# The Roadmap

**Shipped, next, and refused — each with its reason.** This page was written against a 28-item strategy
memo (September 2026) and its 12 proposed anti-features, and revisited against three further strategy reviews
(October 2026), mapped item by item [at the end of this page](#three-strategy-reviews-item-by-item-october-2026).
Every item lands in one of three places: **shipped** (named by the kernel that ships it, so the claim can be
opened and read), **next** (a real gap, with what it needs), or **refused** (with the reason, in the same voice
as the [cannot list](/designed-inability.md)). Work that needs someone outside this project — a pilot bank, a
terminal, an auditor — is marked **outside party**, because no amount of code supplies it.

There are no dates on this page. A roadmap with dates is a promise about the future, and this site does not
make claims it cannot test today. What it can say is where each thing stands, and why.

---

## Shipped

| The memo asked for | What exists | Where to read it |
|---|---|---|
| A self-hostable operator, and a way off the rail | **A rail of rails**: many operators, no global one; members can leave with their records and history. Independent implementations are certified byte-identical. | `mirror-federation`, `mirror-succession`, `mirror-conformance`, [conformance vectors](/conformance-vectors.json) |
| Multi-bank chains, and no single operator to trust | Legs are **roles** (invoice, customs, payment, …) and each corridor names the roles it requires. **Many operators co-sign one verdict**; the verifier checks each signature independently. | `mirror-kernel`, `mirror-cosign` |
| A sandbox that breaks the chicken-and-egg | **Single-player mode**: one bank reconciles its own desks and books through the same rail on day one. A seeded synthetic corridor with planted anomalies scores the kernel against ground truth. | `mirror-internal`, `mirror-autopsy`, [pilot in a box](/pilot) |
| Interop with trade-finance messaging | The bander reads the **payment leg straight off an ISO 20022 `pacs.008` / `pain.001`** inside the bank, fail-closed; outbound, the rail's own block refuses to carry an amount. | `mirror-iso20022-ingest`, `mirror-iso20022` |
| A starter kit for the first two banks | A **corridor charter** (corridor N+1 as a countersignature, not a committee), the **setup ceremony**, a **named legal basis** for every shared signal, the corridor-table standard, two sample tables, and a **pilot runbook** with measurable outcomes, a ceremony script and a supervisor memo — drafts for each bank's counsel, never legal advice. **No pilot has run.** | `mirror-charter`, `mirror-ceremony`, `mirror-basis`, [corridor-table standard](/corridor-table-standard.md), [metals](/sample-corridor-metals.json) · [electronics](/sample-corridor-electronics.json), [first two banks](/first-two-banks.md) |
| A timestamp the operator cannot backdate | Not a VDF (see *Refused*): a **Certificate-Transparency-shaped log**, **witness co-signed tree heads**, **sealed-before ordering** between legs, and **gossip** that turns a split view into a provable fork. | `mirror-anchor`, `mirror-witness`, `mirror-order`, `mirror-gossip` |
| A corridor provenance registry | **Who chose these band edges, and from what** — pinned into every verdict; the ratified registry of which tables are law, and the corridor book that makes it permanent. | `mirror-provenance`, `mirror-registry`, `mirror-book` |
| A tipping-off-safe case workflow | **Party-to-party disclosure**: a signed request on a closed basis vocabulary, a signed grant, the material moving bank to bank and never through the operator. Outcomes compound in a **resolution ledger**. | `mirror-disclosure`, `mirror-resolution`, the bander's `casepack` |
| Continuous adversarial checking | **Known-answer canaries** the operator cannot see coming, a published **filing-term corpus** of smuggling attempts, and the conformance vectors. | `mirror-canary`, [filing-term corpus](/sar-smuggles.json) |
| Sanctions / attribute attestation without seeing the party | **Blind attribute reconciliation** — the generalisation of the price primitive — plus event-driven perpetual KYC and **corroboration** when two banks independently flag one entity. | `mirror-attribute`, `mirror-pkyc`, `mirror-corroborate` |
| A formal verification certificate | **The verdict-rule certificate**: reconcile() checked against the band-level three-state rule in every one of **48,384** configurations — **0 counterexamples**. Bounded model checking, not a theorem prover, and it says so. | [verdict certificate](/verdict-certificate.json), `mirror-verdict-rule` |
| A public, append-only log | The operator serves the log head, consistency proofs, witness heads and gossip; a **public transparency registry** and a **read-only supervisor seat**. | `mirror-anchor`, `mirror-public`, `mirror-supervisor` |
| A pricing simulator, and a pricing model that holds the design together | **Three tiers** — a free open core, the bilateral corridor, the multilateral corridor — plus the **Founding Corridors** programme and free supervisor and researcher access. The simulator runs the billing kernel itself, in your browser, against the published rate card, with volume and flag-rate sliders wired to nothing, because neither is ever billed. | [/pricing](/pricing#simulator), [/founding-corridors](/founding-corridors), `mirror-billing` (`estimateMemberFee`) |
| Regulator legibility | Each verdict mapped to **FATF's own words**; a **model-validation dossier**; a supervisor seat that can **test** the rail, not only watch it. | `mirror-fatf`, `mirror-validation`, `mirror-seat`, [for examiners](/for-examiners) |
| Records that outlive the company | **Verification escrow** for the ten-year record, and salt-continuity escrow so old verdicts stay openable. | `mirror-archive`, `mirror-escrow` |
| Legs from outside banking | **The physical leg**: binding money to matter — container, vessel, port, date — and quantity banded separately from price. | `mirror-physical`, `mirror-dims`, `mirror-locator` |
| Related parties, without either bank showing its client list | **Blind related-party detection**: the two banks test whether buyer and seller share an owner by private set intersection over normalised ownership identifiers (LEI, registry number, person) — each learns only whether the sets meet. A clear that rests only on related parties is graded as such. | `mirror-related`, `mirror-independence` |
| Right weight, wrong grade | **The quality leg**: a declared grade banded against an independent assay, and a price-for-grade check that catches an honestly declared grade priced as a better one. | `mirror-assay` |
| Mirror statistics per shipment | **Customs-to-customs**: the export and the import declaration of one consignment, normalised to one valuation basis and currency inside each administration, compared blind on the consignment reference. Built for a regulator sandbox — **no customs administration takes part today.** | `mirror-customs`, `mirror-locator` (`ucr`) |
| The invoice the seller told its tax authority about | **The tax e-invoice leg**: narrow readers for CFDI, NF-e, the Indian IRN and FatturaPA; the registration is the submitter's dated statement, never Mirror's; the registration id joins the duplicate-financing check where a borrower cannot reword it; and the registered invoice is set against the export declaration. **No tax platform is connected today.** | `mirror-einvoice`, `mirror-locator` (`einv`) |
| Where the ship actually went | **The voyage leg**: the declared vessel, port and day compared blind with every port call a licensed AIS track shows, plus dark gaps, ship-to-ship encounters and implausible movement as facts beside the verdict. A weak independent vertex, because the ship broadcasts its own track. **No AIS vendor is connected today.** | `mirror-voyage` |
| Faster corridors for the goods launderers favour | **The corridor library**: published templates for gold, used vehicles, phones, textiles and scrap — dimensions, required and independent legs, join keys, typologies reached, limits — rendered as a page from the same file the validator reads. **No template carries a price.** | [corridor library](/corridor-library), [JSON](/corridor-library.json), `mirror-library` |
| Turning table agreement into a software step | **The discovery handshake**: each bank signs the tables it already supports, named by hash with their granularity; both compute the same finest shared table, or a clean `no_shared_table`. **Shadow mode**: candidate tables run over the bank's own legs through the operator's kernel, inside the bank, submitting nothing — counts per table, each table's blind spot, and how many shipments change answer. | `mirror-discovery`, `mirror-shadow`, the bander's `shadow`, [a corridor's life](/corridor-lifecycle.md) |
| A finer look, by consent | **Progressive zoom**: one bank signs a request to re-read one shipment under a finer ratified, nested table, with a reason from a closed list; the counterparty signs consent or decline; anyone checks the pair offline. A decline, or silence, is a signed fact — not evidence. | `mirror-zoom`, `mirror-nested` |
| Corridors that end, and secrets that move on | **Time-bound corridors**: a proposal may carry `valid_until`; after it the table judges nothing (`table_expired`) and renewal is a new version. **A calendar hash ratchet** gives a file-held corridor secret forward secrecy: both banks derive each day's, week's or month's secret from the last and destroy the old ones, with no message between them. | `mirror-registry`, `mirror-ratchet`, the bander's `ratchet-start` / `ratchet-turn` |
| One FX basis both banks ratify | The pair names a public publisher, a base currency and a rule for which file applies; each bank fetches the file itself, converts exactly on its own machine, and commits the file's pin inside the pricing basis. Different files hold the reading `undetermined`. Mirror fetches, publishes and chooses no rate. | `mirror-fxbasis`, `mirror-pricebasis`, `band --fx-rates` |
| An operator with no outside party | **The air-gapped operator**: durable state in a hash-chained, append-only journal on local disk — fsynced before a write is acknowledged, one writer, a torn tail archived on the record, and a refusal to start on anything else it cannot account for. A store that is configured but unavailable now stops the start instead of falling back to memory. | `server/store-file.js`, [air-gapped operator](/air-gapped-operator.md) |
| A corridor you can show to a third party | **The corridor passport**: one signed, versioned, offline-verifiable file per corridor, append-only, with exit and error as signed versions rather than removals. Its graph baseline reference ships empty until the graph can support one. | `mirror-passport` |
| A map of the rail that cannot leak | **The corridor graph (structure)**: cells by commodity and lane class under a suppression floor — k corridors past a dwell period, banded counts, a published cell frozen until membership moves by k, baselines withheld under dominance. **On today's rail every cell is below the floor, so every release is empty.** | `mirror-graph` |
| A clear two desks cannot mint | **The independence gate**: `reconciled` now requires a party with no stake in the price - a witness key the members ratified under an independent class (customs, terminal, carrier, inspectorate, ...) - to have agreed on an axis it is competent for. Two banks agreeing is `undetermined` (`insufficient_independence`). A bank's operations desk relaying a terminal receipt counts only where the corridor ratified relays, and is recorded as relayed. | `mirror-independence-gate`, the witness registry in `mirror-registry` |
| A physical witness nobody has to ask | **The terminal commitment bulletin**: a terminal publishes what it weighed (RFC 6962, salted by a receipt secret that travels with the papers); banks prove inclusion; the operator compares masses it never sees. Phantom shipments have no entry; short ones diverge on quantity. **No terminal is connected today.** | `mirror-bulletin` |
| Mispricing inside a band | **Nested resolution** (a fine band under the same salt: in-band mispricing is `divergent` on `resolution`), a signed **geometry certificate** for every ratified table ("this corridor can hide at most X per unit"), and **citation corridors** that cite a published figure instead of attaching a table. | `mirror-nested`, `mirror-geometry`, `mirror-citation`, `/corridor/certificate` |
| Tracking a path, not a hop | **The path certificate**: one cargo's hops by opaque locator, in counts - states, declared free-zone hops, hops without an independent or customs anchor, drift across hops - each proven into the log, released above a k gate; plus a weekly **ghost-coverage certificate**. And **services** get their own key and a certifier witness. | `mirror-path`, `mirror-services`, `/path/certificate`, `/coverage/ghost` |
| A label bound to its value | **Label integrity**: every record states exactly what it asserts - that the committed labels agree, not that a label is the band of its true value. A label can be bound to the document the bank's trade system signed at booking, so a false label is a certain, attributable finding at the first opening; pricing bases are committed and compared; a corridor can ratify its bander builds. Signatures are low-S (no malleated twins). | `mirror-assertion`, `mirror-origin`, `mirror-pricebasis`, [the math triage](/stability-policy.md) |
| A contract, not a page | **The refusal list as an interface** ([/cannot.json](/cannot.json), signed at `/cannot`, change-controlled by test), a versioned **signal taxonomy** ([/signals.json](/signals.json)), a **stability policy** ([/stability-policy.md](/stability-policy.md)) and a **software bill of materials** ([/sbom.cdx.json](/sbom.cdx.json)). | `mirror-cannot`, `mirror-signals` |
| "Did you tip off the counterparty?" | **The case chain**: what happened to a verdict inside the case system — opened, viewed (field classes only), annotated (a hash), forwarded (a count), closed — signed by each officer's key, hash-linked, verifiable offline, with an entitlement an auditor can check views against. Evidence of custody, not absolution. | `mirror-casechain` |
| A witness a terminal can actually run | **The witness publisher** a terminal or weighbridge runs (weigh, publish a signed bulletin that must extend its last one, verify), **relay tooling** for a bank's ops desk on a ratified corridor, **two kinds of witness** where a corridor requires them (gold: a terminal's weight AND an assayer's grade - right weight, wrong metal diverges on `quality`), **equivocation detection** for a witness that signs two histories, and **recall**: when a witness is suspended for cause, each bank gets a signed notice of the clears that rested on it. | `witness/mirror-witness.js`, `mirror-recall`, `mirror-bulletin`, `/recall/notice`, `/witness/forks` |
| Keys a CISO will sign off | **Corridor secrets and signing keys in the bank's HSM or KMS** (the bank's own tool, no shell, KCV-checked), a **rehearsed rotation** by corridor version with an honest rollback window, and **scoped desk keys** delegated by the member root - per-desk permissions with no staff directory at the operator. | `mirror-custody`, `mirror-rotation`, `mirror-delegation`, [custody](/custody.md), [rotation](/corridor-key-rotation.md), [access control](/access-control.md) |
| Event-driven, not batch | **Signed webhooks** to the proven parties only, at least once with a stable dedupe id, a stated retry schedule and SSRF-safe delivery; recall notices pushed at quorum; a **signed, nonce-bound clock** members use to bound the operator's offset. | `mirror-webhook`, `mirror-clock`, [webhooks](/webhooks.md), [clock discipline](/clock-discipline.md) |
| Plumbing a platform team expects | **OpenAPI 3.1** generated and drift-tested with the raw-data wall in the schema; **verifying SDKs in JavaScript, Python, Go, Java and .NET**, held to one set of shared vectors; a **SIEM export** of a member's own signed records; a **Terraform module** validated with a real `terraform`, and a **compiled provider** with drift detection and import; **migration tooling** (`import-check`, `--mapping`, `table-import`); an **origination sidecar** for the trade platform; a **production-parity sandbox**. | [OpenAPI](/openapi.json), [SDK](/sdk.md), [SDK vectors](/sdk-vectors.json), [Terraform](/terraform.md), [sandbox](/sandbox.md) |
| Fields a document-AI tool already extracted | **The document-AI on-ramp**: a vendor-neutral export and the bank's own mapping become the legs the bander reads, behind a confidence gate the bank sets - one declared number format, conflicting documents held and never summed, every document counted in exactly one bucket. Mirror reads no document, and no vendor integration is claimed. | `mirror-docai`, the bander's `docai-import`, [document AI](/document-ai.md) |
| Duplicate financing a lender can use | The concurrent-exposure check now has a **claim command** (the financed document and its aliases committed under the consortium key, signed with its window), **SDK methods** that verify every collision record, and a page with an honest comparison to the established registry. **No lender uses it today.** | `mirror-concurrent-exposure`, the bander's `exposure-claim`, `exposure.*` in the SDK, [duplicate financing](/double-financing.md) |
| A model-risk pack | The evidence a validator asks for, each with the command that reproduces it: the parameter inventory (zero learned), determinism, the enumerated decision table, the verdict-rule certificate, provenance, the suite pin, the vectors, planted anomalies, and monitoring by table drift and end dates. Classifying Mirror stays the bank's decision. | `mirror-validation`, `/dossier`, [model-risk pack](/model-risk.md) |
| A price check without a price authority | **The cited benchmark**: one bank cites a public market figure, bands it under the shipment's salt within an agreed market window, and the corridor requires the role `benchmark`; two documents over-invoiced by the same amount diverge against it. Mirror never sees, fetches or chooses the figure, a benchmark can only make a reading stricter, and it is not the arm's-length check refused below. | `mirror-benchmark`, the bander's `benchmark-leg`, [a corridor's life](/corridor-lifecycle.md) |
| Mirror's checks for AI agents | **An MCP server** over standard input and output wrapping the verifying client: ten tools, every signed answer verified before the agent sees it, raw data refused before a request, no key held, and no tool that bands, scores or files. | `sdk/mirror-mcp.js`, [agents](/ai-agents.md) |
| A kit for the witness the gate waits for | The publisher a terminal runs, how the banks ratify it, what a witness never sees, relays for the cold start and the separate log-witness role, on one page. **No witness is connected.** | `witness/mirror-witness.js`, [become a witness](/become-a-witness.md) |
| Adapters for trade-finance messages | **Reference connectors for the messages trade platforms exchange**: the SWIFT MT700 / MT710 / MT720 documentary credit becomes a `credit` leg, and a DCSA eBL 3.0 bill of lading becomes a cargo key and a shipper-declared mass per container. Both are fail-closed on anything ambiguous. **No named platform is connected.** | `mirror-mt700`, `mirror-ebl`, `connectors/mirror-connect.js`, [connectors](/connectors.md) |
| A diligence file, not a sales deck | **Signed release provenance** (in-toto + SLSA v1, DSSE; SLSA Build L1), checked by rebuilding with **one reproduction command**; **EU data residency**, with processing pinned to Cloudflare's EU jurisdiction and signed at `/residency`; a **tested recovery drill** with measured restore times; a **degradation runbook** tested row by row; a normative **canonical-forms spec** reproduced by an independent implementation; the **roadmap's refusals signed and binding**; and the procurement documents, each saying what it does not cover. | [due diligence](/due-diligence.md), [provenance](/provenance.md), [data residency](/data-residency.md), [RTO / RPO](/rto-rpo.md), `/roadmap` |

## Next

Real gaps. Each one is buildable without breaking a property on this site, and none has a date.

- **An open licence and a container image for the operator.** A `docker run` beside the conformance suite, so a bank can run the operator on its own metal. Needs the maintainer's licence decision first, and an image build that reproduces byte for byte.
- **A public source repository with protected history.** Every release can already be rebuilt and compared with its signed provenance by one command (`node server/reproduce.js`; results per release in [provenance](/provenance.md)). Fetching the tree from a public repository needs the maintainer's decision.
- **An MT798 adapter.** MT798 is the corporate-to-bank envelope around trade messages. Build it like the MT700 reader: spec-exact fixtures first, fail-closed on anything ambiguous, one leg per message.
- **An inclusion-proof explorer.** A page that checks a verdict's inclusion in the log in the browser, offline — what [Verify](/#verify) already does for signatures. It needs an operator route that returns one verdict's inclusion proof against a signed head; today inclusion proofs come back only inside `/anchor/order`.
- **A counterfactual replay across tables.** "Would a tighter table have flagged this?" means re-banding raw values, which only the banks hold — so it runs as a two-bank re-commitment under a candidate table, never at the operator. Shadow mode now answers the in-house half (the bank's own legs under each candidate table), and `mirror-geometry` the widest mispricing a table can hide.
- **Bander commands for discovery offers and zoom requests.** Both are signed records built by their kernels today, called from Node; a bank should be able to sign and check them with the one binary it already runs.
- **A slow, table-specified key derivation.** A ratified PBKDF2 cost on the salt makes a key-holding counterparty's enumeration expensive. It changes the salt every implementation must reproduce, so it ships as a protocol version with new conformance vectors in all five SDKs, never as a patch.
- **A per-transaction random nonce** in place of the reference-derived salt, exchanged over the two banks' own authenticated channel. It ends enumeration, at the cost of a message per trade; Mirror runs no bank-to-bank channel, so it needs one the pair already has.
- **A compacting snapshot and a single-file operator.** The air-gapped journal grows with every write and is replayed at start; a signed snapshot that starts a fresh journal, and an operator built as one executable like the bander, are both unbuilt.
- **Versioned open datasets** — the corpus, the vectors and the typology map, each with a version, a hash, a licence and a citation file.
- **A live fuzz dashboard** fed by the canary and corpus runs.
- **Operator routes for the new readings.** Customs-to-customs, the e-invoice leg, grade, voyage and related-party records run today as kernels, party-side and in the console; operator routes need a governed-corridor lookup first, so that no corridor table ever travels to the operator inside a request.
- **Bander commands for the remaining legs** — customs declarations, e-invoices and AIS tracks — so each is read and committed on the machine that holds it. Fine commitments, pricing bases, declared mass and grade, bulletin anchors, relayed measurements and services legs have their verbs now.
- **A named trade platform, connected.** The origination sidecar signs at booking under the platform's own HSM; connecting a specific platform's booking event to it is per-platform work with that platform's owner.
- **Terminal partners for the commitment bulletin** (outside party). The format, the publisher and the verification ship, with [a kit for the witness](/become-a-witness.md); no terminal publishes a bulletin yet, so the live rail still clears nothing.
- **A ratified market window for the benchmark.** Today the pair agrees the benchmark's window, and the record shows it only through the leg's commitment count. A corridor field the operator enforces - a benchmark wider than ratified holds the reading - needs a registry change, ratified like the edges.
- **A hosted MCP endpoint.** The agent server runs beside the agent, over standard input and output. A hosted one needs an authorisation design that keeps every credential out of an agent's conversation.
- **A zero-knowledge proof that a hidden label is the band of a signed hidden value** - the [commission brief](/commission-zk.md) is published; no cryptographer is engaged yet. Until then the link is proven at opening, against the booked document.
- **Case-chain logging at the operator**, and the case-system integrations that write the events. The chain is only as complete as the system that writes it.
- **Graph statistics** — gated: nothing publishes until enough cells clear the suppression floor, and not before an independent adversarial audit of the construction. The passport's baseline reference waits on the same gate.
- **Regulator sandboxes and data partners** for the customs, tax and AIS legs — the kernels are ready; the parties are not yet connected.
- **SDK packages in public registries** (PyPI, Maven Central, NuGet, the Go module proxy), and the **Terraform provider on the Terraform Registry**. Both ship as source today and are tested. Publishing needs the maintainer's decision on names, and the release signing keys.
- **Two pilot banks** (outside party). The [runbook](/first-two-banks.md) says what a pilot would measure and how it would stop, including the shorter path for a bank that already runs document AI; no bank has agreed to one.
- **An independent review of the kernel** (outside party). The [brief](/commission-review.md) names seven claims and what would falsify each; no reviewer is engaged, and no audit or certification is claimed anywhere on this site.

## Refused

Each of these was proposed, and each is refused for a reason. Where the refusal is enforced by code, the
guard is named; where it is a decision, it says so.

| Proposed | Why it is refused |
|---|---|
| A VDF "timestamp authority" | A verifiable delay function proves that sequential work happened *after* an input existed; it says nothing about wall-clock time, so on its own it cannot stop backdating. Time integrity comes from the log, the witnesses and sealed-before ordering, all shipped. |
| Quorum verdicts — "divergent only if ≥ t of n pairs disagree" | It lets two colluding legs outvote the one independent leg, which is precisely the related-party typology. "Undetermined unless k legs take part" already exists as each corridor's required roles. Doubt never clears. |
| Cryptographic threshold signatures on legs | MPC-class machinery the rail avoids on purpose. k-of-n *independent* ES256 co-signatures (`mirror-cosign`) give the same assurance with a standard anyone can verify. |
| Security badges and certifications Mirror does not hold | No SOC 2, ISO/IEC certificate or third-party audit seal is held, so none is shown. On a site whose argument is proof, a badge without a check behind it would be the cheapest possible contradiction. The conformance suite and the offline verifier are the evidence instead. |
| A "Mirror Practitioner" certification | A credential Mirror issues about itself is a badge with no independent check. Learning material, yes; a certificate, no. |
| A founding-member list before anyone has signed | Nothing is listed that has not been signed. The registry records members when a quorum ratifies them, and not before. The [Founding Corridors](/founding-corridors) register works the same way: a place is shown as taken only when a corridor is ratified on the rail, and today all five are open. |
| A fourth verdict, a risk score, a percentile, a traffic light, peer comparison | Structural refusals, enforced — see the [cannot list](/designed-inability.md). Three states, and the certificate above checks there is never a fourth. |
| Custody, settlement, a fee on volume | Structural: the billing kernel throws on eight named fees — per verdict, basis points, seats, settlement, filings, conversion discounts, scores and volume bands (`mirror-billing` `REFUSALS`) — and no money moves through Mirror. |
| Telemetry in the bander | Structural: the bander seals the network builtins at startup and uses none of them (`bander-cbom.test.js`). |
| An SDK that fetches corridor tables from a Mirror server | Mirror publishes no prices. A table is ratified by the pair and its provenance pinned into the verdict; a fetched table would make Mirror the source. |
| A "peer median" band table computed from other corridors | The same refusal, one step removed: a table Mirror computes is a price Mirror sets, and a median is a manipulation target. The corridor graph cites WHOLE tables that peer corridors ratified, by hash, above the suppression floor — a pair adopts one or deviates, and Mirror computes none. |
| "Your corridor is above its lane's 90th percentile" | Peer comparison and percentiles are on the cannot-list. The graph publishes a cell's population baseline with its count; a member may compare its own corridor privately, and Mirror will not do it for them. |
| A clear resting only on the stakeholders' agreement | Two parties with a stake in the price stating the same number is agreement, not confirmation. Refused in code (`stakeholder_only_clear`): the independence gate holds it `undetermined` until a witness with nothing to gain agrees. |
| A hand-rolled range proof so the verifier can say "band proven" | It would not stop the attack it is aimed at - a liar proves a fake value inside a fake band - and a cryptographic construction the product depends on is commissioned and reviewed, never improvised. The label-to-value link is proven at opening instead; see [the stability policy](/stability-policy.md). |
| A "look-alike" model trained on prior cases | A trained model at the operator is a feature store, and a feature store is a leak. |
| Seat pricing, or a free tier that converts to paid | The rail is priced per corridor, per year — see [/pricing](/pricing). The open core (bander source, verifier, conformance vectors) is free for everyone and never converts: a free tier used as a sales funnel would turn the verifier into a sales tool. Both are refused in code (`no_seat_fee`, `no_conversion_discount`). |
| A public dashboard of "Mirror stats" | Aggregates become rankings. The macro ledger publishes counts only, behind a k-anonymity gate; nothing ranks one member against another. |
| A mobile app for case handling | The audit trail is weaker on a personal device. The console is the web. |
| Cross-corridor counterparty search | A cross-bank customer search by another name. |
| A corridor-table marketplace Mirror curates or sells | A table carrying numbers that Mirror curates, certifies or sells is a price Mirror stands behind - the same objection as a fetched or computed table, with a fee attached. What ships instead carries no number: templates (the corridor library), the hashes of tables pairs ratified (`mirror-public`), and a handshake that finds a table both banks already hold (`mirror-discovery`). |
| Bands weighted by traded volume | Weighting edges by volume needs the volumes, and the volumes are each bank's book. Mirror never holds them, so it can compute no such table. A pair may cut its own edges by any method from its own books (`mirror-negotiate`), and the rail never sees how. |
| An examiner pack licensed to the examiners | The examiner checks the rail; charging the checker is a conflict of interest. The examiner pack, the offline verifier and supervisor access stay free, for good - see [/pricing](/pricing). |
| An arm's-length price check for transfer pricing | Arm's length needs a market price, and a market price supplied by Mirror is the price oracle refused everywhere on this site. What ships is consistency between a group's own books across its entities (`mirror-internal`): they agree or they do not, never "fair" or "unfair". |
| Lock-in as a moat | A rail a bank cannot leave is a risk its examiner should weigh against it. Members leave with their records and history (`mirror-succession`), other operators run the same protocol (`mirror-federation`), and independent implementations are certified byte-identical (`mirror-conformance`). Switching cost should come from evidence a bank has built, never from a door that will not open. |

One proposed refusal is corrected rather than adopted: *"the operator must never learn the number of
corridors, members or throughput."* The operator necessarily sees traffic — it receives the legs — and the
registry of members and ratified tables is **public by design**: membership is earned by quorum and
published. What the operator never receives is a value, a price, a band or a counterparty's customer.
Stating the true line is stronger than stating a stricter one that is not true.

*Read alongside the [boundary register](/boundary-register.md), which carries the upgrade path for each
limit, and the [typology map](/typologies.md), which says what Mirror catches and what it is blind to.*

## Three strategy reviews, item by item (October 2026)

Three reviews arrived together: one on widening the scope and on adoption, one on the core model and its
moats, one on product enrichments. Most of what they asked for was already shipped; what was missing is
now built or listed under *Next*; five proposals are refused above. Every item is placed below, in the
reviews' own order. **New** marks what this release added.

### Widening the scope, and adoption

| Proposed | Where it stands |
|---|---|
| Progressive / nested resolution | Shipped: a fine table nested under the coarse one, same salt (`mirror-nested`), and every table's blind spot certified (`mirror-geometry`). **New:** a consent request per shipment (`mirror-zoom`). A corridor that wants it on every trade ratifies the nested table: standing consent, for every shipment. |
| Independent legs as first-class roles | Shipped: the independence gate holds a clear that rests only on the two banks at `undetermined` (`mirror-independence-gate`); customs, tax e-invoice, AIS voyage and assay legs ship as kernels. Connecting the parties is outside party. |
| Quantity, quality and physical legs | Shipped: `mirror-dims`, `mirror-assay`, `mirror-physical`, and join keys for containers (ISO 6346), vessels, air waybills, bills of lading and VINs (`mirror-locator`). |
| Blind related-party checks | Shipped: private set intersection over ownership identifiers (`mirror-related`, `mirror-psi`). |
| Services trades | Shipped: an obligation key and hours × rate (`mirror-services`). |
| Single-bank use first | Shipped: `mirror-internal`, and the [pilot in a box](/pilot). **New:** shadow mode on the bank's own legs. |
| Metadata hardening | Shipped: constant-size padded batches and cover cadence (`mirror-batch`, `mirror-cadence`). **New:** the calendar hash ratchet. Next: a slow KDF and a per-transaction nonce. |
| Exact values, price oracles, scores, filing decisions, ZK or MPC backends | Refused, as the review itself recommends; see the [cannot list](/designed-inability.md). |
| A corridor library | Shipped as data. **New:** [the library page](/corridor-library). |
| Path certificates, case chains | Shipped: `mirror-path`, `mirror-casechain`. Operator-side case logging is next. |
| A self-contained bander and SDKs | Shipped: one binary per platform and five verifying SDKs. Public registries need the maintainer's decision. |
| Pilot in a box, single-player mode | Shipped. |
| An open table standard, ratified by ICC, BAFT or WCO | The standard ships. Ratification by an industry body is outside party. |
| Discovery handshake, shadow mode | **New:** `mirror-discovery`, `mirror-shadow` and the bander's `shadow`. |
| Templates, charter and ceremony tooling | Shipped. **New:** the [corridor lifecycle](/corridor-lifecycle.md) and the [first-pilot runbook](/first-two-banks.md). |
| Founding corridors, free supervisor and researcher access | Shipped: [Founding Corridors](/founding-corridors) at half the bilateral rate, fixed for life (not free), and supervisor and academic access free for good. |
| ISO 20022, SWIFT MT700, DCSA eBL | Shipped (`mirror-iso20022-ingest`, `mirror-iso20022`, `mirror-mt700`, `mirror-ebl`). MT798 is next; a named platform is outside party. |
| Terraform, SIEM export, signed webhooks, HSM/KMS custody, rotation | Shipped. |
| Data residency with machine-checkable proof | Shipped: processing pinned to Cloudflare's EU jurisdiction and signed at `/residency`. **New:** an air-gapped operator signs its storage as declared. |
| FATF mapping, validation dossier, offline examiner pack | Shipped (`mirror-fatf`, `mirror-validation`, `mirror-pack`). |
| Transparency log, supervisor seat, canaries | Shipped (`mirror-anchor`, `mirror-supervisor`, `mirror-seat`, `mirror-canary`). |
| Legal-basis fields, party-to-party disclosure | Shipped (`mirror-basis`, `mirror-disclosure`). |
| Start with 314(b)-style pairs and mid-sized banks | A choice of where to look for pilots, not code: outside party. The runbook is written for exactly that pair. |
| Open-source vectors, reference bander, protocol | The vectors, the spec and the bander source are published. An open licence and a public repository need the maintainer's decision. |
| Multi-operator co-signing | Shipped (`mirror-cosign`, `mirror-federation`). |
| Pricing that never bills on volume or flags | Shipped and enforced: the billing kernel throws on eight named fees. |
| Two or three real pilots, published results | Outside party. **New:** the runbook with its measures and stop conditions. |
| An independent audit or formal-methods certificate | Outside party. **New:** the [review brief](/commission-review.md). The verdict rule is bounded-model-checked; that is not a formal proof, and no page claims one. |

### The core model, its products and its moats

| Proposed | Where it stands |
|---|---|
| A corridor marketplace, shared tables as a service | What carries no number ships: templates, ratified-table hashes (`mirror-public`) and, **new**, the discovery handshake. A marketplace of tables Mirror curates or sells is refused. |
| Multi-leg, multi-party verdicts with a witness threshold | Shipped: a corridor names any number of required roles; the gate requires an independent witness, and can require several classes of witness (`min_classes`, `require_classes`). A clear on a *majority* of legs is refused (quorum verdicts): doubt never clears. |
| Time-bound and rolling corridors | **New:** `valid_until`, and secrets that roll by day, week or month (`mirror-ratchet`). Per-shipment secrets need a per-transaction channel (next). Volume-weighted bands are refused. |
| The examiner pack as a product | Shipped, free. Licensing it to the examiners is refused. |
| Subscription or per-corridor pricing; a per-verdict fee | Per-corridor pricing ships. A per-verdict fee is refused in the billing code. |
| A witness network | Shipped: the witness registry, the publisher a terminal runs, relays, equivocation detection and recall. No terminal or lab is connected yet: outside party. Any payment to a witness stays between the parties; no money moves through Mirror. |
| Batch and portfolio certificates | Shipped: a signed digest of a batch (counts and a Merkle root) and a certificate (`mirror-digest`, `mirror-certificate`). |
| Provenance-pinned corridor amendments | Shipped: who chose the edges and from what (`mirror-provenance`), a dated effective time and the corridor book (`mirror-book`). **New:** an end date. |
| SIEM and case-management hooks | Shipped: signed webhooks to the proven parties only, and a SIEM export of a member's own records. |
| An offline, air-gapped operator | **New:** the file journal and a fail-closed boot. A container image and a single-file operator are next. |
| Moats: designed inability, offline verifiability, network effects without pooling, regulatory alignment | Properties already shipped and tested; nothing to add but evidence. |
| Moat: switching cost after the first corridor | Lock-in as a goal is refused. Exit is a feature. |
| Quantity against declared weight | Shipped (`mirror-dims`, `mirror-physical`, `mirror-bulletin`). |
| Dual-source pricing for transfer pricing | An arm's-length price check is refused. Consistency between a group's own books ships (`mirror-internal`). |

### Product enrichments

| Proposed | Where it stands |
|---|---|
| Progressive zoom, with refusals logged | **New:** `mirror-zoom` — a decline or silence is a signed fact. |
| A witness network at scale, multi-witness diversity, relay mode | Shipped in code (above). Onboarding terminals, weighbridges, carriers and labs is outside party. |
| Multi-axis kernels: quantity, value, grade, HS and Incoterms, service hours, cargo-intrinsic locators | Shipped (`mirror-dims`, `mirror-assay`, `mirror-attribute`, `mirror-pricebasis`, `mirror-services`, `mirror-locator`). |
| Concurrent exposure, path certificates, related parties | Shipped (`mirror-concurrent-exposure`, `mirror-path`, `mirror-related`). |
| Production-ready corridor templates | Shipped (the library). **New:** the page and the lifecycle around it. |
| Table standard, discovery, shadow mode | The standard ships; **new:** discovery and shadow mode. |
| Versioned, dual-signed ratification pinned into every verdict | Shipped (`mirror-registry`, `mirror-provenance`, `mirror-book`). |
| An industry-ratified template registry | Ratified-table hashes ship (`mirror-public`). Ratification by an industry body is outside party. |
| Chaff and batch mixing | Shipped (`mirror-batch`, `mirror-cadence`). |
| A slow KDF, a per-transaction nonce | Next: one is a protocol version, the other needs the banks' own channel. |
| A hash ratchet | **New:** `mirror-ratchet`, turned by the calendar so two banks never fall out of step. |
| A multi-operator quorum | Shipped (`mirror-cosign`). |
| An ISO 20022 evidence block, SWIFT and platform adapters | Shipped (`mirror-iso20022`, `mirror-mt700`, `mirror-ebl`). Named platforms are outside party. |
| Batch offline verification, a timeline per corridor, ghost corridors, the fact-pattern taxonomy | Shipped (`mirror-pack`, `mirror-book`, `mirror-coverage`, `mirror-taxonomy`). |
| A webhook and an on-prem bander beside the bank's extract | Shipped. |
| Historical backfill | Shipped: party-side re-banding under a new version, and `/replay` bounds a period. |
| k-anonymity-gated systemic certificates, continuous public canaries | Shipped (`mirror-macro`, `mirror-kanon`, `mirror-weather`, `mirror-canary`). Graph statistics stay gated. |
| What to avoid: raw values, scores, invented prices, money, ZK or MPC backends | Agreed, and enforced by the [cannot list](/designed-inability.md). |

## A competitive review, item by item (October 2026)

A review set Mirror against a document-AI vendor serving trade-finance banks, and proposed seven moves. Each is placed below. **New** marks what this release added.

| Proposed | Where it stands |
|---|---|
| Sit on top of document-AI output, so every installation is a way in | **New:** the bander's `docai-import` and a [vendor-neutral format](/document-ai.md). Mapping a named vendor's export is the bank's (or the vendor's) work; no integration is claimed. |
| Lead with duplicate financing across lenders | **New:** the claim command, the SDK methods and [the page](/double-financing.md). The check itself shipped earlier (`mirror-concurrent-exposure`). |
| A "no model risk" pack | **New:** the [model-risk pack](/model-risk.md). It does not presume the bank's classification; it supplies the evidence for either answer. |
| One real pilot, with a bank that already uses document AI | Outside party. **New:** the [runbook's path for that bank](/first-two-banks.md#if-your-bank-already-runs-document-ai). |
| Compare against a cited market price as a third record | **New:** the cited benchmark (`mirror-benchmark`). Mirror supplies no price; the refusal of a price oracle Mirror runs stands. |
| Connect one independent witness | Outside party. **New:** [the witness kit](/become-a-witness.md). |
| Make Mirror's checks callable by AI agents | **New:** the MCP server (`sdk/mirror-mcp.js`, [agents](/ai-agents.md)). |