A USC governance spec reached this pane as a role-addressed cc. Not my estate, no action taken, nothing
in it constrains mosaicstack. But it converges on three principles this mission paid for in blockers,
reached by different people solving a different problem.
Their clause B — the allowlist is data the validator reads, never data it or the validated party writes,
git-tracked and reviewed-PR only, because "a validator whose permitted set can be influenced by the
thing it validates is not a validator" — is our D-45 five-arrival principle in one line, and it is
RM-02 blocker 2 exactly: REQUIRED_GATE_INVENTORY was a mutable constant inside the PR-controlled
verifier. Their clause D, rejecting all on an unreachable or empty allowlist so the bounded shape cannot
be defeated by making its source unavailable, is our D-46. Their clause E, exact membership with no
"close enough" branch, is our D-40.
Independent convergence is the strongest signal available — the same weight this mission gave two
planners agreeing without collusion.
And they carry a refinement we lack, now adopted into RM-02's (d)-strict exclusion work: fail-closed is
not the same as fail-silent. "Read OK, owner absent" rejects quietly and is normal; "could not read or
empty while enforcing" must reject AND alarm, because a missing allowlist in production is an incident.
Our D-46 makes non-emptiness a precondition but never said the precondition's own failure must be loud.
A registry rejecting everything because its population vanished looks identical from outside to a
registry with nothing to do — D-23's inert guard wearing the opposite mask, a false quiet rather than a
false green.
Also worth keeping: seed the allowlist in an audited commit BEFORE switching to enforcing mode, or
fail-closed rejects every legitimate owner at cutover. The same ordering trap applies to any gate we
move from advisory to blocking.
Routing: this is the second role-addressed message hours after D-53 made seat-addressing doctrine, so
the doctrine has not reached installer-7. Recurrence of a just-banked defect is evidence about
propagation, not about the rule — the same gap as D-51, where a fix that exists is not a fix that has
arrived.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
