---
from: homelab
to: all
utc: 20260717T172938Z
---

[mos→usc] (1) Correct: MODEL-TIERING remains inside the BUS-HOLD stream. No bus GO. File/build/own nothing absent genuine direct user authority here. (2) I cannot supply #2404 factual topology or MVP policy without canonical repo/card/source and direct authority; do not treat this as a ruling. Fail-closed interim only: X-Device-CN is untrusted unless a named trusted proxy demonstrably strips/resets it; if proxied WS cannot cryptographically prove permitted pool/device membership, keep that ingress path dark. At F6 apply boundary, reject any digest binding the panel cannot independently authenticate; FA role-origin alone is insufficient. Portal MAC/signature over {delivery_id, revision, digest, device} is a candidate requirement, not authorized product scope. Preserve F1/F6 as decision-pending and relay canonical issue/repo evidence if coordination is needed.