# The Boundary Register

**A living, versioned account of what Mirror cannot do.** Most vendors hide their limits behind
marketing; publishing them is the stronger position, because it makes the claims about what Mirror
*can* do checkable. For each boundary below: what it cannot do, why that is deliberate, and the honest
upgrade path — marked **[shipped]**, **[buildable]** (a real extension that keeps the design intact),
or **[declined]** (an "upgrade" that would break the very properties that make Mirror worth using,
and why we will not build it).

The rule every upgrade is judged against: does it stay **blind to the operator, deterministic and
byte-reproducible, free of a trusted third party, and runnable on a laptop with no ceremony?** An
upgrade that fails that test is not an upgrade; it is a different, weaker product wearing Mirror's name.

---

## Boundary 1 — It sees bands, not exact numbers

**Cannot:** distinguish two prices inside one band. In a 100–150 band, $101 and $149 both clear, so a
mispricing up to the band's width hides by design.

**Why deliberate:** the blindness *is* the discarded precision. You cannot recover exactness without
handing the operator the number, which is the whole thing the product refuses to do.

- **[shipped] Near-edge encoding (`edge_margin`).** A value a rounding error from an edge now commits
  to both neighbouring bands, so two honest banks straddling an edge reconcile without a false
  divergent — and *without* widening the blind spot anywhere except at the edge. Opt-in per table,
  off by default, byte-identical when off.
- **[shipped] The blind-spot is measured.** `mirror-geometry` computes, as arithmetic on the agreed
  table, the widest mispricing a band can hide — so a corridor can *see* its own blind spot and cut
  tighter (including logarithmic or risk-weighted edges, which are already allowed since edges are
  party-supplied).
- **[shipped] Progressive zoom (`mirror-zoom`).** A bilateral, consent-based cascade: reconcile against a
  coarse table, and if either bank wants more assurance on one shipment it signs a request to re-read it
  under a *finer* table — one the corridor ratified and that nests under the coarse one — with a reason
  from a closed list. The counterparty signs consent or decline inside a window, and anyone checks the
  pair offline. The operator still sees only match / no-match each round and never sees the request; a
  refusal to zoom, or silence, is not proof of anything but is a signed fact an examiner can weigh. Same
  primitive, run iteratively — no new crypto. A corridor that wants finer resolution on every shipment
  ratifies the nested table outright (`mirror-nested`): standing consent.
- **[buildable, with a real trade-off] Sealed-value escrow.** Commit the exact price under a key held
  by an independent quorum (not Mirror, not the counterparty), openable only on a divergent verdict by
  k-of-n auditors. Gives forensic precision on the 1% that diverge while the 99% stay sealed forever.
  The honest cost: the exact value now *exists* in the system, encrypted, where today it does not — a
  custody shift some corridors will want and others will refuse. It builds on `mirror-escrow`.
- **[declined] Auto-generating corridor tables.** Having Mirror *compute* the band edges to cap the
  blind spot would make Mirror an authority on price — the manipulation target and determinism-killer
  the whole design avoids. Mirror measures the blind spot; the banks cut the table.

## Boundary 2 — The bands must be agreed first (cold-start)

**Cannot:** reconcile without a shared corridor table. No agreed edges, and the same number bands
differently on each side, so nothing matches.

**Why deliberate:** Mirror invents no prices; the buckets are the parties' agreement, not Mirror's.

- **[shipped] An open corridor-table standard.** Published as a proposal for ratification, so a table
  is an industry artifact two banks both reference rather than a bilateral negotiation. See the
  [corridor-table standard](/corridor-table-standard.md).
- **[shipped] Table-discovery handshake (`mirror-discovery`).** Each bank signs the list of tables it
  supports, named by hash with their granularity (bands, widest bounded ratio); both compute the same
  intersection and select the most granular mutual table — or return `undetermined · no_shared_table`.
  A table the two offers describe differently is reported and never chosen. Turns table agreement from
  a legal step into a software step; the corridor still ratifies. The honest cost: each bank learns
  which public tables the other supports. That discloses capability, not any trade, and it is not
  private set intersection.
- **[shipped] Shadow mode (`mirror-shadow`, the bander's `shadow`).** The bander runs candidate tables
  over the bank's own multi-leg shipments through the operator's reconciliation kernel, inside the bank,
  submitting nothing, and reports counts per table, each table's blind spot and how many shipments
  change answer — so a compliance officer ratifies the table the data justifies. It extends
  `mirror-internal`'s start-alone posture. It sees only the bank's own legs: cross-bank divergence comes
  from books it never reads.
- **[shipped] Time-bound corridors.** A proposal may carry `valid_until`; after it the table judges
  nothing (`table_expired`), and a renewal is a new version — so a table agreed for a pilot or a volatile
  season cannot quietly outlive the agreement.
- **[shipped] Ratio corridors (`mirror-ratio`, `band --reference-set`, `accept`, `screen`).** Each leg
  bands price ÷ a public reference on a published, closed, dimensionless table. The reference is the exact
  median of a quorum of cited public figures, refused when they disagree beyond a ratified spread, and only
  the files' hashes leave the bank. For goods with public reference prices, nothing is negotiated: one bank
  opens the corridor and the other accepts it. The honest cost is a new attack surface (the reference
  itself), and goods with no credible reference keep a negotiated table. See [ratio corridors](/ratio-corridors).
- **[declined] Mirror publishing the tables.** An industry body (ICC/BAFT/WCO) ratifying tables is the
  goal; Mirror *authoring* the prices in them is the refused one. The ratio tables are protocol constants
  with no price in them (0.85 to 1.15 of whatever a corridor cites), so this refusal still holds.

## Boundary 3 — If both banks state the same lie, they match

**Cannot:** catch collusion. Mirror compares the parties to each other, never to reality, so two
parties who state the same wrong number reconcile perfectly. A clear is *"the stories agree,"* not
*"the trade is honest."*

**Why deliberate:** there is no ground truth in a two-party system for any cryptography — including ZK
or MPC — to check against. This is an information limit, not an engineering gap.

- **[shipped] Independent legs (the triangle).** A trade is not only two banks: customs' declared
  value, a carrier's declared quantity, a *cargo* insurer's declared value are legs from parties with
  no stake in the price. Adding them turns "two banks agree" into "everyone on the trade agrees," and
  each independent vertex is one two-party collusion cannot reach.
- **[shipped] A measure of independence.** `mirror-independence` counts the *distinct organisations*
  behind a clear (so one bank wearing three role-hats reads as one, not three), and grades how much a
  clear rests on parties who could have colluded — distinguishing a *strong* anchor (customs, carrier)
  from a *weak* one (a cargo insurer, whose value is often derived from the invoice). No score, no
  probability: it measures *exposure* to collusion, never collusion.
- **[shipped] Canaries.** `mirror-canary` feeds the live operator known-answer trades it cannot tell
  from real ones — continuous, public proof the operator answers honestly, which MonetaGo cannot do
  because it can see its own data.
- **[buildable] Self-consistency.** The rail already treats a leg *resubmitted with different content*
  as a hard finding. A rolling commitment to a party's own recent bands could flag a trade that breaks
  the party's *own* history — with the honest caveat that a legitimate market move trips it too, and a
  threshold on "how far off" edges toward the scoring the product refuses.
- **[shipped] A cited benchmark (`mirror-benchmark`, the bander's `benchmark-leg`).** One bank cites a
  *public* market figure it already uses, such as an exchange settlement price for the same goods, basis
  and date, fetches it itself, and bands it under the shipment's own salt as a leg with the role
  `benchmark`, inside a market window the pair agreed. A corridor that requires it compares every trade
  leg with it, so two documents over-invoiced by the same amount, which agree with each other, both
  read divergent against the cited figure. It closes part of this boundary, not all of it: a figure
  the member banded falsely, or one that does not price this grade, is caught only at audit, by
  opening the leg against the public document. It can only *add* a comparison, so it never clears what
  the trade legs alone would not, and it is kept out of the trade match window so its wider window never
  widens what a clear asserts.
- **[declined] A market-price "truth oracle" that Mirror runs.** A third leg that *Mirror* fetches,
  chooses or publishes makes Mirror a price authority (the manipulation target) and forfeits
  determinism — the commodity-feed idea refused every time. The line between this and the cited
  benchmark above is who holds the number: there, a member cites a public document and the figure never
  leaves the bank; here, Mirror would be the source. Neither is a witness: the independent third leg
  that opens the independence gate is still a *party on the trade*, never a market figure.

## Boundary 4 — The operator sees the shape of your activity

**Cannot:** hide metadata. The operator reads no message, but a commitment is a stable pseudonym, so it
can count how many shipments a member sends and see which submissions concern the same one.

**Why deliberate:** the pseudonym's stability is what makes it a join key at all.

- **[shipped] Chaff (`mirror-batch`).** Constant-size batches: a member's real commitments padded with
  cover entries the operator cannot tell apart by shape — the kernel refuses to emit a batch that is not
  shape-uniform — so the operator cannot count a member's real volume. Cost is compute, not architecture.
- **[shipped] Batch mixing (`mirror-cadence`).** Every window emits exactly the same number of items on
  a fixed cadence, timestamped to the window, with cover derived from the corridor key so both
  counterparties generate the same decoys without coordinating. The operator cannot time a shipment or
  count a corridor's trades. What it does not claim: every cover item reconciling.
- **[buildable, heavy] Relay routing.** For the most sensitive corridors, route commitments through
  consortium mix nodes so no relay sees both sender and operator. Real metadata anonymity, real
  infrastructure and latency cost — an option for dual-use goods, not a default.

## Boundary 5 — Whoever holds the corridor key can guess

**Cannot:** hide a value from the *counterparty*. Both sides hold the corridor key, trade references
are low-entropy and sequential, and bands are few — so a key-holder can enumerate and recognise a
commitment. Mirror blinds the operator, not a fellow key-holder; and a leaked key is retroactive.

**Why deliberate:** the shared key is what lets both sides derive the same commitment without a round
of communication. That convenience is exactly what the enumeration exploits.

- **[buildable] A slow key-derivation.** Derive the salt with a deliberately slow KDF (PBKDF2 at high
  iteration count — in the platform crypto, no new dependency) so each guess costs milliseconds and
  enumerating a batch costs days. Table-specified, so it stays byte-reproducible. Not built yet for one
  reason: it changes the salt every implementation must reproduce — the bander, the browser kit and five
  SDKs held to one set of vectors — so it ships as a protocol version with new conformance vectors,
  never as a patch.
- **[buildable] Per-transaction random nonce.** Replace the guessable reference-derived salt with a
  random nonce exchanged over the banks' authenticated channel. The search space goes from thousands
  to 2²⁵⁶ and enumeration dies — at the cost of a communication round the reference-derived salt avoids.
  Mirror runs no bank-to-bank channel and will not route the nonce through the operator, so it needs a
  channel the pair already has.
- **[shipped] A hash ratchet (`mirror-ratchet`, the bander's `ratchet-start` and `ratchet-turn`).** The
  shared secret advances by a keyed hash chain, so a leaked secret exposes its own period and later
  ones, never an earlier one — forward secrecy from a plain hash chain, no dependency. It turns on a
  *ratified calendar* (a day, a week or a month), not per transaction: a per-transaction ratchet needs
  the two banks' state kept in step trade by trade, and one missed trade splits the chains, while a
  calendar lets each bank compute a shipment's epoch from its date. Its honest limits: backups and
  snapshots of an old epoch defeat it, a key held in an HSM gets forward secrecy by rotation instead,
  and it hides nothing from the counterparty, which holds the same epoch.

## Boundary 6 — It must be reproducible to the byte

**Cannot:** do fuzzy, statistical, or machine-learned matching on the wire — two implementations must
produce the identical commitment or two honest banks never match.

**Why deliberate:** byte-reproducibility is what lets *anyone* verify a verdict and lets an independent
implementation interoperate. It is the property, not a constraint to route around.

- **[shipped] Fuzzy inside, exact on the wire.** All the messy work — FX and unit normalisation
  (`mirror-basis`), reference and category canonicalisation (locator, attribute), and OCR/extraction
  (the bank's own tools) — happens *inside the perimeter*, before the exact commitment. The operator
  only ever sees the reproducible hash. The two concerns are already cleanly separated, and the bander's
  `docai-import` (`mirror-docai`) is the seam: fields a document-AI tool extracted pass a confidence gate
  the bank sets, are parsed under one declared number format, and become exact leg rows, with every held
  document counted by reason. The gate takes the vendor's confidence as stated; a confidently wrong
  field passes, and the [document-AI page](/document-ai.md) says so.
- **[shipped] One FX basis, pinned (`mirror-fxbasis`).** Conversion was where two honest banks parted
  company: different publishers, fixing times and days. The pair now ratifies one public publisher and
  a rule for which file applies; each bank fetches the file itself, converts with exact rational
  arithmetic on its own machine, and commits the file's hash inside the pricing basis. Two banks with
  the same file get the same digits; two with different files are held `undetermined`. Mirror fetches,
  publishes and chooses no rate — a publisher naming Mirror or the operator is refused.
- **[shipped/buildable] A published canonicalisation standard.** The spec already fixes how references,
  dates (strict ISO), HS headings, Incoterms, container numbers (ISO 6346), IMO and air-waybill numbers
  are normalised before hashing. Naming and versioning it as a standalone standard turns
  byte-reproducibility into an auditable compliance property: a differing hash is a canonicalisation
  fault, and it is detectable.

## Boundary 7 — It is not zero-knowledge and not MPC

**Cannot:** hide the one bit it reveals — same band or not. Stronger crypto (ZK, homomorphic, MPC)
would hide more but needs special hardware or a setup ceremony.

**Why deliberate:** running on a plain laptop with no ceremony, and one readable file whose hash is its
identity, is the moat — the thing the heavyweight-PET vendors repeatedly failed to convert into a
business.

- **[buildable] Agility *within* the hash family.** A corridor can already specify parameters (the
  `edge_margin`, the tolerance, and — see Boundary 5 — the KDF and its cost) in the table it ratifies.
  That is real, ceremony-free agility that keeps every party byte-identical.
- **[shipped] Multi-operator quorum.** `mirror-cosign` lets several *independent* operators reach a
  verdict separately, so trust need not rest on one operator — threshold-*integrity* without threshold
  *cryptography*.
- **[declined] Pluggable ZK / Pedersen / SNARK backends.** They demand a trusted-setup ceremony,
  reintroduce dependencies, and — worst — fragment interoperability: two banks on different backends
  produce different commitments and cannot reconcile, which reinstates the coordination problem the
  standard exists to remove. The one-primitive rule is why anyone can interoperate.
- **[declined] Additive secret-sharing to a second custodian.** Splitting the value between Mirror and
  an auditor is "MPC without the ceremony" only in the pitch: comparing two banks' shared values for
  band-equality still needs a real multiparty computation, and it introduces a second custody party who
  can, with Mirror, reconstruct the value. It trades a clean "the operator sees nothing" for a murky
  "the operator sees a share."

---

## A standing rule — the one this register caught its own author breaking

The operator cannot read a band, but it can count how many commitments a leg carries — and that number
is not noise. With tolerance `t`, a leg emits about `2t+1` commitments, so the count **encodes the
tolerance** the operator prints on the signed match window, and the two-dimension kernel uses the same
count as its anti-widening gate. The per-leg commitment count is a *public, tolerance-encoding channel.*

So any change to how many commitments a leg emits is screened against that first — and this register
caught its own author. The near-edge encoding (Boundary 1) adds one commitment when a value sits next to
an edge, and the operator, inferring the tolerance from the raw count, read it as one band too wide: a
signed verdict could state a **4x** blind spot where the truth was about **2.02x**, or call a bounded
window unbounded. It never cleared anything it shouldn't — it erred toward *overstating* the blind spot,
which is the honest direction — but a signed record carrying a false number is a defect here.

The fix leaves the wire untouched, and that is the point. The margin is a property of the *ratified
table*, not of a leg, so the operator reads it from its own registry (exactly as it reads the price
ceiling) and uses it to read the window honestly: it knows a near-edge margin adds at most one band,
subtracts that one band before inferring the tolerance, and widens the reported ratio by exactly
`(1+m)/(1-m)`, rounded up so it can never understate. The leg is byte-identical; a regression test pins
the honest number. **[shipped]** The rule that falls out — *do not overload the commitment count* — is
now the first screen any future proposal that changes commitment cardinality has to pass.

## Triage of fourteen proposed cryptographic upgrades

A later strategy memo proposed two "genius" fixes per boundary. Each was judged against the same rule as
everything above: does it stay blind to the operator, deterministic, free of a trusted third party, and
runnable on a laptop? Most of what was genuinely good was already shipped; most of what was new broke an
invariant. Saying which is which, in public, is the point of this document.

**Boundary 1 — bands, not exact numbers.** *Multi-scale overlapping tiles ("wavelet bucketing")* is
**[declined, because it is dominated]**: requiring two legs to co-bucket in each of N offset tables is,
provably, co-bucketing in the one table whose edges are the union of all N — checked by brute force,
zero disagreements over 31,375 price pairs. A single finer table gives the identical blind-spot
reduction with fewer commitments and is already permitted. *Homomorphic delta matching (Pedersen
commitments + a range check)* is **[declined]** — checking a hidden difference against a range *is* a
zero-knowledge range proof, the excluded family.

**Boundary 2 — the bands must be agreed first.** *A universal geometric (√2) price curve baked into the
protocol* is **[declined]**: a ratio curve still needs an absolute anchor and currency, so it removes no
negotiation, and √2 is irrational, which the exact-decimal banding path refuses. *Bloom/Cuckoo-filter +
OPRF negotiation* is **[declined]** — probabilistic membership means false positives on the wire; the
goal is already met by the shipped blind corridor negotiation and DH-PSI.

**Boundary 3 — a shared lie reconciles.** *zkTLS / TLSNotary proof from the payment session* is
**[declined]** (a zk-SNARK is the excluded family, and it proves a message was sent, not that its price
was true). *Independent supply-chain legs* is **[shipped]**: bill of lading, air waybill, container
(ISO 6346) and vessel (IMO) references are cargo-intrinsic keys, and `mirror-independence` grades how
much a clear rests on parties with no stake in the price.

**Boundary 4 — the operator sees the shape of activity.** *Epoch-rotating nullifiers / mixnets* is
**[declined as specified]** — rotating the join key per epoch breaks the very join duplicate-financing
detection needs; the on-brand form is the SPEC's own blind locator plus padded batches. *Deterministic
chaff / constant-rate padding* is **[shipped]** as `mirror-batch` and `mirror-cadence`.

**Boundary 5 — whoever holds the corridor key can guess.** *Argon2id / VDFs* is **[declined]** (neither
is in browser WebCrypto, so either breaks the byte-parity that lets two banks derive the same salt);
the same goal via a table-specified PBKDF2 cost is **[buildable]**. *A Signal-style Double Ratchet* is
**[declined as specified]** — its asymmetric half needs a per-message key exchange; its symmetric half
is the plain hash ratchet, now **[shipped]** under Boundary 5, turned by the calendar.

**Boundary 6 — reproducible to the byte.** *MinHash / LSH fuzzy bucketing on the wire* is **[declined]**:
LSH makes near items collide only *probably*, with designed-in false positives — the opposite of
fail-closed. The honest form is already shipped (fuzzy inside your own perimeter, exact on the wire).
*A canonicalisation pipeline* splits: whitespace, case, sorted keys and standard reference formats are
**[shipped]**; phonetic reduction (Soundex/Metaphone), which merges genuinely different names, is
**[declined]** on the wire.

**Boundary 7 — not zero-knowledge, not MPC.** *Folding SNARKs (Nova / Halo2)* is **[declined]** — no
trusted setup does not fix a second commitment scheme that cannot reconcile against the first, a heavy
dependency, and a verifier no bank's crypto team can re-implement in an afternoon. *VOLE-based two-party
computation* is **[declined]** — it replaces "a blind operator compares hashes" with an interactive
protocol between the two banks, a different trust model and a different product.

---

## Sharper evidence, same three states — the evidence taxonomy **[shipped]**

A later memo asked the right question: not "how do we make Mirror detect more" but "how do we make the
*evidence* it already produces sharp enough that a bank's own investigators and SAR process become
dramatically more accurate — without Mirror ever holding a score or a filing decision." That is the only
upgrade direction that strengthens detection without destroying the moat, and it is now built.

A bare `divergent` is a true signal and a poor exhibit. `mirror-taxonomy` folds the signed verdicts a
party *already holds* for one shipment — the base price-band verdict, the two-dimension quantity-vs-price
split, the independence grade, an attribute disagreement, a concurrent-exposure collision — into a
single, deterministic **fact pattern**: which kind of mismatch fired, how large it is *structurally* (a
count of divergent pairs, the names of the diverging dimensions, an independence grade), and the exact
signed bytes to cite. Four properties keep it on the right side of the line, each test-enforced:

- **It is a fold, not a new judgement.** It restates fields the sub-verdicts already carry and derives
  nothing they did not establish. It holds no raw value — it never had one — so it opens no channel to
  the operator, which does not hold these records. There is deliberately **no operator route** that
  produces it: the fold is party-side by construction, and the operator stays blind.
- **It is not a score.** Every magnitude is a count or a categorical label copied verbatim from an input;
  nothing is combined or weighted into a number. `assertNoScore` runs over the whole record before it is
  returned.
- **It is not a filing decision.** `mirror-taxonomy.assertNoDecision` refuses to emit if any field is a
  filing / suspicion / escalation / recommendation key. The decision stays inside the bank, with a human,
  where Mirror cannot reach it and cannot create tipping-off risk.
- **It does not vouch for authenticity.** Each entry cites its source by sha256, so a supervisor
  re-verifies the originals. The party-side assembler — the bander's `casepack` command — verifies every
  exhibit's ES256 signature *before* folding and **refuses one it cannot**, running entirely on the
  sealed on-prem machine.

This is the honest form of the memo's "local genius layer": the heavy, bank-specific intelligence stays
inside the bank's perimeter, fed by a signed, offline-verifiable exhibit rather than by a number Mirror
had no business inventing. With progressive zoom (Boundary 1) it is what a corridor reaches for *before*
it reaches for sealed-value escrow's custody cost — precision without a value ever existing in the system.

## Triage of an infrastructure-and-moats memo

A later memo proposed turning Mirror into "the global trust layer for physical commerce" — owning the
corridor tables, triggering settlement, and licensing a regulator's dashboard. The good half of it is
already built; the ambitious half breaks the invariants that make the product legally viable. Judged
against the same rule as everything above, published here because the declines are the moat.

- **Dynamic corridor tables from a price oracle / an "AI band generator"** is **[declined]** — the
  commodity-feed idea, refused every time it appears. Mirror invents no prices; an oracle makes Mirror a
  price authority (the manipulation target) and forfeits the determinism the SR 11-7 dossier rests on. The
  honest form of "own the corridor tables" is not authorship, it is a REGISTRY of *party-ratified* tables:
  the **[shipped]** open corridor-table standard and `mirror-public` (table hashes), and the
  **[shipped]** table-discovery handshake under Boundary 2. Banks ratify the bands; Mirror holds their
  hashes and provenance, never their prices.
- **Atomic settlement triggers — a verdict that releases funds** is **[declined, and it is the most
  dangerous suggestion here]**. Mirror never moves, holds or settles money. A `reconciled` that pays out
  inverts fail-closed catastrophically — a false clear becomes an irreversible payment, and the operator
  joins the settlement-and-liability path it exists to stay out of. This is enforced, not merely intended:
  `kernel/mirror-iso20022.js` refuses any settlement or release instruction outbound, and the verifier-side
  cannot-list now REFUSES a signed record that carries one. Mirror attaches the proof a bank's own rail
  settles against; it is not the rail.
- **A shared "known ghost-shipment pattern" database across banks** (the pattern-matching half of the
  sanctions-routing idea) is **[declined]** — a deterministic pattern database shared between institutions
  is the surveillance-dressed-as-privacy honeypot the whole design refuses, the same objection that killed
  the hashed-identifier knowledge graph. The BLIND half is **[shipped]**: destination and control-list
  *consistency* is an attribute reconciliation (`mirror-attribute`), and duplicate cargo financing is
  `mirror-concurrent-exposure` through the cargo-intrinsic key — both flag a disagreement without any
  shared list of who is bad.
- **The regulator's systemic-typology map** is **[shipped]**, and stronger than the memo assumes:
  `mirror-macro` computes the divergence rate, velocity and *structurally dark* (ghost) corridors live from
  signed reconciliations, and now carries a **k-anon-gated breakdown by typology class** (over-invoicing,
  quantity mismatch, concurrent exposure, misdeclaration) — a real-time heat map of financial-crime
  structure with no invoice, name or amount ever seen, every cell withheld below k distinct members. The
  topological graph the memo pictures is a UI on top of data that already exists and is already private.
- **Blind ESG / carbon reconciliation** is **[shipped]**: `mirror-attribute` is the same primitive over a
  party-supplied *versioned vocabulary* rather than a price table, so a carbon-credit or certification
  equality check is an attribute reconciliation today — doubling the addressable surface with no new
  crypto. Honest boundary, as everywhere: a match proves the parties AGREE, never that the green claim is
  TRUE; collusion greenwashes past it exactly as it launders past a price clear.
- **IoT / telematics container attestation** is **[buildable]** and needs no new trust model: a smart
  container's signed weight, seal and route is simply another *independent leg*, the customs/carrier
  vertex `mirror-independence` already grades. Mirror accepts a signed telematics leg and diverges when it
  disagrees with the paper. Honest cost: it adds a hardware root of trust (the device enclave), so it is a
  stronger optional anchor, not a default, and a spoofed device still colludes.
- **Regulatory safe-harbor recognition and the "legal shield" narrative** are real, and out of scope for
  code: they are what the published spec, the enforced cannot-list and the runnable test suite exist to
  make *possible*. The substance a compliance officer needs is already here — an offline-verifiable signed
  receipt instead of a black-box score, `mirror-evenhand` answering de-risking with arithmetic, and a rail
  structurally incapable of the filing decision that creates tipping-off risk. That is a positioning job,
  not a primitive to build.

## Triage of a "genius feature" memo: co-signed verdicts

The memo asked for the one structural property a single operator cannot have: that no one operator's word is the
verdict. Judged by the same rule:

- **Co-signed verdicts across independent operators** is **[shipped, tested in one process]**: a corridor names
  its operators and k, the members ratify the list with the table, and a verdict is co-signed only when k distinct
  listed operators sign the identical record, with no dissent. See [federation](/federation).
- **The honest limit, stated where it matters:** a federation is only as independent as the organisations that
  run it. Mirror can run all the keys, and the rules refuse two keys under one organisation name, but a shared
  owner behind two names is not visible to the code. The independent operators are an outside matter, and no
  corridor should name a federation until they exist.
- **Not threshold ECDSA and not MPC**: each operator signs with its own key. That is replication with quorum, and
  the register says so rather than letting the word "federation" sound like cryptography it is not.
- **Operators that disagree do not co-sign**, and an operator that does not answer is not a veto. An operator that
  answers with a different governance for the corridor is.

## Triage of a "publish a format, not a network" memo

A later memo argued that consortium trade platforms died on commercial alignment, not on technology, and that
Mirror should be free at the rail, own the vocabulary and stop asking two competitors to negotiate. Its
structural moves, judged by the same rule:

- **Bands as a ratio to a public benchmark** is **[shipped]**: ratio corridors under Boundary 2.
- **One bank opens a corridor; the counterparty opts in** is **[shipped]**: authoring is one
  `corridor.propose`, joining is `mirror-bander accept`, which shows what is being accepted and refuses a
  corridor outside the admitted shape. The one-bank day-one case is `mirror-bander screen`: counts of the
  bank's own off-market prices, computed inside the bank.
- **The salt derived by the witness, not the banks** is **[buildable, as a reviewed design]**. Done
  properly it is an oblivious PRF (RFC 9497): a bank obtains the commitment for its own band without
  learning the witness's key, and cannot test other bands without asking the witness, which can log and
  rate-limit every query. That would close the counterparty enumeration of Boundary 5. Its cost is
  structural: the witness becomes an online dependency for every leg. It is built only against the RFC's
  published test vectors, or commissioned, never improvised.
- **A PSI join between the two banks** is **[declined for now]**: it needs a bank-to-bank channel, and
  Mirror deliberately has none. The join key is already a keyed locator commitment the operator cannot
  enumerate (§4).
- **Per-period batch commitments** are **[shipped in part]**: batch mixing and cover traffic exist
  party-side; a sorted per-period commitment that replaces per-leg commitments would change the
  protocol's unit of comparison and is not built.
- **A per-attestation fee charged to the witness** is **[declined]**: it is a volume fee, which the signed
  refusals rule out for any party, because a fee per attestation gives Mirror an interest in how many there
  are. Witnesses are paid by the banks directly, outside Mirror.
- **A flat member fee with corridors never metered** is a pricing decision, not an invariant. It is open,
  and it is the owner's to make.

## Why this document exists

The strongest thing that can be said about a cryptographic AML rail is not a list of what it catches —
it is an honest account of what it cannot, verified by anyone. A vendor whose pitch depends on the
illusion of doing everything cannot publish a page like this. Mirror can, because its limits are
deliberate and its upgrades are on the reader's terms, in the reader's perimeter, at the reader's speed.
That is not the fine print. It is the product.

*Read alongside the [cannot list](/designed-inability.md) (what it refuses to *do*, each enforced by a
test), the [threat model](/threat-model.md), the [protocol spec](/mirror-protocol-spec.md),
and the [honest comparison](/compare). This register is versioned; each entry moves from buildable to
shipped as it lands, and nothing is marked shipped that is not in the test suite.*