is an explicit nonclaim.
Synthetic qualification is interpreted as DG protocol proof	Candidate claim boundary and protocol identity are machine-checked; PF-03 reclosure and a successor PF-06A remain separate approvals.

The current shared-foundation candidate satisfies its registered synthetic denominator but awaits explicit human approval. It changes no production runtime capability and authorizes no PF-03 or PF-06A protocol claim.

Storage and replay threats

All stored/runpack bytes are hostile. Controls include version rejection, bounded decode before allocation, checked arithmetic, duplicate/trailing rejection, constructor-mediated reconstruction, canonical identity recomputation, exact head/history checks, and explicit retention dependencies.

Old prelaunch formats reject without migration. A digest proves only its named integrity relation, not source authenticity, current-head authority, rollback protection, or external binding. Live re-query is new evidence. Replay reports exactly which original acquisition, schema, authorization, freshness, and policy relations can be reconstructed.

PF-05 additionally assumes hostile manifest/object trees, hostile explicitly supplied supplemental bytes, compromised local repository contents, malicious record ordering/ranges, decompositional bombs, publication races, path/symlink substitution, claim-dependency confusion, and verifier resource exhaustion. Controls are twelve mandatory family roots, nominal domain-separated fixed- width identities, canonical bounded objects, range/fanout/depth checks, checked arithmetic, checkpoint-bound pages, an independent reducer, a closed claim DAG, deterministic work budgets, capability-relative filesystem targets, create-new object publication, exact retained-byte comparison, and manifest-last visibility.

The verifier resolves only bundled or explicitly supplied local material. It has no network, provider, clock, SQLite, MCP, ambient-path, or generic-resolver authority. A locator never satisfies material availability. External raw supplemental bytes can satisfy digest/structure relations only; they cannot mint source authenticity, currentness, rollback resistance, dispatch, deployment, or build-provenance claims.

Deployment threats

Namespace, route, cache, node identity, region label, or configuration does not prove serving assignment, authorization, capacity, residency, key authority, or evaluator qualification. Profile adapters consume exact external witnesses with subject, authority revision, scope, currentness, and operation.

Initial scale routes distinct runs to resolved co-located evaluator/commit nodes. Dynamic owner transfer, automated failover, active-active, mobile finality, subcells, and physical resource/sanitization protocols are deferred external platform/DG-E families. Their state is not mirrored into the semantic kernel.

Current enforced controls

Current code has useful typed parsing/errors, many bounds, canonical hashing, tri-state evaluation, graph/law identity checks, explicit stage opening, tool authentication/authorization, schema validation, provider timeouts and response limits, some SSRF/path controls, redaction, signature/anchor checks, SQLite transactions, audit events, and runpack integrity checks.

Current code enforces bounded constructor-mediated identifiers, nonzero namespace coordinates, canonical finite vocabularies, reviewed transport provenance, nominal scenario-law identity, DgValueFormatV1, typed condition domains and predicates, independent acquisition bindings, factorized evidence admission, canonical snapshots, and pure I/O-free evaluation. The supported runtime contains only caller submission, named time, immutable allowlisted environment snapshots, and capability-rooted strict JSON/YAML acquisition; network and executable-provider paths are not reachable.

PF-04 additionally enforces authority-minted run identity, nominal operation families, accepted-only receipt-first resolution, exact-head conditional acceptance, named typed acceptance time, atomic accepted tuples, bounded current state, indexed immutable history, schema-12 hostile rehydration, and integrity quarantine across memory and SQLite. Creation receipt resolution is namespace- scoped, and the sealed admission relation cannot be minted through public enum variant construction.

Schema 12 also binds the sealed governance-evidence identity into the same accepted-run transaction. Audit and usage delivery is idempotent by stable event identity and returns a receipt only after durable ingress. Delivery remains a separate obligation from the accepted-run database transaction; the stored intent prevents the mutation from becoming evidence-free.

PF-05 enforces coherent backend-neutral audit checkpoints, bounded indexed export with constructor-checked revision/cursor ownership, runpack-v6 hostile construction, capability-rooted local immutable publication, independent supplied-material accepted-history reduction, total claim reporting, and deterministic work budgets. Structural integrity completes independently before semantic interpretation, and MCP authorizes the manifest-bound namespace before full object traversal. OSS runtime/configuration has no S3/object-store runpack path or fetch-capable verifier mode.

Current gaps include explicit human approval of the synthetic shared formal- assurance foundation, a separate PF-03 assurance reclosure and adversarial implementation-correspondence pass, a successor PF-06A dispatch-model closure, PF-06B local recovery runtime, PF-06C model/backend and offline-claim refinement, PF-06D platform-adapter contract, PF-06E assignment-stable product integration and PL-05 conformance; PF-07 external authenticity/currentness, coherent-rollback anchoring, and deployment qualification; PF-08 remote-publication qualification; DG execution of the checked-in PF-05 harnesses through the repository’s isolated pinned Kani authority; an observed Windows golden result; million-record streaming, peak- memory, and calibrated product-runner evidence; portable Certesa evidence; and release approval. The production Rust and Kani-bundled Rust pins are separate authorities, so their version difference is not itself a gap.

Required evidence

Compile-fail sealing and constructor-bypass tests.
RET/Xarxa reference and property evidence.
Hostile condition/evidence/schema/storage/runpack tests.
Caller/time/environment/document source-specific adversarial tests.
Deterministic snapshot/evaluation and live/replay equivalence.
Negative reachability for unsupported acquisition/execution capabilities.
PF-03 accepted-run bounded model/mutation/trace evidence and independent PF-04 model-to-Rust/backend refinement; shared-foundation assumption closure, non-vacuity, induction, symbolic corroboration, refinement, systematic mutation, and independent-oracle qualification; separate PF-03 assurance reclosure; and a successor PF-06A dispatch closure under that authority.
Authorization, attribution, stale/race, response-loss, crash, corruption, and retention tests.
Hostile runpack-v6 object/tree/manifest, checkpoint parity, local filesystem substitution/race, independent-reducer mutation, claim dependency, supplied- material, deterministic budget, concurrent create-new convergence, and cross-OS golden canonical-identity tests.
Profile-specific external authority and deployment qualification.

Every report states what its evidence establishes and what remains unproved. Test volume is never launch readiness.

Threat Model Delta (2026-07-17, correctness hard cut): updated. Schema 12 atomically binds governance intent identity, MCP audit and usage seams are fallible and receipt-bearing, and non-durable sinks fail closed. The matching record is Docs/security/deltas/2026-07-17-certesa-decision-gate-correctness-hard-cut.md.

Threat Model Delta (2026-07-18, fixed-window authority hard cut): updated. Decision Gate now has one sealed, monotonic-clock-backed, bounded fixed-window request authority shared by MCP ingress and account-scoped tool composition. Zero-valued disabled shapes, ambient correctness sampling, duplicate bucket algorithms, and mutate-before-failure paths are rejected. The matching record is Docs/security/deltas/2026-07-18-fixed-window-rate-limit-authority-hard-cut.md.

Threat Model Delta (2026-07-18, accepted-run closed-wire exactness): updated. The accepted-run Unset, RunWide, and Empty tagged states now reject surplus hostile fields at their core-owned wire boundary. The matching record is Docs/security/deltas/2026-07-18-accepted-run-closed-wire-exactness-hard-cut.md.