Shipped, next, and refused — each with its reason. This page was written against a 28-item strategy memo (September 2026) and its 12 proposed anti-features, and revisited against three further strategy reviews (October 2026), mapped item by item at the end of this page. Every item lands in one of three places: shipped (named by the kernel that ships it, so the claim can be opened and read), next (a real gap, with what it needs), or refused (with the reason, in the same voice as the cannot list). Work that needs someone outside this project — a pilot bank, a terminal, an auditor — is marked outside party, because no amount of code supplies it.
There are no dates on this page. A roadmap with dates is a promise about the future, and this site does not make claims it cannot test today. What it can say is where each thing stands, and why.
Shipped#
| The memo asked for | What exists | Where to read it |
|---|---|---|
| A self-hostable operator, and a way off the rail | A rail of rails: many operators, no global one; members can leave with their records and history. Independent implementations are certified byte-identical. | mirror-federation, mirror-succession, mirror-conformance, conformance vectors |
| Multi-bank chains, and no single operator to trust | Legs are roles (invoice, customs, payment, …) and each corridor names the roles it requires. Many operators co-sign one verdict; the verifier checks each signature independently. | mirror-kernel, mirror-cosign |
| A sandbox that breaks the chicken-and-egg | Single-player mode: one bank reconciles its own desks and books through the same rail on day one. A seeded synthetic corridor with planted anomalies scores the kernel against ground truth. | mirror-internal, mirror-autopsy, pilot in a box |
| Interop with trade-finance messaging | The bander reads the payment leg straight off an ISO 20022 pacs.008 / pain.001 inside the bank, fail-closed; outbound, the rail's own block refuses to carry an amount. | mirror-iso20022-ingest, mirror-iso20022 |
| A starter kit for the first two banks | A corridor charter (corridor N+1 as a countersignature, not a committee), the setup ceremony, a named legal basis for every shared signal, the corridor-table standard, two sample tables, and a pilot runbook with measurable outcomes, a ceremony script and a supervisor memo — drafts for each bank's counsel, never legal advice. No pilot has run. | mirror-charter, mirror-ceremony, mirror-basis, corridor-table standard, metals · electronics, first two banks |
| A timestamp the operator cannot backdate | Not a VDF (see Refused): a Certificate-Transparency-shaped log, witness co-signed tree heads, sealed-before ordering between legs, and gossip that turns a split view into a provable fork. | mirror-anchor, mirror-witness, mirror-order, mirror-gossip |
| A corridor provenance registry | Who chose these band edges, and from what — pinned into every verdict; the ratified registry of which tables are law, and the corridor book that makes it permanent. | mirror-provenance, mirror-registry, mirror-book |
| A tipping-off-safe case workflow | Party-to-party disclosure: a signed request on a closed basis vocabulary, a signed grant, the material moving bank to bank and never through the operator. Outcomes compound in a resolution ledger. | mirror-disclosure, mirror-resolution, the bander's casepack |
| Continuous adversarial checking | Known-answer canaries the operator cannot see coming, a published filing-term corpus of smuggling attempts, and the conformance vectors. | mirror-canary, filing-term corpus |
| Sanctions / attribute attestation without seeing the party | Blind attribute reconciliation — the generalisation of the price primitive — plus event-driven perpetual KYC and corroboration when two banks independently flag one entity. | mirror-attribute, mirror-pkyc, mirror-corroborate |
| A formal verification certificate | The verdict-rule certificate: reconcile() checked against the band-level three-state rule in every one of 48,384 configurations — 0 counterexamples. Bounded model checking, not a theorem prover, and it says so. | verdict certificate, mirror-verdict-rule |
| A public, append-only log | The operator serves the log head, consistency proofs, witness heads and gossip; a public transparency registry and a read-only supervisor seat. | mirror-anchor, mirror-public, mirror-supervisor |
| A pricing simulator, and a pricing model that holds the design together | Three tiers — a free open core, the bilateral corridor, the multilateral corridor — plus the Founding Corridors programme and free supervisor and researcher access. The simulator runs the billing kernel itself, in your browser, against the published rate card, with volume and flag-rate sliders wired to nothing, because neither is ever billed. | /pricing, /founding-corridors, mirror-billing (estimateMemberFee) |
| Regulator legibility | Each verdict mapped to FATF's own words; a model-validation dossier; a supervisor seat that can test the rail, not only watch it. | mirror-fatf, mirror-validation, mirror-seat, for examiners |
| Records that outlive the company | Verification escrow for the ten-year record, and salt-continuity escrow so old verdicts stay openable. | mirror-archive, mirror-escrow |
| Legs from outside banking | The physical leg: binding money to matter — container, vessel, port, date — and quantity banded separately from price. | mirror-physical, mirror-dims, mirror-locator |
| Related parties, without either bank showing its client list | Blind related-party detection: the two banks test whether buyer and seller share an owner by private set intersection over normalised ownership identifiers (LEI, registry number, person) — each learns only whether the sets meet. A clear that rests only on related parties is graded as such. | mirror-related, mirror-independence |
| Right weight, wrong grade | The quality leg: a declared grade banded against an independent assay, and a price-for-grade check that catches an honestly declared grade priced as a better one. | mirror-assay |
| Mirror statistics per shipment | Customs-to-customs: the export and the import declaration of one consignment, normalised to one valuation basis and currency inside each administration, compared blind on the consignment reference. Built for a regulator sandbox — no customs administration takes part today. | mirror-customs, mirror-locator (ucr) |
| The invoice the seller told its tax authority about | The tax e-invoice leg: narrow readers for CFDI, NF-e, the Indian IRN and FatturaPA; the registration is the submitter's dated statement, never Mirror's; the registration id joins the duplicate-financing check where a borrower cannot reword it; and the registered invoice is set against the export declaration. No tax platform is connected today. | mirror-einvoice, mirror-locator (einv) |
| Where the ship actually went | The voyage leg: the declared vessel, port and day compared blind with every port call a licensed AIS track shows, plus dark gaps, ship-to-ship encounters and implausible movement as facts beside the verdict. A weak independent vertex, because the ship broadcasts its own track. No AIS vendor is connected today. | mirror-voyage |
| Faster corridors for the goods launderers favour | The corridor library: published templates for gold, used vehicles, phones, textiles and scrap — dimensions, required and independent legs, join keys, typologies reached, limits — rendered as a page from the same file the validator reads. No template carries a price. | corridor library, JSON, mirror-library |
| Turning table agreement into a software step | The discovery handshake: each bank signs the tables it already supports, named by hash with their granularity; both compute the same finest shared table, or a clean no_shared_table. Shadow mode: candidate tables run over the bank's own legs through the operator's kernel, inside the bank, submitting nothing — counts per table, each table's blind spot, and how many shipments change answer. | mirror-discovery, mirror-shadow, the bander's shadow, a corridor's life |
| A finer look, by consent | Progressive zoom: one bank signs a request to re-read one shipment under a finer ratified, nested table, with a reason from a closed list; the counterparty signs consent or decline; anyone checks the pair offline. A decline, or silence, is a signed fact — not evidence. | mirror-zoom, mirror-nested |
| Corridors that end, and secrets that move on | Time-bound corridors: a proposal may carry valid_until; after it the table judges nothing (table_expired) and renewal is a new version. A calendar hash ratchet gives a file-held corridor secret forward secrecy: both banks derive each day's, week's or month's secret from the last and destroy the old ones, with no message between them. | mirror-registry, mirror-ratchet, the bander's ratchet-start / ratchet-turn |
| One FX basis both banks ratify | The pair names a public publisher, a base currency and a rule for which file applies; each bank fetches the file itself, converts exactly on its own machine, and commits the file's pin inside the pricing basis. Different files hold the reading undetermined. Mirror fetches, publishes and chooses no rate. | mirror-fxbasis, mirror-pricebasis, band --fx-rates |
| An operator with no outside party | The air-gapped operator: durable state in a hash-chained, append-only journal on local disk — fsynced before a write is acknowledged, one writer, a torn tail archived on the record, and a refusal to start on anything else it cannot account for. A store that is configured but unavailable now stops the start instead of falling back to memory. | server/store-file.js, air-gapped operator |
| A corridor you can show to a third party | The corridor passport: one signed, versioned, offline-verifiable file per corridor, append-only, with exit and error as signed versions rather than removals. Its graph baseline reference ships empty until the graph can support one. | mirror-passport |
| A map of the rail that cannot leak | The corridor graph (structure): cells by commodity and lane class under a suppression floor — k corridors past a dwell period, banded counts, a published cell frozen until membership moves by k, baselines withheld under dominance. On today's rail every cell is below the floor, so every release is empty. | mirror-graph |
| A clear two desks cannot mint | The independence gate: reconciled now requires a party with no stake in the price - a witness key the members ratified under an independent class (customs, terminal, carrier, inspectorate, ...) - to have agreed on an axis it is competent for. Two banks agreeing is undetermined (insufficient_independence). A bank's operations desk relaying a terminal receipt counts only where the corridor ratified relays, and is recorded as relayed. | mirror-independence-gate, the witness registry in mirror-registry |
| A physical witness nobody has to ask | The terminal commitment bulletin: a terminal publishes what it weighed (RFC 6962, salted by a receipt secret that travels with the papers); banks prove inclusion; the operator compares masses it never sees. Phantom shipments have no entry; short ones diverge on quantity. No terminal is connected today. | mirror-bulletin |
| Mispricing inside a band | Nested resolution (a fine band under the same salt: in-band mispricing is divergent on resolution), a signed geometry certificate for every ratified table ("this corridor can hide at most X per unit"), and citation corridors that cite a published figure instead of attaching a table. | mirror-nested, mirror-geometry, mirror-citation, /corridor/certificate |
| Tracking a path, not a hop | The path certificate: one cargo's hops by opaque locator, in counts - states, declared free-zone hops, hops without an independent or customs anchor, drift across hops - each proven into the log, released above a k gate; plus a weekly ghost-coverage certificate. And services get their own key and a certifier witness. | mirror-path, mirror-services, /path/certificate, /coverage/ghost |
| A label bound to its value | Label integrity: every record states exactly what it asserts - that the committed labels agree, not that a label is the band of its true value. A label can be bound to the document the bank's trade system signed at booking, so a false label is a certain, attributable finding at the first opening; pricing bases are committed and compared; a corridor can ratify its bander builds. Signatures are low-S (no malleated twins). | mirror-assertion, mirror-origin, mirror-pricebasis, the math triage |
| A contract, not a page | The refusal list as an interface (/cannot.json, signed at /cannot, change-controlled by test), a versioned signal taxonomy (/signals.json), a stability policy (/stability-policy.md) and a software bill of materials (/sbom.cdx.json). | mirror-cannot, mirror-signals |
| "Did you tip off the counterparty?" | The case chain: what happened to a verdict inside the case system — opened, viewed (field classes only), annotated (a hash), forwarded (a count), closed — signed by each officer's key, hash-linked, verifiable offline, with an entitlement an auditor can check views against. Evidence of custody, not absolution. | mirror-casechain |
| A witness a terminal can actually run | The witness publisher a terminal or weighbridge runs (weigh, publish a signed bulletin that must extend its last one, verify), relay tooling for a bank's ops desk on a ratified corridor, two kinds of witness where a corridor requires them (gold: a terminal's weight AND an assayer's grade - right weight, wrong metal diverges on quality), equivocation detection for a witness that signs two histories, and recall: when a witness is suspended for cause, each bank gets a signed notice of the clears that rested on it. | witness/mirror-witness.js, mirror-recall, mirror-bulletin, /recall/notice, /witness/forks |
| Keys a CISO will sign off | Corridor secrets and signing keys in the bank's HSM or KMS (the bank's own tool, no shell, KCV-checked), a rehearsed rotation by corridor version with an honest rollback window, and scoped desk keys delegated by the member root - per-desk permissions with no staff directory at the operator. | mirror-custody, mirror-rotation, mirror-delegation, custody, rotation, access control |
| Event-driven, not batch | Signed webhooks to the proven parties only, at least once with a stable dedupe id, a stated retry schedule and SSRF-safe delivery; recall notices pushed at quorum; a signed, nonce-bound clock members use to bound the operator's offset. | mirror-webhook, mirror-clock, webhooks, clock discipline |
| Plumbing a platform team expects | OpenAPI 3.1 generated and drift-tested with the raw-data wall in the schema; verifying SDKs in JavaScript, Python, Go, Java and .NET, held to one set of shared vectors; a SIEM export of a member's own signed records; a Terraform module validated with a real terraform, and a compiled provider with drift detection and import; migration tooling (import-check, --mapping, table-import); an origination sidecar for the trade platform; a production-parity sandbox. | OpenAPI, SDK, SDK vectors, Terraform, sandbox |
| Fields a document-AI tool already extracted | The document-AI on-ramp: a vendor-neutral export and the bank's own mapping become the legs the bander reads, behind a confidence gate the bank sets - one declared number format, conflicting documents held and never summed, every document counted in exactly one bucket. Mirror reads no document, and no vendor integration is claimed. | mirror-docai, the bander's docai-import, document AI |
| Duplicate financing a lender can use | The concurrent-exposure check now has a claim command (the financed document and its aliases committed under the consortium key, signed with its window), SDK methods that verify every collision record, and a page with an honest comparison to the established registry. No lender uses it today. | mirror-concurrent-exposure, the bander's exposure-claim, exposure.* in the SDK, duplicate financing |
| A model-risk pack | The evidence a validator asks for, each with the command that reproduces it: the parameter inventory (zero learned), determinism, the enumerated decision table, the verdict-rule certificate, provenance, the suite pin, the vectors, planted anomalies, and monitoring by table drift and end dates. Classifying Mirror stays the bank's decision. | mirror-validation, /dossier, model-risk pack |
| A price check without a price authority | The cited benchmark: one bank cites a public market figure, bands it under the shipment's salt within an agreed market window, and the corridor requires the role benchmark; two documents over-invoiced by the same amount diverge against it. Mirror never sees, fetches or chooses the figure, a benchmark can only make a reading stricter, and it is not the arm's-length check refused below. | mirror-benchmark, the bander's benchmark-leg, a corridor's life |
| Mirror's checks for AI agents | An MCP server over standard input and output wrapping the verifying client: ten tools, every signed answer verified before the agent sees it, raw data refused before a request, no key held, and no tool that bands, scores or files. | sdk/mirror-mcp.js, agents |
| A kit for the witness the gate waits for | The publisher a terminal runs, how the banks ratify it, what a witness never sees, relays for the cold start and the separate log-witness role, on one page. No witness is connected. | witness/mirror-witness.js, become a witness |
| Adapters for trade-finance messages | Reference connectors for the messages trade platforms exchange: the SWIFT MT700 / MT710 / MT720 documentary credit becomes a credit leg, and a DCSA eBL 3.0 bill of lading becomes a cargo key and a shipper-declared mass per container. Both are fail-closed on anything ambiguous. No named platform is connected. | mirror-mt700, mirror-ebl, connectors/mirror-connect.js, connectors |
| A diligence file, not a sales deck | Signed release provenance (in-toto + SLSA v1, DSSE; SLSA Build L1), checked by rebuilding with one reproduction command; EU data residency, with processing pinned to Cloudflare's EU jurisdiction and signed at /residency; a tested recovery drill with measured restore times; a degradation runbook tested row by row; a normative canonical-forms spec reproduced by an independent implementation; the roadmap's refusals signed and binding; and the procurement documents, each saying what it does not cover. | due diligence, provenance, data residency, RTO / RPO, /roadmap |
Next#
Real gaps. Each one is buildable without breaking a property on this site, and none has a date.
- An open licence and a container image for the operator. A
docker runbeside the conformance suite, so a bank can run the operator on its own metal. Needs the maintainer's licence decision first, and an image build that reproduces byte for byte. - A public source repository with protected history. Every release can already be rebuilt and compared with its signed provenance by one command (
node server/reproduce.js; results per release in provenance). Fetching the tree from a public repository needs the maintainer's decision. - An MT798 adapter. MT798 is the corporate-to-bank envelope around trade messages. Build it like the MT700 reader: spec-exact fixtures first, fail-closed on anything ambiguous, one leg per message.
- An inclusion-proof explorer. A page that checks a verdict's inclusion in the log in the browser, offline — what Verify already does for signatures. It needs an operator route that returns one verdict's inclusion proof against a signed head; today inclusion proofs come back only inside
/anchor/order. - A counterfactual replay across tables. "Would a tighter table have flagged this?" means re-banding raw values, which only the banks hold — so it runs as a two-bank re-commitment under a candidate table, never at the operator. Shadow mode now answers the in-house half (the bank's own legs under each candidate table), and
mirror-geometrythe widest mispricing a table can hide. - Bander commands for discovery offers and zoom requests. Both are signed records built by their kernels today, called from Node; a bank should be able to sign and check them with the one binary it already runs.
- A slow, table-specified key derivation. A ratified PBKDF2 cost on the salt makes a key-holding counterparty's enumeration expensive. It changes the salt every implementation must reproduce, so it ships as a protocol version with new conformance vectors in all five SDKs, never as a patch.
- A per-transaction random nonce in place of the reference-derived salt, exchanged over the two banks' own authenticated channel. It ends enumeration, at the cost of a message per trade; Mirror runs no bank-to-bank channel, so it needs one the pair already has.
- A compacting snapshot and a single-file operator. The air-gapped journal grows with every write and is replayed at start; a signed snapshot that starts a fresh journal, and an operator built as one executable like the bander, are both unbuilt.
- Versioned open datasets — the corpus, the vectors and the typology map, each with a version, a hash, a licence and a citation file.
- A live fuzz dashboard fed by the canary and corpus runs.
- Operator routes for the new readings. Customs-to-customs, the e-invoice leg, grade, voyage and related-party records run today as kernels, party-side and in the console; operator routes need a governed-corridor lookup first, so that no corridor table ever travels to the operator inside a request.
- Bander commands for the remaining legs — customs declarations, e-invoices and AIS tracks — so each is read and committed on the machine that holds it. Fine commitments, pricing bases, declared mass and grade, bulletin anchors, relayed measurements and services legs have their verbs now.
- A named trade platform, connected. The origination sidecar signs at booking under the platform's own HSM; connecting a specific platform's booking event to it is per-platform work with that platform's owner.
- Terminal partners for the commitment bulletin (outside party). The format, the publisher and the verification ship, with a kit for the witness; no terminal publishes a bulletin yet, so the live rail still clears nothing.
- A ratified market window for the benchmark. Today the pair agrees the benchmark's window, and the record shows it only through the leg's commitment count. A corridor field the operator enforces - a benchmark wider than ratified holds the reading - needs a registry change, ratified like the edges.
- A hosted MCP endpoint. The agent server runs beside the agent, over standard input and output. A hosted one needs an authorisation design that keeps every credential out of an agent's conversation.
- A zero-knowledge proof that a hidden label is the band of a signed hidden value - the commission brief is published; no cryptographer is engaged yet. Until then the link is proven at opening, against the booked document.
- Case-chain logging at the operator, and the case-system integrations that write the events. The chain is only as complete as the system that writes it.
- Graph statistics — gated: nothing publishes until enough cells clear the suppression floor, and not before an independent adversarial audit of the construction. The passport's baseline reference waits on the same gate.
- Regulator sandboxes and data partners for the customs, tax and AIS legs — the kernels are ready; the parties are not yet connected.
- SDK packages in public registries (PyPI, Maven Central, NuGet, the Go module proxy), and the Terraform provider on the Terraform Registry. Both ship as source today and are tested. Publishing needs the maintainer's decision on names, and the release signing keys.
- Two pilot banks (outside party). The runbook says what a pilot would measure and how it would stop, including the shorter path for a bank that already runs document AI; no bank has agreed to one.
- An independent review of the kernel (outside party). The brief names seven claims and what would falsify each; no reviewer is engaged, and no audit or certification is claimed anywhere on this site.
Refused#
Each of these was proposed, and each is refused for a reason. Where the refusal is enforced by code, the guard is named; where it is a decision, it says so.
| Proposed | Why it is refused |
|---|---|
| A VDF "timestamp authority" | A verifiable delay function proves that sequential work happened after an input existed; it says nothing about wall-clock time, so on its own it cannot stop backdating. Time integrity comes from the log, the witnesses and sealed-before ordering, all shipped. |
| Quorum verdicts — "divergent only if ≥ t of n pairs disagree" | It lets two colluding legs outvote the one independent leg, which is precisely the related-party typology. "Undetermined unless k legs take part" already exists as each corridor's required roles. Doubt never clears. |
| Cryptographic threshold signatures on legs | MPC-class machinery the rail avoids on purpose. k-of-n independent ES256 co-signatures (mirror-cosign) give the same assurance with a standard anyone can verify. |
| Security badges and certifications Mirror does not hold | No SOC 2, ISO/IEC certificate or third-party audit seal is held, so none is shown. On a site whose argument is proof, a badge without a check behind it would be the cheapest possible contradiction. The conformance suite and the offline verifier are the evidence instead. |
| A "Mirror Practitioner" certification | A credential Mirror issues about itself is a badge with no independent check. Learning material, yes; a certificate, no. |
| A founding-member list before anyone has signed | Nothing is listed that has not been signed. The registry records members when a quorum ratifies them, and not before. The Founding Corridors register works the same way: a place is shown as taken only when a corridor is ratified on the rail, and today all five are open. |
| A fourth verdict, a risk score, a percentile, a traffic light, peer comparison | Structural refusals, enforced — see the cannot list. Three states, and the certificate above checks there is never a fourth. |
| Custody, settlement, a fee on volume | Structural: the billing kernel throws on eight named fees — per verdict, basis points, seats, settlement, filings, conversion discounts, scores and volume bands (mirror-billing REFUSALS) — and no money moves through Mirror. |
| Telemetry in the bander | Structural: the bander seals the network builtins at startup and uses none of them (bander-cbom.test.js). |
| An SDK that fetches corridor tables from a Mirror server | Mirror publishes no prices. A table is ratified by the pair and its provenance pinned into the verdict; a fetched table would make Mirror the source. |
| A "peer median" band table computed from other corridors | The same refusal, one step removed: a table Mirror computes is a price Mirror sets, and a median is a manipulation target. The corridor graph cites WHOLE tables that peer corridors ratified, by hash, above the suppression floor — a pair adopts one or deviates, and Mirror computes none. |
| "Your corridor is above its lane's 90th percentile" | Peer comparison and percentiles are on the cannot-list. The graph publishes a cell's population baseline with its count; a member may compare its own corridor privately, and Mirror will not do it for them. |
| A clear resting only on the stakeholders' agreement | Two parties with a stake in the price stating the same number is agreement, not confirmation. Refused in code (stakeholder_only_clear): the independence gate holds it undetermined until a witness with nothing to gain agrees. |
| A hand-rolled range proof so the verifier can say "band proven" | It would not stop the attack it is aimed at - a liar proves a fake value inside a fake band - and a cryptographic construction the product depends on is commissioned and reviewed, never improvised. The label-to-value link is proven at opening instead; see the stability policy. |
| A "look-alike" model trained on prior cases | A trained model at the operator is a feature store, and a feature store is a leak. |
| Seat pricing, or a free tier that converts to paid | The rail is priced per corridor, per year — see /pricing. The open core (bander source, verifier, conformance vectors) is free for everyone and never converts: a free tier used as a sales funnel would turn the verifier into a sales tool. Both are refused in code (no_seat_fee, no_conversion_discount). |
| A public dashboard of "Mirror stats" | Aggregates become rankings. The macro ledger publishes counts only, behind a k-anonymity gate; nothing ranks one member against another. |
| A mobile app for case handling | The audit trail is weaker on a personal device. The console is the web. |
| Cross-corridor counterparty search | A cross-bank customer search by another name. |
| A corridor-table marketplace Mirror curates or sells | A table carrying numbers that Mirror curates, certifies or sells is a price Mirror stands behind - the same objection as a fetched or computed table, with a fee attached. What ships instead carries no number: templates (the corridor library), the hashes of tables pairs ratified (mirror-public), and a handshake that finds a table both banks already hold (mirror-discovery). |
| Bands weighted by traded volume | Weighting edges by volume needs the volumes, and the volumes are each bank's book. Mirror never holds them, so it can compute no such table. A pair may cut its own edges by any method from its own books (mirror-negotiate), and the rail never sees how. |
| An examiner pack licensed to the examiners | The examiner checks the rail; charging the checker is a conflict of interest. The examiner pack, the offline verifier and supervisor access stay free, for good - see /pricing. |
| An arm's-length price check for transfer pricing | Arm's length needs a market price, and a market price supplied by Mirror is the price oracle refused everywhere on this site. What ships is consistency between a group's own books across its entities (mirror-internal): they agree or they do not, never "fair" or "unfair". |
| Lock-in as a moat | A rail a bank cannot leave is a risk its examiner should weigh against it. Members leave with their records and history (mirror-succession), other operators run the same protocol (mirror-federation), and independent implementations are certified byte-identical (mirror-conformance). Switching cost should come from evidence a bank has built, never from a door that will not open. |
One proposed refusal is corrected rather than adopted: "the operator must never learn the number of corridors, members or throughput." The operator necessarily sees traffic — it receives the legs — and the registry of members and ratified tables is public by design: membership is earned by quorum and published. What the operator never receives is a value, a price, a band or a counterparty's customer. Stating the true line is stronger than stating a stricter one that is not true.
Read alongside the boundary register, which carries the upgrade path for each limit, and the typology map, which says what Mirror catches and what it is blind to.
Three strategy reviews, item by item (October 2026)#
Three reviews arrived together: one on widening the scope and on adoption, one on the core model and its moats, one on product enrichments. Most of what they asked for was already shipped; what was missing is now built or listed under Next; five proposals are refused above. Every item is placed below, in the reviews' own order. New marks what this release added.
Widening the scope, and adoption#
| Proposed | Where it stands |
|---|---|
| Progressive / nested resolution | Shipped: a fine table nested under the coarse one, same salt (mirror-nested), and every table's blind spot certified (mirror-geometry). New: a consent request per shipment (mirror-zoom). A corridor that wants it on every trade ratifies the nested table: standing consent, for every shipment. |
| Independent legs as first-class roles | Shipped: the independence gate holds a clear that rests only on the two banks at undetermined (mirror-independence-gate); customs, tax e-invoice, AIS voyage and assay legs ship as kernels. Connecting the parties is outside party. |
| Quantity, quality and physical legs | Shipped: mirror-dims, mirror-assay, mirror-physical, and join keys for containers (ISO 6346), vessels, air waybills, bills of lading and VINs (mirror-locator). |
| Blind related-party checks | Shipped: private set intersection over ownership identifiers (mirror-related, mirror-psi). |
| Services trades | Shipped: an obligation key and hours × rate (mirror-services). |
| Single-bank use first | Shipped: mirror-internal, and the pilot in a box. New: shadow mode on the bank's own legs. |
| Metadata hardening | Shipped: constant-size padded batches and cover cadence (mirror-batch, mirror-cadence). New: the calendar hash ratchet. Next: a slow KDF and a per-transaction nonce. |
| Exact values, price oracles, scores, filing decisions, ZK or MPC backends | Refused, as the review itself recommends; see the cannot list. |
| A corridor library | Shipped as data. New: the library page. |
| Path certificates, case chains | Shipped: mirror-path, mirror-casechain. Operator-side case logging is next. |
| A self-contained bander and SDKs | Shipped: one binary per platform and five verifying SDKs. Public registries need the maintainer's decision. |
| Pilot in a box, single-player mode | Shipped. |
| An open table standard, ratified by ICC, BAFT or WCO | The standard ships. Ratification by an industry body is outside party. |
| Discovery handshake, shadow mode | New: mirror-discovery, mirror-shadow and the bander's shadow. |
| Templates, charter and ceremony tooling | Shipped. New: the corridor lifecycle and the first-pilot runbook. |
| Founding corridors, free supervisor and researcher access | Shipped: Founding Corridors at half the bilateral rate, fixed for life (not free), and supervisor and academic access free for good. |
| ISO 20022, SWIFT MT700, DCSA eBL | Shipped (mirror-iso20022-ingest, mirror-iso20022, mirror-mt700, mirror-ebl). MT798 is next; a named platform is outside party. |
| Terraform, SIEM export, signed webhooks, HSM/KMS custody, rotation | Shipped. |
| Data residency with machine-checkable proof | Shipped: processing pinned to Cloudflare's EU jurisdiction and signed at /residency. New: an air-gapped operator signs its storage as declared. |
| FATF mapping, validation dossier, offline examiner pack | Shipped (mirror-fatf, mirror-validation, mirror-pack). |
| Transparency log, supervisor seat, canaries | Shipped (mirror-anchor, mirror-supervisor, mirror-seat, mirror-canary). |
| Legal-basis fields, party-to-party disclosure | Shipped (mirror-basis, mirror-disclosure). |
| Start with 314(b)-style pairs and mid-sized banks | A choice of where to look for pilots, not code: outside party. The runbook is written for exactly that pair. |
| Open-source vectors, reference bander, protocol | The vectors, the spec and the bander source are published. An open licence and a public repository need the maintainer's decision. |
| Multi-operator co-signing | Shipped (mirror-cosign, mirror-federation). |
| Pricing that never bills on volume or flags | Shipped and enforced: the billing kernel throws on eight named fees. |
| Two or three real pilots, published results | Outside party. New: the runbook with its measures and stop conditions. |
| An independent audit or formal-methods certificate | Outside party. New: the review brief. The verdict rule is bounded-model-checked; that is not a formal proof, and no page claims one. |
The core model, its products and its moats#
| Proposed | Where it stands |
|---|---|
| A corridor marketplace, shared tables as a service | What carries no number ships: templates, ratified-table hashes (mirror-public) and, new, the discovery handshake. A marketplace of tables Mirror curates or sells is refused. |
| Multi-leg, multi-party verdicts with a witness threshold | Shipped: a corridor names any number of required roles; the gate requires an independent witness, and can require several classes of witness (min_classes, require_classes). A clear on a majority of legs is refused (quorum verdicts): doubt never clears. |
| Time-bound and rolling corridors | New: valid_until, and secrets that roll by day, week or month (mirror-ratchet). Per-shipment secrets need a per-transaction channel (next). Volume-weighted bands are refused. |
| The examiner pack as a product | Shipped, free. Licensing it to the examiners is refused. |
| Subscription or per-corridor pricing; a per-verdict fee | Per-corridor pricing ships. A per-verdict fee is refused in the billing code. |
| A witness network | Shipped: the witness registry, the publisher a terminal runs, relays, equivocation detection and recall. No terminal or lab is connected yet: outside party. Any payment to a witness stays between the parties; no money moves through Mirror. |
| Batch and portfolio certificates | Shipped: a signed digest of a batch (counts and a Merkle root) and a certificate (mirror-digest, mirror-certificate). |
| Provenance-pinned corridor amendments | Shipped: who chose the edges and from what (mirror-provenance), a dated effective time and the corridor book (mirror-book). New: an end date. |
| SIEM and case-management hooks | Shipped: signed webhooks to the proven parties only, and a SIEM export of a member's own records. |
| An offline, air-gapped operator | New: the file journal and a fail-closed boot. A container image and a single-file operator are next. |
| Moats: designed inability, offline verifiability, network effects without pooling, regulatory alignment | Properties already shipped and tested; nothing to add but evidence. |
| Moat: switching cost after the first corridor | Lock-in as a goal is refused. Exit is a feature. |
| Quantity against declared weight | Shipped (mirror-dims, mirror-physical, mirror-bulletin). |
| Dual-source pricing for transfer pricing | An arm's-length price check is refused. Consistency between a group's own books ships (mirror-internal). |
Product enrichments#
| Proposed | Where it stands |
|---|---|
| Progressive zoom, with refusals logged | New: mirror-zoom — a decline or silence is a signed fact. |
| A witness network at scale, multi-witness diversity, relay mode | Shipped in code (above). Onboarding terminals, weighbridges, carriers and labs is outside party. |
| Multi-axis kernels: quantity, value, grade, HS and Incoterms, service hours, cargo-intrinsic locators | Shipped (mirror-dims, mirror-assay, mirror-attribute, mirror-pricebasis, mirror-services, mirror-locator). |
| Concurrent exposure, path certificates, related parties | Shipped (mirror-concurrent-exposure, mirror-path, mirror-related). |
| Production-ready corridor templates | Shipped (the library). New: the page and the lifecycle around it. |
| Table standard, discovery, shadow mode | The standard ships; new: discovery and shadow mode. |
| Versioned, dual-signed ratification pinned into every verdict | Shipped (mirror-registry, mirror-provenance, mirror-book). |
| An industry-ratified template registry | Ratified-table hashes ship (mirror-public). Ratification by an industry body is outside party. |
| Chaff and batch mixing | Shipped (mirror-batch, mirror-cadence). |
| A slow KDF, a per-transaction nonce | Next: one is a protocol version, the other needs the banks' own channel. |
| A hash ratchet | New: mirror-ratchet, turned by the calendar so two banks never fall out of step. |
| A multi-operator quorum | Shipped (mirror-cosign). |
| An ISO 20022 evidence block, SWIFT and platform adapters | Shipped (mirror-iso20022, mirror-mt700, mirror-ebl). Named platforms are outside party. |
| Batch offline verification, a timeline per corridor, ghost corridors, the fact-pattern taxonomy | Shipped (mirror-pack, mirror-book, mirror-coverage, mirror-taxonomy). |
| A webhook and an on-prem bander beside the bank's extract | Shipped. |
| Historical backfill | Shipped: party-side re-banding under a new version, and /replay bounds a period. |
| k-anonymity-gated systemic certificates, continuous public canaries | Shipped (mirror-macro, mirror-kanon, mirror-weather, mirror-canary). Graph statistics stay gated. |
| What to avoid: raw values, scores, invented prices, money, ZK or MPC backends | Agreed, and enforced by the cannot list. |
A competitive review, item by item (October 2026)#
A review set Mirror against a document-AI vendor serving trade-finance banks, and proposed seven moves. Each is placed below. New marks what this release added.
| Proposed | Where it stands |
|---|---|
| Sit on top of document-AI output, so every installation is a way in | New: the bander's docai-import and a vendor-neutral format. Mapping a named vendor's export is the bank's (or the vendor's) work; no integration is claimed. |
| Lead with duplicate financing across lenders | New: the claim command, the SDK methods and the page. The check itself shipped earlier (mirror-concurrent-exposure). |
| A "no model risk" pack | New: the model-risk pack. It does not presume the bank's classification; it supplies the evidence for either answer. |
| One real pilot, with a bank that already uses document AI | Outside party. New: the runbook's path for that bank. |
| Compare against a cited market price as a third record | New: the cited benchmark (mirror-benchmark). Mirror supplies no price; the refusal of a price oracle Mirror runs stands. |
| Connect one independent witness | Outside party. New: the witness kit. |
| Make Mirror's checks callable by AI agents | New: the MCP server (sdk/mirror-mcp.js, agents). |