{
  "v": 1,
  "type": "mirror.cannot-registry",
  "version": "1.1.0",
  "published": "2026-09-28",
  "guarantee": "Within a major version a refusal code is never removed, reused or weakened: a structural refusal never becomes merely enforced and its wire code never changes. Adding a refusal is a minor version. Removing or weakening one requires a major version, a dated changelog entry and at least 90 days' published notice. server/cannot.test.js holds this registry against the pinned previous one on every run.",
  "changelog": [
    {
      "version": "1.0.0",
      "date": "2026-09-27",
      "change": "First published registry: 32 refusals across the operator, the signed record, the business and the evidence kernels, each tied to the tests that pin it - including the independence gate, the precise assertion and low-S signatures."
    },
    {
      "version": "1.1.0",
      "date": "2026-09-28",
      "change": "Seven refusals added, none removed or weakened: no staff directory and no delegate acting outside its scopes; no verdict pushed to a non-party and no webhook into a private network; no assay or origin secret at the door or in a signed record; no clear between legs banded under different corridor keys."
    }
  ],
  "refusals": [
    {
      "code": "raw_value",
      "area": "operator",
      "severity": "structural",
      "refuses": "a raw trade value, unit count, band, corridor table or per-shipment salt, at any nesting depth, on any route",
      "because": "the operator reconciles opaque commitments; a value it never receives cannot leak, be subpoenaed or be scored",
      "wire_code": "raw_leaked",
      "enforced_by": [
        "server/core.js",
        "server/designed-inability.test.js",
        "server/core-routes.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "filing_decision",
      "area": "operator",
      "severity": "structural",
      "refuses": "a suspicious-activity filing or a filing decision, including homoglyph and zero-width disguises of the key",
      "because": "tipping-off is a criminal offence; the rail must be incapable of holding the thing it would tip off about",
      "wire_code": "sar_wall",
      "enforced_by": [
        "server/core.js",
        "conformance/sar-wall.test.js",
        "server/wall-normalization.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "secret_custody",
      "area": "operator",
      "severity": "structural",
      "refuses": "a corridor secret - no route accepts, escrows or recovers one",
      "because": "an operator holding a secret could open every commitment made under it without searching at all",
      "wire_code": null,
      "enforced_by": [
        "server/designed-inability.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "cargo_identifier",
      "area": "operator",
      "severity": "structural",
      "refuses": "a plaintext container number, cargo key, receipt secret or measured or declared mass - a cargo travels as an opaque locator and a salted mass commitment",
      "because": "an identifier painted on the box would let the operator follow the cargo across banks; a kilogram is a trade figure like a price",
      "wire_code": "raw_leaked",
      "enforced_by": [
        "server/core.js",
        "server/path-routes.test.js",
        "server/app.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "private_key",
      "area": "operator",
      "severity": "enforced",
      "refuses": "a member's private signing key, even on a demo operator",
      "because": "a member's key never leaves the institution; the right answer to receiving one is a loud refusal, not a silent discard",
      "wire_code": "private_key_leaked",
      "enforced_by": [
        "server/core.js",
        "server/cannot.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "plaintext_join_key",
      "area": "operator",
      "severity": "enforced",
      "refuses": "a plaintext join key on the duplicate-financing bus",
      "because": "a join key must arrive as an opaque locator commitment; a readable document reference would identify the trade",
      "wire_code": "plaintext_join_key",
      "enforced_by": [
        "server/core.js",
        "server/cutover.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "risk_score",
      "area": "record",
      "severity": "structural",
      "refuses": "a risk score, probability, rating, likelihood or percentile - even inside a validly signed record",
      "because": "a score about a party is a de-risking instrument the moment it exists; Mirror reports states and counts with denominators",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-forbidden.js",
        "kernel/mirror-sign.js",
        "kernel/mirror-forbidden.test.js",
        "kernel/mirror-certificate.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "fourth_verdict",
      "area": "record",
      "severity": "structural",
      "refuses": "any verdict other than reconciled, divergent or undetermined",
      "because": "ambiguity fails closed to undetermined, never to a clear; the verdict-rule certificate checks every configuration",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-verdict-rule.test.js",
        "kernel/mirror-kernel.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "member_ranking",
      "area": "record",
      "severity": "structural",
      "refuses": "a ranking, percentile or per-counterparty comparison of members or corridors",
      "because": "a ranking of institutions is a scoreboard regulators would read as a verdict on conduct",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-evenhand.test.js",
        "kernel/mirror-rerisk.test.js",
        "kernel/mirror-graph.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "byproduct_leak",
      "area": "record",
      "severity": "enforced",
      "refuses": "a trade-shaped field in the public registry, or cover traffic that is not structurally uniform",
      "because": "a by-product that carries shape leaks what the primary output withholds",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-public.test.js",
        "kernel/mirror-cadence.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "filing_in_record",
      "area": "record",
      "severity": "structural",
      "refuses": "a filing decision inside a signed record - refused by the verifier whoever signed it",
      "because": "the promise must hold on the record in an examiner's hand, not only at the operator's door",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-forbidden.test.js",
        "server/forbidden-parity.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "secret_in_record",
      "area": "record",
      "severity": "structural",
      "refuses": "a per-shipment salt or shared secret inside a signed record",
      "because": "a leaked salt opens the commitments it salted",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-forbidden.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "settlement_instruction",
      "area": "record",
      "severity": "structural",
      "refuses": "a settlement, payment or release instruction; the ISO 20022 evidence block attaches proof and never triggers a payment",
      "because": "Mirror is not in the payment path and never will be",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-iso20022.test.js",
        "kernel/mirror-forbidden.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "stakeholder_only_clear",
      "area": "record",
      "severity": "structural",
      "refuses": "a reconciled verdict that rests only on parties with a stake in the price - two desks stating the same number cannot mint a clear",
      "because": "same-lie collusion reconciles perfectly; only a party with nothing to gain - a ratified witness key, competent on the axis - reaches past it",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-independence-gate.js",
        "kernel/mirror-independence-gate.test.js",
        "server/independence-gate-routes.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "overclaimed_assertion",
      "area": "record",
      "severity": "structural",
      "refuses": "a record claiming more than that the committed labels agree - that a label is the band of its true value is never asserted at reconciliation",
      "because": "a signed clean bill of health and a signed false one differ exactly by that sentence; the verifier rejects an assertion that does not restate the record",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-assertion.js",
        "kernel/mirror-leg.js",
        "server/label-integrity-routes.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "malleable_signature",
      "area": "record",
      "severity": "enforced",
      "refuses": "a second valid signature form for one signing - every signature is low-S, and a malleated copy is the same record, never a second verdict",
      "because": "a verdict entering an append-only log must not circulate under two signature strings",
      "wire_code": null,
      "enforced_by": [
        "kernel/envelope.js",
        "kernel/mirror-malleability.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_per_verdict_fee",
      "area": "business",
      "severity": "structural",
      "refuses": "a per-trade, per-verdict or per-shipment fee",
      "because": "coverage is the value; metering it would pay a member to submit less",
      "wire_code": "volume_fee_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js",
        "server/pricing-sim.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_bps_fee",
      "area": "business",
      "severity": "structural",
      "refuses": "a fee on trade value - basis points, ad valorem, a take rate",
      "because": "Mirror never sees a value, and a cut of flow would put it in the payment path",
      "wire_code": "volume_fee_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js",
        "server/pricing-sim.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_seat_fee",
      "area": "business",
      "severity": "enforced",
      "refuses": "a per-seat or per-user fee",
      "because": "the value is the corridor and the archive; seats penalise a compliance team for growing",
      "wire_code": "pricing_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_settlement_fee",
      "area": "business",
      "severity": "structural",
      "refuses": "a fee on settlement or money movement",
      "because": "there is no settlement, so there is nothing to charge for",
      "wire_code": "pricing_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_filing_fee",
      "area": "business",
      "severity": "structural",
      "refuses": "a fee tied to a filing decision",
      "because": "the rail refuses to hold a filing decision",
      "wire_code": "pricing_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_conversion_discount",
      "area": "business",
      "severity": "enforced",
      "refuses": "a free-to-paid conversion discount",
      "because": "a free tier that converts makes the verifier a sales tool",
      "wire_code": "pricing_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_score_fee",
      "area": "business",
      "severity": "structural",
      "refuses": "a fee for a trust or risk score",
      "because": "Mirror produces no score",
      "wire_code": "pricing_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "no_volume_band",
      "area": "business",
      "severity": "enforced",
      "refuses": "a volume-band pricing tier",
      "because": "volume is a side channel the boundary register names",
      "wire_code": "pricing_refused",
      "enforced_by": [
        "kernel/mirror-billing.js",
        "kernel/mirror-billing.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "invented_price",
      "area": "business",
      "severity": "structural",
      "refuses": "a price or band table Mirror authored, suggested or computed - templates carry none, and the corridor graph cites whole ratified tables by hash",
      "because": "a price source inside the rail is a manipulation target and makes the operator an authority on value",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-library.test.js",
        "kernel/mirror-graph.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "custody",
      "area": "business",
      "severity": "structural",
      "refuses": "moving, holding, freezing or settling money",
      "because": "custody is a different, licensed business, and a boundary this product does not cross",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-iso20022.test.js",
        "kernel/mirror-billing.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "case_content",
      "area": "evidence",
      "severity": "structural",
      "refuses": "the content of a case in the case chain: field values, recipients, notes or a filing action",
      "because": "the chain proves custody - what was touched and when - and is safe to log publicly only because it holds nothing else",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-casechain.js",
        "kernel/mirror-casechain.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "graph_identity",
      "area": "evidence",
      "severity": "structural",
      "refuses": "a member, product, corridor id, per-corridor rate or percentile in a corridor-graph release",
      "because": "the graph publishes population cells under a suppression floor; anything identifying defeats the floor",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-graph.js",
        "kernel/mirror-graph.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "price_in_citation",
      "area": "business",
      "severity": "structural",
      "refuses": "a figure inside a citation corridor - a citation names a public document and a step, never a price; each bank derives the table party-side",
      "because": "the corridor must never become a place Mirror publishes or holds a price",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-citation.js",
        "kernel/mirror-nested.test.js",
        "server/nested-routes.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "path_count_below_k",
      "area": "evidence",
      "severity": "structural",
      "refuses": "a path or ghost-coverage count describing fewer than k institutions besides the requester - withheld, never partial",
      "because": "with two banks on a path, one bank's count is a statement about the other's trade",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-path.js",
        "kernel/mirror-path.test.js",
        "server/path-routes.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "unreviewed_graph_statistic",
      "area": "evidence",
      "severity": "enforced",
      "refuses": "a corridor-graph statistic published without a named external review of its mechanism, or described as differential privacy it does not provide",
      "because": "a network statistic a reviewer can break with a membership-inference argument is a leak with extra steps",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-graph.js",
        "kernel/mirror-graph.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "government_verification_claim",
      "area": "evidence",
      "severity": "enforced",
      "refuses": "a claim that Mirror verified a tax authority's or customs administration's signature",
      "because": "registration is the submitting institution's dated statement; Mirror checks no government signature and says so on the leg",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-einvoice.js",
        "kernel/mirror-einvoice.test.js"
      ],
      "since": "1.0.0"
    },
    {
      "code": "staff_directory",
      "area": "operator",
      "severity": "structural",
      "refuses": "a directory of a member's staff - names, email addresses, passwords or SCIM users. Access is by scoped member keys; which person holds a key is decided behind the member's own SSO",
      "because": "an operator holding a bank's staff roster would hold personal data on a rail whose argument is that it holds almost nothing",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-delegation.js",
        "kernel/mirror-delegation.test.js",
        "kernel/mirror-auth.js"
      ],
      "since": "1.1.0"
    },
    {
      "code": "unscoped_delegate",
      "area": "operator",
      "severity": "enforced",
      "refuses": "a delegated key acting outside the scopes its member granted, after its certificate expired, or after the member revoked it - a live session included",
      "because": "per-desk permission is only real if the operator enforces it on every request",
      "wire_code": "scope",
      "enforced_by": [
        "server/core.js",
        "kernel/mirror-delegation.js",
        "server/delegation.test.js"
      ],
      "since": "1.1.0"
    },
    {
      "code": "push_to_non_party",
      "area": "operator",
      "severity": "structural",
      "refuses": "a webhook delivery of a verdict to any member whose leg did not authenticate on it",
      "because": "telling a non-party that a trade was judged would draw the correspondent graph this rail exists not to build",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-webhook.js",
        "kernel/mirror-webhook.test.js",
        "server/webhooks.test.js"
      ],
      "since": "1.1.0"
    },
    {
      "code": "webhook_to_private_network",
      "area": "operator",
      "severity": "enforced",
      "refuses": "a webhook delivered to a private, loopback, link-local or metadata address - by literal, or by what a registered name resolves to at connect time",
      "because": "an operator that posts wherever a name points becomes a probe into its own network",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-webhook.js",
        "server/webhook-send.js",
        "server/webhooks.test.js"
      ],
      "since": "1.1.0"
    },
    {
      "code": "assay_and_origin_secret",
      "area": "operator",
      "severity": "structural",
      "refuses": "a declared or measured grade, an assay certificate secret or a document salt, at any nesting depth, on any route",
      "because": "a grade is a trade figure like a price, and the certificate secret and the document salt open the commitments they salt",
      "wire_code": "raw_leaked",
      "enforced_by": [
        "server/core.js",
        "server/wall-normalization.test.js"
      ],
      "since": "1.1.0"
    },
    {
      "code": "opening_secret_in_record",
      "area": "record",
      "severity": "structural",
      "refuses": "a terminal receipt secret, an assay certificate secret or a document salt inside a signed record - refused by the verifier whoever signed it",
      "because": "each of them opens a witness or origin commitment the record was built to keep closed",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-forbidden.js",
        "server/forbidden-parity.test.js"
      ],
      "since": "1.1.0"
    },
    {
      "code": "cross_key_clear",
      "area": "record",
      "severity": "structural",
      "refuses": "a clear between legs banded under different corridor keys or tables - such a shipment is undetermined, never reconciled and never divergent",
      "because": "during a key rotation a straddling shipment must fail safe, not accuse anyone and not clear",
      "wire_code": null,
      "enforced_by": [
        "kernel/mirror-kernel.js",
        "server/rotation-rehearsal.test.js"
      ],
      "since": "1.1.0"
    }
  ],
  "note": "Machine-readable form of the cannot-list (/designed-inability.md). Assert against the codes; every entry names the files that enforce it and the tests that pin it.",
  "disclaimer": "Enforced by this codebase and pinned by its tests - not certified by a third party. It does not by itself prove a given deployment runs this code: compare the spec pin on /health and the published conformance-suite hash."
}