Safeguards · the refusal contract, version 1.1.0
Not a policy page. Each refusal names the code that enforces it and the test that fails the build if it ever stops holding. The list is signed at GET /cannot, and within a major version nothing on it is removed or weakened.
The hallmark plate
An assayer punches a hallmark into metal that has passed the test. Here each mark is a refusal the code enforces. Brass marks are structural: removing one would change what Mirror is. Ink marks are enforced guards under the same change control. Hover or focus a mark to read it; select it to open its entry.
Hover or focus a mark to read what it refuses.Break it
A list of refusals is a claim until you attack it. Choose a role, fire at a simulated operator, and read what you actually get back: nothing you can use.
Simulated against the real properties · the homoglyph fold runs live in your browser
The ledger
raw_valuestructuralwire: raw_leakedWhy. The operator reconciles opaque commitments; a value it never receives cannot leak, be subpoenaed or be scored.
server/core.jsserver/designed-inability.test.jsserver/core-routes.test.jsfiling_decisionstructuralwire: sar_wallWhy. Tipping-off is a criminal offence; the rail must be incapable of holding the thing it would tip off about.
server/core.jsconformance/sar-wall.test.jsserver/wall-normalization.test.jssecret_custodystructuralWhy. An operator holding a secret could open every commitment made under it without searching at all.
server/designed-inability.test.jscargo_identifierstructuralwire: raw_leakedWhy. An identifier painted on the box would let the operator follow the cargo across banks; a kilogram is a trade figure like a price.
server/core.jsserver/path-routes.test.jsserver/app.test.jsprivate_keyenforcedwire: private_key_leakedWhy. A member's key never leaves the institution; the right answer to receiving one is a loud refusal, not a silent discard.
server/core.jsserver/cannot.test.jsplaintext_join_keyenforcedwire: plaintext_join_keyWhy. A join key must arrive as an opaque locator commitment; a readable document reference would identify the trade.
server/core.jsserver/cutover.test.jsstaff_directorystructuralnew in 1.1.0Why. An operator holding a bank's staff roster would hold personal data on a rail whose argument is that it holds almost nothing.
kernel/mirror-delegation.jskernel/mirror-delegation.test.jskernel/mirror-auth.jsunscoped_delegateenforcedwire: scopenew in 1.1.0Why. Per-desk permission is only real if the operator enforces it on every request.
server/core.jskernel/mirror-delegation.jsserver/delegation.test.jspush_to_non_partystructuralnew in 1.1.0Why. Telling a non-party that a trade was judged would draw the correspondent graph this rail exists not to build.
kernel/mirror-webhook.jskernel/mirror-webhook.test.jsserver/webhooks.test.jswebhook_to_private_networkenforcednew in 1.1.0Why. An operator that posts wherever a name points becomes a probe into its own network.
kernel/mirror-webhook.jsserver/webhook-send.jsserver/webhooks.test.jsassay_and_origin_secretstructuralwire: raw_leakednew in 1.1.0Why. A grade is a trade figure like a price, and the certificate secret and the document salt open the commitments they salt.
server/core.jsserver/wall-normalization.test.jsrisk_scorestructuralWhy. A score about a party is a de-risking instrument the moment it exists; Mirror reports states and counts with denominators.
kernel/mirror-forbidden.jskernel/mirror-sign.jskernel/mirror-forbidden.test.jskernel/mirror-certificate.test.jsfourth_verdictstructuralWhy. Ambiguity fails closed to undetermined, never to a clear; the verdict-rule certificate checks every configuration.
kernel/mirror-verdict-rule.test.jskernel/mirror-kernel.test.jsmember_rankingstructuralWhy. A ranking of institutions is a scoreboard regulators would read as a verdict on conduct.
kernel/mirror-evenhand.test.jskernel/mirror-rerisk.test.jskernel/mirror-graph.test.jsbyproduct_leakenforcedWhy. A by-product that carries shape leaks what the primary output withholds.
kernel/mirror-public.test.jskernel/mirror-cadence.test.jsfiling_in_recordstructuralWhy. The promise must hold on the record in an examiner's hand, not only at the operator's door.
kernel/mirror-forbidden.test.jsserver/forbidden-parity.test.jssecret_in_recordstructuralWhy. A leaked salt opens the commitments it salted.
kernel/mirror-forbidden.test.jssettlement_instructionstructuralWhy. Mirror is not in the payment path and never will be.
kernel/mirror-iso20022.test.jskernel/mirror-forbidden.test.jsstakeholder_only_clearstructuralWhy. Same-lie collusion reconciles perfectly; only a party with nothing to gain - a ratified witness key, competent on the axis - reaches past it.
kernel/mirror-independence-gate.jskernel/mirror-independence-gate.test.jsserver/independence-gate-routes.test.jsoverclaimed_assertionstructuralWhy. A signed clean bill of health and a signed false one differ exactly by that sentence; the verifier rejects an assertion that does not restate the record.
kernel/mirror-assertion.jskernel/mirror-leg.jsserver/label-integrity-routes.test.jsmalleable_signatureenforcedWhy. A verdict entering an append-only log must not circulate under two signature strings.
kernel/envelope.jskernel/mirror-malleability.test.jsopening_secret_in_recordstructuralnew in 1.1.0Why. Each of them opens a witness or origin commitment the record was built to keep closed.
kernel/mirror-forbidden.jsserver/forbidden-parity.test.jscross_key_clearstructuralnew in 1.1.0Why. During a key rotation a straddling shipment must fail safe, not accuse anyone and not clear.
kernel/mirror-kernel.jsserver/rotation-rehearsal.test.jsno_per_verdict_feestructuralwire: volume_fee_refusedWhy. Coverage is the value; metering it would pay a member to submit less.
kernel/mirror-billing.jskernel/mirror-billing.test.jsserver/pricing-sim.test.jsno_bps_feestructuralwire: volume_fee_refusedWhy. Mirror never sees a value, and a cut of flow would put it in the payment path.
kernel/mirror-billing.jskernel/mirror-billing.test.jsserver/pricing-sim.test.jsno_seat_feeenforcedwire: pricing_refusedWhy. The value is the corridor and the archive; seats penalise a compliance team for growing.
kernel/mirror-billing.jskernel/mirror-billing.test.jsno_settlement_feestructuralwire: pricing_refusedWhy. There is no settlement, so there is nothing to charge for.
kernel/mirror-billing.jskernel/mirror-billing.test.jsno_filing_feestructuralwire: pricing_refusedWhy. The rail refuses to hold a filing decision.
kernel/mirror-billing.jskernel/mirror-billing.test.jsno_conversion_discountenforcedwire: pricing_refusedWhy. A free tier that converts makes the verifier a sales tool.
kernel/mirror-billing.jskernel/mirror-billing.test.jsno_score_feestructuralwire: pricing_refusedWhy. Mirror produces no score.
kernel/mirror-billing.jskernel/mirror-billing.test.jsno_volume_bandenforcedwire: pricing_refusedWhy. Volume is a side channel the boundary register names.
kernel/mirror-billing.jskernel/mirror-billing.test.jsinvented_pricestructuralWhy. A price source inside the rail is a manipulation target and makes the operator an authority on value.
kernel/mirror-library.test.jskernel/mirror-graph.test.jscustodystructuralWhy. Custody is a different, licensed business, and a boundary this product does not cross.
kernel/mirror-iso20022.test.jskernel/mirror-billing.test.jsprice_in_citationstructuralWhy. The corridor must never become a place Mirror publishes or holds a price.
kernel/mirror-citation.jskernel/mirror-nested.test.jsserver/nested-routes.test.jscase_contentstructuralWhy. The chain proves custody - what was touched and when - and is safe to log publicly only because it holds nothing else.
kernel/mirror-casechain.jskernel/mirror-casechain.test.jsgraph_identitystructuralWhy. The graph publishes population cells under a suppression floor; anything identifying defeats the floor.
kernel/mirror-graph.jskernel/mirror-graph.test.jspath_count_below_kstructuralWhy. With two banks on a path, one bank's count is a statement about the other's trade.
kernel/mirror-path.jskernel/mirror-path.test.jsserver/path-routes.test.jsunreviewed_graph_statisticenforcedWhy. A network statistic a reviewer can break with a membership-inference argument is a leak with extra steps.
kernel/mirror-graph.jskernel/mirror-graph.test.jsgovernment_verification_claimenforcedWhy. Registration is the submitting institution's dated statement; Mirror checks no government signature and says so on the leg.
kernel/mirror-einvoice.jskernel/mirror-einvoice.test.jsChange control
Within a major version a refusal code is never removed, reused or weakened: a structural refusal never becomes merely enforced and its wire code never changes. Adding a refusal is a minor version. Removing or weakening one requires a major version, a dated changelog entry and at least 90 days' published notice. server/cannot.test.js holds this registry against the pinned previous one on every run.
First published registry: 32 refusals across the operator, the signed record, the business and the evidence kernels, each tied to the tests that pin it - including the independence gate, the precise assertion and low-S signatures.
Seven refusals added, none removed or weakened: no staff directory and no delegate acting outside its scopes; no verdict pushed to a non-party and no webhook into a private network; no assay or origin secret at the door or in a signed record; no clear between legs banded under different corridor keys.
Check it yourself
This page is generated from the same registry the operator signs. Fetch the signed list and verify it offline - on the bench, or with your own code against the published key.
Put the signed list on the bench# the signed registry, straight from the operator OP=https://mirror-operator.vasileburuian94.workers.dev curl $OP/cannot > cannot.json curl $OP/jwks > jwks.json # verify offline: ES256 over canonical JSON, plus the refusal scan node -e 'const k = require("./mirror-kit.js"); k.sign.verifyRecord(require("./cannot.json"), require("./jwks.json")) .then((v) => console.log(v.valid, v.reason))'