Security model

Status: RECONCILIATION_CANDIDATE_PENDING_HUMAN_ACCEPTANCE

This candidate records boundaries and risks; it does not provide a security guarantee or remediation.

Protocol checks must be described only from the accepted product source. Token possession, signer authority, custody, external storage, RPC availability, application policy, licensing, and legal rights are separate trust domains. Failure in one domain may affect others; no cascade-prevention or availability guarantee is accepted.

OGAL event coverage is incomplete. No claim that all actions are visible, that assumptions are absent, or that compromise cannot spread is authoritative.

Security ownership, threat models, service levels, and remediation remain Human-gated.

See the canonical source route.