# The Typology Map

**Which trade-based money-laundering typologies Mirror addresses, by what mechanism, and — stated with
the same weight — which it is blind to.** A tool that claims to catch everything catches nobody's trust.
This page maps the FATF-named TBML typologies to the specific kernel that speaks to each, and marks each
one **addressed**, **partial** (works only when a specific leg participates), or **blind** (a structural
limit, not a roadmap gap).

Read it as the detection companion to the [cannot list](/designed-inability.md) (what Mirror refuses to
*do*) and the [boundary register](/boundary-register.md) (the honest upgrade path for each limit).

## The measured proof, first

`mirror-autopsy` builds a deterministic synthetic corridor, plants anomalies at known positions —
**including ones a band table structurally cannot express** — runs the real kernel over it, and scores
against ground truth. It is built to make Mirror look *honest*, not good. A representative run (seed 42,
the one-dimensional price kernel, 200 shipments):

| | |
|---|---|
| Anomalies planted | **38** |
| Expressible under this table | 18 · **structurally invisible** 20 |
| Caught | **18 of 18 expressible (100%)** |
| Missed | 20 — **all** structurally invisible (planted on purpose) |
| Missed but *should* have been caught | **0** |
| False positives | **0** |

So the honest headline is not "detects TBML." It is: **of the mispricing a ratified table can express,
this run caught all of it with zero false positives; of the mispricing that hides inside a band or a
matched-factor move, it caught none — and says so on the scorecard.** Cut a tighter table and the
expressible fraction rises; `mirror-geometry` tells you by how much before you ratify it.

## The map

### Addressed — the cross-institution price signal is the core

| Typology | Mechanism | Kernel |
|---|---|---|
| **Over-invoicing** (declare $300/unit, worth $100 — value out) | the invoice, customs and payment legs band price-per-unit against one agreed table; a multi-band gap between them is `divergent`. Where both customs administrations take part, the export and the import declaration of one consignment are compared directly — mirror statistics per shipment — and a tax-registered e-invoice can be set against the export declaration | `mirror-kernel`, `mirror-customs`, `mirror-einvoice` |
| **Under-invoicing** (value in) | identical, opposite direction; the two-dimension kernel also names it *unit-price divergence* | `mirror-kernel`, `mirror-dims`, `mirror-customs` |
| **Multiple invoicing** (one shipment financed at two banks) | both lenders band a *cargo-intrinsic* key (ISO 6346 container / IMO vessel + port + date, a VIN, a bar serial) or the invoice's **tax-platform registration id** — which the borrower cannot reword between lenders — under a consortium-wide key; the operator flags the collision **while staying blind to who, what, and how much** | `mirror-concurrent-exposure`, `mirror-locator`, `mirror-einvoice` |

### Partial — works when the leg that sees it takes part

| Typology | Mechanism | Kernel | Depends on |
|---|---|---|---|
| **Phantom / short shipment** (invoice 1,000 t, ship 100 t) | a terminal publishes a **commitment bulletin** of what it weighed at gate-in (RFC 6962, salted by a receipt secret that travels with the papers); the banks prove inclusion and the operator compares the weighed band with every declared mass - a short shipment is `divergent` on quantity, and a phantom has no entry at all, so the **independence gate** holds the reading `undetermined` however well the banks agree. Quantity is also banded apart from price, and the voyage against the AIS track | `mirror-bulletin`, `mirror-independence-gate`, `mirror-dims`, `mirror-voyage` | a terminal (or weighbridge, carrier) ratified as a witness - or, at cold start, a bank's operations desk relaying the terminal receipt on a corridor that accepts relays |
| **Misdeclared goods / substitution** | HS-heading equality and control-list membership are compared as commitments; a disagreement on *what it is* diverges. Grade is banded too: a declared grade an independent assay did not measure diverges, and so does an honestly declared grade priced as a better one. For gold and other high-value goods a corridor can **require two kinds of witness** - a terminal's weight AND an assayer's grade - so right weight, wrong metal diverges on `quality`, and weight alone is `undetermined` (`insufficient_anchor_diversity`) | `mirror-attribute`, `mirror-assay`, `mirror-bulletin` (quality axis), `mirror-independence-gate` | two legs that independently state the classification, or an independent inspection or assay leg - for a two-witness corridor, both a terminal and an assayer ratified as witnesses |
| **Carousel / round-tripping** | closed cycles in an opaque flow graph | `mirror-cycle` | enough distinct members to clear the k-anonymity gate (this leg leaks graph shape, and says so) |
| **Free-zone re-invoicing / transit manipulation** | one **path certificate** per cargo (by opaque locator): hops, declared free-zone hops, hops without an independent or customs-class anchor, and the accumulated drift across hops that each pass pairwise - counts only, every hop proven into the verdict log, released above a k gate | `mirror-path`, `mirror-chain` | the intermediary hops being on the rail, and k institutions behind the path |
| **Structuring / velocity games** | divergence rate and velocity per corridor, counts only, k-anon gated; a weekly **ghost-coverage certificate** counts the cargo keys in each corridor that never had a customs-class anchor | `mirror-macro`, `mirror-path` | enough traffic to pass the minimum-sample gate |
| **Related-party mispricing** | the two traders' banks test, blind, whether buyer and seller share an owner (a private set intersection over normalised ownership identifiers — neither sees the other's list); a clear resting only on related parties is graded as such. It still catches mispricing only if an *independent* leg disagrees | `mirror-related`, `mirror-independence` | both banks holding ownership data, and a genuinely independent third leg |

### Blind — structural limits, stated as plainly as the wins

| Typology | Why Mirror cannot see it | What is honest about it |
|---|---|---|
| **Collusion** (every party states the *same* lie) | Mirror compares the parties to *each other*; a consistent lie among parties with a stake in the price still agrees. What changed: agreement is no longer a clear. The **independence gate** withholds `reconciled` unless a ratified witness with nothing to gain (customs, a terminal, a carrier) agreed on an axis it is competent for - so two desks can no longer mint a clear. A lie on an axis no witness covers (the price, on a real shipment with a terminal anchor) still agrees, and the record says which axes rested on stakeholders alone | `mirror-independence-gate` refuses stakeholder-only clears; `mirror-independence` measures exposure; a label is bound to the bank's booked document by `mirror-origin`, so a false label is a certain finding at the first opening |
| **In-band mispricing** (a move that stays inside one band) | a single table cannot be both private and precise; $101 and $149 share a 100–150 band. **Nested resolution** commits a second, fine band under the same salt: coarse agreement with fine disagreement is `divergent` on axis `resolution`. What still hides: a move inside one fine window | `mirror-nested`; every ratified table carries a signed **geometry certificate** of the widest mispricing it still clears (`mirror-geometry`), and a corridor can ratify a **citation** of a published figure instead of a table (`mirror-citation`) |
| **Off-rail / unratified / non-member leg** | a leg that is not submitted cannot be compared; the verdict is `undetermined`, never a false clear | `mirror-macro` surfaces *ghost corridors* — a required leg systematically absent — which no single member can see |
| **Services-trade mispricing** | a service has no container to weigh. It gets its own key instead - derived from the signed statement of work - and hours and rate are banded as two dimensions against the parties' own rate card. Fictitious services between agreeing parties still stop at the independence gate unless a ratified **certifier** confirms the hours | `mirror-services`: a rate card is the parties' own - a match says nothing about whether it is at market, and a certifier confirms hours, never the value of the work |

## What this map is not

It is not a risk score, and it is not a claim that a `reconciled` means a trade is honest — only that the
legs that took part agree, under a table someone ratified, within a window someone set. Every verdict
carries that sentence in its own disclaimer field, so an examiner reading one never has to rediscover the
boundary. The strongest true claim Mirror makes is narrow on purpose: **it turns cross-institution
mispricing from something no single bank can see into a signed, offline-checkable verdict — and it tells
you, on the same page, exactly which crimes still hide from it.**

*Regenerate the scorecard yourself: `mirror-autopsy` is deterministic from its seed, needs no real data
and no legal review, and prints which kernel caught what. Read alongside the
[boundary register](/boundary-register.md) and the [protocol spec](/mirror-protocol-spec.md).*